Fusion terminal storage write protection system based on power event trigger

Abstract

The application relates to a power event trigger-based fusion terminal storage write protection system. The system comprises an interception authentication module that captures a write request, blocks abnormal call output business logs, a memory buffer module that buffers the logs in a random access memory, a state monitoring module that triggers a hardware interrupt to generate a transient hardware random number when the power grid is abnormal, a feature extraction module that obtains storage medium physical wear parameters based on fault signals, an integrated signature module that extracts logs to generate data blocks, combines the random number and the wear parameters to generate a digital signature, and encapsulates the digital signature into the data blocks, and a persistence control module that bypasses a page cache to direct write the data blocks containing metadata into underlying preset physical sectors during super capacitor operation. The application prolongs storage life, guarantees data integrity and prevents forgery when power is cut off.

Description

Technical Field

[0001] This application relates to the fields of power distribution networks and edge computing technology, and in particular to a converged terminal storage write protection system based on power event triggering. Background Technology

[0002] As a core device on the edge of the power distribution network, the power convergence terminal undertakes the tasks of collecting, processing, and storing a large amount of power business data locally. To cope with the complex external operating environment, the terminal is usually equipped with non-volatile storage media and supercapacitor redundant power supplies for power failure protection. However, in actual operation, the existing storage management architecture still has obvious limitations. During normal terminal operation, the current storage mechanism lacks effective authentication and reasonable buffering for write requests from upper-layer applications. A large number of regular business logs and even abnormally intensive write operations are often directly sent to the underlying storage layer. This frequent physical programming operation exacerbates the physical wear and tear of the non-volatile storage media, seriously shortening the overall lifespan of the hardware. When the terminal faces conditions such as a sudden drop in external grid voltage or a sudden power outage, the system needs to rely on supercapacitors for preemptive writing. The existing power failure protection mechanism usually continues to use the operating system's page cache level for data distribution, resulting in many intermediate links in data transmission and delays in response time. At the same time, the system often lacks an accurate comparative assessment of the available backup power and the energy required to write data to disk, causing critical business data to be frequently damaged or lost due to power depletion before being fully written to the physical sectors.

[0003] Furthermore, in the event of a power outage, existing write-on strategies are mostly limited to simple data transfer, lacking security verification methods tied to the underlying hardware operating state. Data written to disk lacks effective anti-counterfeiting measures and is easily tampered with; moreover, after the device is powered on again across a power outage cycle, the system has difficulty accurately self-verifying and locating the last validly written data block using the existing storage structure, thus affecting the reliable recovery of terminal timing and system state. Summary of the Invention

[0004] Therefore, it is necessary to provide a converged terminal storage write protection system based on power event triggering to address the above-mentioned technical problems. This system can reduce the frequency of physical programming of storage media under normal operation, ensure the complete data write to disk under sudden power outage conditions, and improve the anti-forgery and anti-tampering capabilities of the written data.

[0005] A power event-triggered converged terminal storage write protection system is applied to a power converged terminal equipped with a main processor, a real-time microcontroller, non-volatile storage media, and a supercapacitor redundant power supply. The system includes: The interception and authentication module captures write request calls issued by the application, performs a two-dimensional threshold joint judgment on the write request payload using information entropy and write request frequency, discards the write request payloads that are judged to be abnormal in kernel mode, and redirects the output of legitimate business logs to the memory buffer module. The memory buffer module resides the business log in the main processor's random access memory in a lock-free circular queue aligned with the operating system's memory page boundaries. During normal operation, physical programming operations to non-volatile storage media are prohibited. After the queue is full, the control tail write pointer wraps back to the base start address to overwrite the historical node. When the power grid operating conditions are abnormal, the status monitoring module triggers an unmasked hardware interrupt and generates a hardware fault signal. In the same clock cycle that triggers the interrupt, a transient hardware random number is generated. The hardware fault signal, the transient hardware random number, and the fault timestamp aligned with the global clock are transmitted across the core to the feature extraction module. The feature extraction module reads lifetime indication data from the read-only extended data register inside the non-volatile storage medium controller based on hardware fault signals, and calculates physical wear parameters that characterize the percentage of physical erase and write aging of the storage medium. The integrated signature module extracts the business log sequence from the tail of the lock-free circular queue of the memory buffer module to generate a data block. It combines the device's unique hardware identifier, physical wear parameters, transient hardware random numbers, and the predecessor state digital signature to generate a dynamic salt value through a key derivation function. The dynamic salt value is used to calculate a hash-based message authentication code for the data block as the current state digital signature. The current state digital signature, hardware timestamp, and physical wear parameters are encapsulated as metadata and concatenated to the end of the data block to form a data block containing metadata. The persistent control module calculates the effective remaining energy of the supercapacitor redundant power supply and the energy safety boundary required to write the data block containing metadata to disk. When the effective remaining energy is greater than the energy safety boundary, it bypasses the operating system page cache mechanism and writes the data block containing metadata to a preset physical dedicated sector of the non-volatile storage medium. When the effective remaining energy is less than or equal to the energy safety boundary, it abandons the physical write and sends a suspend command to the storage controller to lock the storage medium.

[0006] The aforementioned integrated terminal storage write protection system based on power event triggering utilizes an interception authentication module to perform dual-dimensional judgment of information entropy and frequency on write requests issued by the application, intercepting abnormal writes. Simultaneously, a memory buffer module aligns and buffers legitimate logs in the random access memory, reducing the frequency of physical programming to non-volatile storage media under normal operation. This reduces hardware wear caused by frequent or malicious writes, thereby extending the lifespan of the terminal storage media. When an anomaly occurs in the external power grid, a status monitoring module quickly triggers a hardware interrupt, and a persistent control module compares the effective remaining energy of the supercapacitor with the energy required for disk write. When sufficient power is available, the system bypasses the operating system's page cache mechanism and writes data directly to the underlying physical dedicated sector, shortening the data transmission path and ensuring the complete write of critical business data to disk during sudden power outages. Furthermore, an integrated signature module combines extracted transient hardware random numbers with physical wear parameters of the storage media to calculate and generate a digital signature with hardware status characteristics, which is then encapsulated into a data block. This enhances the anti-forgery and anti-tampering capabilities of business data and provides a basis for accurately locating valid data and restoring the system state after the device is powered back on. Attached Figure Description

[0007] Figure 1 This is a framework diagram of a converged terminal storage write protection system based on power event triggering in one embodiment; Figure 2 This is a graph showing the comparison between the duration of the attack and the cumulative number of erase / write cycles on the physical medium in one embodiment. Figure 3 This is a timing curve of the supercapacitor terminal voltage versus time series under extreme power failure conditions in one embodiment. Detailed Implementation

[0008] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0009] The power event-triggered converged terminal storage write protection system provided in this application is applied to a power converged terminal equipped with a main processor, a real-time microcontroller, non-volatile storage media, and a supercapacitor redundant power supply. The main processor is responsible for executing the operating system and application containers; the real-time microcontroller is responsible for connecting to the underlying power electrical interface; and the non-volatile storage media uses a standard-compliant embedded multimedia card or flash memory device.

[0010] In one embodiment, such as Figure 1 As shown, a converged terminal storage write protection system based on power event triggering is provided, the system comprising: The interception and authentication module captures write request calls issued by the application, performs a two-dimensional threshold joint judgment on the write request payload using information entropy and write request frequency, discards write request payloads that are judged to be abnormal in kernel mode, and redirects the output of legitimate business logs to the memory buffer module.

[0011] Understandably, during the system's normal operating cycle, the interception and authentication module is responsible for blocking frequent write operations to the physical storage medium and redirecting data streams at the operating system kernel level. To achieve global capture of application-layer write request calls, the interception and authentication module employs low-level interface takeover technology within the system. As a preferred approach, the underlying feature implementation of this capture action is primarily configured through two mechanisms: the first is to take over write interface calls in the standard C library through a dynamic link library preloading mechanism; the second is to dynamically mount file operation probe functions at the virtual file system layer of the operating system kernel. When an application initiates a file write command, the system calls it triggers are intercepted and taken over by the aforementioned probe functions before being passed to the underlying real file system node.

[0012] Based on intercepted system calls, the interception and authentication module extracts the sequence of bytes to be written from the captured write request calls as the current write request payload. Before evaluating the legality of the payload, it is necessary to introduce the Shannon entropy principle from information theory as a general technical foundation. Conventional structured business logs usually contain a large number of repetitive characters and fixed format boundaries, and the probability of their characters appearing exhibits a skewed distribution; while malicious padding payloads designed to exhaust the lifespan of storage media often exhibit highly random uniform distribution characteristics in order to bypass simple feature matching.

[0013] To quantify this disordered state, the module maintains a sliding window with a fixed time length (usually configured in ms or s) in system memory to record and accumulate the number of write request calls initiated by the corresponding application process per unit time. This accumulated value is the write request frequency. Based on this, the module calculates the information entropy of the data distribution of the current write request load. The formula for calculating information entropy is: ; in, This represents the information entropy of the current write request payload; The decimal index representing the possible values ​​of the byte, with a range of 0 to 255; Indicates the decimal value A single byte of data; Represents bytes The frequency or probability distribution of occurrences in the total byte length of the current write request payload; This represents the symbol for the logarithmic function with base 2. It is important to note that, to ensure the completeness of the algorithm's logic and the stability of the program's execution, if the byte does not appear in the payload, i.e. When the value equals 0, the system stipulates in its underlying logic that... The value of is 0, thus avoiding the error of the logarithmic function approaching an undefined mathematical singularity.

[0014] The system memory is pre-configured with an information entropy security threshold and a write request frequency threshold. Since single-dimensional extreme value determination is easily affected by sudden, legitimate large files, this solution employs a dual-dimensional logical joint judgment to improve robustness. Regarding the determination of these thresholds, since the theoretical upper limit of the information entropy of an ideal random byte stream is 8, while the information entropy of a typical plaintext log is generally between 3 and 5, as a preferred implementation, the information entropy security threshold can be configured to range from 7.0 to 7.5. The write request frequency threshold is set based on the factory-specified upper limit of the number of input / output operations per second of the underlying non-volatile storage medium, combined with the terminal's daily concurrency baseline. The interception and authentication module synchronously records the real-time statistically obtained write request frequency and the calculated information entropy into the comparison logic unit. When the write request frequency exceeds the system-set write request frequency threshold, and the information entropy of the corresponding payload exceeds the information entropy security threshold, the module determines that the write request is an exhaustion-type denial-of-service attack targeting the erase / write lifespan of the underlying physical medium. At this point, the interception and authentication module directly discards the write request payload in kernel mode to free up memory space, and returns a simulated system response code indicating successful write to the application layer, thereby blocking the path of malicious high-entropy data triggering physical programming operations on the underlying non-volatile storage medium.

[0015] Conversely, for write request calls whose write request frequency or information entropy does not reach the aforementioned two-dimensional threshold conditions, the interception and authentication module determines that the payload they carry is a legitimate business log. For this legitimate business log, the interception and authentication module blocks its default path pointing to the physical storage medium block device, and instead modifies the destination memory address pointer of the data stream to the entry address of the memory buffer module. Through the above redirection operation, the interception and authentication module aggregates fragmented, routine file write operations into the memory-resident environment without affecting the normal operation of the upper-layer application logic.

[0016] The memory buffer module resides the business logs in the main processor's random access memory in a lock-free circular queue aligned with the operating system's memory page boundaries. During normal operation, physical programming operations on non-volatile storage media are prohibited. After the queue is full, the control tail write pointer wraps back to the base start address to overwrite the historical node.

[0017] It is understandable that, based on the redirected data stream passed by the aforementioned interception and authentication module, the memory buffer module needs to provide a carrier with continuous read and write capabilities. As a preferred approach, the underlying feature implementation of the lock-free circular queue relies on the system kernel's random access memory file system mechanism. In specific implementation, the system uses this mechanism to lock a contiguous segment of physical memory during the initialization phase, aiming to prevent this frequently accessed buffered data from being swapped out to external slow storage devices by the operating system's page swapping mechanism. Given the system background of multiple independent application containers running simultaneously, concurrent writes can easily lead to resource contention and thread blocking. This solution abandons the conventional mutex lock structure and instead adopts a circular queue design based on compare and swap atomic instructions. The underlying block device alignment mechanism of the storage device is introduced as a basic theoretical support. The underlying non-volatile storage medium typically performs read and write interactions with a fixed physical sector size. If the data segments in memory are of different sizes, realignment will inevitably occur during subsequent batch distribution, resulting in computational overhead and amplification effects of read, modify, and write operations within the physical medium. To eliminate this deficiency, this solution hard-constrains and aligns the space of each business log entry within the queue to the standard memory page size of the operating system within the pre-allocated memory space. The address mapping relationship for this alignment calculation is defined by the following formula: ; ; in, Indicates the number of elements in the circular queue. The absolute memory address of the starting point of each log entry; This indicates the base physical starting address allocated to the lock-free circular queue in random access memory; This represents the fixed memory page size parameter set by the system, which is typically 4096B in this embodiment; This is an integer index parameter for the nodes within the queue, with values ​​ranging from 0 to... between, Maximum node capacity; Represents the mathematical congruence operator; This represents the mathematical modulo (remainder) operator. To ensure that consecutive addressing operations do not result in memory boundary overflows, the above maximum node capacity... The value is determined based on the total physical memory capacity allocated to the buffer module in the current system. In one embodiment, when the memory buffer module pre-allocates the lock-free circular queue, it determines the starting memory address of each log entry according to the memory page aligned address mapping formula, and determines the total number of queue nodes according to the maximum node capacity constraint formula. The maximum node capacity constraint formula is: ; in, The total contiguous physical memory capacity parameter pre-allocated to the system kernel; This represents the fixed memory page size parameter set by the system. This indicates the floor function; Each log entry sequentially includes a high-precision hardware timestamp, a service type label, the actual payload length, and a data payload area padded with zeros to 4096 bytes; the lock-free circular queue adopts a circular queue design based on compare and exchange atomic instructions.

[0018] Within this data structure, each log entry sequentially includes a high-precision hardware timestamp, a service type tag, the actual payload length, and a 4096-byte data payload area padded with zeros at the end. During normal operation, when the system does not receive external specific operating condition pulse signals, the memory buffer module maintains a silent data residency strategy. As upper-layer redirected service logs continue to be imported, once all nodes within the lock-free circular queue have been allocated and written with data, the tail write pointer of the memory buffer module will automatically wrap around to the baseline physical starting address, based on the addressing characteristics of the circular data structure. Subsequently, the system carries the latest time-series logs by directly overwriting historical nodes. By deploying a circular overwrite control mechanism that only performs overwrites in volatile memory, the system physically disconnects the communication link between the regular fragmented log files and the underlying non-volatile storage medium. During this period, the underlying controller is in a low-power standby state and does not receive any erase or programming commands. This isolation state makes the effective write amplification factor of the physical medium equivalent to zero at this stage, thereby reducing the operating losses of the storage device in the power convergence terminal under complex business conditions.

[0019] When the power grid operating conditions are abnormal, the status monitoring module triggers an unmasked hardware interrupt and generates a hardware fault signal. In the same clock cycle that triggers the interrupt, a transient hardware random number is generated. The hardware fault signal, the transient hardware random number, and the fault timestamp aligned with the global clock are transmitted across the core to the feature extraction module.

[0020] It is understandable that the status monitoring module is deployed on the underlying hardware layer with a heterogeneous multi-core processing architecture, responsible for capturing grid operating condition anomalies and extracting tamper-proof security roots of trust under extreme physical conditions. Based on the underlying hardware topology of the converged terminal, the real-time microcontroller is connected to the grid voltage monitoring loop through its on-chip analog-to-digital converter peripheral. In conventional electrical monitoring principles, grid outages or abnormal surges are usually characterized by a decrease in the absolute value of the line voltage or an abnormal increase in the rate of voltage change. To filter out interference from normal power load fluctuations and accurately capture real power outages, the real-time microcontroller runs high-frequency sampling and polling logic. When the acquired transient voltage value meets a specific triggering condition, the system determines that an abnormality has occurred in the external grid operating condition. To avoid the risk of false triggering caused by a single extreme value judgment, this solution comprehensively considers the voltage drop amplitude and drop rate. In one embodiment, the status monitoring module acquires the transient voltage value of the grid line through the real-time microcontroller, and triggers a non-maskable hardware interrupt when the following logical judgment condition is met: ; in, Indicates the current timestamp The transient voltage value of the line acquired by the analog-to-digital converter is expressed in V (volts). This indicates the nominal reference voltage value of the power grid to which the terminal is connected. The drop coefficient is the system's preset value. This represents the time interval between two adjacent analog-to-digital conversion sampling operations. This represents the set critical voltage change rate threshold, used to capture rapid power loss characteristics over a very short period of time. Represents the logical OR operator; The transient hardware random number is generated by extracting thermal noise from silicon-based semiconductor circuits or phase jitter from a ring oscillator as a physical entropy source from an on-chip true random number generator.

[0021] Specifically, in the actual operating environment of a microcontroller, if adjacent sampling timestamps are equal due to underlying timer malfunctions or interrupt blocking, i.e. If the value approaches 0, the underlying calculation logic will default the determination result of the voltage change rate to false, thereby avoiding the hardware divider throwing a division-to-zero exception. When any condition in the above formula is met and the above-mentioned exception prevention logic is satisfied, the hardware logic of the state monitoring module will immediately latch the current state, trigger a non-maskable hardware interrupt, and generate a corresponding hardware fault signal.

[0022] Before confirming a power failure and preparing to perform an unbalanced write, to prevent potential malicious attackers from replaying the legitimate state sequence of the past after a device reset, the system must introduce a unique and unpredictable dynamic variable in each disk write operation. In this embodiment, the microcontroller activates an on-chip true random number generator within the same clock cycle that triggers a hardware interrupt. The lower-level feature implementation of this generator relies on extracting the thermal noise of the underlying silicon-based semiconductor circuit or the phase jitter of the ring oscillator as a physical entropy source, and generating transient hardware random numbers of a specified bit width via a sampling compression circuit. This physical mechanism fundamentally ensures that the random value does not depend on any preset algorithm seed and has cryptographic non-reproducibility in independent power outage events. Since the power convergence terminal adopts a heterogeneous collaborative architecture of a main processor and a real-time microcontroller, the underlying microcontroller, after obtaining the aforementioned security credentials, must transmit them across physical cores to the application main processor running the operating system. As a preferred approach, this cross-core transmission mechanism relies on the hardware mailbox bus mechanism within the on-chip system. Considering that heterogeneous processors typically use independent phase-locked loops (PLLs) for their clock sources, to ensure the main processor has a unified time base when retrieving memory logs, the system uses an on-chip global high-precision timer to hard synchronize the timestamp registers of the two cores during the initialization phase. When an interrupt occurs, the microcontroller encapsulates the hardware fault signal, the precisely timed fault trigger timestamp aligned with the global clock, and the aforementioned transient hardware random number into a message payload with a fixed data structure. The microcontroller then writes this message payload into the shared register of the hardware mailbox and pulls a specific interrupt pin high for the main processor. Upon responding to this signal, the main processor immediately wakes up the feature extraction module to perform subsequent security profile sealing operations.

[0023] The feature extraction module reads lifetime indication data from the read-only extended data register inside the non-volatile storage medium controller based on hardware fault signals, and calculates physical wear parameters that characterize the percentage of physical erase and write aging of the storage medium.

[0024] It is understandable that after receiving an anomaly signal transmitted across cores, the feature extraction module is responsible for directly establishing communication with the underlying storage hardware to extract unforgeable physical trust credentials. Based on the storage management isolation mechanism of modern computer architectures, conventional operating system file read / write instructions are restricted to the logical block address mapping layer and cannot directly access the private state area of ​​the underlying controller. To overcome this isolation limitation, after being awakened by the aforementioned hardware interrupt, the feature extraction module immediately suspends unnecessary application-layer threads running on the main processor. This module calls the kernel's underlying storage bus driver to construct a low-level device command packet conforming to the general storage protocol specification, bypassing the operating system's conventional block device driver layer and logical address translation mechanism, and sends device control instructions to the underlying hardware controller of the non-volatile storage medium.

[0025] As a preferred approach, in scenarios where standard-compliant embedded multimedia cards are widely used as storage devices in power convergence terminals, the device control commands issued by the module are configured to send dedicated protocol command primitives. After receiving and verifying the command, the underlying controller opens its internal bus, allowing the host to read its internal extended data register. This register is specifically used inside the chip to record the hardware lifecycle status and internal self-test data; its physical manifestation is a read-only memory space within the media controller chip that cannot be arbitrarily erased or rewritten by user-level programs. Before extracting this parameter, it is necessary to introduce the general physical principles of underlying storage media aging. The flash memory cells inside non-volatile storage devices are mainly constructed based on floating gate transistor arrays. With repeated programming and erasing operations, the high-voltage electric field applied to the transistor tunnel oxide layer inevitably leads to physical damage to the silicon lattice structure and electron trapping effects. This microscopic material degradation is irreversible, exhibiting a macroscopic unidirectional decay characteristic. The module extracts decimal raw data from the byte offset position fed back by the above register and converts it into a physical wear parameter characterizing the current physical write aging percentage of the storage medium according to the device's factory standards. In one embodiment, the wear parameter conversion formula is: ; in, The physical wear parameter represents the current physical write aging percentage of the storage medium, and its value range is strictly mapped to a closed interval from 0% to 100%. This indicates the current lifetime indicator value obtained directly from the extended data register; This represents the physical erase lifetime limit constant set at the factory for this non-volatile storage device.

[0026] Specifically, based on the industry-standard underlying memory physical specifications, the specific value of this limiting constant depends on the physical architecture type of the wafer inside the device; for example, single-layer cell chips... Typically in the order of 100,000, while the three-layer unit particles... Typically, the number is on the order of 3000. Regarding algorithm completeness, due to... The parameters are fixed in the chip's read-only memory by the hardware manufacturer during the tape-out stage. They are fixed hardware specification constants that are greater than zero. Therefore, this division operation logic naturally avoids the risk of the denominator approaching zero during the operation of the underlying firmware.

[0027] The technical purpose of obtaining the aforementioned physical wear parameters is to construct a fundamental physical root of trust. Because this parameter accurately reflects the true physical irreversible wear state of the hardware, even if a purely software-level attacker infiltrates the operating system, they cannot forge or tamper with hardware aging parameters that present a time-reversed state. This provides a core security factor for subsequent steps to resist state replay attacks.

[0028] The integrated signature module extracts the business log sequence from the tail of the lock-free circular queue of the memory buffer module to generate a data block. Combining the device's unique hardware identifier, physical wear parameters, transient hardware random numbers, and the predecessor state digital signature, a dynamic salt value is generated through a key derivation function. The dynamic salt value is used to calculate a hash-based message authentication code for the data block as the current state digital signature. The current state digital signature, hardware timestamp, and physical wear parameters are encapsulated as metadata and concatenated to the end of the data block to form a data block containing metadata.

[0029] It is understandable that the integrated signature module performs cross-level data binding operations in the main processor memory. Based on the joint verification requirements of micro-physical state and macro-business logic, this module first performs reverse retrieval of the business log sequence and performs bit data padding to match the operation boundaries of the underlying physical medium. Introducing the physical storage structure of the underlying flash memory device as a general technical foundation, the data erasure and programming operations of the non-volatile storage medium are strictly limited to fixed physical block and physical page sizes. To avoid triggering additional read, modify, and write actions within the underlying controller after data is sent, and thus causing write amplification, the system needs to spatially align the data to be written to disk in memory. In actual operation, the module starts from the current tail pointer of the lock-free circular queue in the memory buffer module and reversely extracts the historically resident business log sequence. The system assembles the extracted continuous log data into a data block to be written and calculates its current total byte length. Subsequently, the module performs zero-value bit data padding according to the underlying physical block boundaries. In one embodiment, the total number of zero-value bytes to be padded to the tail of the data block according to the physical erase block boundary alignment padding formula is: ; in, This indicates the total number of zero-value bytes that need to be padded to the end of the data block; This indicates the total length in bytes of the extracted business log data; A constant representing the size of a single physical block in bytes. This represents the mathematical modulo operation.

[0030] Specifically, as a preferred approach, based on the currently accepted physical specifications of flash memory media in the industry, this constant is typically configured as 524288B or 1048576B. Through the aforementioned nested modulo operation, the algorithm effectively eliminates the possibility of physical space padding while ensuring that the physical space is filled in. Just for For integer multiples, the system still fills in an additional complete physical block of logical defect. After completing the calculation, the module appends a length of [length missing] to the end of the data block. The zero-value sequence is used to generate aligned data blocks.

[0031] Before generating cryptographic signatures, it is necessary to introduce the general security design principle of state-based replay protection. Conventional static keys cannot defend against replay attacks carried out by advanced attackers through flash memory image stripping. The system must deeply integrate the device's transient operating environment, irreversible physical wear and tear, and historical time-series states to establish a multi-dimensional secure trust chain.

[0032] In one embodiment, a dynamic salt value is generated by combining the device's unique hardware identifier, physical wear parameters, transient hardware random numbers, and the predecessor state digital signature via a key derivation function, including: The integrated signature module concatenates the device's unique hardware identifier and physical wear parameters into a byte sequence and then inputs the result into a cryptographically secure hash function. The result of the hash function, the transient hardware random number, and the predecessor state digital signature are aligned to the same bit width, and then a bitwise XOR operation is performed. The XOR result is input into a key derivation function to calculate and generate a dynamic salt value. ; in, This indicates the generated dynamic salt value; This represents a standard key derivation function, whose sub-features typically employ a hash-based key derivation mechanism; This represents a transient hardware random number transmitted across cores by the status monitoring module; This represents the digital signature of the preceding state generated in the previous disk placement operation; Represents a cryptographically secure hash function; A globally unique hardware identifier for the processor; This represents a physical wear parameter that characterizes the current percentage of physical erase / write aging of the storage medium; symbol Indicates bitwise XOR operation; symbol This indicates a byte sequence concatenation operation. To ensure that no overflow or exception occurs when the underlying registers perform a bitwise XOR operation, the system mandates that the bits involved in the operation... , as well as Output values ​​are strictly aligned to the same safe bit width. As a preferred implementation, this bit width is uniformly configured to 256 bits. If the original data does not reach this length, the algorithm automatically pads the high-order bits with zeros before entering the XOR logic; if it exceeds this length, high-order bits are truncated. Furthermore, for boundary conditions such as initial device power-on initialization and the absence of historical signature records, the underlying firmware will... The default setting is a pre-defined initial random vector. The technical purpose of the above operation is to transform the underlying microscopic physical state and macroscopic time series into cryptographic context variables, so that the generated dynamic salt value is uniquely bound to the physical device state at the current instant.

[0033] Based on the unique key variable calculated above, the module further ensures the integrity and tamper-proof properties of the business data to be written to disk. In one embodiment, a hash-based message authentication code is calculated for the data block using a dynamic salt value as the digital signature of the current state, including: The current state digital signature is calculated by using a hash-based message authentication code to represent the data block with a dynamic salt value: ; in, This represents the currently calculated message authentication code and serves as the current state digital signature for this disk write operation. This represents the hash-based message authentication code calculation function. Indicates dynamic salt value, This indicates a data block to be written that meets the physical erase block boundary alignment requirement; The current state digital signature, hardware timestamp, and physical wear parameters are packaged into structured metadata, which is then appended to the end of the data block to be written, forming a data block containing metadata.

[0034] The underlying primitive implementation and cryptographic parameter configuration of the hash-based message authentication code calculation function can be adapted and called by those skilled in the art according to the kernel encryption framework used. This is well-known technology in the field and will not be elaborated further here. After completing the ciphertext generation, the module will calculate the... Hardware timestamps and The system packages and builds the additional metadata into a structured format. Then, the system concatenates this additional metadata into... At the end, a final disk payload with self-verification capabilities is formed. Through this deep, cross-layer cryptographic binding, the system ensures that even if the storage medium is forcibly disassembled, attackers cannot forge or parse legitimate business data sequences without the support of specific physical chips.

[0035] The persistent control module calculates the effective remaining energy of the supercapacitor redundant power supply and the energy safety boundary required to write the data block containing metadata to disk. When the effective remaining energy is greater than the energy safety boundary, it bypasses the operating system page cache mechanism and writes the data block containing metadata to a preset physical dedicated sector of the non-volatile storage medium. When the effective remaining energy is less than or equal to the energy safety boundary, it abandons the physical write and sends a suspend command to the storage controller to lock the storage medium.

[0036] The persistence control module is responsible for persisting the integrated and signed data payload to a non-volatile storage medium in the event of a main power failure. Drawing on the general principles of physical energy storage and semiconductor power consumption, terminal devices typically incorporate supercapacitors or tantalum capacitor arrays as backup power for power loss. When the main power supply drops, the system needs to calculate whether the remaining physical energy is sufficient to support the underlying physical programming operations of the entire data set.

[0037] In one embodiment, the persistent control module calculates the effective remaining energy according to the formula for the effective remaining energy of the supercapacitor, and calculates the energy safety boundary according to the formula for the energy consumption safety boundary of the disk, including: The persistent control module calculates the effective remaining energy according to the formula for the effective remaining energy of the supercapacitor, and calculates the energy safety boundary according to the formula for the energy consumption safety boundary of the disk discharge, respectively: ; ; in, This represents the effective remaining energy in the backup capacitor matrix that can be used to maintain system operation. This indicates the nominal equivalent capacitance of the backup energy storage capacitor. This represents the transient voltage value across the supercapacitor redundant power supply, which is collected in real time via an analog-to-digital converter at the current moment. This indicates the minimum safe cutoff voltage threshold required to ensure proper operation of the storage controller and main processor. Indicates the total length of the data to be written to disk and integrated; This indicates the rated physical write rate of the underlying non-volatile storage medium in continuous programming mode. This represents the peak operating power of the storage device in full-speed programming mode. This represents the system's preset safety redundancy coefficient; When the effective remaining energy is greater than the energy safety boundary, the persistent control module adds a direct device access control flag to the low-level input / output instructions to establish a physical addressing channel.

[0038] Specifically, to offset the energy dissipation caused by temperature drift and capacitor aging, as a preferred approach, The value range is typically rigidly constrained to be between 1.2 and 1.5. Regarding the completeness of the above algorithm logic, considering the rated write rate of the non-volatile storage medium... Determined by the hardware factory specifications, its physical properties are strictly positive constants. Furthermore, to prevent parameter loss due to firmware errors while reading device tree configuration, the system performs mandatory verification during kernel initialization. The system verifies the validity of the read value; if the read value is less than or equal to zero, a default minimum write rate is automatically assigned. This protection mechanism ensures that the system naturally avoids mathematical errors where the denominator approaches zero when performing the above division check. The technical purpose of the above energy verification mechanism is that if the remaining power is insufficient to support the writing of a complete physical block, the system will immediately abandon the disk writing operation and trigger hardware locking, thereby preventing the spread of large-scale bad blocks in the storage chips caused by power failure.

[0039] During normal operation, the file system relies on the flash translation layer for logical-to-physical address mapping and wear leveling. However, under power-down write conditions, the flash translation layer's mapping table updates and background garbage collection mechanisms introduce uncontrollable time delays. To reduce the uncertainty of system latency, the persistent control module directly allocates a contiguous reserved area within the non-volatile storage medium and uses a direct physical block mapping formula for sequential addressing.

[0040] In one embodiment, writing data blocks containing metadata to a predetermined physical dedicated sector of a non-volatile storage medium includes: The starting address of the underlying physical sector for this operation is determined according to the physical sector addressing formula. The data block containing metadata is then written to this starting address. The physical sector addressing formula is as follows: ; in, This indicates the starting address of the underlying physical sector that this operation will target; This indicates the starting reference address of the decimal raw data reserved partition that the system has pre-defined in the medium; This represents the incrementing sequence number of the cumulative power-off write events that have occurred since the system's lifecycle began. A constant representing the size in bytes of a single physical block; This indicates the total available capacity of the decimal raw data reserved partition; After the write is complete, the persistence control module overwrites the current state digital signature into the predecessor state record area of ​​the system memory, completing the recursive update of the time-series state chain.

[0041] Specifically, based on the strict requirements for aligned writing of underlying storage granules, the system enforces a constraint on the total available capacity when dividing the aforementioned reserved areas. It must be set to the physical block size in bytes. The system establishes a rigid, ring-shaped overflow prevention boundary at the hardware level by introducing modulo congruence operations on the total partition capacity, while satisfying the aforementioned integer multiple constraint. This mechanism ensures that when the device experiences frequent power outages and restarts in harsh power grid environments, the underlying physical write pointer can stably loop within the safe reserved area boundary, effectively preventing out-of-bounds overwriting of the operating system's core firmware or other critical application container data.

[0042] Based on the calculated security energy and absolute address, the module invokes the raw write command of the underlying serial peripheral interface or embedded multimedia card bus to directly inject the aligned data block containing the digital signature and device status into the floating gate array of the underlying chip. The timing control, register configuration, and specific block erase and programming primitives of the underlying bus communication protocol can be adapted and invoked by those skilled in the art according to the hardware platform used; these are well-known technologies in the field and will not be elaborated upon here.

[0043] After the write bus command is issued, the underlying controller continuously monitors the busy / idle indicator bit of the medium by polling the hardware status register. To prevent the underlying storage medium from falling into a deadlock state due to wafer damage under extreme physical conditions, the system simultaneously starts a hardware watchdog timer when polling begins. The overflow threshold of this timer is dynamically set based on the maximum runtime that the effective remaining energy can sustain, as determined by the aforementioned assessment. Once the medium sends back a confirmation signal that physical programming is complete, or the hardware timer triggers a timeout interrupt, the persistent control module immediately pulls the global ready pin on the system bus low. This action forcibly cuts off the clock tree supply to all non-core peripherals, allowing the main processor core to safely enter a deep sleep or hard reset state, thereby completing the root of trust anti-tampering sealing and secure power-down process under this abnormal physical environment.

[0044] To ensure the continuity of the timing state chain and write addressing after a power outage, when the external main power is restored, the device is powered on again, and the operating system kernel is initialized, the persistent control module actively takes over the underlying storage bus. The system scans the decimal raw data reserved partitions in the non-volatile storage medium, which are designated as preset physical dedicated sectors, according to a preset base address, and then proceeds according to the physical block size. The system performs a step-by-step read. It uses a hash-based message authentication code self-verification mechanism to verify the legitimacy of the read data blocks, locating the aligned data block that was last validly written to disk. Subsequently, the system parses the verification parameters of the last valid write from the metadata space of this data block, and recovers the predecessor state digital signature from it. Simultaneously, based on the absolute physical offset of the valid data block within the reserved partition, the system reverse-engineers and recalculates the incremental sequence number of the cumulative power-loss write-preemption events. The aforementioned parameters are then reloaded into system memory. Through this closed-loop recovery mechanism, the system achieves timing replay immunity and addressing continuity across power outage cycles at the physical level.

[0045] In the aforementioned system, to address the issue of accelerated wear caused by frequent physical programming of the storage medium under normal operation, this application deploys an interception and authentication module at the operating system's virtual file system layer. This module performs a joint determination of the write request payload using a dual-dimensional threshold of information entropy and write request frequency. High-entropy, high-frequency abnormal write requests are directly discarded in kernel mode, and a simulated success response is returned. Simultaneously, legitimate business logs are redirected to the memory buffer module. The memory buffer module resides the business logs in the main processor's random access memory using a lock-free circular queue aligned with memory page boundaries. During normal operation, it completely prohibits any physical programming operations on the non-volatile storage medium. Once the queue is full, the tail pointer automatically wraps around to overwrite historical nodes, putting the underlying storage controller in a silent standby state with zero physical programming during this stage. Through this isolation mechanism, the effective write amplification factor of the physical medium is equivalent to zero under normal conditions, fundamentally cutting off the consumption of the storage medium's erase and write lifespan by fragmented writing and significantly extending the lifespan of the terminal storage medium. To address the issue of poor data integrity during sudden power outages, the status monitoring module uses a real-time microcontroller to frequently poll and collect transient voltage values ​​from the power grid. When the voltage drop or rate of change meets preset conditions, an unmasked hardware interrupt is immediately triggered. The persistent control module then calculates the effective remaining energy based on the transient voltage values ​​across the supercapacitor redundant power supply and the safe cutoff voltage threshold. This energy is then precisely compared with the energy safety boundary required for the data to be written to disk. Only when energy is sufficient is a direct device access control flag added to the underlying input / output instructions. This allows the data flow to completely bypass the uncontrollable time consumption of the operating system's page cache mechanism and flash memory translation layer, and writes data blocks containing metadata to a preset physical dedicated sector of the non-volatile storage medium. Through the aforementioned energy margin gating mechanism and the direct physical write channel that bypasses the page cache, intermediate links and uncontrollable delays in data transmission are eliminated, ensuring that critical business data is completely written to disk before power is exhausted during sudden power outages. When the effective remaining energy is insufficient, the system actively abandons the write and locks the storage medium, preventing the spread of bad blocks caused by power outages.To address the lack of hardware-level security verification and reliable recovery mechanisms for data written to disk, this application utilizes an on-chip true random number generator to extract physical thermal noise and generate transient hardware random numbers within the same clock cycle that triggers a hardware interrupt. A feature extraction module calculates physical wear parameters characterizing the percentage of physical erase / write aging by reading lifetime indication data from the read-only extended data register inside the storage medium controller. An integrated signature module fuses the device's unique hardware identifier, physical wear parameters, transient hardware random numbers, and the predecessor state digital signature using a key derivation function to generate a dynamic salt value. This dynamic salt value is then used to calculate hash-based message authentication for aligned data blocks. The code serves as a digital signature of the current state and is encapsulated as metadata. By deeply integrating unforgeable transient hardware random numbers, irreversible and irreversible physical wear parameters of storage media, unique hardware identifiers of devices, and historical time-series states, the dynamic salt value is uniquely bound to the current instantaneous physical device state. The generated digital signature has hardware-level anti-forgery and anti-tampering capabilities. After the device is powered on again, the hash-based message authentication code self-verification mechanism is used to accurately locate the last valid data block written to disk, recover the previous state digital signature from it, and deduce the write-up sequence number in reverse. This achieves time-series anti-replay and reliable system state recovery across power outage cycles.

[0046] In one embodiment, after the device is powered on again, the persistence control module takes over the underlying storage bus, reads data blocks in the decimal raw data reservation partition in steps according to the physical block size based on the preset starting reference address, performs a message authentication code self-verification based on hash for each read data block, locates the last valid data block that passed the verification, parses the predecessor state digital signature from the metadata space of the valid data block, derives the incrementing sequence number in reverse based on the absolute physical offset position of the valid data block in the reservation partition, and loads the recovered predecessor state digital signature and incrementing sequence number into the system memory.

[0047] In a specific embodiment, to more clearly illustrate the workflow of the technical solution of this application in a real-world scenario, the following description is based on a specific application scenario.

[0048] The scenario is set as a situation where the intelligent converged terminal of the distribution radio station is subjected to a malicious attack and a sudden power outage caused by lightning.

[0049] During the normal operation and attack prevention phase, a power converged terminal deployed in an outdoor distribution substation, with a main processor running Linux and an internal 8GB eMMC storage medium, was subjected to a write exhaustion denial-of-service attack from a controlled botnet. The attack program wrote garbage files generated by pseudo-random numbers to the device at a frequency of 500 times per second, aiming to burn out the eMMC chips. At this time, the interception and authentication module was triggered, and the calculated information entropy of the attack payload was as high as 7.8 (exhibiting a highly random and uniform distribution), and the write request frequency far exceeded the preset threshold of 100 times / second. The module immediately discarded the data in kernel mode, blocking physical writes. At the same time, the terminal's normal temperature and current service logs (information entropy of about 4.2, frequency of about 10 times / second) were redirected to the memory buffer module and resided in the main processor RAM aligned to the 4096B page boundary. During this phase, the underlying eMMC remained in a silent standby state, and the write amplification factor dropped to 0.

[0050] The emergency triggering and feature extraction phase occurred that evening when a lightning strike caused a sudden trip of the 10kV high-voltage line, resulting in a sudden loss of the external 220V AC power supply to the fusion terminal. The status monitoring module's ADC high-speed polling detected a voltage drop to 160V within 200 microseconds (meeting both the voltage change rate and drop amplitude thresholds). The system immediately triggered a hardware interrupt, extracting the current thermal noise to generate a 256-bit transient hardware random number. The feature extraction module bypassed the file system and directly read the eMMC's underlying extended registers to obtain the current physical wear parameters of the storage medium (e.g., the current lifetime consumption percentage is 15.2%).

[0051] The data alignment, signing, and persistent write phase involves the integrated signing module reversibly extracting backlogged business logs from RAM, such as transient power grid waveform data in the last few milliseconds before a lightning strike, with a total length of 180KB. To align with the 512KB physical erase block boundary of the eMMC, the module pads the end with 332KB of zero-value bits. The system extracts the previous state digital signature from the last disk write, combines it with 15.2% physical wear parameters, transient hardware random numbers, and the CPU hardware ID to derive a one-time dynamic salt value, and calculates an HMAC signature for the 512KB aligned data block, encapsulating it at the end. The persistent control module assesses the remaining energy of the supercapacitor: the current voltage is 4.8V, the cutoff voltage is 2.5V, and the calculated remaining joules are far greater than the energy required to physically write this 512KB of data. Subsequently, the module attaches a direct device access control flag, bypassing the operating system page cache, and directly injects the data into the eMMC's preset physical reserved sector. After the underlying feedback is written, the system latches the latest signature, and the main processor safely cuts off the clock tree and enters hard sleep. It successfully saves the transient cross-sectional data before the power failure before the supercapacitor is exhausted, and the data is uniquely cryptographically bound to the physical chip.

[0052] To verify the validity of this application, a mainstream power convergence terminal test bench based on heterogeneous ARM architecture was built in the laboratory. The performance difference between the traditional Linux Ext4 file system native disk persistence strategy (control group) and the convergence protection system proposed in this application (experimental group) was compared.

[0053] Experiment 1 is a comparative experiment on the lifespan of storage media resisting malicious write exhaustion attacks. The experimental method simulates the execution of a malicious script inside the device by exploiting a vulnerability, writing high-entropy pseudo-random data to the log directory at an extremely high frequency. It runs continuously for 72 hours, and the physical write / erase count (P / ECycles) of the underlying eMMC is monitored.

[0054] Experimental results are as follows Figure 2 As shown, attached Figure 2 The graph shows the relationship between the attack duration (hours) on the horizontal axis and the cumulative number of physical media erase / write operations (P / ECycles) on the vertical axis. Under the traditional native disk write strategy (control group), the curve shows a sharp, non-linear increase, exceeding 5000 erase / write operations by approximately 50 hours of attack duration. This indicates that the flash memory conversion layer in the traditional control group suffers from write amplification (write amplification factor > 4) due to frequent small file modifications, severely overdrawing storage lifespan. Conversely, under the fusion protection system of this application (experimental group), the curve remains consistently at the horizontal zero mark, with the cumulative number of physical media erase / write operations remaining at 0 for 72 hours. This directly demonstrates that the experimental group of this application, through dual-dimensional threshold interception (information entropy + frequency) and memory residency mechanisms, effectively discards all invalid malicious write operations at the virtual file system layer, while normal logs are only cyclically overwritten in volatile memory, effectively resisting write exhaustion attacks targeting the underlying physical media.

[0055] Experiment 2 is an experiment on the success rate of data preservation and the rate of tamper prevention under extreme power failure conditions. The experimental method is to use a programmable adjustable AC power supply to simulate a sudden power outage (100 cycles), and to tamper with the historical data in the eMMC offline through a programmer in some cycles.

[0056] The experimental results showed that the traditional control group, relying on the operating system's page cache, often failed to flush dirty pages to the physical medium in time during sudden power outages, resulting in a data survival rate of only 42.5% and complete unawareness of offline tampering. In contrast, our experimental group achieved a 100% successful write-on rate and a 100% offline tampering detection rate in 100 sudden power outages.

[0057] like Figure 3 As shown, attached Figure 3The graph illustrates the timing sequence of events, with the horizontal axis representing the time series after power loss (ms) and the vertical axis representing the supercapacitor terminal voltage (V). The solid line represents the capacitor discharge curve, and the horizontal dashed line marks the 2.5V safety cutoff threshold. When the time series after power loss progresses to approximately 20ms, the voltage drop characteristic meets the threshold requirement, the system triggers a hardware interrupt, and begins execution; subsequently, the system enters the persistent physical write window (bypassing the flash conversion layer), indicated by the gray shaded area. During this window, the persistent control module sends memory data to a preset physical dedicated sector through supercapacitor energy assessment and direct raw device write channels. When the time series reaches approximately 140ms, the supercapacitor terminal voltage drops to approximately 2.8V. At this point, the underlying feedback write is complete, the system marks the closed-loop confirmation as complete, and enters safe sleep mode. The entire persistent physical write window not only completely bypasses the uncontrollable time consumption of the flash conversion layer but also fully closes the loop before the voltage drops to the 2.5V safety cutoff threshold, ensuring 100% data survival under extreme power loss conditions. Meanwhile, by introducing a dynamic salt signature that integrates hardware wear and transient hardware random numbers during the process, state replay attacks are blocked and a 100% anti-tampering detection rate is achieved.

[0058] Those skilled in the art will understand that all or part of the processes in the systems described in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes described in the embodiments of the above systems. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0059] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0060] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these modifications and improvements all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A power event-triggered converged terminal storage write protection system, applied in a power converged terminal equipped with a main processor, a real-time microcontroller, non-volatile storage media, and a supercapacitor redundant power supply, characterized in that, The system includes: The interception and authentication module captures write request calls issued by the application, performs a two-dimensional threshold joint judgment on the write request payload using information entropy and write request frequency, discards the write request payloads that are judged to be abnormal in kernel mode, and redirects the output of legitimate business logs to the memory buffer module. The memory buffer module resides the business log in the main processor's random access memory in a lock-free circular queue aligned with the operating system's memory page boundaries. During normal operation, physical programming operations to non-volatile storage media are prohibited. After the queue is full, the control tail write pointer wraps back to the base start address to overwrite the historical node. When the power grid operating conditions are abnormal, the status monitoring module triggers an unmasked hardware interrupt and generates a hardware fault signal. In the same clock cycle that triggers the interrupt, a transient hardware random number is generated. The hardware fault signal, the transient hardware random number, and the fault timestamp aligned with the global clock are transmitted across the core to the feature extraction module. The feature extraction module reads lifetime indication data from the read-only extended data register inside the non-volatile storage medium controller based on hardware fault signals, and calculates physical wear parameters that characterize the percentage of physical erase and write aging of the storage medium. The integrated signature module extracts the business log sequence from the tail of the lock-free circular queue of the memory buffer module to generate a data block. It combines the device's unique hardware identifier, physical wear parameters, transient hardware random numbers, and the predecessor state digital signature to generate a dynamic salt value through a key derivation function. The dynamic salt value is used to calculate a hash-based message authentication code for the data block as the current state digital signature. The current state digital signature, hardware timestamp, and physical wear parameters are encapsulated as metadata and concatenated to the end of the data block to form a data block containing metadata. The persistent control module calculates the effective remaining energy of the supercapacitor redundant power supply and the energy safety boundary required to write the data block containing metadata to disk. When the effective remaining energy is greater than the energy safety boundary, it bypasses the operating system page cache mechanism and writes the data block containing metadata to a preset physical dedicated sector of the non-volatile storage medium. When the effective remaining energy is less than or equal to the energy safety boundary, it abandons the physical write and sends a suspend command to the storage controller to lock the storage medium.

2. The system according to claim 1, characterized in that, When the memory buffer module pre-allocates the lock-free circular queue, it determines the starting memory address of each log entry according to the memory page aligned address mapping formula, and determines the total number of queue nodes according to the maximum node capacity constraint formula, which is: ； in, The total contiguous physical memory capacity parameter pre-allocated to the system kernel; This represents the fixed memory page size parameter set by the system. This indicates the floor function; Each log entry sequentially includes a high-precision hardware timestamp, a service type label, the actual payload length, and a data payload area padded with zeros to 4096 bytes; the lock-free circular queue adopts a circular queue design based on compare and exchange atomic instructions.

3. The system according to claim 1, characterized in that, The status monitoring module collects transient voltage values ​​of the power grid line through a real-time microcontroller. It triggers a non-maskable hardware interrupt when the following logical condition is met: ； in, Indicates the current timestamp The transient voltage value of the line acquired by the analog-to-digital converter is expressed in V (volts). This indicates the nominal reference voltage value of the power grid to which the terminal is connected. The drop coefficient is the system's preset value. This represents the time interval between two adjacent analog-to-digital conversion sampling operations. This represents the set critical voltage change rate threshold, used to capture rapid power loss characteristics over a very short period of time. Represents the logical OR operator; The transient hardware random number is generated by extracting thermal noise from silicon-based semiconductor circuits or phase jitter from a ring oscillator as a physical entropy source from an on-chip true random number generator.

4. The system according to claim 1, characterized in that, Upon receiving a hardware fault signal, the feature extraction module suspends unnecessary application-layer threads running on the main processor, constructs a low-level device command packet conforming to the general storage protocol specification, bypasses the operating system block device driver layer and logical address translation mechanism to send a dedicated protocol command primitive to the storage controller, reads the lifetime indicator value recording the hardware lifecycle status in the extended data register, and calculates the physical wear parameters according to the wear parameter conversion formula, which is: ； in, The physical wear parameter represents the current physical write aging percentage of the storage medium, and its value range is strictly mapped to a closed interval from 0% to 100%. This indicates the current lifetime indicator value obtained directly from the extended data register; This represents the factory-set physical erase lifetime limit constant for non-volatile storage devices.

5. The system according to claim 1, characterized in that, The integrated signature module reverse-extracts the business log sequence and calculates its total data byte length. It then calculates the total number of zero-value bytes to be filled at the end of the data block according to the physical erase block boundary alignment filling formula. Finally, it appends a zero-value sequence of the corresponding length to the end of the data block to generate a data block that satisfies the physical erase block boundary alignment. The total number of zero-value bytes to be padded to the end of the data block according to the physical erase block boundary alignment padding formula is as follows: ； in, This indicates the total number of zero-value bytes that need to be padded to the end of the data block; This indicates the total length in bytes of the extracted business log data; A constant representing the size of a single physical block in bytes. This represents the mathematical modulo operation.

6. The system according to claim 5, characterized in that, A dynamic salt value is generated by combining the device's unique hardware identifier, physical wear parameters, transient hardware random numbers, and the predecessor state digital signature through a key derivation function. This salt value includes: The integrated signature module concatenates the device's unique hardware identifier and physical wear parameters into a byte sequence and then inputs it into a cryptographically secure hash function for calculation. The result of the cryptographically secure hash function, the transient hardware random number, and the predecessor state digital signature are aligned to the same bit width, and then a bitwise XOR operation is performed. The XOR result is input into a key derivation function to calculate and generate a dynamic salt value. ； in, This indicates the generated dynamic salt value; This represents a standard key derivation function, whose lower-order features employ a hash-based key derivation mechanism; This represents a transient hardware random number transmitted across cores by the status monitoring module; This represents the digital signature of the preceding state generated in the previous disk placement operation; Represents a cryptographically secure hash function; A globally unique hardware identifier for the processor; This represents a physical wear parameter that characterizes the current percentage of physical erase / write aging of the storage medium; symbol Indicates bitwise XOR operation; symbol This indicates a byte sequence concatenation operation.

7. The system according to claim 6, characterized in that, The current state digital signature is calculated using a hash-based message authentication code on the data block with a dynamic salt value, including: The current state digital signature is calculated by using a hash-based message authentication code to represent the data block with a dynamic salt value: ； in, This represents the currently calculated message authentication code and serves as the current state digital signature for this disk write operation. This represents the hash-based message authentication code calculation function. Indicates dynamic salt value, This indicates a data block to be written that meets the physical erase block boundary alignment requirement; The current state digital signature, hardware timestamp, and physical wear parameters are packaged into structured metadata, which is then appended to the end of the data block to be written, forming a data block containing metadata.

8. The system according to claim 1, characterized in that, The persistent control module calculates the effective remaining energy according to the formula for the effective remaining energy of the supercapacitor, and calculates the energy safety boundary according to the formula for the energy consumption safety boundary of the disk, including: The persistent control module calculates the effective remaining energy according to the formula for the effective remaining energy of the supercapacitor, and calculates the energy safety boundary according to the formula for the energy consumption safety boundary of the disk discharge, respectively: ； ； in, This represents the effective remaining energy in the backup capacitor matrix that can be used to maintain system operation. This indicates the nominal equivalent capacitance of the backup energy storage capacitor. This represents the transient voltage value across the supercapacitor redundant power supply, which is collected in real time via an analog-to-digital converter at the current moment. This indicates the minimum safe cutoff voltage threshold required to ensure proper operation of the storage controller and main processor. Indicates the total length of the data to be written to disk and integrated; This indicates the rated physical write rate of the underlying non-volatile storage medium in continuous programming mode. This represents the peak operating power of the storage device in full-speed programming mode. This represents the system's preset safety redundancy coefficient; When the effective remaining energy is greater than the energy safety boundary, the persistent control module adds a direct device access control flag to the low-level input / output instructions to establish a physical addressing channel.

9. The system according to claim 1, characterized in that, Directly write data blocks containing metadata to a predefined physical dedicated sector of the non-volatile storage medium, including: The starting address of the underlying physical sector for this operation is determined according to the physical sector addressing formula. The data block containing metadata is then written to this starting address. The physical sector addressing formula is as follows: ； in, This indicates the starting address of the underlying physical sector that this operation will target; This indicates the starting reference address of the decimal raw data reserved partition pre-defined by the system in the medium; This represents the incrementing sequence number of the cumulative power-off write events that have occurred since the system's lifecycle started. A constant representing the size in bytes of a single physical block; This indicates the total available capacity of the decimal raw data reserved partition; After the write is complete, the persistence control module overwrites the current state digital signature into the predecessor state record area of ​​the system memory, completing the recursive update of the time-series state chain.

10. The system according to claim 1, characterized in that, After the device is powered on again, the persistent control module takes over the underlying storage bus and reads data blocks in the decimal raw data reservation partition step by step according to the physical block size based on the preset starting reference address. It performs a self-verification of the message authentication code based on hash for each read data block, locates the valid data block that passed the last verification, parses the predecessor state digital signature from the metadata space of the valid data block, and reverse-derives the incrementing sequence number based on the absolute physical offset position of the valid data block in the reservation partition. The recovered predecessor state digital signature and incrementing sequence number are then loaded into the system memory.

Images