# An On-Demand Fault-Tolerant Routing Strategy for Secure Key Distribution Network
## 3 System and Problem Model
### Problem Model  
We define a network \(G=(V,E)\), and denote \(F\subseteq V\backslash\{v_{s},v_{d}\}\) as the set of faulty nodes, where \(\{v_{s},v_{d}\}\subseteq V\) is the set of source and destination pairs. First, we will formally analyze the changes in the reliability of the key distribution system under fault scenarios, and describe the conditions that the routing strategy needs to meet to complete key distribution for secure communication  
where \(\gamma_{i}(\mathbf{x})\) is the product of the binary states corresponding to the set of components. Therefore, as long as \(\phi(\mathbf{x})\) is equal to 1, it means that at least one \(\gamma_{i}(\mathbf{x})\) is equal to 1, which means that a set of components that constitute this \(\gamma_{i}(\mathbf{x})\) does not belong to the set \(F\). To this end, we hope to design a feasible and robust routing strategy, which first needs to discover such \(\gamma_{i}(\mathbf{x})\), and second distributes the secure communication keys through a single path composed of corresponding components.  
Next, we will describe the specific scenario when the binary state \(x_{i}\) is equal to 1, that is, we will introduce the network layer faults covered by the proposed solution according to the different fault occurrence stages. In the path discovery phase, if the relay \(f\in F\) causes routing packets passing through this node to be lost due to benign reasons such as scarce key material [21], mobility [9], etc., it may lead to the failure of key distribution path establishment and perform a new round of path discovery [32]. The path discovery overhead is increased and a certain delay is also added. If \(f\) is controlled by an attacker, the routing control information may be tampered with, forged, or discarded, thereby affecting the establishment of the actual key distribution path. The path may also be redirected to the path where the node exists to facilitate the eavesdropping of subsequent communication keys [15]. In the communication key distribution phase, the same benign reasons can cause communication key message forwarding to fail. However, when \(f\) exhibits Byzantine behavior, the communication key may be discarded when passing through the node, that is, black hole attack, delayed, or forwarded to a suboptimal exit [32]. In addition, it is also easy to cause the communication key to be leaked, thereby reducing the success rate and security of key distribution. In a real-world setting, due to the embedded nature of semiconductor superlattice devices, SKDN is suitable for incremental deployment on the underlay network to be compatible with existing IP devices, so the risk on general-purpose servers also applies to secure key distribution network scenarios such as potential broken access control, denial of distributed service attacks, etc. These potential security risks may cause the above Byzantine behavior. As shown in Figure 3, malicious cause failures can also occur in two stages at the same time. For example, in the path discovery stage, incorrect path information is injected to build the key distribution path on the faulty node. In the subsequent communication key distribution stage, faulty nodes will conduct black hole attack or other Byzantine behaviors, seriously affecting the reliability of security key distribution.  
Figure 3: A mixed fault scenario.