# An On-Demand Fault-Tolerant Routing Strategy for Secure Key Distribution Network
## 4 Proposed Solution
### Fault Detection  
When a path is discovered, communication key distribution can be performed within the path. As mentioned earlier, if there are faulty nodes on the path, transmission abnormalities will occur. Therefore, this detection method is based on the destination node's acknowledgment of the communication key: if the amount of acknowledgment in a sliding window is greater than the threshold, fault detection at the source is triggered.  
Some faulty nodes may send bogus information to the destination node to maintain the traffic consistency principle. However, in the SKDN, the SKD node will utilize the local key to encrypt or decrypt messages when forwarding or receiving messages. If the faulty node does not use the local key, this bogus information will be decrypted into garbled characters and cannot be forwarded to the destination, causing fault detection to be triggered. Therefore, by using the local key, the traffic flowing through the faulty node is limited to a certain normal range, which improves the detection accuracy.  
When fault detection is triggered, a detection list is maintained based on the relay list of the corresponding entry of this path in the routing table at this moment. We assume that  
Figure 7: A distribution of logical link resource status. \(Cost_{XY}\) represents the key supply capability of the logical link between \(X\) and \(Y\).  
the path includes source and destination with an odd number of \(N\) nodes, with \(1,2,\ldots,N\) as serial numbers, respectively. If the detection is triggered, the detected abnormal path from \(1\) to \(N\) is divided into two parts by inserting the intermediate point \((N-1)/2\) in the detection list. When the next communication request arrives, the detection list is attached to the end of the packet carrying the communication key and then forwarded. All points in the detection list, including the destination, need to return acknowledgment and recursively detect the two subpaths. By analogy, until the detection triggers detection on the indivisible path from \(i\) to \(j\), it is suspected that one of the nodes is faulty.  
To prevent the faulty node from discarding the acknowledgment so that it can be blamed on any node between itself and the destination on the path when the relay receives the packet containing its own identity in the detection list, it needs to trigger the timing without sending the acknowledgment first. When the acknowledgment returned by the destination arrives at the relay within the time limit, the relay information and the packet body will be signed and attached to the end of the packet; otherwise, a new acknowledgment will be generated and sent.  
If a fault-triggered communication key is used for secure communication between source and destination, the communication of both parties may be leaked. We observe the asynchronous nature of key distribution and application, establishing four different states for communication keys: uncertain, suspicious, available, and unavailable. For convenience, we assume that the duration of the fault will exceed the full cycle of fault detection. When the communication key request arrives, the status of the forwarded communication key is uncertain. When the acknowledgment rate is lower than the threshold, the status of the batch of keys is converted to available and returned to the service layer. Otherwise, convert the key status to suspicious.