Master Key (MK) → Key Derivation → Sender Key (SK) → Frame Encryption

┌─────────────────────────────────────┐
│         Master Key (MK)             │  ← 轮换周期：30-60秒（合规驱动）
│   分发路径：可靠信令通道（TCP/QUIC）  │
└──────────────┬──────────────────────┘
               │ HKDF派生
               ▼
┌─────────────────────────────────────┐
│      Epoch Key (EK)                 │  ← 轮换周期：2-5秒（性能驱动）
│   分发路径：媒体通道内带/数据通道    │
└──────────────┬──────────────────────┘
               │ HKDF派生
               ▼
┌─────────────────────────────────────┐
│      Sender Key (SK)                │  ← 每帧使用
└─────────────────────────────────────┘

// 伪代码：EK轮换触发逻辑
void onKeyRotationTimer() {
    if (current_epoch_age > EK_ROTATION_INTERVAL_MS) {
        // 1. 生成新EK，本地派生新SK
        auto new_ek = hkdf(master_key, "epoch", ++epoch_counter);
        auto new_sk = hkdf(new_ek, "sender", my_sender_id);
        
        // 2. 通过DataChannel可靠组播新EK（附带epoch序号）
        data_channel.send(reliable_multicast, {
            type: "EK_UPDATE",
            epoch: epoch_counter,
            ek_ciphertext: encrypt_for_group(new_ek)  // 使用当前MK加密
        });
        
        // 3. 立即切换发送端加密上下文
        encoder.set_send_key(new_sk, epoch_counter);
    }
}

Time →
KMS:     [MK_n]──────►[MK_{n+1}]──────►[MK_{n+2}]
Member:     │            │            │
            ▼            ▼            ▼
        Recv MK_n   Recv MK_{n+1}  Recv MK_{n+2}
            │            │            │
            ▼            ▼            ▼
        Activate    Pre-store    Pre-store
        @T_n        @T_n+δ       @T_n+2δ

// Rust风格伪代码：原子双缓冲切换
struct KeyStore {
    current: AtomicPtr<MasterKey>,
    next: Mutex<Option<MasterKey>>,
}

impl KeyStore {
    fn pre_store(&self, mk: MasterKey) {
        *self.next.lock() = Some(mk);
    }
    
    fn activate_next(&self) -> Result<(), KeyError> {
        let mut next_guard = self.next.lock();
        if let Some(new_mk) = next_guard.take() {
            // 原子交换指针，无锁读取路径零开销
            self.current.swap(Box::into_raw(Box::new(new_mk)), Ordering::AcqRel);
            Ok(())
        } else { Err(KeyError::NoPendingKey) }
    }
}

# 同步不一致窗口 P99
histogram_quantile(0.99, rate(sframe_epoch_sync_duration_seconds_bucket[5m]))

# 解密失败率
rate(sframe_decrypt_fail_total[1m]) / rate(sframe_decrypt_total[1m])

# 前向安全窗口实际值
sframe_epoch_rotation_interval_seconds

stateDiagram-v2
    [*] --> EPOCH_N_ACTIVE: 会议创建/收到MK_n
    EPOCH_N_ACTIVE --> EPOCH_N_DRAINING: 收到EK_{n+1}预分发信令
    EPOCH_N_DRAINING --> EPOCH_N_ACTIVE: 预分发超时回滚/异常
    EPOCH_N_DRAINING --> EPOCH_N1_ACTIVE: 收到激活信令(epoch_active=1)
    EPOCH_N1_ACTIVE --> EPOCH_N1_DRAINING: 收到EK_{n+2}预分发
    EPOCH_N_ACTIVE --> EPOCH_N_EXPIRED: 成员全量ACK/超时清理
    EPOCH_N_EXPIRED --> [*]: 内存释放/审计日志归档

type EpochState struct {
    EpochID       uint64
    Status        EpochStatus // ACTIVE | DRAINING | EXPIRED
    SenderKeys    map[uint32]*SenderKeyContext // sender_id -> {ratchet_counter, cipher_suite}
    MemberAckMap  *sync.Map   // member_id -> ack_timestamp
    KeyExpiry     time.Time   // 基于轮换周期+容忍窗口计算
    RefCount      int32       // 引用计数：活跃发送流数+录制任务数
}

func (s *SFUServer) OnFrame(pkt *SFramePacket) ForwardDecision {
    ctx, ok := s.epochs.Load(pkt.KID.Epoch())
    if !ok { return DROP_UNKNOWN_EPOCH }
    
    epoch := ctx.(*EpochState)
    switch epoch.Status {
    case ACTIVE:
        return FORWARD_NORMAL
    case DRAINING:
        // 关键帧强制同步：新成员加入/切流时，必须等待新epoch首个IDR
        if pkt.IsKeyFrame() && pkt.KID.Epoch() == s.nextEpochID {
            return FORWARD_WITH_SYNC_MARKER // 标记给接收端：此帧可安全切换
        }
        return FORWARD_LEGACY_ONLY // 仅转发旧epoch帧，保护滞后成员
    default:
        return DROP_EXPIRED
    }
}

// 核心库：无平台依赖，纯逻辑
pub trait KeyStore: Send + Sync {
    fn derive_sender_key(&self, epoch: u64, sender_id: u32) -> Result<SenderKey, CryptoError>;
    fn rotate_epoch(&self, new_mk: &[u8]) -> Result<(), CryptoError>;
    fn export_for_backup(&self) -> Result<EncryptedBackup, CryptoError>; // 灾备导出
}

// 平台适配层
#[cfg(target_os = "ios")]
mod ios_keystore {
    use security_framework::os::ios::keychain::SecKey;
    pub struct IOSKeyStore { mk_handle: SecKey } // MK仅存于SE，不可导出
    impl KeyStore for IOSKeyStore { /* 调用SecKeyKeyDerivation... */ }
}

#[cfg(target_arch = "wasm32")]
mod wasm_keystore {
    use web_sys::CryptoKey;
    pub struct WasmKeyStore { mk_wrapped: CryptoKey } // AES-KW包装后存IndexedDB
    impl KeyStore for WasmKeyStore { /* SubtleCrypto.deriveKey PBKDF2/HKDF */ }
}

Master Key (MK)
    │
    ├─► Epoch Key (EK_n)
    │       │
    │       └─► Sender Key (SK_sender) = HKDF(EK_n, "sender", sender_id)
    │               │
    │               ├─► Base Layer Key (SK_BL) = HKDF(SK_sender, "layer", 0)
    │               ├─► Enhance Layer 1 Key (SK_EL1) = HKDF(SK_sender, "layer", 1)
    │               └─► Enhance Layer 2 Key (SK_EL2) = HKDF(SK_sender, "layer", 2)
    │
    └─► (Next Epoch Pre-derived...)

// 编码器侧回调伪码
void OnFrameEncoded(EncodedFrame frame) {
    if (frame.is_key_frame() && key_manager.pending_epoch_switch()) {
        // 1. 原子切换加密上下文
        key_manager.activate_next_epoch(); 
        
        // 2. 标记此帧为新Epoch首帧 (SFrame Header KID更新)
        frame.metadata.epoch_marker = true; 
        
        // 3. 通知SFU：新Epoch流开始，可触发下游关键帧请求
        sfu_signal_new_epoch_stream(frame.sender_id, key_manager.current_epoch());
    }
    encryptor.encrypt(frame, key_manager.current_sender_key());
}

# .github/workflows/chaos-sframe.yml
jobs:
  chaos-test:
    runs-on: [self-hosted, gpu, linux] # 需真实网络栈
    steps:
      - uses: actions/checkout@v4
      - name: Deploy Test Cluster (Kind + Helm)
        run: helm install sframe-test ./charts --set chaos.enabled=true
      - name: Inject Network Partition (LitmusChaos)
        run: kubectl apply -f chaos/network-partition-kms.yaml
      - name: Run E2E Test Suite (Rust + WebRTC)
        run: |
          cargo test --features chaos_test -- 
            --scenario large_meeting_500 
            --duration 300s 
            --assert "sync_window_p99 < 100ms" 
            --assert "decrypt_failure_rate < 0.001"
      - name: Collect Metrics & Generate Report
        run: |
          python scripts/analyze_chaos.py --input results/ --output report.html
      - name: Gate: Fail if SLO Breached
        if: failure()
        run: exit 1

# 1. 密钥轮换成功率 (按会议维度)
sum(rate(sframe_epoch_rotation_success_total[5m])) by (conference_id) 
/ 
sum(rate(sframe_epoch_rotation_attempt_total[5m])) by (conference_id)

# 2. 客户端版本兼容性矩阵
count by (client_version, platform, result) (sframe_decrypt_result_total)

# 3. SFU 密钥状态机异常转移
increase(sfu_epoch_state_transition_total{from=~"ACTIVE|DRAINING", to=~"ERROR|EXPIRED"}[1h])

# 4. KMS 下发延迟热力图 (按地区/运营商)
histogram_quantile(0.99, sum by (le, region, isp) (rate(kms_key_distribute_latency_seconds_bucket[5m])))