Integrity checking method and device, equipment and storage medium

Abstract

The invention provides an integrity checking method and device, equipment and a storage medium, and relates to the technical field of computers. The method comprises the following steps: sending an integrity verification request to a universal flash memory UFS device in first hardware, wherein the verification request comprises an identifier of a first file; and based on the UFS equipment and a Merkle tree module in the first hardware, executing an integrity verification operation on the first file. Therefore, the Hash calculation process and the verification process are integrated into the UFS equipment, and the overall energy consumption of the system can be remarkably reduced. The method has important significance in the aspects of battery life, equipment heat dissipation and the like, and particularly in mobile and portable equipment, integrity verification can be carried out in the UFS controller, so that the CPU load is remarkably reduced, the overall calculation efficiency is improved, a large amount of processor resources are prevented from being occupied, and the execution of other tasks of the system is prevented from being influenced.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technologies, and in particular, to a method, apparatus, device, and storage medium for integrity verification. Background Art

[0002] With the popularization of mobile devices in daily life, ensuring the integrity of system files and the security of the system has become particularly important. Traditional software-based verification methods rely on the processor to complete the hash calculation of data, which may cause a large amount of processor resources to be occupied during large-scale data processing, affecting the execution of other tasks of the system. Summary of the Invention

[0003] The present disclosure provides a method, apparatus, device, and storage medium for integrity verification, aiming to at least solve one of the technical problems in the related art to a certain extent.

[0004] In a first aspect, the present disclosure provides an integrity verification method, including:

[0005] Sending an integrity verification request to a Universal Flash Storage (UFS) device in a first hardware, where the verification request includes an identifier of a first file;

[0006] Performing an integrity verification operation on the first file based on the UFS device and a Merkle tree module in the first hardware.

[0007] In a second aspect, the present disclosure provides an integrity verification apparatus, including:

[0008] A sending module, configured to send an integrity verification request to a Universal Flash Storage (UFS) device in a first hardware, where the verification request includes an identifier of a first file;

[0009] A verification module, configured to perform an integrity verification operation on the first file based on the UFS device and a Merkle tree module in the first hardware.

[0010] In a third aspect, the present disclosure provides an electronic device, including: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the integrity verification method.

[0011] In a fourth aspect, the present disclosure provides a computer-readable storage medium, which, when instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to execute the integrity verification method.

[0012] In a fifth aspect, the present disclosure provides a computer program product, including a computer program, and the computer program is executed by a processor to implement the integrity verification method.

[0013] In the embodiments of the present disclosure, first, an integrity verification request is sent to the Universal Flash Storage (UFS) device in the first hardware. The verification request contains the identifier of the first file. Then, based on the UFS device and the Merkle tree module in the first hardware, an integrity verification operation for the first file is performed. Thus, integrating the hash calculation and verification process into the UFS device can significantly reduce the overall system power consumption. This is of great significance for aspects such as battery life and device heat dissipation. Especially in mobile and portable devices, by performing integrity verification in the UFS controller, the CPU load can be significantly reduced, the overall computing efficiency can be improved, a large amount of processor resources can be avoided from being occupied, and the execution of other system tasks can be prevented from being affected.

[0014] Additional aspects and advantages of the present disclosure will be given in part in the following description, become apparent in part from the following description, or be learned through the practice of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings herein are incorporated into the specification and constitute a part of this specification, showing embodiments consistent with the present disclosure, and are used together with the specification to explain the principles of the present disclosure.

[0016] Figure 1 is a schematic flowchart of an integrity verification method shown according to the first embodiment of the present disclosure;

[0017] Figure 2 is a schematic flowchart of an integrity verification method shown according to the second embodiment of the present disclosure;

[0018] Figure 3 is another schematic flowchart of an integrity verification method shown according to the second embodiment of the present disclosure;

[0019] Figure 4 is a schematic flowchart of an integrity verification method shown according to the third embodiment of the present disclosure;

[0020] Figure 5 is another schematic flowchart of an integrity verification method shown according to the third embodiment of the present disclosure;

[0021] Figure 6 is a schematic structural diagram of an integrity verification device shown according to the fourth embodiment of the present disclosure;

[0022] Figure 7 shows a block diagram of an exemplary electronic device suitable for implementing the embodiments of the present disclosure.

[0023] Through the above-mentioned accompanying drawings, specific embodiments of the present disclosure have been shown, and will be described in more detail hereinafter. These drawings and the textual description are not intended to limit the scope of the concept of the present disclosure in any way, but to illustrate the concept of the present disclosure to those skilled in the art by reference to specific embodiments. Detailed Description of the Embodiments

[0024] The embodiments of the present disclosure will be described in detail below. Examples of the embodiments are shown in the accompanying drawings, where the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by reference to the accompanying drawings are exemplary only for explaining the present disclosure and should not be construed as limiting the present disclosure. On the contrary, the embodiments of the present disclosure include all variations, modifications, and equivalents that fall within the spirit and scope of the appended claims.

[0025] Integrity verification can help prevent unauthorized changes and malicious operations, thus protecting the security of devices and data. Integrity verification is performed during startup to verify whether there are any tampering situations during the system startup process. Performing integrity verification during runtime is equally important. For example, a device can use digital signatures to verify the integrity of system files to ensure that these files have not been tampered with by malware. In addition, secure boot technology can be adopted to ensure that the firmware and drivers loaded during system startup are certified and untampered. Additionally, Internet of Things devices can also use encryption technology to protect the integrity and privacy of data, as well as implement access control mechanisms to restrict modifications and access to system files. The comprehensive application of these security measures can effectively improve the security and reliability of Internet of Things devices.

[0026] dm-verity is a mechanism for data integrity verification in the Android system. When using dm-verity, the file system is divided into fixed-size data blocks. For each data block, a hash value is calculated, and these hash values are used to construct a Merkle tree. The hash value of the root node of the Merkle tree is saved at a certain location in the system. When reading a data block stored in UFS or other storage media, the system calculates the hash value of the data block in real time and compares it with the pre-calculated hash value. If the two do not match, it means that the data block may have been tampered with or damaged.

[0027] However, for example, in a Merkle tree structure with three levels, to read one address and meet the corresponding integrity check, at least three hash256 calculations and comparison operations are required. Such calculations increase the energy consumption of the entire system, especially on mobile devices, which reduces the device's usage time, degrades the user experience, and increases the user's operation latency. Additionally, an attacker may use corresponding attack methods to target the calculation and comparison processes, resulting in poor security.

[0028] To address the above issues, the present disclosure proposes an integrity check method that enables the hash calculation and comparison processes to be executed not by the CPU but by a dedicated hardware unit. This can free up CPU resources, reduce the CPU's load and power consumption. The hardware unit can complete the hash calculation and comparison operations in a short time, thereby improving the processing speed and response speed of the entire system. Since the hash calculation and comparison processes are executed at the hardware level, an attacker cannot undermine the data integrity check through software attacks, achieving faster, more energy-efficient, and more secure data integrity checks.

[0029] It should be noted that the execution entity of the integrity check method in the embodiments of the present disclosure is an integrity check device, which can be implemented in software and / or hardware, and can be configured in any electronic device, such as any mobile device like a mobile phone, tablet, smartwatch, vehicle, etc. Alternatively, the execution entity of the integrity check method in the embodiments of the present disclosure can also be the Linux kernel, which is not limited herein.

[0030] Figure 1 is a flowchart of the integrity check method shown in the first embodiment of the present disclosure. As Figure 1 shown, the method includes:

[0031] S101: Send an integrity check request to the Universal Flash Storage (UFS) device in the first hardware. The verification request contains the identifier of the first file.

[0032] Among them, a UFS (Universal Flash Storage) device can be composed of a controller chip (UFS controller) and a flash chip. The controller chip can be responsible for functions such as managing data transmission, error detection and correction, and command parsing, while the flash chip can be used to store data, which is not limited herein.

[0033] Among them, the UFS controller is a key component in the UFS device, which is responsible for managing and controlling various operations and functions of the UFS device. The UFS controller includes a controller chip and related circuits. The controller chip is the core of the UFS device, responsible for processing commands and data from the host and interacting with the flash memory chips. The controller chip also includes a built-in processor and memory for executing control algorithms and caching data to improve performance and reliability. In addition, the controller chip provides physical layer and link layer functions for the UFS interface to ensure the correct transmission of data and communication stability.

[0034] Among them, the first file can be a system file to be verified.

[0035] For example, for Internet of Things (IoT) devices, integrity verification is required during startup. During the use of IoT devices, users usually perform various operations such as opening applications and modifying settings. During the use of IoT devices, the system needs to read various system files to execute operations, so integrity verification is also required during operation.

[0036] Among them, the integrity verification request is used to request the UFS device to start integrity verification, and indicates the system file to be verified through the identifier of the first file contained in the request.

[0037] For example, if a user wants to modify a certain setting X during the use of the device, the file x associated with the setting X can be used as the first file, which is not limited here.

[0038] Among them, the first hardware can be a mobile phone chip, an Internet of Things (IoT) chip, a vehicle-mounted chip, which is not limited here.

[0039] It should be noted that the UFS device can be set in the first hardware. For example, if the first hardware is a mobile phone chip, the mobile phone chip contains many intellectual property cores (IP cores) to implement specific functions, such as storage cores, processor cores, memory controller cores, which are not limited here. Among them, the UFS device can be configured in any core of the first hardware.

[0040] Among them, the identifier of the first file can be a symbol, letter, number, serial number or any other form of information used to represent the first file, which can uniquely represent the first file, and is not limited here.

[0041] Optionally, in response to determining that the first file is a system file to be used by the device, an integrity verification request is sent to the Universal Flash Storage (UFS) device in the first hardware.

[0042] Among them, the system file to be used can be the system file required by the system when performing a certain operation. For example, if the user wants to open Application A, the system file associated with Application A can be used as the system file to be used, that is, the first file, which is not limited here.

[0043] S102: Based on the Merkle tree module in the UFS device and the first hardware, perform an integrity verification operation on the first file.

[0044] Among them, the Merkle tree can be a hash tree structure.

[0045] In the embodiments of the present disclosure, hereinafter, the Merkle tree module is represented by MTU (Merkle Tree Unit) for description. Among them, the MTU can be a component or module for implementing the Merkle tree function.

[0046] Optionally, the Merkle tree module can be inlined in the UFS device, or the Merkle tree module and the UFS device can be separately located in the first hardware.

[0047] As a possible implementation, the first file can be divided into different data blocks, and the hash value x corresponding to each data block is calculated, and the hash value y corresponding to the first file in the Merkle tree is determined through the MTU, and the hash values x and y are compared and verified in the UFS device to check whether they match. If the hash values x and y match, it means that the first file is complete and the data has not been tampered with, so the first file can be used. If the hash values x and y do not match, it means that the first file may be tampered with or damaged and the data is incomplete, so the first file cannot be accessed and used, which is not limited here.

[0048] In the embodiments of the present disclosure, first, an integrity verification request is sent to the universal flash storage UFS device in the first hardware, and the verification request contains the identifier of the first file, and then, based on the UFS device and the Merkle tree module in the first hardware, an integrity verification operation on the first file is performed. Thus, integrating the hash calculation and verification process into the UFS device can significantly reduce the overall system energy consumption. This is of great significance for aspects such as battery life and device heat dissipation. Especially in mobile and portable devices, by performing integrity verification in the UFS controller, the CPU load can be significantly reduced, the overall computing efficiency can be improved, a large amount of processor resources can be avoided from being occupied, and the execution of other system tasks can be avoided from being affected. It can enhance the resistance of the system and make it more difficult to be attacked externally and tampered with internally. Since the key verification steps are carried out inside the UFS controller, it makes it difficult for potential attackers to access these key verification processes, thereby improving the overall security of the system.

[0049] Figure 2 is a schematic flowchart of the integrity verification method shown in the second embodiment of the present disclosure. As Figure 2 shown, the method includes:

[0050] S201: Send an integrity verification request to the Universal Flash Storage (UFS) device in the first hardware. The verification request contains the identifier of the first file.

[0051] It should be noted that the specific implementation manner of step S201 can refer to the above embodiment and will not be elaborated here.

[0052] S202: If the Merkle tree module is inline in the UFS device, determine the first storage address mapped by the first file in the UFS device.

[0053] Among them, if the Merkle tree module is inline in the UFS device, it means that the Maximum Transmission Unit (MTU) is located in the UFS device.

[0054] Among them, the first storage address can be the block storage address of the UFS device.

[0055] Optionally, the driver program can be run to read the system image address of the first file. After that, the system image address can be used as the first storage address mapped by the first file in the UFS device.

[0056] Among them, the system image address can be the actual physical address of the system image in the system memory.

[0057] Among them, the block storage address is an address used to access and locate data blocks on the storage device. In the embodiments of the present disclosure, the first storage address can be the physical address of the file data block corresponding to the first file.

[0058] In the UFS device, system files are usually stored and managed in fixed-size blocks. Each block has a unique address, and specific data blocks can be accurately located and accessed through this address.

[0059] In the embodiments of the present disclosure, the system kernel can run the driver program, then read the system image address of the first file, and use the system image address as the first storage address mapped by the first file in the UFS device.

[0060] S203: Based on the Merkle tree module inline in the UFS device, convert the first storage address to a second storage address.

[0061] Optionally, the first storage address can be input into the Merkle tree module (MTU), and then the MTU can convert the first storage address into a second storage address through a logical mapping conversion relationship, that is, mapping or calculation can be performed.

[0062] Among them, the second storage address can be the storage address of the first file in the Merkle tree.

[0063] S204: Obtain the file data of the first file to calculate the corresponding first hash value.

[0064] Optionally, based on the first storage address, the file data of the first file can be obtained from the file system.

[0065] Specifically, the file data of the first file can be obtained from the file system through the UFS device based on the first storage address. Among them, the file system can be a system partition, and different regions store data blocks of different files. In the embodiments of the present disclosure, the data of the first file, that is, the file data of the first file, can be read from the file system according to the first storage address corresponding to the first file.

[0066] Among them, the first hash value can be a hash value obtained by performing a hash calculation on the file data of the first file.

[0067] Among them, the hash value of the file data can be completed using a hash function. A hash function is an algorithm that maps data of any size to a hash value of a fixed length, such as MD5, SHA-1, SHA-256, which is not limited herein.

[0068] It should be noted that since a hash function can only process data of a limited length at a time, the file data needs to be divided into appropriately sized blocks, and fixed-sized blocks or variable-length blocks can be used as input. Then, a hash operation can be performed on each data block, and the selected hash function can be applied to each data block to obtain the hash value of the block. The hash function can generate a hash value by taking each byte of the data block as input and going through a series of complex operations. If there are multiple blocks of file data, the hash values of each block can be combined into a larger data structure, such as a Merkle tree or a hash linked list. This can perform integrity verification more efficiently during verification.

[0069] Optionally, if the first file has only one data block, then the hash value of this block is the final hash value of the file. If a combined structure is used, the final hash value can be obtained by performing a further hash operation on these structures, which is not limited herein.

[0070] S205: Determine the second hash value corresponding to the first file from the pre-constructed Merkle tree based on the second storage address.

[0071] Among them, the pre-built Merkle tree may contain reference hash values corresponding to different files in the system file. It should be noted that the hash values corresponding to each file in the pre-built Merkle tree are pre-computed values, which can represent the hash values corresponding to each file when the data is complete, not tampered with, and not damaged.

[0072] Among them, the second hash value may be the hash value corresponding to the first file in the pre-built Merkle tree.

[0073] It should be noted that since the second storage address is the storage address of the first file in the Merkle tree, the second hash value corresponding to the first file can be determined from the pre-built Merkle tree through the second storage address.

[0074] S206: Based on the UFS device, perform integrity verification on the first file according to the first hash value and the second hash value.

[0075] Specifically, in the UFS device, the first hash value and the second hash value can be compared and verified to determine whether the first hash value and the second hash value match. If the first hash value and the second hash value match, it means that the first file is complete and the data has not been tampered with, so the first file can be used. If the first hash value and the second hash value do not match, it means that the first file may have been tampered with or damaged and the data is incomplete, so the first file cannot be accessed and used. No limitation is made here.

[0076] As Figure 3 shown, Figure 3 is a flowchart of an integrity verification method shown in an embodiment of the present disclosure. Among them, the Merkle tree module (MTU) is inline in the UFS device. After sending a request (integrity verification request) to the UFS device, the first storage address mapped by the first file in the UFS device is determined, and logical mapping conversion is performed based on the MTU, and then the first storage address is converted into a second storage address. After that, the UFS device reads the file data corresponding to the first file from the file system based on the first storage address and converts it into a first hash value, determines the second hash value from the Merkle tree based on the second storage address, and then performs verification.

[0077] In an embodiment of the present disclosure, first, an integrity verification request is sent to a Universal Flash Storage (UFS) device in a first hardware. The verification request contains an identifier of a first file. If the Merkle tree module is inline in the UFS device, a first storage address mapped by the first file in the UFS device is determined. Then, based on the Merkle tree module inline in the UFS device, the first storage address is converted into a second storage address. Next, the file data of the first file is obtained to calculate a corresponding first hash value. Then, based on the second storage address, a second hash value corresponding to the first file is determined from a pre-constructed Merkle tree. Finally, based on the UFS device, the first file is subjected to integrity verification according to the first hash value and the second hash value. Thereby, the consistency and integrity of the file data of the first file can be ensured. Since the comparison verification calculation is performed according to the first hash value and the second hash value in the UFS device, the energy consumption of the CPU can be reduced, the CPU load can be significantly alleviated, and the overall computing efficiency can be improved. Since the hash verification process is accelerated at the hardware level, the data reading and verification processes are faster, and the latency of the system when reading protected data is greatly reduced.

[0078] Figure 4 is a schematic flowchart of an integrity verification method according to the third embodiment of the present disclosure, as Figure 4 shown, the method includes:

[0079] S301: Send an integrity verification request to a Universal Flash Storage (UFS) device in a first hardware. The verification request contains an identifier of a first file.

[0080] S302: If the Merkle tree module and the UFS device are separately located in the first hardware, determine a first storage address mapped by the first file in the UFS device.

[0081] It should be noted that the specific implementation manners of steps S301 and S302 can refer to the above embodiments and will not be elaborated here.

[0082] S303: Pass the first storage address to the Merkle tree module to convert the first storage address into a second storage address through the Merkle tree module.

[0083] Optionally, since the Merkle tree module and the UFS device are separately located in the first hardware, the UFS device can pass the first storage address to the Merkle tree module (MTU). Then, the MTU can perform logical mapping conversion based on the first storage address, that is, it can perform mapping or calculation to convert the first storage address into a second storage address. Then, the MTU can return the second storage address to the UFS device.

[0084] S304: Obtain the file data of the first file to calculate a corresponding first hash value.

[0085] S305: Determine a second hash value corresponding to the first file from the pre-constructed Merkle tree based on the second storage address.

[0086] S306: Based on the UFS device, perform integrity verification on the first file according to the first hash value and the second hash value.

[0087] It should be noted that steps S304 - S306 can refer to the above embodiments and will not be elaborated here.

[0088] As Figure 5 shown, Figure 5 is a flowchart of another integrity verification method shown in the embodiments of the present disclosure. Among them, the Merkle tree module and the UFS device are separately located in the first hardware. After sending a request (integrity verification request) to the UFS device, determine the first storage address mapped by the first file in the UFS device. The UFS device transmits the first storage address to the MTU, and the MTU performs logical mapping conversion, and then converts the first storage address into a second storage address for the UFS device. After that, the UFS device respectively reads the file data corresponding to the first file from the file system based on the first storage address and converts it into a first hash value, determines the second hash value from the Merkle tree based on the second storage address, and then performs verification.

[0089] In the embodiments of the present disclosure, first send an integrity verification request to the universal flash storage (UFS) device in the first hardware. The verification request contains the identifier of the first file. If the Merkle tree module and the UFS device are separately located in the first hardware, determine the first storage address mapped by the first file in the UFS device, and then transmit the first storage address to the Merkle tree module to convert the first storage address into a second storage address through the Merkle tree module. Then obtain the file data of the first file to calculate the corresponding first hash value. After that, based on the second storage address, determine the second hash value corresponding to the first file from the pre-constructed Merkle tree. Finally, based on the UFS device, perform integrity verification on the first file according to the first hash value and the second hash value. Thus, the consistency and integrity of the file data of the first file can be ensured. Since the comparison and verification calculation are performed in the UFS device according to the first hash value and the second hash value, the energy consumption of the CPU can be reduced, the CPU load can be significantly reduced, and the overall calculation efficiency can be improved. Since the hash verification process is accelerated at the hardware level, the data reading and verification processes are faster, and the system latency when reading protected data is greatly reduced.

[0090] Figure 6 is a block diagram of an integrity verification device shown according to the present disclosure. As Figure 6 shown, the integrity verification device 600 includes:

[0091] A sending module 610, configured to send an integrity verification request to a Universal Flash Storage (UFS) device in a first hardware, where the verification request includes an identifier of a first file.

[0092] A verification module 620, configured to perform an integrity verification operation on the first file based on the UFS device and a Merkle tree module in the first hardware.

[0093] Optionally, the Merkle tree module is inline in the UFS device.

[0094] Alternatively, the Merkle tree module and the UFS device are separately located in the first hardware.

[0095] Optionally, if the Merkle tree module and the UFS device are separately located in the first hardware, the verification module includes:

[0096] A first determination unit, configured to determine a first storage address mapped by the first file in the UFS device.

[0097] A conversion unit, configured to pass the first storage address to the Merkle tree module, so that the Merkle tree module converts the first storage address into a second storage address.

[0098] An acquisition unit, configured to acquire file data of the first file to calculate a corresponding first hash value.

[0099] A second determination unit, configured to determine a second hash value corresponding to the first file from a pre-constructed Merkle tree based on the second storage address.

[0100] A verification unit, configured to perform an integrity verification on the first file based on the UFS device according to the first hash value and the second hash value.

[0101] Optionally, if the Merkle tree module is inline in the UFS device, the verification module is specifically configured to:

[0102] Determine a first storage address mapped by the first file in the UFS device.

[0103] Based on the Merkle tree module inline in the UFS device, convert the first storage address into a second storage address.

[0104] Acquire file data of the first file to calculate a corresponding first hash value.

[0105] Determine a second hash value corresponding to the first file from a pre-constructed Merkle tree based on the second storage address;

[0106] Based on the UFS device, perform integrity verification on the first file according to the first hash value and the second hash value.

[0107] Optionally, the obtaining unit is specifically configured to:

[0108] Obtain file data of the first file from a file system based on the first storage address.

[0109] Optionally, the first determining unit is specifically configured to:

[0110] Run a driver program to read a system image address of the first file;

[0111] Use the system image address as a first storage address mapped by the first file in the UFS device.

[0112] Optionally, the sending module is specifically configured to:

[0113] In response to determining that the first file is a system file to be used by the device, send an integrity verification request to a universal flash storage (UFS) device in the first hardware.

[0114] In an embodiment of the present disclosure, first send an integrity verification request to a universal flash storage (UFS) device in a first hardware. The verification request includes an identifier of a first file, and then perform an integrity verification operation on the first file based on the UFS device and a Merkle tree module in the first hardware. Thus, integrating the hash calculation and verification process into the UFS device can significantly reduce the overall system power consumption. This is of great significance for aspects such as battery life and device heat dissipation. Especially in mobile and portable devices, by performing integrity verification in the UFS controller, the CPU load can be significantly reduced, the overall computing efficiency can be improved, a large amount of processor resources can be avoided from being occupied, and the execution of other system tasks can be prevented from being affected. The resistance of the system can be enhanced, making it more difficult to be attacked externally and tampered internally. Since the key verification steps are performed inside the UFS controller, it is difficult for potential attackers to access these key verification processes, thereby improving the overall security of the system.

[0115] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0116] Figure 7 A block diagram of an exemplary electronic device suitable for implementing the embodiments of the present disclosure is shown. Figure 7The illustrated electronic device 12 is merely an example and should not impose any limitation on the functions and usage scope of the embodiments of the present disclosure.

[0117] As Figure 7 shown, the electronic device 12 appears in the form of a general-purpose computing device. The components of the electronic device 12 may include, but are not limited to: one or more processors or processing units 16, a memory 28, and a bus 18 that connects different system components (including the memory 28 and the processing unit 16).

[0118] The bus 18 represents one or more of several types of bus architectures, including a memory bus or a memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of the various bus architectures. By way of example, these architectures include, but are not limited to, Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnection (PCI) bus.

[0119] The electronic device 12 typically includes a variety of computer system-readable media. These media can be any available media that can be accessed by the electronic device 12, including volatile and non-volatile media, removable and non-removable media.

[0120] The memory 28 may include computer system-readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or a cache 32. The electronic device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, a storage system 34 may be used for reading and writing on non-removable, non-volatile magnetic media ( Figure 7 not shown, commonly referred to as a "hard disk drive"). Although Figure 7Not shown in the figure, a disk drive for reading and writing a removable non-volatile disk (such as a "floppy disk") and an optical disk drive for reading and writing a removable non-volatile optical disk (such as: Compact Disc Read Only Memory (hereinafter referred to as: CD-ROM), Digital Video Disc Read Only Memory (hereinafter referred to as: DVD-ROM) or other optical media) can be provided. In these cases, each drive can be connected to the bus 18 through one or more data medium interfaces. The memory 28 may include at least one program product having a set (such as at least one) of program modules configured to perform the functions of the embodiments of the present disclosure.

[0121] A program / utility 40 having a set (at least one) of program modules 42 can be stored in, for example, the memory 28. Such program modules 42 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include the implementation of a network environment. The program modules 42 generally perform the functions and / or methods in the embodiments described in the present disclosure.

[0122] The electronic device 12 can also communicate with one or more external devices 14 (such as a keyboard, a pointing device, a display 24, etc.), and can also communicate with one or more devices that enable a user to interact with the electronic device 12, and / or communicate with any device that enables the electronic device 12 to communicate with one or more other computing devices (such as a network card, a modem, etc.). Such communication can be carried out through the input / output (I / O) interface 22. Moreover, the electronic device 12 can also communicate with one or more networks (such as a Local Area Network (hereinafter referred to as: LAN), a Wide Area Network (hereinafter referred to as: WAN) and / or a public network, such as the Internet) through the network adapter 20. As shown in the figure, the network adapter 20 communicates with other modules of the electronic device 12 through the bus 18. It should be understood that although not shown in the figure, other hardware and / or software modules can be used in combination with the electronic device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0123] The processing unit 16 executes various functional applications and data processing by running the programs stored in the memory 28, such as implementing the methods mentioned in the foregoing embodiments.

[0124] In the description of this specification, the descriptions referring to terms such as "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" etc. mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present disclosure. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, without contradiction, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0125] In addition, the terms "first" and "second" are used for descriptive purposes only and cannot be construed as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, the features defined with "first" and "second" may explicitly or implicitly include at least one of such feature. In the description of the present disclosure, "a plurality of" means at least two, such as two, three, etc., unless otherwise specifically defined.

[0126] Any process or method description shown in the flowchart or described in other ways herein can be understood to represent a module, segment, or portion of code including one or more executable instructions for implementing a customized logic function or process, and the scope of the preferred embodiments of the present disclosure includes additional implementations, where the functions can be executed in a substantially simultaneous manner or in an opposite order according to the involved functions, rather than in the order shown or discussed, which should be understood by those skilled in the art to which the embodiments of the present disclosure pertain.

[0127] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a definable list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other systems that can fetch and execute instructions from the instruction execution system, apparatus, or device), or in conjunction with these instruction execution systems, apparatuses, or devices. For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection portion having one or more wirings (electronic device), a portable computer diskette (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpretation, or otherwise processing as appropriate, and then storing it in a computer memory.

[0128] It should be understood that various parts of the present disclosure can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one or a combination of the following techniques well known in the art can be used: discrete logic circuits having logic gate circuits for implementing logical functions on data signals, application specific integrated circuits having appropriate combinational logic gate circuits, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.

[0129] Those of ordinary skill in the art of this technology can understand that all or part of the steps carried by the method of implementing the above embodiments can be completed by instructing relevant hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.

[0130] In addition, each functional unit in various embodiments of the present disclosure may be integrated into a processing module, may exist physically alone for each unit, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. When the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0131] The above-mentioned storage medium may be a read-only memory, a magnetic disk, an optical disc, etc. Although the embodiments of the present disclosure have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present disclosure. Those of ordinary skill in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present disclosure.

Claims

1. An integrity verification method, characterized in that, Including: Sending an integrity verification request to a Universal Flash Storage (UFS) device in a first hardware, where the verification request includes an identifier of a first file; Performing an integrity verification operation on the first file based on the UFS device and a Merkle tree module in the first hardware.

2. The method according to claim 1, characterized in that, The Merkle tree module is inline in the UFS device. Alternatively, the Merkle tree module and the UFS device are separately located in the first hardware.

3. The method according to claim 1, characterized in that, If the Merkle tree module and the UFS device are separately located in the first hardware, the performing an integrity verification operation on the first file based on the UFS device and the Merkle tree module includes: Determining a first storage address mapped by the first file in the UFS device; Transmitting the first storage address to the Merkle tree module to convert the first storage address into a second storage address by the Merkle tree module; Obtaining file data of the first file to calculate a corresponding first hash value; Determining a second hash value corresponding to the first file from a pre-constructed Merkle tree based on the second storage address; Performing an integrity verification on the first file based on the UFS device according to the first hash value and the second hash value.

4. The method according to claim 2, characterized in that, If the Merkle tree module is inline in the UFS device, the performing an integrity verification operation on the first file based on the UFS device and the Merkle tree module includes: Determining a first storage address mapped by the first file in the UFS device; Converting the first storage address into a second storage address based on the Merkle tree module inline in the UFS device; Obtaining file data of the first file to calculate a corresponding first hash value; Determining a second hash value corresponding to the first file from a pre-constructed Merkle tree based on the second storage address; Performing an integrity verification on the first file based on the UFS device according to the first hash value and the second hash value.

5. The method according to claim 3 or 4, characterized in that, The obtaining file data of the first file includes: Obtaining file data of the first file from a file system based on the first storage address.

6. The method according to claim 3 or 4, characterized in that, The determining a first storage address mapped by the first file in the UFS device includes: Running a driver to read a system image address of the first file; Using the system image address as the first storage address mapped by the first file in the UFS device.

7. The method according to claim 1, characterized in that, The sending an integrity verification request to a Universal Flash Storage (UFS) device in a first hardware includes: In response to determining that the first file is a system file to be used by the device, sending an integrity verification request to the Universal Flash Storage (UFS) device in the first hardware.

8. An integrity verification device, characterized in that, Including: A sending module, configured to send an integrity verification request to a Universal Flash Storage (UFS) device in a first hardware, where the verification request includes an identifier of a first file; A verification module, configured to perform an integrity verification operation on the first file based on the Merkle tree module in the UFS device and the first hardware.

9. An electronic device, characterized in that, Comprising: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, Computer-executable instructions are stored in the computer-readable storage medium, and when the computer-executable instructions are executed by a processor, they are used to implement the method according to any one of claims 1-7.

Images