Tamper-resistant end-to-end service data evidence storage method and system

Abstract

The invention discloses a tamper-resistant end-to-end service data storage method and system, and relates to the technical field of service data storage methods, and the method comprises the steps: initializing a hardware security module and a monotone increasing clock in terminal equipment, building a unique identity identifier of the equipment, and preparing a log environment for recording service data; the method comprises the following steps: collecting current business data and associated meta-information thereof, and constructing input content of current data processing in combination with an equipment identity, a clock value, a data structure template and an abstract value generated by previous business data; hash operation is carried out on the input content to generate an abstract of the business data, the abstract is signed by using a hardware security module to form an equipment side digital signature, and the abstract, the signature and meta-information are written into a log only increasing but not changing and an offline queue; and after the terminal recovers the network connection, generating a unique idempotent key based on the abstract of the service data or the combination of the equipment identity and the clock, and submitting an evidence storage request containing the abstract and the signature to the server.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of business data evidence storage methods, in particular to an anti-tampering end-to-end business data evidence storage method and system. BACKGROUND

[0002] The business data evidence storage method refers to the process of using cryptographic means to solidify the data generated during business operation into electronic evidence with time attributes and tamper-proof characteristics, which usually includes data digest generation, digital signature, timestamp binding, and chain anchoring. The technology of block chain, trusted timestamp, and hash chain is used to ensure the authenticity, integrity, and traceability of the data, and is widely used in the fields of finance, judiciary, government affairs, and Internet of Things to achieve tamper-proof recording and subsequent judicial verification of key business data. Therefore, how to use advanced technical means to improve the intelligent level and security of the business data evidence storage method has become one of the problems to be solved.

[0003] In the field of business data evidence storage methods, the existing methods mostly rely on a single channel of block chain or timestamp agency for anchoring. If the channel fails, is delayed, or is attacked, the evidence storage result is not reliable, and there is a lack of cross-validation mechanism to enhance the robustness and anti-fraud of the evidence. Moreover, when there is no network connection, the terminal cannot submit data, and the local log is usually stored in a normal file, which lacks a tamper-proof mechanism and is easily deleted or modified, resulting in ineffective storage of data during offline period. SUMMARY

[0004] In view of the above existing problems, the present application is proposed.

[0005] Therefore, the present application provides an anti-tampering end-to-end business data evidence storage method to solve the problem that the existing methods mostly rely on a single channel of block chain or timestamp agency for anchoring. If the channel fails, is delayed, or is attacked, the evidence storage result is not reliable, and there is a lack of cross-validation mechanism to enhance the robustness and anti-fraud of the evidence. Moreover, when there is no network connection, the terminal cannot submit data, and the local log is usually stored in a normal file, which lacks a tamper-proof mechanism and is easily deleted or modified, resulting in ineffective storage of data during offline period.

[0006] To solve the above technical problems, the present application provides the following technical solutions: In a first aspect, the present application provides an anti-tampering end-to-end business data evidence storage method, which comprises: Initializing a hardware security module and a monotonic increasing clock in a terminal device, establishing a unique device identity, and preparing a log environment for recording business data; Collecting current business data and its associated meta-information, combining device identity, clock value, data structure template, and digest value generated by the previous business data to construct the input content of this data processing; Hashing the input content to generate a digest of the current service data, signing the digest by using a hardware security module to form a device-side digital signature, and writing the digest, signature and meta information into an append-only log and an offline queue; After the terminal restores network connection, a unique idempotent key is generated based on the digest of the current service data or the combination of the device identity and the clock, and a storage evidence request containing the digest and the signature is submitted to the server; The server identifies the request uniqueness through the idempotent key, and after verifying the validity of the device identity and the signature, submits the digest to the blockchain system and the trusted timestamp agency, obtains the on-chain transaction voucher and the timestamp token, and performs consistency check on the time information contained in the two; After confirming the consistency of the double-channel anchoring results, the server generates a fusion receipt and returns it to the terminal after signing, and the terminal updates the local record state to valid after verifying the authenticity of the receipt, forming a complete storage closed loop; Based on all the signatures, anchoring evidence and state information, an electronic certificate meeting the verifiable voucher standard is generated, and after encoding, it is output as a voucher image that can be scanned and identified, supporting third parties to complete multi-signature verification and state verification under networkless conditions.

[0007] As a preferred scheme of the tamper-resistant end-to-end service data storage method, wherein: the current service data and its associated meta information are collected, combined with the device identity, the clock value, the data structure template and the digest value generated by the previous service data to construct the input content of the current data processing, and the specific steps are: In the terminal device startup process, a hardware security module is called to generate a device-specific asymmetric key pair, wherein the private key is stored in the secure area and cannot be exported, and the public key is used to register a decentralized identity, forming a unique identity of the device in the entire system; A monotonically increasing clock value is obtained through the operating system interface, which continuously increases with the device running and is not affected by artificial time adjustment; A log file structure that only supports append write is created, and access permissions are set to prohibit any process from performing modification or deletion operations on the file; When new service data is collected, the digest value generated by the last successfully processed service data is read as a chained input parameter; The current service data, meta information, device identity, current clock value, data structure template and previously generated digest value are jointly combined as structured input content.

[0008] As a preferred embodiment of the tamper-proof end-to-end business data notarization method of the present invention, the step of performing a hash operation on the input content to generate a digest of the current business data, signing the digest using a hardware security module to form a device-side digital signature, and writing the digest, signature, and metadata into an increment-only log and an offline queue, specifically: Perform cryptographic hashing on the constructed structured input to generate a fixed-length data digest; Define the abstract as The calculation method is as follows: ; in, This represents structured input content. It is a collision-resistant hash function; Invoke the hardware security module and use the device private key to digest. Perform digital signature calculations to generate a device-side digital signature. ; Summary ,sign The metadata, device identification, clock value, and data structure template are packaged into a complete record; The record is appended to the end of the log file (which only increments and does not modify) and simultaneously added to the local offline task queue.

[0009] As a preferred embodiment of the tamper-proof end-to-end service data notarization method of the present invention, the step of generating a unique idempotent key based on the digest of the current service data or the combination of device identity and clock after the terminal restores network connection, and submitting a notarization request containing the digest and signature to the server, specifically includes: Detect the status of the communication link between the terminal and the remote server to confirm that the network connection is available; Select the idempotent key generation method according to the system configuration policy; If you select the summary-based mode, then the summary will be used. As an idempotent key; If the time-based mode is selected, the device identity identifier is combined with the current clock value and then hashed to generate an idempotent key. ; Construct containing summary ,sign Meta-information and idempotent keys Standardized request messages; The request message is sent to the server through a secure transmission channel, and the corresponding task in the offline queue is marked as submitted to prevent duplicate sending.

[0010] As a preferred embodiment of the tamper-proof end-to-end business data notarization method described in this invention, the server identifies the uniqueness of the request through an idempotent key. After verifying the device identity and signature validity, the server simultaneously submits the digest to the blockchain system and a trusted timestamp institution to obtain on-chain transaction credentials and timestamp tokens, and performs consistency verification on the time information contained in both. Specifically: After receiving the request message, the server queries the processed record database to determine if a duplicate idempotent key exists. If the historical records exist, the original response is returned directly to achieve idempotency. If no duplicate records are found, the device identity is parsed to obtain the corresponding public key, which is then used to sign the document. Verify that it was generated by a legitimate device; After verification, the abstract will be sent. The data is submitted in parallel to the blockchain gateway module and the trusted timestamp client module. The blockchain gateway will summarize Packaged into a new block, obtaining on-chain transaction credentials. and block generation time ; Trusted timestamp clients will digest Submit to an authoritative timestamping authority and receive timestamped tokens. and the authoritative time included therein ; Calculate the time difference Its expression is: ; like If the time exceeds the preset threshold, the two channels are determined to be inconsistent, and the request is marked as abnormal.

[0011] As a preferred embodiment of the tamper-proof end-to-end business data evidence preservation method of the present invention, the method involves: after confirming the consistency of the dual-channel anchoring results, the server generates a fusion receipt, signs it, and returns it to the terminal. After verifying the authenticity of the receipt, the terminal signs the receipt content again and updates the local record status to valid, forming a complete evidence preservation closed loop. Specifically: When the server determines the time difference Within permissible limits, the dual-channel anchoring is considered successful, and the transaction certificates are integrated. Timestamp token Block time and authoritative time Generate fusion receipt ; The server uses its private key to process the fusion receipt. Perform signing and generate a server-side signature. and will and Return to the terminal together; After receiving the receipt, the terminal uses the pre-set server public key to verify the signature. The effectiveness; After successful verification, the terminal invokes the hardware security module and uses the device private key to verify the fusion receipt. Sign again to generate the final device signature. ; Update the status of the corresponding record in the local log to valid, thus completing end-to-end two-way authentication.

[0012] As a preferred embodiment of the tamper-proof end-to-end business data notarization method of the present invention, the step of generating an electronic certificate conforming to the verifiable credential standard based on all signatures, anchor evidence, and status information, and outputting it as a scannable and recognizable credential image after encoding, supports third parties to complete multi-signature verification and status verification under offline conditions, specifically: Integrated Summary First signature on the device side Final device signature Server-side signature Transaction vouchers Timestamp token And certificate status, to build a verifiable credential structure that conforms to international standards; Introducing an integrity protection mechanism to calculate the overall summary of the voucher. Its expression is: ; in, Indicates data concatenation; The verifiable credential is subjected to compact encoding and compression to generate a binary data stream; Convert the data stream into a QR code image and output it; After a third-party verification device scans the code, it can independently parse the credential content and verify it using the device and service public keys obtained from public channels. , , The validity of the data is verified through local caching or light nodes. and To verify authenticity and enable offline self-verification.

[0013] Secondly, the present invention provides an tamper-resistant end-to-end business data evidence storage system, comprising: Initialization module, input construction module, digest signature module, request submission module, dual-channel anchoring module, receipt closed-loop module, and voucher generation module; The initialization module is used to generate a device key pair, register a decentralized identity, obtain a monotonic clock, and create an increment-only log environment when the terminal is started. The input construction module is used to construct structured input content by combining current data, metadata, device identity, clock, data template and preceding summary when collecting business data. The digest signature module is used to perform hash operations on the structured input content to generate a digest, call the hardware security module to generate a device-side digital signature with the device private key, and write the digest, signature and related information into the local log and offline queue. The request submission module is used to generate an idempotent key based on a digest or device identity and clock combination after network recovery, construct and send a certificate storage request message, and mark the task as submitted. The dual-channel anchoring module is used to submit the digest to the blockchain and the trusted timestamp institution simultaneously after the server verifies the signature, obtain the transaction certificate and timestamp token, and verify the time consistency of the two. The receipt closed-loop module is used by the server to generate a fused receipt, sign it and return it, and after the terminal verifies it, it signs the receipt again and updates the local record status to be valid, thus completing two-way authentication. The certificate generation module is used to integrate all signatures, anchor evidence and status information to generate verifiable certificates, calculate the overall certificate summary to ensure integrity, and output the encoded image as a scannable image that supports offline self-verification.

[0014] Thirdly, the present invention provides a computer device including a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, it implements any step of the tamper-resistant end-to-end business data evidence storage method as described in the first aspect of the present invention.

[0015] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the tamper-resistant end-to-end business data evidence preservation method as described in the first aspect of the present invention.

[0016] The beneficial effects of this invention are as follows: By constructing a chained input based on the pre-sequence digest on the terminal side and combining it with a hardware security module, the source data is protected against tampering. A dual-channel heterogeneous anchoring mechanism is used to synchronously upload the data digest to the chain and obtain a trusted timestamp. By verifying the consistency of the two times, the credibility and non-repudiation of the evidence storage result are enhanced. Verifiable credentials that support offline verification are generated. This solves the problems of traditional evidence storage systems being easily tampered with in offline environments, having a single source of trust, and relying on the server for verification. It realizes end-to-end traceability, high tamper resistance, and self-verifiable business data evidence storage, improving the security, integrity, and judicial effectiveness of data evidence storage. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of the tamper-resistant end-to-end business data evidence preservation method in Example 1.

[0019] Figure 2 This is a schematic diagram of the tamper-resistant end-to-end business data storage system in Example 1. Detailed Implementation

[0020] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0021] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0022] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0023] Example, refer to Figure 1 and Figure 2 This embodiment of the invention provides a tamper-resistant end-to-end business data notarization method, comprising the following steps: S1. Initialize the hardware security module and monotonically increasing clock in the terminal device, establish a unique device identity, and prepare a log environment for recording business data. Furthermore, during the startup process of the terminal device, the trusted execution environment calls the hardware security module to generate a device-specific asymmetric key pair. The private key is permanently stored inside the security chip and cannot be exported. The public key is registered as a decentralized identity identifier after being issued by a certificate authority, forming a globally unique device identity credential. The continuously increasing time value is obtained through the high-precision monotonic clock interface provided by the operating system to ensure that the clock is not affected by the system time adjustment. A log storage area based on file system-level write protection is created, access control policies are configured to prohibit any read and write operations except for specified processes, and a fixed-size storage space is pre-allocated to prevent log overflow from causing data loss, thus completing the trusted initialization of the evidence storage environment. It should be noted that the trusted execution environment and hardware security module together constitute the root of trust of the terminal, ensuring that the key generation and storage process is not interfered with by malicious programs at the operating system level. The established unique device identity and monotonically increasing clock provide an auditable time sequence and source authentication basis for all subsequent data operations. The write protection mechanism of the log storage area prevents the evidence data from being tampered with or deleted locally, thereby ensuring the credibility and integrity of the starting point of the evidence chain.

[0024] S2. Collect current business data and its associated metadata, and combine it with device identity, clock value, data structure template and summary value generated from the previous business data to construct the input content for this data processing. Furthermore, during the startup process of the terminal device, the hardware security module is invoked to generate a device-specific asymmetric key pair. The private key is stored in a secure area and cannot be exported, while the public key is used to register a decentralized identity, forming a unique identity for the device throughout the entire system. The clock value is obtained through the operating system interface. This clock value increases continuously as the device runs and is not affected by manual time adjustments. Create a log file structure that only supports append-only writing, and set access permissions to prevent any process from modifying or deleting the file; When new business data is collected, the summary value generated from the previously successfully processed business data is read as a chained input parameter. The current business data, metadata, device identification, current clock value, data structure template, and previously generated summary value are combined into structured input content. It should be noted that by introducing the summary value generated by the previous business data as a component of the current input, a chain dependency structure is formed, so that any modification to any historical data will cause all subsequent summary values ​​to change, thereby achieving forward integrity protection of the data sequence. This design effectively prevents data insertion, deletion or replay attacks without relying on a centralized server.

[0025] S3. Perform a hash operation on the input content to generate a summary of the current business data. Use the hardware security module to sign the summary to form a device-side digital signature. Write the summary, signature and metadata into the increment-only log and offline queue. Furthermore, a cryptographic hash operation is performed on the constructed structured input to generate a fixed-length data digest; Define the abstract as The calculation method is as follows: ; in, This represents structured input content. It is a collision-resistant hash function; Invoke the hardware security module and use the device private key to digest. Perform digital signature calculations to generate a device-side digital signature. ; Summary ,sign The metadata, device identification, clock value, and data structure template are packaged into a complete record; The record is appended to the end of the log file (which only increments and never modifies) and simultaneously added to the local offline task queue. It should be noted that the generation and signing processes of the digest are both completed within the hardware security module. The private key is never exposed outside the secure area, ensuring the non-repudiation of the signing behavior. The append-writing mechanism of the log record and the separate management of the offline queue ensure that the data can still be completely retained and submitted in an orderly manner in the event of abnormal situations such as network interruption, thereby improving the robustness of the system in complex operating environments.

[0026] S4. After the terminal restores the network connection, generate a unique idempotent key based on the summary of the current business data or the combination of the device identity and the clock, and submit a notarization request containing the summary and signature to the server. Furthermore, the status of the communication link between the terminal and the remote server is checked to confirm that the network connection is available; Select the idempotent key generation method according to the system configuration policy; If you select the summary-based mode, then the summary will be used. As an idempotent key; If the time-based mode is selected, the device identity identifier is combined with the current clock value and then hashed to generate an idempotent key. ; Construct containing summary ,sign Meta-information and idempotent keys Standardized request messages; The request message is sent to the server through a secure transmission channel, and the corresponding task in the offline queue is marked as submitted to prevent duplicate sending. It should be noted that the dual-mode generation strategy of idempotent keys takes into account both high-precision deduplication and low-bandwidth adaptability. The digest-based mode is suitable for scenarios with extremely high uniqueness requirements, while the device identity and clock-based mode is suitable for resource-constrained or batch submission scenarios. Both mechanisms can effectively avoid duplicate evidence storage caused by network retries, ensuring the idempotency of server-side processing logic and data consistency.

[0027] S5. The server identifies the uniqueness of the request through idempotent keys. After verifying the device identity and the validity of the signature, it submits the digest to the blockchain system and the trusted timestamp institution at the same time to obtain the on-chain transaction certificate and timestamp token, and performs consistency verification on the time information contained in the two. Furthermore, after receiving the request message, the server queries the database of processed records to determine if a duplicate idempotent key exists. If the historical records exist, the original response is returned directly to achieve idempotency. If no duplicate records are found, the device identity is parsed to obtain the corresponding public key, which is then used to sign the document. Verify that it was generated by a legitimate device; After verification, the abstract will be sent. The data is submitted in parallel to the blockchain gateway module and the trusted timestamp client module. The blockchain gateway will summarize Packaged into a new block, obtaining on-chain transaction credentials. and block generation time ; Trusted timestamp clients will digest Submit to an authoritative timestamping authority and receive timestamped tokens. and the authoritative time included therein ; Calculate the time difference Its expression is: ; like If the preset threshold is exceeded, the time difference between the two channels is determined to be inconsistent, and the request is marked as abnormal. It should be noted that the dual-channel anchoring mechanism uses heterogeneous trusted sources to independently time-mark the same digest, and the verification of the time deviation between the two forms a cross-validation capability, which can effectively identify time forgery or delayed on-chain behavior in either channel, significantly enhancing the authority and anti-attack capability of the evidence of the storage time.

[0028] S6. After confirming that the dual-channel anchoring results are consistent, the server generates a fusion receipt, signs it, and returns it to the terminal. After the terminal verifies the authenticity of the receipt, it signs the receipt content again and updates the local record status to valid, forming a complete evidence storage closed loop. Furthermore, when the server determines the time difference... Within permissible limits, the dual-channel anchoring is considered successful, and the transaction certificates are integrated. Timestamp token Block time and authoritative time Generate fusion receipt ; The server uses its private key to process the fusion receipt. Perform signing and generate a server-side signature. and will and Return to the terminal together; After receiving the receipt, the terminal uses the pre-set server public key to verify the signature. The effectiveness; After successful verification, the terminal invokes the hardware security module and uses the device private key to verify the fusion receipt. Sign again to generate the final device signature. ; Update the status of the corresponding record in the local log to valid, and complete the end-to-end two-way authentication; It should be noted that the terminal's secondary signature on the server's response achieves a two-way authentication closed loop, which not only verifies the authenticity of the server's response, but also proves that the terminal has successfully received and recognized the anchoring result. The update of the local record status indicates that the business data has completed end-to-end notarization, providing a clear status basis for subsequent credential generation.

[0029] S7. Generate an electronic certificate that conforms to the verifiable credential standard based on all signatures, anchor evidence and status information. After encoding, output as a scannable and recognizable credential image, supporting third parties to complete multi-signature verification and status verification without network conditions. Furthermore, integrate the summary First signature on the device side Final device signature Server-side signature Transaction vouchers Timestamp token And certificate status, to build a verifiable credential structure that conforms to international standards; Introducing an integrity protection mechanism to calculate the overall summary of the voucher. Its expression is: ; in, Indicates data concatenation; The verifiable credential is subjected to compact encoding and compression to generate a binary data stream; Convert the data stream into a QR code image and output it; After a third-party verification device scans the code, it can independently parse the credential content and verify it using the device and service public keys obtained from public channels. , , The validity of the data is verified through local caching or light nodes. and To verify the authenticity of the information and enable offline self-verification; It should be noted that the verifiable credential integrates multi-party signatures and anchored evidence throughout the entire process. The calculation of its overall summary ensures the integrity of each field within the credential. The QR code output facilitates the connection between the physical world and digital evidence storage. The offline verification capability eliminates the dependence on specific platforms or network connections, enabling third parties to independently and in real time complete authenticity verification, greatly improving the usability and judicial credibility of the evidence storage results.

[0030] This embodiment also provides a tamper-resistant end-to-end business data evidence storage system, including: Initialization module, input construction module, digest signature module, request submission module, dual-channel anchoring module, receipt closed-loop module, and voucher generation module; The initialization module is used to generate device key pairs, register decentralized identities, obtain monotonic clocks, and create an increment-only log environment when the terminal starts. The input construction module is used to construct structured input content by combining current data, metadata, device identity, clock, data template and preceding summary when collecting business data. The digest and signature module is used to perform hash operations on the structured input content to generate a digest, call the hardware security module to generate a device-side digital signature with the device private key, and write the digest, signature and related information to the local log and offline queue. The request submission module is used to generate an idempotent key based on a digest or device identity and clock combination after network recovery, construct and send a certificate request message, and mark the task as submitted. The dual-channel anchoring module is used to submit the digest to the blockchain and the trusted timestamp institution simultaneously after the server verifies the signature, obtain the transaction certificate and timestamp token, and verify the consistency of the two times. The receipt closed-loop module is used by the server to generate a fused receipt, sign it and return it. After the terminal verifies it, it signs the receipt again and updates the local record status to be valid, thus completing two-way authentication. The credential generation module integrates all signatures, anchor evidence, and status information to generate verifiable credentials, calculates the overall credential summary to ensure integrity, and outputs a scannable image after encoding, supporting offline self-verification.

[0031] This embodiment also provides a computer device applicable to the tamper-resistant end-to-end business data evidence storage method, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the tamper-resistant end-to-end business data evidence storage method proposed in the above embodiment.

[0032] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0033] This embodiment also provides a storage medium storing a computer program thereon. When executed by a processor, the program implements the tamper-resistant end-to-end business data evidence storage method proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0034] In summary, this invention achieves source data tamper-proofing by constructing a chained input based on a pre-sequence digest on the terminal side and combining it with a hardware security module. It utilizes a dual-channel heterogeneous anchoring mechanism to synchronously upload the data digest to the blockchain and obtain a trusted timestamp. By verifying the consistency of the timestamps, the credibility and non-repudiation of the evidence storage results are enhanced. Verifiable credentials that support offline verification are generated. This solves the problems of traditional evidence storage systems, such as susceptibility to tampering in offline environments, single trust, and server-side reliance for verification. It achieves end-to-end traceability, high tamper resistance, and self-verifiable business data evidence storage, improving the security, integrity, and judicial effectiveness of data evidence storage.

[0035] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A tamper-resistant end-to-end business data evidence storage method, characterized in that: include: Initialize the hardware security module and monotonically increasing clock in the terminal device, establish a unique device identifier, and prepare a log environment for recording business data; Collect current business data and its associated metadata, and combine it with device identity, clock value, data structure template, and summary value generated from the previous business data to construct the input content for this data processing. The input content is hashed to generate a summary of the current business data. The summary is then signed using the hardware security module to form a device-side digital signature. The summary, signature, and metadata are then written to the increment-only log and the offline queue. After the terminal restores its network connection, a unique idempotent key is generated based on the summary of the current business data or the combination of the device identity and the clock, and a notarization request containing the summary and signature is submitted to the server. The server identifies the uniqueness of a request through an idempotent key. After verifying the device identity and the validity of the signature, it submits the digest to both the blockchain system and a trusted timestamp institution to obtain on-chain transaction credentials and timestamp tokens, and performs consistency verification on the time information contained in both. After confirming that the dual-channel anchoring results are consistent, the server generates a fusion receipt, signs it, and returns it to the terminal. After the terminal verifies the authenticity of the receipt, it signs the receipt content again and updates the local record status to valid, thus forming a complete evidence storage loop. Based on all signatures, anchor evidence, and status information, an electronic certificate conforming to the verifiable credential standard is generated. After encoding, it is output as a scannable and recognizable credential image, supporting third parties to complete multi-signature verification and status verification even without a network connection.

2. The tamper-resistant end-to-end business data evidence preservation method as described in claim 1, characterized in that: The process involves collecting current business data and its associated metadata, combining this data with device identity, clock value, data structure template, and the summary value generated from the previous business data, to construct the input content for this data processing. The specific steps are as follows: During the startup process of the terminal device, the hardware security module is invoked to generate a device-specific asymmetric key pair. The private key is stored in a secure area and cannot be exported, while the public key is used to register a decentralized identity, forming a unique identity for the device in the entire system. The clock value is obtained through the operating system interface. This clock value increases continuously as the device runs and is not affected by manual time adjustments. Create a log file structure that only supports append-only writing, and set access permissions to prevent any process from modifying or deleting the file; When new business data is collected, the summary value generated from the previously successfully processed business data is read as a chained input parameter. The current business data, metadata, device identification, current clock value, data structure template, and previously generated summary value are combined into structured input content.

3. The tamper-resistant end-to-end business data evidence preservation method as described in claim 2, characterized in that: The process involves hashing the input content to generate a digest of the current business data, signing the digest using a hardware security module to form a device-side digital signature, and then writing the digest, signature, and metadata into a non-modifiable log and an offline queue. Specifically: Perform cryptographic hashing on the constructed structured input to generate a fixed-length data digest; Define the abstract as The calculation method is as follows: ； in, This represents structured input content. It is a collision-resistant hash function; Invoke the hardware security module and use the device private key to digest. Perform digital signature calculations to generate a device-side digital signature. ; Summary ,sign The metadata, device identification, clock value, and data structure template are packaged into a complete record; The record is appended to the end of the log file (which only increments and does not modify) and simultaneously added to the local offline task queue.

4. The tamper-resistant end-to-end business data evidence preservation method as described in claim 3, characterized in that: After the terminal restores its network connection, a unique idempotent key is generated based on the summary of the current service data or the combination of the device identity and the clock. A notarization request containing the summary and signature is then submitted to the server. Specifically: Detect the status of the communication link between the terminal and the remote server to confirm that the network connection is available; Select the idempotent key generation method according to the system configuration policy; If you select the summary-based mode, then the summary will be used. As an idempotent key; If the time-based mode is selected, the device identity identifier is combined with the current clock value and then hashed to generate an idempotent key. ; Construct containing summary ,sign Meta-information and idempotent keys Standardized request messages; The request message is sent to the server through a secure transmission channel, and the corresponding task in the offline queue is marked as submitted to prevent duplicate sending.

5. The tamper-resistant end-to-end business data evidence preservation method as described in claim 4, characterized in that: The server identifies the uniqueness of requests using idempotent keys. After verifying the device identity and signature validity, it simultaneously submits the digest to both the blockchain system and a trusted timestamp institution to obtain on-chain transaction credentials and timestamp tokens. It then performs consistency verification on the time information contained in both, specifically: After receiving the request message, the server queries the processed record database to determine if a duplicate idempotent key exists. If the historical records exist, the original response is returned directly to achieve idempotency. If no duplicate records are found, the device identity is parsed to obtain the corresponding public key, which is then used to sign the document. Verify that it was generated by a legitimate device; After verification, the abstract will be sent. The data is submitted in parallel to the blockchain gateway module and the trusted timestamp client module. The blockchain gateway will summarize Packaged into a new block, obtaining on-chain transaction credentials. and block generation time ; Trusted timestamp clients will digest Submit to an authoritative timestamping authority and receive timestamped tokens. and the authoritative time included therein ; Calculate the time difference Its expression is: ； like If the time exceeds the preset threshold, the two channels are determined to be inconsistent, and the request is marked as abnormal.

6. The tamper-resistant end-to-end business data evidence preservation method as described in claim 5, characterized in that: After confirming the consistency of the dual-channel anchoring results, the server generates a fusion receipt, signs it, and returns it to the terminal. The terminal verifies the authenticity of the receipt, signs the receipt content again, and updates the local record status to valid, forming a complete evidence storage loop. Specifically: When the server determines the time difference Within permissible limits, the dual-channel anchoring is considered successful, and the transaction certificates are integrated. Timestamp token Block time and authoritative time Generate fusion receipt ; The server uses its private key to process the fusion receipt. Perform signing and generate a server-side signature. and will and Return to the terminal together; After receiving the receipt, the terminal uses the pre-set server public key to verify the signature. Validity; After successful verification, the terminal invokes the hardware security module and uses the device private key to verify the fusion receipt. Sign again to generate the final device signature. ; Update the status of the corresponding record in the local log to valid, thus completing end-to-end two-way authentication.

7. The tamper-resistant end-to-end business data evidence preservation method as described in claim 6, characterized in that: The process involves generating an electronic certificate that conforms to the verifiable credential standard based on all signatures, anchor evidence, and status information. After encoding, the certificate is output as a scannable and recognizable credential image, enabling third parties to complete multi-signature verification and status verification even without a network connection. Specifically: Integrated Summary First signature on the device side Final device signature Server-side signature Transaction vouchers Timestamp token And certificate status, to build a verifiable credential structure that conforms to international standards; Introducing an integrity protection mechanism to calculate the overall summary of the voucher. Its expression is: ； in, Indicates data concatenation; The verifiable credential is subjected to compact encoding and compression to generate a binary data stream; Convert the data stream into a QR code image and output it; After a third-party verification device scans the code, it can independently parse the credential content and verify it using the device and service public keys obtained from public channels. , , The validity of the data is verified through local caching or light nodes. and To verify authenticity and enable offline self-verification.

8. A tamper-resistant end-to-end business data evidence storage system, based on the tamper-resistant end-to-end business data evidence storage method according to any one of claims 1 to 7, characterized in that: include: Initialization module, input construction module, digest signature module, request submission module, dual-channel anchoring module, receipt closed-loop module, and voucher generation module; The initialization module is used to generate a device key pair, register a decentralized identity, obtain a monotonic clock, and create an increment-only log environment when the terminal is started. The input construction module is used to construct structured input content by combining current data, metadata, device identity, clock, data template and preceding summary when collecting business data. The digest signature module is used to perform hash operations on the structured input content to generate a digest, call the hardware security module to generate a device-side digital signature with the device private key, and write the digest, signature and related information into the local log and offline queue. The request submission module is used to generate an idempotent key based on a digest or device identity and clock combination after network recovery, construct and send a certificate storage request message, and mark the task as submitted. The dual-channel anchoring module is used to submit the digest to the blockchain and the trusted timestamp institution simultaneously after the server verifies the signature, obtain the transaction certificate and timestamp token, and verify the time consistency of the two. The receipt closed-loop module is used by the server to generate a fused receipt, sign it and return it, and after the terminal verifies it, it signs the receipt again and updates the local record status to be valid, thus completing two-way authentication. The certificate generation module is used to integrate all signatures, anchor evidence and status information to generate verifiable certificates, calculate the overall certificate summary to ensure integrity, and output the encoded image as a scannable image that supports offline self-verification.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the tamper-resistant end-to-end business data storage method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the tamper-resistant end-to-end business data storage method according to any one of claims 1 to 7.

Images