A method and device for realizing data integrity protection by dividing data into blocks

Abstract

The present invention provides a method and device for implementing data integrity protection for data blocks, including: dividing the data to be sent into multiple data blocks, calculating the hash value of each data block, and storing it in the corresponding data field of each data block; dispersing and storing the multiple data blocks in storage sites; obtaining multiple data blocks from the storage sites, calculating the hash value of each data block, and performing integrity verification on the data of each data block; after the verification is completed, sending the information data in the multiple data blocks to the user site. The integrity protection of the data is achieved by linking the hash values ​​of the data blocks forward and backward.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method and device for implementing data integrity protection for data blocks. Background Art

[0002] A hash function is a transformation algorithm that transforms an input of arbitrary length into an output of fixed length. Its output is the hash value. The hash value is a common method to implement data integrity protection. Data integrity protection is used to protect the integrity of data during storage and transmission to prevent illegal entities from modifying the data or data from being damaged during storage or transmission.

[0003] The sender calculates the hash value of the data to be protected according to a predetermined hash algorithm. After receiving the data, the receiver calculates the hash value of the data using the same hash algorithm and compares it with the hash value calculated by the sender to determine whether the received data has been modified.

[0004] In network data transmission, the receiving end cannot know the hash value of the data in advance, but must obtain the hash value from the sending end through data transmission. Therefore, hackers in the network can deceive the receiving end by modifying the transmitted data and the hash value of the data at the same time.

[0005] In the data transmission and storage of the network, a large data can be divided into a group of data blocks for storage and transmission respectively. For each data block, the data integrity can be protected by calculating the hash value of the block. Since this method of one block and one hash value is vulnerable to attacks by illegal entities in network data transmission, the present invention proposes a method for a group of data blocks by establishing a hash value link between blocks to achieve the integrity protection of the entire data. Summary of the invention

[0006] In view of this, the present invention provides a method and device for realizing data integrity protection for data blocks. By establishing forward and backward links for the hash values ​​of multiple data blocks, the hash check is performed on multiple data blocks instead of a single data block, thereby greatly improving the reliability of the data integrity check. At the same time, by acquiring data at a storage site at the edge of the network and sending it to users, the data transmission delay is greatly reduced.

[0007] The present invention provides a method for implementing data integrity protection for data blocks, comprising:

[0008] Divide the data to be sent into multiple data blocks; calculate the hash value of each data block and store it in the corresponding data field of each data block; each data block contains not only the hash value of the block itself, but also the hash values ​​of adjacent data blocks;

[0009] Further, the data block includes a data part and an additional part;

[0010] The data part is the information data that needs to be transmitted in data blocks;

[0011] The additional part is the non-information data part in the data block, which is used to assist the data block in transmitting information data.

[0012] Optionally, the additional part includes: a block header and / or a block footer, etc.

[0013] The additional part includes a sequence identifier of the data blocks, and the sequence identifiers of the multiple data blocks divided from the same data are continuous;

[0014] Furthermore, two data fields are set in the additional part of the data block: a "current block hash value" field and a "previous block hash value" field.

[0015] The adjacent data blocks include:

[0016] Data blocks with similar sequence numbers in the data block sequence identifier are adjacent data blocks;

[0017] The first data block and the last data block are adjacent data blocks.

[0018] Distribute and store the multiple data blocks in each storage site;

[0019] Optionally, the storage site is a group of network sites at the edge of the network close to the user site;

[0020] The calculation of the hash value of each data block and storing it in the corresponding data field of each data block includes:

[0021] (1) For the last data block, a hash value is calculated using a hash algorithm for the portion of the block except for the "previous block hash value" field and the "current block hash value" field, and the calculated hash value is filled into the "current block hash value" field of the last data block and the "previous block hash value" field of the first data block;

[0022] (2) Starting from the first data block to the second to last data block, calculate the hash value of the part of the data block except the "Hash value of this block" field, fill the calculated hash value into the "Hash value of this block" field of the block to which it belongs, and fill it into the "Hash value of the previous block" field of the next data block to which it belongs.

[0023] Obtain data blocks from the storage site and perform integrity verification;

[0024] The data integrity check comprises:

[0025] Calculate the hash value of each data block and determine whether the data integrity of the current data block group is damaged;

[0026] Specifically,

[0027] (1) Starting from the first data block to the second to last data block, the hash value is calculated for the part except the "Hash value of this block" field, and the calculated hash value of this block is compared with the data in the "Hash value of this block" field. If they are different, it is determined that the data integrity of the current data block has been damaged. If they are the same, further verification is performed;

[0028] The further verification is to compare the calculated hash value of the current block with the value of the "previous block hash value" field of the next block. If they are different, it is determined that the data integrity of the current data block has been damaged. If they are the same, the next data block is verified;

[0029] (2) For the last data block, a hash value is calculated for the portion other than the "previous block hash value" field and the "current block hash value" field, and the calculated hash value of the last data block is compared with the data in the "current block hash value" field. If they are different, it is determined that the data integrity of the last data block has been compromised. If they are the same, the calculated hash value of the last data block is compared with the value of the "previous block hash value" field of the first block. If they are different, it is determined that the data integrity of the current data block has been compromised. If they are the same, it is determined that the data of the current data block is complete.

[0030] When the data integrity check of the last data block is completed, the data integrity check of the entire data block group is completed;

[0031] After verification is completed, the information data in multiple data blocks is sent to the user site.

[0032] A device for implementing data integrity protection for data blocks, comprising:

[0033] The sending module is used to divide the data to be sent into multiple data blocks, and store the multiple data blocks in the storage module in a dispersed manner;

[0034] The sending module is further used to calculate the hash value of each data block and store the hash value of the data block in the corresponding data field of each data block;

[0035] Furthermore, the sending module includes:

[0036] A configuration unit, configured to configure an additional part for the data block, wherein the additional part is used to assist the data block in data transmission;

[0037] The configuration unit is further used to set two data fields in the additional part of each data block: a "current block hash value" field and a "previous block hash value" field;

[0038] A processing unit, used for calculating a hash value of each data block and storing the hash value in a corresponding data field of each data block;

[0039] The processing unit is used to calculate the hash value of the last data block, calculate the hash value of the part of the last data block except the "previous block hash value" field and the "current block hash value" field by using a hash algorithm, and then fill the calculated hash value into the "current block hash value" field of the last data block and the "previous block hash value" field of the first data block;

[0040] The processing unit is also used to calculate the hash values ​​of all data blocks except the last data block, including: starting from the first data block to the second to last data block, calculating the hash value of the part of the data block except the "current block hash value" field, filling the calculated hash value into the "current block hash value" field of the block, and filling it into the "previous block hash value" field of the next data block of the block.

[0041] A storage module, which is a group of network sites near the network edge of the receiving module, and is used to receive and store the data block groups;

[0042] The storage module is also used to send the data blocks to the data calling module when the receiving module requests to obtain the data of the data block group;

[0043] A data calling module is used to obtain the data block data from the storage module and perform integrity verification;

[0044] The receiving module is used to receive the information data sent by the data calling module.

[0045] The data calling module comprises:

[0046] A calculation unit, used to calculate the hash value of each data block;

[0047] The calculation unit calculates the hash value of the portion except the "hash value of this block" field from the first data block to the second to last data block;

[0048] The calculation unit calculates the hash value of the part other than the "previous block hash value" field and the "current block hash value" field for the last data block.

[0049] A determination unit, used to determine whether the data integrity of the current data block group is damaged;

[0050] The determination unit compares the hash value of the current block obtained by the calculation unit with the data in the "hash value of the current block" field for the data blocks other than the last data block. If they are different, it is determined that the data integrity of the current data block has been damaged. If they are the same, further verification is performed;

[0051] The further verification is to compare the calculated hash value of the current block with the value of the "previous block hash value" field of the next block. If they are different, it is determined that the data integrity of the current data block has been damaged. If they are the same, it is determined that the data of the current data block is complete and the next data block is verified.

[0052] The determination unit compares the last data block hash value obtained by the calculation unit with the data in the "current block hash value" field for the last data block. If they are different, it is determined that the data integrity of the current data block has been damaged. If they are the same, the determination unit compares the last data block hash value calculated with the value in the "previous block hash value" field of the first block. If they are different, it is determined that the data integrity of the current data block has been damaged. If they are the same, it is determined that the data of the current data block is complete.

[0053] The present invention divides a large data into data block groups, transmits the data blocks to several storage sites, and realizes integrity protection of the entire data by linking the hash values ​​between the data blocks, effectively avoiding the method of one block and one hash value in network data transmission being vulnerable to attacks by illegal entities, making data transmission safe and reliable; at the same time, through the decentralized storage of data, the wireless base station or LAN gateway can quickly call these data blocks and send them to users, reducing transmission delay.

[0054] For the above and related purposes, one or more embodiments include features that will be described in detail below and particularly pointed out in the claims. The following description and the accompanying drawings describe certain exemplary aspects in detail, and are indicative of only some of the various ways in which the principles of the various embodiments may be employed. Other benefits and novel features will become apparent as the following detailed description is considered in conjunction with the accompanying drawings, and the disclosed embodiments are intended to include all such aspects and their equivalents. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 It is a flow chart of a method for implementing data integrity protection by data segmentation provided by the present invention;

[0056] Figure 2 It is a schematic diagram of the flow of calculating the hash value of data blocks at the source site provided by the present invention;

[0057] Figure 3 It is a flow chart of a method for obtaining data block data from each storage site for integrity verification provided by the present invention;

[0058] Figure 4 The present invention provides a device composition diagram for implementing data integrity protection for data blocks. DETAILED DESCRIPTION

[0059] The following description and the accompanying drawings fully illustrate specific embodiments of the present invention so that those skilled in the art can practice them. Other embodiments may include structural, logical, electrical, process and other changes. The examples represent possible changes only. Unless explicitly required, separate components and functions are optional, and the order of operation may vary. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. The scope of the embodiments of the present invention includes the entire scope of the claims, and all available equivalents of the claims. In this article, these embodiments of the present invention may be represented individually or collectively by the term "invention", which is only for convenience, and if more than one invention is actually disclosed, it is not intended to automatically limit the scope of the application to any single invention or inventive concept.

[0060] On the Internet, the source site stores user application data. When the user site needs to obtain application data, it sends a request to the data source site to obtain the corresponding data. This data call method, on the one hand, will cause repeated transmission of user application data on the Internet, thereby reducing the transmission efficiency of network data. On the other hand, it will also cause delays in data transmission, reducing the user's service experience. When the data called by the user site is large in volume, such as video data, the above shortcomings will be more obvious.

[0061] To this end, a group of storage sites are set up in the network edge area close to the user site, and the popular data in the network is stored in these sites. When the user site requests this data, the wireless base station or LAN gateway calls the data nearby, and the delay for users to obtain this data is greatly reduced. In addition to configuring a dedicated storage site, a group of wireless base stations or LAN gateways that are close in location can also be set as the above storage sites;

[0062] When the popular data in the network is a large amount of data, it is divided into several data blocks and stored in each of the above-mentioned storage sites for the wireless base station or LAN gateway to call nearby. In order to prevent hackers in the network from damaging the data blocks, such as inserting Trojans in them, data integrity protection is required for these data blocks.

[0063] The present invention provides a method for protecting data integrity by segmenting data. Figure 1 As shown, including:

[0064] S101. Divide the data to be sent into multiple data blocks, calculate the hash value of each data block, and store it in the corresponding data field of each data block.

[0065] Specifically, the data to be sent is divided into a plurality of data blocks, and additional parts are configured for the data blocks;

[0066] The additional part is a non-information data part in the data block, and the additional part is used to assist the data block in performing information data transmission;

[0067] Optionally, the additional part includes a block header and / or a block tail of the data block.

[0068] Furthermore, two data fields are set in the additional part of each data block: a "current block hash value" field and a "previous block hash value" field;

[0069] Calculate the hash value of each data block and store it in the corresponding data field of each data block;

[0070] Furthermore, the additional part includes a data block sequence identifier; the additional part of the last data block includes a specific identifier, and the specific identifier is used to mark it as the last data block;

[0071] The adjacent data blocks include:

[0072] Data blocks with similar sequence numbers in the data block sequence identifier are adjacent data blocks;

[0073] The first data block and the last data block are adjacent data blocks.

[0074] Calculate the values ​​of the "this block hash value" field and the "previous block hash value" field of each block as follows: Figure 2 As shown, including:

[0075] S101a. For the last data block, a hash value is calculated using a hash algorithm for the part except the "previous block hash value" field and the "current block hash value" field, and then the calculated hash value is filled into the "current block hash value" field of the block and into the "previous block hash value" field of the first data block.

[0076] S101b. Starting from the first data block, for all data blocks except the last data block, calculate the hash value of the part of the data block except the "Hash value of this block" field, fill the calculated hash value into the "Hash value of this block" field of the block to which it belongs, and fill it into the "Hash value of the previous block" field of the next data block to which it belongs.

[0077] S102. Distribute and store the plurality of data blocks in various storage sites; the storage sites are a group of network sites at the edge of the network close to the user site;

[0078] A group of storage sites are set up near the user site to store popular data frequently requested by users in the network, which are referred to as edge storage sites in the present invention; the source site blocks the data and stores multiple data blocks in a group of edge storage sites.

[0079] S103. Obtain data blocks from each storage site and perform integrity check;

[0080] like Figure 3 As shown, the specific steps are as follows:

[0081] S103a. The user site sends a data request, and the site that calls the data finds that the requested data is stored in the storage site in the form of data block groups. The site that calls the data sends a data request to the storage site.

[0082] S103b. The storage site sends the corresponding data blocks to the site that calls the data.

[0083] S103c. The site that calls the data obtains the data blocks from the storage sites and performs integrity verification.

[0084] Specifically, the hash value of each data block is calculated according to the following steps, and it is determined whether the data integrity of the current data block is damaged;

[0085] (1) Starting from the first data block to the second to last data block, the hash value is calculated for the part except the "Hash value of this block" field, and the calculated hash value of this block is compared with the data in the "Hash value of this block" field. If they are different, it is determined that the data integrity of the current data block has been damaged and the verification is terminated; if they are the same, further verification is performed;

[0086] The further verification is to compare the calculated hash value of the current block with the value of the "previous block hash value" field of the next data block. If they are different, it is determined that the data integrity of the current data block has been damaged and the verification is skipped; if they are the same, the verification of the next data block is performed;

[0087] This process continues until the data integrity check of the second-to-last block is completed.

[0088] (2) For the last data block, a hash value is calculated for the part except the "previous block hash value" field and the "current block hash value" field, and the calculated hash value of the last data block is compared with the data in the "current block hash value" field. If they are different, it is determined that the data integrity of the current data block has been damaged and the verification is exited. If they are the same, the calculated hash value of the last data block is compared with the value of the "previous block hash value" field of the first block. If they are different, it is determined that the data integrity of the current data block has been damaged and the verification is exited. If they are the same, it is determined that the data of the current data block is complete.

[0089] S104. After the verification is completed, the site that calls the data sends the information data in the data block to the user site.

[0090] Embodiment 1

[0091] In network communication, a group of user sites that are close in location are controlled by the same upper-level central site, and they all communicate with sites in the Internet via the upper-level central site. When the user site is located in an Ethernet network, the upper-level central site is an Ethernet gateway, and when the user site is located in a wireless network (such as a mobile communication network, a wireless local area network), the upper-level central site is a wireless base station. When a user site requests data from a remote site via the upper-level central site, if the upper-level central site finds that the requested data is stored in an edge storage site, the central site can directly call the data in the edge storage site and send the data to the user site.

[0092] This embodiment considers the case where the user station is in a wireless network, and the station that calls data is a wireless base station. For the case where the user station is in a wired network, the implementation process of the method proposed in the present invention can be similarly deduced.

[0093] S201. The source site divides the data to be sent into multiple data blocks, and configures an additional part for the data blocks; the data block includes a data part and an additional part; the data part is the information data to be transmitted by the block;

[0094] The additional part is a non-information data part in the data block, and the additional part is used to assist the data block in performing information data transmission;

[0095] Optionally, the additional part includes a block header and / or a block footer of the data block;

[0096] Furthermore, the source site sets two data fields in the additional part of each data block: a "current block hash value" field and a "previous block hash value" field;

[0097] Further, the hash value of each data block is calculated and stored in the corresponding data field of each data block;

[0098] It should be noted that the calculation of the hash value of this block is not only for the data part of this block, but also includes the additional part; each data block contains not only the hash value of this block, but also the hash value of the adjacent data blocks;

[0099] Furthermore, the block header includes a data block sequence identifier; the sequence identifiers of the multiple data blocks divided from the same data are continuous;

[0100] The adjacent data blocks include:

[0101] Data blocks with similar sequence numbers in the data block sequence identifier are adjacent data blocks;

[0102] It should be noted that the first data block and the last data block are adjacent data blocks; the adjacent data blocks of the first data block are the last data block and the second data block; similarly, the adjacent data blocks of the last data block are the second to last data block and the first data block.

[0103] Specifically, the source site calculates the values ​​of the "this block hash value" field and the "previous block hash value" field of each block as follows: Figure 2 As shown, including:

[0104] S201a. For the last data block, the hash value is calculated by the hash algorithm for the part except the "previous block hash value" field and the "current block hash value" field, and then the calculated hash value is filled into the "current block hash value" field of the block and into the "previous block hash value" field of the first data block.

[0105] S201b. Starting from the first data block, for all data blocks except the last data block, calculate the hash value of the part of the data block except the "Hash value of this block" field, fill the calculated hash value into the "Hash value of this block" field of the block to which it belongs, and fill it into the "Hash value of the previous block" field of the next data block to which it belongs.

[0106] Specifically, starting from the first data block, a hash value is calculated for the portion of the first data block except the "current block hash value" field using a hash algorithm, and then the calculated hash value is filled into the "current block hash value" field of the first data block, and into the "previous block hash value" field of the second data block;

[0107] For the second data block, a hash value is calculated by a hash algorithm for the portion other than the "Hash value of this block" field, wherein the portion other than the "Hash value of this block" field includes a "Hash value of the previous block" field that has been filled with a numerical value, that is, the hash value of the first data block, so that the "Hash value of this block" field of the second data block contains the hash value of the first data block; the calculated hash value of the second data block is filled into the "Hash value of this block" field of the second data block, and into the "Hash value of the previous block" field of the third data block;

[0108] It should be noted that this calculation method continues until the second to last block.

[0109] In this way, by linking the hash values ​​forward and backward, it is possible to effectively prevent network hackers from tampering with or adding data to one or more data blocks without being discovered. At the same time, it is also difficult for the edge storage site itself to tamper with or add data to the stored block data. For example, if a network hacker modifies the data of a block by recalculating the block hash value, but because the hash value of this block is also stored in the next block, the value of the "previous block hash value" field in the next block must be modified to make the modification undetected, but modifying the value of the "previous block hash value" field in the next block will cause the value of the "current block hash value" field in the next block to be recalculated. Similarly, it will be equally difficult for an edge storage site that stores a block to modify the data of the stored block.

[0110] It can be seen that by linking the hash values ​​of data blocks, the integrity of the entire data can be protected as a whole. When the data blocks are stored and transmitted in a decentralized manner, it can effectively prevent criminals from modifying the data.

[0111] S202. Distribute and store the plurality of data blocks in various storage sites; the storage sites are a group of network sites at the edge of the network close to the user site;

[0112] For wireless communication systems, a group of storage sites are set up near wireless base stations to store popular data frequently requested by users in the network. This group of storage sites provides storage services to wireless base stations. Optionally, the wireless base stations themselves can also serve as such storage sites. Since these storage sites are close to the edge of the network, they are referred to as edge storage sites in the present invention. In this way, when a user site requests hot data from a wireless base station, the wireless base station does not need to request the data from the source site of the data, but obtains the data from a group of neighboring edge storage sites, which greatly reduces the delay of data transmission. The source site divides the data into blocks and stores them in a group of edge storage sites for a group of neighboring wireless base stations to call.

[0113] S203. The wireless base station obtains the data block data from the edge storage site and performs integrity check; specifically,

[0114] S203a user site sends a data request to the wireless base station, the wireless base station finds that the requested data is stored in the adjacent edge storage site in the form of data block groups, the wireless base station sends a data request to the edge storage site;

[0115] A typical situation where this happens is: the user site requests a large amount of data on a popular site;

[0116] S203b. The edge storage site sends the corresponding data blocks to the wireless base station.

[0117] S203c. The wireless base station performs a data integrity check on the data blocks obtained from the edge storage site.

[0118] After receiving all the data blocks, the wireless base station performs data integrity check on them; specifically, the hash value of each data block is calculated according to the following steps, and it is determined whether the data integrity of the current data block group is damaged;

[0119] (1) Starting from the first data block to the second to last data block, the wireless base station calculates the hash value for the part except the "Hash value of this block" field, and compares the calculated hash value of this block with the data in the "Hash value of this block" field. If they are different, it is determined that the data integrity of the current data block has been damaged and the verification is terminated; if they are the same, further verification is performed;

[0120] The further verification is to compare the calculated hash value of the current block with the value of the "previous block hash value" field of the next data block. If they are different, it is determined that the data integrity of the current data block has been damaged and the verification is skipped; if they are the same, the verification of the next data block is performed;

[0121] This process continues until the data integrity check of the second-to-last block is completed.

[0122] (2) For the last data block, the wireless base station calculates the hash value for the part except the "previous block hash value" field and the "current block hash value" field, and compares the calculated hash value of the last data block with the data in the "current block hash value" field. If they are different, it is determined that the data integrity of the current data block has been damaged and the verification is exited; if they are the same, the calculated hash value of the last data block is compared with the value of the "previous block hash value" field of the first block. If they are different, it is determined that the data integrity of the current data block has been damaged and the verification is exited; if they are the same, it is determined that the data of the current data block is complete.

[0123] Further, when the data integrity check of the last data block is completed, the data integrity check of the entire group of data blocks is completed.

[0124] It should be noted that when it is found during the verification process that the data integrity of the current data block is damaged, the wireless base station continues to apply for the data from the source site of the current data, and reports the information to the relevant source site and edge storage site. The relevant source site and edge storage site can find the cause of the data integrity damage and maintain network security.

[0125] S203d. After completing the verification, the wireless base station sends the information data in the data block group to the user station.

[0126] Embodiment 2

[0127] The present invention provides a device 300 for implementing data integrity protection for data blocks, such as Figure 4 As shown, including:

[0128] The sending module 310 is used to divide the data to be sent into multiple data blocks, and the sending module 310 stores the multiple data blocks in the storage module 320 in a dispersed manner;

[0129] The sending module 310 is further used to calculate the hash value of each data block and store it in the corresponding data field of each data block;

[0130] The data to be sent is hot data with a large amount of data that the user site frequently applies to obtain.

[0131] Furthermore, the sending module 310 includes:

[0132] A configuration unit 311 is used to configure an additional part for the data block, where the additional part is a non-information data part in the data block, and the additional part is used to assist the data block in information data transmission;

[0133] Optionally, the additional part includes a block header and / or a block footer of the data block;

[0134] The configuration unit 311 is further used to set two data fields in the additional part of each data block: a "current block hash value" field and a "previous block hash value" field;

[0135] The processing unit 312 is used to calculate the hash value of each data block and store it in the corresponding data field of each data block;

[0136] The processing unit 312 is specifically used to calculate the hash value of the last data block, calculate the hash value of the part of the last data block except the "previous block hash value" field and the "current block hash value" field through a hash algorithm, and then fill the calculated hash value into the "current block hash value" field of the block and the "previous block hash value" field of the first data block.

[0137] The processing unit 312 is also used to calculate the hash values ​​of all data blocks except the last data block, including: starting from the first data block, for all data blocks except the last data block, calculating the hash value of the part of the data block except the "current block hash value" field, filling the calculated hash value into the "current block hash value" field of the block to which it belongs, and filling it into the "previous block hash value" field of the next data block of the block to which it belongs.

[0138] The storage module 320 is a group of network sites at the network edge close to the user site; including a receiving unit 321, which is used to receive and store the data blocks;

[0139] The module further comprises a sending unit 322, which is used to send the corresponding data blocks to the data calling module when the receiving module requests to obtain the data of the data block group.

[0140] The data calling module 330 is used to obtain data blocks from the storage module and perform data integrity verification:

[0141] The data calling module 330 includes:

[0142] The calculation unit 331 is used to calculate the hash value of each data block. Specifically,

[0143] The calculation unit 331 calculates the hash value of the portion except the "hash value of this block" field from the first data block to the second to last data block;

[0144] The calculation unit 331 calculates the hash value of the last data block except the "previous block hash value" field and the "current block hash value" field.

[0145] The determination unit 332 is used to determine whether the data integrity of the current data block group is damaged.

[0146] The determination unit 332 compares the hash value of the current block obtained by the calculation unit with the data in the "hash value of the current block" field for the data blocks other than the last data block. If they are different, it is determined that the data integrity of the current data block has been damaged and the verification is skipped; if they are the same, further verification is performed;

[0147] The further verification is to compare the calculated hash value of the current block with the value of the "previous block hash value" field of the next block. If they are different, it is determined that the data integrity of the current data block has been damaged and the verification is skipped; if they are the same, the verification of the next data block is performed;

[0148] This process continues until the data integrity check of the second-to-last block is completed;

[0149] The determination unit 332 compares the last data block hash value obtained by the calculation unit 331 with the data in the "current block hash value" field for the last data block. If they are different, it is determined that the data integrity of the current data block has been damaged; if they are the same, the last data block hash value calculated is compared with the value in the "previous block hash value" field of the first block. If they are different, it is determined that the data integrity of the current data block has been damaged and the verification is skipped; if they are the same, it is determined that the data of the current data block is complete;

[0150] The receiving module 340 is used to receive the information data sent by the data calling module 330.

[0151] The method and device for implementing data integrity protection for data blocks provided by the present invention perform data integrity protection on a plurality of data blocks as units by linking the hash values ​​of a group of data blocks forward and backward, so that the hash check is performed on a plurality of data blocks instead of a single data block, and the reliability of the data integrity check is greatly improved; at the same time, by acquiring data at a storage site at the edge of the network and sending it to users, the data transmission delay is greatly reduced.

[0152] It will be appreciated by those skilled in the art that the various exemplary method steps and device units described herein in conjunction with the disclosed embodiments can all be implemented in electronic hardware, software, or a combination of the two. In order to clearly illustrate the interchangeability between hardware and software, the various exemplary steps and units are generally described in the form of their functionality. Whether this functionality is implemented in hardware or software depends on the design constraints implemented by the specific application and the entire system. Those skilled in the art can implement the described functionality in a variety of ways for each specific application, but the results of this implementation should not be interpreted as departing from the scope of the present invention.

[0153] The steps of the method described in conjunction with the above disclosed embodiments may be directly embodied as hardware, a software module executed by a processor, or a combination of the two. The software module may exist in a RAM memory, a flash memory, a ROM memory, an EPROM memory, an EEPROM memory, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. A typical storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. In an alternative embodiment, the storage medium is an integral part of the processor. The processor and the storage medium may exist in an ASIC. The ASIC may exist in a user station. In an alternative embodiment, the processor and the storage medium may exist as discrete components in a user station.

[0154] According to the disclosed embodiments, it is possible for those skilled in the art to implement or use the present invention. It is obvious to those skilled in the art that various modifications of these embodiments are possible, and the general principles defined herein can also be applied to other embodiments without departing from the scope and gist of the present invention. The embodiments described above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for implementing data integrity protection for data blocks, characterized in that: include: Divide the data to be sent into multiple data blocks; Calculate the hash value of each data block and store it in the corresponding data field of each data block; Each data block contains not only the hash value of the block itself, but also the hash values ​​of adjacent data blocks; Distribute and store the plurality of data blocks in each storage site; Acquire multiple data blocks from each storage site, calculate a hash value of each data block, and perform integrity check on data of each data block; After verification is completed, the information data in the plurality of data blocks is sent to the user site; The data block includes a data part and an additional part; Two data fields are set in the additional part: "this block hash value" field and "previous block hash value" field; The calculation of the hash value of each data block and storing it in the corresponding data field of each data block includes: (1) For the last data block, a hash value is calculated using a hash algorithm for the portion of the block except for the "previous block hash value" field and the "current block hash value" field, and the calculated hash value is filled into the "current block hash value" field of the last data block and the "previous block hash value" field of the first data block; (2) Starting from the first data block to the second to last data block, calculate the hash value of the data block except the "current block hash value" field, fill the calculated hash value into the "current block hash value" field of the data block to which it belongs, and fill it into the "previous block hash value" field of the next data block to which it belongs; The step of calculating the hash value of each data block and performing integrity check on the data of each data block includes: (1) Starting from the first data block to the second to last data block, the hash value is calculated for the part except the "Hash value of this block" field, and the calculated hash value of this block is compared with the data in the "Hash value of this block" field. If they are different, it is determined that the data integrity of the current data block has been damaged. If they are the same, further verification is performed; The further verification is to compare the calculated hash value of the current block with the value of the "previous block hash value" field of the next block. If they are different, it is determined that the data integrity of the current data block has been damaged. If they are the same, the verification of the next data block is performed; (2) For the last data block, a hash value is calculated for the portion other than the "previous block hash value" field and the "current block hash value" field, and the calculated hash value of the last data block is compared with the data in the "current block hash value" field. If they are different, it is determined that the data integrity of the last data block has been compromised. If they are the same, the calculated hash value of the last data block is compared with the value in the "previous block hash value" field of the first block. If they are different, it is determined that the data integrity of the current data block has been compromised. If they are the same, it is determined that the data of the current data block is complete.

2. The method for data integrity protection according to claim 1, characterized in that: The additional part includes a data block sequence identifier.

3. The method for data integrity protection according to claim 1, characterized in that: The storage sites are a group of network sites at the edge of the network close to the user sites.

4. The method for data integrity protection according to claim 1, characterized in that: The adjacent data blocks include: Data blocks with similar sequence numbers in the data block sequence identifier are adjacent data blocks; The first data block and the last data block are adjacent data blocks.

5. A device for implementing data integrity protection for data blocks, characterized in that: include: The sending module is used to divide the data to be sent into multiple data blocks, and store the multiple data blocks in the storage module in a dispersed manner; The sending module is further used to calculate the hash value of each data block and store the hash value of the data block in the corresponding data field of each data block; A storage module, which is a group of network sites close to the network edge of the receiving module, and is used to receive and store multiple data blocks sent by the sending module; The storage module is further used to send the data blocks to the data calling module when the receiving module requests to obtain the data of the data blocks; A data calling module is used to receive a data request from the receiving module, obtain data block data from the storage module, and perform integrity verification; The data calling module is also used to send the information data in the data block to the receiving module after the verification is completed; A receiving module, used for receiving information data sent by the data calling module; The sending module comprises: A configuration unit, configured to configure an additional part for the data block, wherein the additional part is a non-information data part in the data block, and the additional part includes a data block sequence identifier; The configuration unit is further used to set two data fields in the additional part of each data block: a "current block hash value" field and a "previous block hash value" field; A processing unit, used for calculating a hash value of each data block and storing the hash value in a corresponding data field of each data block; The processing unit is further used to calculate the hash value of the last data block, calculate the hash value of the part of the last data block except the "previous block hash value" field and the "current block hash value" field by using a hash algorithm, and then fill the calculated hash value into the "current block hash value" field of the last block and the "previous block hash value" field of the first data block; The processing unit is further used to calculate the hash values ​​of all data blocks except the last data block, including: starting from the first data block to the second to last data block, calculating the hash value of the data block except the "current block hash value" field, filling the calculated hash value into the "current block hash value" field of the data block to which it belongs, and filling it into the "previous block hash value" field of the next data block of the data block to which it belongs; The data calling module comprises: A calculation unit, used to calculate the hash value of each data block; The calculation unit calculates the hash value of the portion except the "hash value of this block" field from the first data block to the second to last data block; The calculation unit, for the last data block, calculates the hash value of the part except the "previous block hash value" field and the "current block hash value" field; A determination unit, used to determine whether the data integrity of the current data block group is damaged; The determination unit compares the hash value of the current block obtained by the calculation unit with the data in the "hash value of the current block" field for the data blocks other than the last data block. If they are different, it is determined that the data integrity of the current data block has been damaged. If they are the same, further verification is performed; The further verification is to compare the calculated hash value of the current block with the value of the "previous block hash value" field of the next block. If they are different, it is determined that the data integrity of the current data block has been damaged. If they are the same, it is determined that the data of the current data block is complete and the next data block is verified; The determination unit compares the last data block hash value obtained by the calculation unit with the data in the "current block hash value" field for the last data block. If they are different, it is determined that the data integrity of the current data block has been damaged. If they are the same, the determination unit compares the last data block hash value calculated with the value in the "previous block hash value" field of the first block. If they are different, it is determined that the data integrity of the current data block has been damaged. If they are the same, it is determined that the data of the current data block is complete.

Images