File verification data processing method and device, electronic equipment and medium

Abstract

The application provides a processing method and device of verification data of a file, electronic equipment and a medium. The method comprises: obtaining a reading request of verification data of a file, the reading request comprising node index information, the node index information comprising a target node where the verification data is located; determining target offset information of the verification data corresponding to the target node based on node information of each node of an index area, wherein the node information comprises organization information of the node and offset information of the verification data corresponding to the node; judging whether a page cache to which the verification data belongs exists in the memory based on the target offset information, and if so, feeding back the verification data of the file based on the page cache after determining that the page cache meets an integrity measurement. The method of the application supports on-demand acquisition of the verification data of the file, which is conducive to reducing the calculation amount and waiting time during the integrity measurement, thereby improving the user experience.

Description

TECHNICAL FIELD

[0001] The present application relates to computer system security technology, and in particular to a file verification data processing method and device, electronic equipment and medium. BACKGROUND

[0002] On a vehicle-mounted or mobile device, key data and configuration files are saved in a system partition. If the integrity of the system partition is destroyed, the system service performance may be out of control, and therefore, the integrity of the system partition needs to be measured.

[0003] Existing integrity measurement mechanisms include dm-verity and IMA. In the dm-verity, a private key is used to sign the root hash when the root hash is generated. In the boot stage, the signature data is verified by using a public key to verify whether the root hash is tampered with. Further, the dm-verity uses the root hash to verify the entire hash tree, and finally checks each data block in the entire partition. For the IMA mechanism, file measurement information is stored in the additional attributes of each file, security.ima / security.evm. In the file open / mmap process, the security.evm is first used to verify the security.ima integrity, and the signature data of the security.ima is stored in the security.evm. Then, the security.ima is used to measure the integrity of the file. The hash stored in the security.ima is the result of calculating the hash algorithm based on all the contents of the file, and therefore, to verify whether the file is tampered with under the ima mechanism, all the data of the file needs to be read for verification.

[0004] The system partition is usually several G levels, and when the above two integrity measurement mechanisms perform integrity measurement, the file measurement efficiency and the system boot index are affected due to the long time of reading the file verification data, and therefore, the user experience is not improved. SUMMARY

[0005] The present application provides a file verification data processing method, device, electronic equipment and medium to support on-demand reading of file verification data, which is beneficial to efficient file integrity measurement, and therefore, is beneficial to improving user experience.

[0006] In one aspect, the present application provides a file verification data processing method, which comprises:

[0007] Obtaining a read request of verification data of a file, wherein the read request comprises node index information, and the node index information comprises a target node where the verification data is located;

[0008] determine target offset information of the check data corresponding to the target node based on node information of each node in the index area, wherein the node information comprises organization information of the node and offset information of the check data corresponding to the node;

[0009] determine whether a page cache to which the check data belongs exists in the memory based on the target offset information, and if the page cache exists, feed back the check data of the file based on the page cache after determining that the page cache satisfies the integrity measurement.

[0010] In another possible implementation manner, before the read request of the check data of the file is acquired, the method further comprises:

[0011] divide each file in a preset capacity to obtain at least one data block, wherein the preset capacity is smaller than the capacity of the file;

[0012] perform a pre-design calculation on the data block of each file to obtain the check data of each file;

[0013] divide the check data of the file in the preset capacity to obtain at least one check data block;

[0014] perform the pre-design calculation on each check data block to obtain root check data corresponding to each check data block;

[0015] store the root check data and the check data of each file to a check data area, and generate node information of each node in the index area.

[0016] In another possible implementation manner, the determination that the page cache satisfies the integrity measurement comprises:

[0017] determine whether the page cache satisfies the integrity measurement according to a measurement mark of the page cache; wherein the page cache is determined to satisfy the integrity measurement when the measurement mark is an update mark, and the update mark is used to indicate that the page cache passes the integrity measurement.

[0018] In another possible implementation manner, before the determination that the page cache satisfies the integrity measurement according to the measurement mark of the page cache, the method further comprises:

[0019] calculate current root check data of the page cache when the page cache is read;

[0020] if the current root check data is consistent with the root check data, the page cache passes the integrity measurement, and a measurement mark is set as an update mark;

[0021] If the current root check data is inconsistent with the root check data, the page cache fails the integrity measurement, and the measurement flag is set as an error flag.

[0022] In another possible implementation manner, before the read request of the check data of the file is acquired, the method further includes:

[0023] When the opening request of the file in which the check data is located is acquired, the signature data is decrypted based on a public key corresponding to a preset private key to acquire a preset data digest;

[0024] A preset calculation is performed based on the node information in the opening request and the current root check data, to obtain a current data digest;

[0025] It is judged whether the current data digest is consistent with the preset data digest, and if the obtained judgment result is consistent, the opening request is responded to open the file in which the check data is located.

[0026] In another possible implementation manner, before the signature data is decrypted based on the public key corresponding to the preset private key to acquire the preset data digest, the method further includes:

[0027] The root check data and the node information of each node of the index area are respectively subjected to the preset calculation to obtain the preset data digest;

[0028] The signature data is generated based on the preset data digest and the preset private key.

[0029] In another possible implementation manner, the method further includes: after the signature data is generated based on the preset data digest and the preset private key, the method further includes:

[0030] The signature data is stored to a check data signature area.

[0031] On the other hand, the application provides a processing apparatus of check data of a file, including an acquisition module, a determination module and a feedback module, wherein,

[0032] The acquisition module is used for acquiring a read request of check data of a file, and the read request includes node index information, and the node index information includes a target node in which the check data is located;

[0033] The determination module is used for determining target offset information of check data corresponding to the target node based on node information of each node of an index area, and the node information includes organization information of a node and offset information of check data corresponding to the node;

[0034] a feedback module, configured to determine, based on the target offset information, whether a page cache to which the check data belongs exists in the memory, and if so, feed back the check data of the file based on the page cache after determining that the page cache meets the integrity measurement.

[0035] In another possible implementation manner, the apparatus further includes a division module, a first calculation module, a second calculation module, and a first generation module.

[0036] The first division module is configured to divide each file in a preset capacity unit to obtain at least one data block, the preset capacity being smaller than a capacity of the file.

[0037] The first calculation module is configured to perform a preset calculation on the data block of each file to obtain check data of each file.

[0038] The second division module is configured to divide the check data of the file in the preset capacity unit to obtain at least one check data block.

[0039] The second calculation module is configured to perform the preset calculation on each check data block to obtain root check data corresponding to each check data block.

[0040] The first generation module is configured to store the root check data and the check data of each file to a check data area, and generate node information of each node of the index area.

[0041] In another possible implementation manner, the feedback module is specifically configured to:

[0042] determine whether the page cache meets the integrity measurement according to a measurement mark of the page cache, wherein the measurement mark is the update mark when the measurement mark is determined to indicate that the page cache passes the integrity measurement.

[0043] In another possible implementation manner, the apparatus further includes a third calculation module, a first setting module, and a second setting module.

[0044] The third calculation module is configured to calculate current root check data of the page cache when the page cache is read.

[0045] The first setting module is configured to set the measurement mark as the update mark when the current root check data is consistent with the root check data and the page cache passes the integrity measurement.

[0046] The second setting module is configured to set the measurement mark as an error mark when the current root check data is inconsistent with the root check data and the page cache fails to pass the integrity measurement.

[0047] In another possible implementation manner, the apparatus further includes a decryption module, a fourth calculation module, and a judgment module, wherein,

[0048] The decryption module is configured to decrypt the signature data based on a public key corresponding to the preset private key to obtain the preset data digest when the opening request of the file in which the verification data is located is acquired.

[0049] The fourth calculation module is configured to perform a preset calculation based on the node information in the opening request and the current root verification data to obtain the current data digest.

[0050] The judgment module is configured to perform a preset calculation based on the node information in the opening request to obtain the current data digest.

[0051] In another possible implementation manner, the apparatus further includes a fifth calculation module and a second generation module, wherein,

[0052] The fifth calculation module is configured to perform a preset calculation on the root verification data and the node information of each node in the index area respectively to obtain the preset data digest.

[0053] The second generation module is configured to generate signature data based on the preset data digest and the preset private key.

[0054] In another possible implementation manner, the apparatus further includes a storage module, wherein,

[0055] The storage module is configured to store the signature data to a verification data signature area.

[0056] In a third aspect, the present application provides an electronic device, including:

[0057] at least one processor and a memory;

[0058] The memory stores computer execution instructions.

[0059] The at least one processor executes the computer execution instructions stored in the memory, so that the at least one processor executes the processing method of the verification data of the file according to any one of the first aspect.

[0060] In a fourth aspect, the present application provides a computer readable storage medium, the computer readable storage medium stores computer execution instructions, when the processor executes the computer execution instructions, the processing method of the verification data of the file according to any one of the first aspect is realized.

[0061] The application provides a file verification data processing method and device, an electronic device and a medium, supports a user to obtain file verification data on demand, and the specific process is as follows: when it is required to read the verification data of a data block, the verification data of a file to which the data block belongs is first read, specifically, the reading process is as follows: based on the offset and length of the verification data of the file, the corresponding page cache is found in the memory, when the corresponding page cache is obtained, whether the file in which the verification data is located is tampered with is confirmed based on the measurement mark of the page cache, and when the file is not tampered with, the verification data is fed back, so that the safe reading of the verification data of the file is realized. After the verification data of the file is obtained, the verification data of the data block can be finally obtained based on the offset and length of the specific data block, so as to complete the on-demand verification when the integrity measurement is completed, the calculation amount and the waiting time when the integrity measurement is completed are effectively reduced, and then the user experience is improved. BRIEF DESCRIPTION OF DRAWINGS

[0062] The accompanying drawings, which are incorporated herein and form part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles of the application.

[0063] Figure 1a A file verification data storage structure diagram provided by an embodiment of the application;

[0064] Figure 1b A file verification data storage structure diagram provided by an embodiment of the application Figure 2 ;

[0065] Figure 1c A file verification data storage structure diagram provided by an embodiment of the application;

[0066] Figure 2 A file verification data processing method flow diagram provided by an embodiment of the application;

[0067] Figure 3a A file verification data processing method flow diagram provided by an embodiment of the application Figure 2 ;

[0068] Figure 3b A file verification data processing method flow diagram provided by an embodiment of the application;

[0069] Figure 4 A file verification data processing method flow diagram provided by an embodiment of the application;

[0070] Figure 5 A file verification data processing method flow diagram provided by an embodiment of the application Figure 4 ;

[0071] Figure 6 A file verification data processing method flowchart provided by an embodiment of the present application Figure 5

[0072] Figure 7 A file verification data processing device schematic diagram provided by an embodiment of the present application

[0073] Figure 8 An electronic device provided by an embodiment of the present application

[0074] The specific embodiments of the present application have been shown through the above-described drawings, and will be described in more detail hereinafter. These drawings and the written description are not intended to restrict the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0075] The exemplary embodiments will be described in detail herein with reference to the attached drawings. In the following description, the same numbers are used to indicate the same or similar components. The embodiments described in the following exemplary embodiments are not meant to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present application as detailed in the appended claims.

[0076] To improve the security of file storage and access, an integrity measurement mechanism is generally used to measure the integrity of a file. The integrity measurement is used to verify whether the file has been tampered with. When the file has been tampered with, the integrity measurement result considers that the file does not satisfy the integrity measurement. When the file has not been tampered with, the integrity measurement result considers that the file satisfies the integrity measurement.

[0077] The existing integrity measurement mechanisms commonly include dm-verity and IMA. The dm-verity mechanism is suitable for the integrity measurement of a certain partition, and any partition includes at least one file. The IMA mechanism is suitable for the integrity measurement of any file in a partition, and any file includes at least one data block.

[0078] When the dm-verity mechanism is used for integrity measurement, all data blocks included in the files in the partition need to be checked. Only when all data blocks included in the files in the partition pass the check, it is considered that the files in the partition all satisfy the integrity measurement. When the IMA mechanism is used for integrity measurement, all data blocks included in the target file need to be checked. Only when all data blocks included in the target file pass the check, it is considered that the file satisfies the integrity measurement.

[0079] ​If a partition contains a large number of files and the number of data blocks that make up a file is large, then accessing a file, even with the IMA mechanism for integrity measurement, requires a huge amount of computation and waiting time, which affects file measurement and system startup metrics, and is not conducive to improving user experience.

[0080] This application provides a method, apparatus, electronic device, and medium for processing file verification data, used to achieve on-demand file verification during integrity measurement. Specifically, it allows users to perform verification checks only on a specific portion of a file when accessing it, effectively reducing computational load and user waiting time, thereby improving user experience.

[0081] Figure 1a This is a schematic diagram of the storage structure of file verification data provided in an embodiment of this application. Figure 1b This is a schematic diagram of a file verification data storage structure provided in an embodiment of this application. Figure 2 , Figure 1c This is a schematic diagram (3) illustrating the storage structure of file verification data provided in an embodiment of this application. For example... Figure 1a , Figure 1b and Figure 1c As shown, the storage structure provided in this application embodiment includes an index area, a verification data area, and a verification data signature area. The index area is used to store node information of each file of the device. The node information includes the organization information corresponding to each node and the offset information of the corresponding verification data. The data verification area is used to store the verification data of each file of the device and the root verification data obtained based on the verification data of each file. The verification data signature area is used to store signature data.

[0082] Specifically, such as Figure 1b and Figure 1cAs shown, the organization information includes access path information composed of parent node information, brother node information and child node information corresponding to each file and metadata of the file, and the metadata contains file attribute data such as file length, owner and access permission; the offset information includes offset and length of the check data of each file. When the check data of the file is needed, the corresponding check data is read according to the access path information, offset and length of the check data of the file. The check data of the file is obtained by pre-designing each data block in each file on the device, and the size of each data block is 4K. The signature data is obtained by pre-designing each node information. Specifically, in the embodiment of the application, the pre-designing can be any kind of hash calculation, for example, it can be MD5 algorithm, it can also be SHA1 algorithm, and it can also be SHA256 algorithm; the check data of the file is the hash data of the file, which is obtained by hash calculating each data block in the file; and the root check data is the root hash, which is obtained by hash calculating the hash data of each file.

[0083] Through the above storage structure, the signature data stored in the check data signature area is obtained by hash calculating the node information and the root check data contained in the storage structure and then signing by using the pre-prepared private key, so when the user opens the storage structure, the check can be performed based on the signature data first, at this time, if the check result is that the current node information and / or the root check data is inconsistent with the original node information and / or the root check data, a prompt that the storage structure is tampered can be directly returned, thereby effectively saving the calculation amount and the check waiting time. If the check result is that the current node information and the root check data are consistent with the original node information and the root check data, the storage structure is allowed to be opened.

[0084] When the user reads the hash data of any file in the storage structure, the integrity of the hash data of the file can be checked only, that is, only the hash of the page cache corresponding to the hash data of the file is compared with the hash data of the file stored in the storage structure, so that whether the hash data of the file is tampered can be known, thereby reducing the time for calculating the hash of other data blocks in the partition, and further improving the check efficiency.

[0085] The technical solutions of the application and how the technical solutions of the application solve the above technical problems through the above storage structure will be described in detail in specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described in detail in some embodiments.

[0086] Figure 2 A flowchart of a processing method of the check data of the file provided in the embodiment is shown in FIG. 1. The following will be described in combination with Figure 2 An embodiment of the application will be described in detail. As shown in FIG. 1, the processing method of the check data of the file includes the following steps. Figure 2As shown, the method in this embodiment can include step S201, step S202, and step S203, wherein,

[0087] In step S201, a read request for the check data of the file is obtained.

[0088] The read request includes node index information, and the node index information includes a target node where the check data is located.

[0089] In step S202, based on node information of each node in the index area, target offset information of the check data corresponding to the target node is determined.

[0090] The node information includes organization information of the node and offset information of the check data corresponding to the node.

[0091] In step S203, based on the target offset information, it is determined whether a page cache to which the check data belongs exists in the memory. If the page cache exists, after it is determined that the page cache meets the integrity measurement, the check data of the file is fed back based on the page cache.

[0092] Specifically, the way to determine whether the page cache to which the check data belongs exists in the memory is as follows: the check data is searched in the memory. If the check data can be found, it is determined that the page cache to which the check data belongs exists. If the check data cannot be found, it is determined that the page cache to which the check data belongs does not exist.

[0093] The method provided in this embodiment provides convenience for obtaining the check data of the file and supports obtaining the check data of a certain data block of the file. Through the method provided in this application, when the check data of the file is obtained, first, based on the node information of each node in the index area and the target node where the check data is located, target offset information of the check data corresponding to the target node is determined. Then, based on the target offset information, the page cache corresponding to the check data is searched in the memory. Finally, based on the obtained page cache, the check data of the file is fed back. Through the above method, the required check data can be obtained based on the target offset information, so as to support the on-demand check integrity measurement mechanism.

[0094] Figure 3a is a processing method flow of the check data of the file provided in this embodiment Figure 2 , Figure 3b is a method schematic diagram for obtaining the check data of the file provided in this embodiment Figure 4 is a processing method flowchart three of the check data of the file provided in this embodiment Figure 5 is a processing method flow of the check data of the file provided in this embodiment Figure 4 . The following will be combined with Figure 3a , Figure 3b , Figure 4 and Figure 5The specific implementation process of the embodiment of the present application is described in detail. Specifically, the embodiment describes the way of storing and obtaining the check data, and the way of setting the page cache metric tag.

[0095] The following describes the way of obtaining and storing the check data of the file. Figure 3a and Figure 3b The way of obtaining and storing the check data of the file is described. As shown in Figure 3a The storage way of the check data used in the embodiment includes steps S301, S302, S303 and S304, wherein,

[0096] Step S301: The original data of the file is divided into at least one data block in a preset capacity, and the preset capacity is less than the capacity of the file.

[0097] The preset capacity corresponds to the size of the page cache, which is 4K. Specifically, when calculating the hash data of the file, the file is first divided into at least one data block in units of 4K.

[0098] Step S302: The data blocks of each file are pre-calculated to obtain the check data of each file.

[0099] Specifically, the hash value of each data block is obtained by performing hash calculation on each data block, and the hash value of each data block constitutes the check data of the file.

[0100] Step S303: The check data of the file is divided into at least one check data block in a preset capacity, and the root check data corresponding to each check data block is obtained by pre-calculating each check data block.

[0101] Specifically, the check data of each file obtained in step S303 is divided into at least one check data block in units of 4K, and the root hash corresponding to each check data block is obtained by performing hash calculation on each check data block.

[0102] Step S304: The root check data and the check data are stored in the check data area, and the node information of each node of the index area is generated.

[0103] Specifically, after obtaining the root check data and the check data, the root check data and the check data are stored in the check data area. The node information of each node is generated based on the storage path of the root check data and the check data.

[0104] As shown in Figure 4 The method for obtaining the check data includes steps S401, S402, S403, S404, S405, S406 and S407, wherein,

[0105] Step S401: Obtain a read request for the file's verification data. The read request includes node index information, which includes the target node where the verification data is located.

[0106] Step S402: Based on the node information of each node in the index area, obtain the target offset information of the verification data corresponding to the target node.

[0107] The node information includes the organization information of each node and the offset information of the corresponding checksum data for each node. The organization information includes the access paths of each file under that node, and the offset information of the checksum data includes the offset and length of the checksum data under that node.

[0108] Step S403: Based on the target offset information, determine whether the page cache to which the verification data belongs exists in memory. If it exists, proceed to step S404; otherwise, proceed to step S405.

[0109] The method for determining whether the page cache to which the verification data belongs exists in memory in step S403 is detailed in the description of step S203 in the previous embodiment, and will not be repeated in this embodiment.

[0110] Step S404: Determine whether the page cache meets the integrity metric based on the page cache metric flag. If yes, proceed to step S406; otherwise, proceed to step S407.

[0111] Step S405: Read the verification data from the disk and obtain the page cache to which the verification data belongs and the page cache's metric tag.

[0112] Specifically, when reading verification data, a new cache page is first created in memory. After the verification data is read, it is filled into the cache page, thus obtaining the page cache to which the verification data belongs.

[0113] Step S406: Based on the page cache, return the file's verification data.

[0114] Step S407: Read request rejected.

[0115] Specifically, when the page cache corresponding to the verification data passes the integrity measurement, it indicates that the verification data has not been tampered with. At this time, step S406 is executed to return the file's verification data. When the page cache corresponding to the verification data fails the integrity measurement, it indicates that the verification data has been tampered with. To improve file storage security, the read request is rejected to warn the user.

[0116] like Figure 5 As shown, the method for setting the page cache metric flag provided in this embodiment includes steps S501, S502, S503, and S504, wherein...

[0117] In step S501, when reading the page cache, the current root check data of the page cache is calculated.

[0118] Specifically, the current root check data of the page cache is calculated by performing a hash calculation on the current check data included in the page cache to obtain the root check data of the page cache.

[0119] In step S502, it is determined whether the current root check data is consistent with the root check data corresponding to the page cache stored in the root check data area. If yes, step S503 is performed; if no, step S504 is performed.

[0120] In step S503, the page cache passes the integrity measurement, and the measurement mark is set as an update mark.

[0121] In step S504, the page cache fails the integrity measurement, and the measurement mark is set as an error mark.

[0122] Specifically, when the current root check data is consistent with the root check data, the measurement mark of the page cache is set as an update mark to indicate that the check data corresponding to the page cache is not tampered with and passes the integrity measurement. When the current root check data is inconsistent with the root check data, the measurement mark of the page cache is set as an error mark to indicate that the check data corresponding to the page cache is tampered with and fails the integrity measurement.

[0123] The method provided in the embodiment, when storing the check data of a file, first divides the file into at least one data block of 4K in size, performs a preset hash calculation on each data block in each file to obtain the check data of each file. Secondly, performs a preset hash calculation on the check data of each file to obtain the root check data of each file. Finally, stores the check data of the file and the root check data of the file to the check data area, and generates node information based on the storage path of the check data of the file and the root check data of the file, and stores the node information to the index area.

[0124] By the above storage manner, when the check data of the file needs to be acquired, the target offset information of the target check data contained in the target node can be determined based on the node index information included in the read request. Then, based on the target offset information, it is checked whether the page cache of the target acquired check data exists in the memory. If not, the target acquired check data is first read into the memory to generate the page cache corresponding to the target acquired check data, and the measurement mark of the corresponding page cache is acquired. If yes, the measurement mark of the corresponding page cache is directly acquired. Finally, if the measurement mark of the page cache is the update mark, that is, the check data contained in the page cache is not tampered, the check data is fed back to complete the read of the check data. After the check data of the file is obtained, the target acquired data block check data can be acquired based on the offset and length of the target acquired data block check data, so as to realize the on-demand check.

[0125] Figure 6 is a file check data processing method provided by the embodiment of the application Figure 5 , on the basis of the above embodiment, in combination with Figure 6 , the specific implementation process of the embodiment of the application is further described in detail. Specifically, the embodiment describes in detail the way of checking the integrity of the node information of the file when the file is opened.

[0126] As shown in Figure 6 , the way includes steps S601, S602, S603, S604 and S605, wherein,

[0127] Step S601, when the opening request of the file where the check data is located is acquired, the signature data is decrypted based on the public key corresponding to the preset private key to acquire the preset data digest.

[0128] The way of obtaining the preset data digest and the signature data is that the node information of each node of the index area and the root check data are respectively pre-designed to obtain the preset data digest; and the signature data is generated based on the preset data digest and the preset private key.

[0129] Further, after the preset data digest and the signature data are obtained, the signature data is stored in the check data signature area.

[0130] Step S602, based on the node information in the opening request and the current root check data, pre-designing is performed to obtain the current data digest.

[0131] Specifically, the way of obtaining the current data digest is that the current node information and the current root check data are subjected to hash calculation to obtain the current data digest.

[0132] Step S603, judging whether the current data digest is consistent with the preset data digest. If consistent, step S604 is executed; if not consistent, step S605 is executed.

[0133] Step S604, opening the file where the verification data is located in response to the opening request.

[0134] Step S605, rejecting the opening request.

[0135] The method provided by the embodiment can, when opening the storage structure where the verification data obtained by the target is located, first verify the current node information and the current root verification data, so that the opening request can be rejected in time when the current node information and / or the current root verification data is tampered, thereby facilitating the secure storage of the verification data.

[0136] The above embodiment introduces a processing method of verification data of a file from the perspective of a method flow, and the following embodiment introduces a processing device of verification data of a file from the perspective of a virtual module or a virtual unit. For details, refer to the following embodiment.

[0137] An embodiment of the present application provides a processing device of verification data of a file, as shown in the figure, the device comprises an obtaining module 71, a determining module 72 and a feedback module 73, wherein, Figure 7

[0138] The obtaining module 71 is configured to obtain a reading request of verification data of a file, and the reading request comprises node index information, and the node index information comprises a target node where the verification data is located.

[0139] The determining module 72 is configured to determine target offset information of the verification data corresponding to the target node based on node information of each node in the index area, wherein the node information comprises organization information of the node and offset information of the verification data corresponding to the node.

[0140] The feedback module 73 is configured to judge whether a page cache to which the verification data belongs exists in the memory based on the target offset information, and if the page cache exists, feed back the verification data of the file based on the page cache after determining that the page cache meets the integrity measurement.

[0141] Another possible implementation manner of the embodiment of the present application, the device further comprises a division module, a first calculation module, a second calculation module and a first generation module, wherein,

[0142] The first division module is configured to divide each file in a preset capacity unit to obtain at least one data block, and the preset capacity is smaller than the capacity of the file.

[0143] The first calculation module is configured to perform a preset calculation on the data block of each file to obtain the verification data of each file.

[0144] ​The second dividing module is configured to divide the check data of the file in units of a preset capacity to obtain at least one check data block.

[0145] The second calculating module is configured to perform a preset calculation on each check data block to obtain root check data corresponding to each check data block.

[0146] The first generating module is configured to store the root check data and the check data of each file into a check data area and generate node information of each node of an index area.

[0147] In another possible implementation of the embodiment of the application, the feedback module 73 is specifically configured to:

[0148] According to the measurement mark of the page cache, it is determined whether the page cache satisfies the integrity measurement; wherein, when the measurement mark is an update mark, it is determined that the page cache satisfies the integrity measurement, and the update mark is used to indicate that the page cache passes the integrity measurement.

[0149] In another possible implementation of the embodiment of the application, the device further comprises a third calculating module, a first setting module and a second setting module, wherein,

[0150] The third calculating module is configured to calculate the current root check data of the page cache when the page cache is read into the memory.

[0151] The first setting module is configured to set the measurement mark as the update mark when the current root check data is consistent with the root check data and the page cache passes the integrity measurement.

[0152] The second setting module is configured to set the measurement mark as the error mark when the current root check data is inconsistent with the root check data and the page cache does not pass the integrity measurement.

[0153] In another possible implementation of the embodiment of the application, the device further comprises a decryption module, a fourth calculating module and a judging module, wherein,

[0154] The decryption module is configured to, when an opening request of a file where the check data is located is acquired, decrypt the signature data based on a public key corresponding to a preset private key to obtain a preset data digest.

[0155] The fourth calculating module is configured to perform a preset calculation based on the node information in the opening request to obtain the current data digest.

[0156] The judging module is configured to perform a preset calculation based on the node information in the opening request to obtain the current data digest.

[0157] In another possible implementation of the embodiment of the application, the device further comprises a fifth calculating module and a second generating module, wherein,

[0158] The fifth computing module is configured to respectively pre-compute the node information of each node in the index area to obtain a preset data digest corresponding to each node respectively;

[0159] The second generating module is configured to generate, for each node, signature data corresponding to the node based on the preset data digest and the preset private key.

[0160] In another possible implementation of the embodiment of the application, the apparatus further includes a storage module, wherein,

[0161] The storage module is configured to store the preset data digest and the signature data to the verification data signature area.

[0162] In the embodiment of the application, the first computing module, the second computing module, the third computing module, the fourth computing module and the fifth computing module can be the same computing module, can be partially same computing module, or can be different computing modules. The first generating module and the second generating module can be the same generating module, or can be different generating modules. The first setting module and the second setting module can be the same setting module, or can be different setting modules. The first dividing module and the second dividing module can be the same dividing module, or can be different dividing modules. In the embodiment of the application, none of them is limited.

[0163] The processing apparatus for the verification data of the file provided in the embodiment of the application is applicable to the method embodiment described above, and will not be described here.

[0164] In the embodiment of the application, an electronic device is provided, such as Figure 8 As shown in the figure, Figure 8 The electronic device shown in the figure includes a processor 81 and a memory 82. Wherein, the processor 81 and the memory 82 are connected, such as through a bus 83. Optionally, the electronic device can also include a transceiver 84. It should be noted that in actual application, the transceiver 84 is not limited to one, and the structure of the electronic device does not constitute a limitation on the embodiment of the application.

[0165] The processor 81 can be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. It can implement or execute various exemplary logical blocks, modules and circuits described in connection with the disclosure. The processor 81 can also be a combination of computing functions, such as a combination of one or more microprocessors 81, a combination of a DSP and a microprocessor 81, etc.

[0166] The bus 83 can include a path for transmitting information between the above-mentioned components. The bus 83 can be a PCI (Peripheral Component Interconnect) bus 83 or an EISA (Extended Industry Standard Architecture) bus 83, etc. The bus 83 can be divided into an address bus 83, a data bus 83, a control bus 83, etc. For ease of representation, only one thick line is shown in FIG. 3, but it does not mean that there is only one bus 83 or only one type of bus 83.

[0167] The memory 82 can be a ROM (Read Only Memory) or other type of static storage device that can store static information and instructions, a RAM (Random Access Memory) or other type of dynamic storage device that can store information and instructions, an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto.

[0168] The memory 82 is configured to store application codes for implementing the solutions of the present application, and the processor 81 is configured to execute the application codes stored in the memory 82.

[0169] The electronic device includes, but is not limited to, a mobile terminal such as a mobile phone, a notebook computer, a digital broadcast receiver, a PDA (Personal Digital Assistant), a PAD (Tablet Personal Computer), a PMP (Portable Multimedia Player), a car terminal (e.g., a car navigation terminal), and the like, and a stationary terminal such as a digital TV, a desktop computer, and the like. It can also be a server or the like. Figure 8 The illustrated electronic device is merely an example and should not impose any limitation on the functions and use range of the embodiments of the present disclosure.

[0170] The embodiments of the present application provide a computer readable storage medium, which stores a computer program, and when the computer program is executed on a computer, the computer can execute the corresponding content in the foregoing method embodiments.

[0171] Other embodiments of the present application will be readily apparent to those skilled in the art upon considering the description of the application in conjunction with the accompanying drawings. The present application is intended to cover any variations, uses, or adaptations of the application following the general principles thereof and including such departures from the present disclosure as come within known use or custom in the art to which the application pertains. The description and examples are to be regarded as illustrative in nature and not as restrictive, with the true scope and spirit of the application being indicated by the claims.

[0172] It should be understood that the present application is not limited to the precise construction that has been described and illustrated above and that various modifications and changes can be made therein without departing from the scope thereof. The scope of the application is indicated by the appended claims.

Claims

1. A method of processing check data of a file, characterized by, The method comprises the following steps: obtaining a read request of check data of a file, wherein the read request comprises node index information, and the node index information comprises a target node where the check data is located; determining target offset information of the check data corresponding to the target node based on node information of each node in an index area, wherein the index area is used for storing node information of the file, and the node information comprises organization information of the node and offset information of the check data corresponding to the node; judging whether a page cache to which the check data belongs exists in a memory based on the target offset information, and if the page cache exists, feeding back the check data of the file based on the page cache after it is determined that the page cache meets an integrity measurement.

2. The method of claim 1, wherein, Before the read request of the check data of the file is obtained, the method further comprises the following steps: dividing each file into at least one data block in a preset capacity, wherein the preset capacity is smaller than a capacity of the file; performing a pre-design calculation on the data block of each file to obtain check data of each file; dividing the check data of the file into at least one check data block in the preset capacity; performing the pre-design calculation on each check data block to obtain root check data corresponding to each check data block; storing the root check data and the check data of each file in a check data area, and generating node information of each node in the index area.

3. The method of claim 2, wherein, The determination that the page cache meets the integrity measurement comprises the following steps: determining whether the page cache meets the integrity measurement according to a measurement mark of the page cache, wherein the page cache is determined to meet the integrity measurement when the measurement mark is an update mark, and the update mark is used to indicate that the page cache passes the integrity measurement.

4. The method of claim 3, wherein, Before the determination that the page cache meets the integrity measurement according to the measurement mark of the page cache, the method further comprises the following steps: calculating current root check data of the page cache when the page cache is read; if the current root check data is consistent with the root check data, the page cache passes the integrity measurement, and the measurement mark is set to the update mark; if the current root check data is inconsistent with the root check data, the page cache fails to pass the integrity measurement, and the measurement mark is set to an error mark.

5. The method of claim 1, wherein, Before the read request of the check data of the file is obtained, the method further comprises the following steps: when an open request of a file where the check data is located is obtained, decrypting signature data based on a public key corresponding to a preset private key to obtain a preset data digest; performing a pre-design calculation based on the node information in the open request and current root check data to obtain a current data digest; determining whether the current data digest is consistent with the preset data digest, and if the determination result is consistent, opening the file where the check data is located in response to the open request.

6. The method of claim 5, wherein, Before the signature data is decrypted based on the public key corresponding to the preset private key to obtain the preset data digest, the method further comprises the following steps: performing a pre-design calculation on the root check data and the node information of each node in the index area respectively to obtain the preset data digest. The signature data is generated based on the preset data digest and the preset private key.

7. The method of claim 6, wherein, After the signature data is generated based on the preset data digest and the preset private key, the method further comprises: storing the signature data to a verification data signature area.

8. An apparatus for processing check data of a file, characterized by comprising: comprise: an acquisition module, configured to acquire a read request of verification data of a file, the read request comprising node index information, the node index information comprising a target node where the verification data is located; a determination module, configured to determine target offset information of the verification data corresponding to the target node based on node information of each node of an index area, the index area being configured to store node information of the file, the node information comprising organization information of the node and offset information of the verification data corresponding to the node; a feedback module, configured to determine whether a page cache to which the verification data belongs exists in a memory based on the target offset information, and if the page cache exists, feed back the verification data of the file based on the page cache after determining that the page cache meets integrity measurement.

9. An electronic device, comprising: comprise: at least one processor and a memory; the memory stores computer execution instructions; the at least one processor executes the computer execution instructions stored in the memory, so that the at least one processor executes the processing method of the verification data of the file according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the processing method of the verification data of the file according to any one of claims 1-7.

Images