Data storage and query method, device, equipment and computer storage medium

Abstract

Embodiments of the present invention provide a data storage and query method, apparatus, device, and computer storage medium capable of acquiring distance data from a query target within a preset period, encoding the distance data, assigning the distance data to corresponding buckets based on the correspondence between the distance data encoding and the bucket encoding, and encrypting the distance data belonging to the same bucket using a secret key to obtain a ciphertext block. The secret key is synchronized via a secure channel between a sink node and a storage node, and an information set is sent to the storage node for the storage node to organize and store the acquired buckets based on the information set. The information set includes at least information about the sensing node, a preset period, a ciphertext block, and the encoding of the distance data. This method can protect the integrity and security of data in a two-layer sensor network.

Description

Technical Field

[0001] The present invention relates to wireless sensor network communications, and in particular to a data storage and query method, device, equipment and computer storage medium. Background Art

[0002] Wireless sensor networks (WSNs), as an important component of the perception layer of the Internet of Things, are composed of a large number of micro-sensing nodes with certain perception, computing and communication capabilities through self-organization. They are widely used in various important fields such as environmental monitoring, urban management, medical care, national defense and military, industrial and agricultural control, etc.

[0003] In traditional wireless sensor network models based on node similarity, sensing nodes need to send their sensory data to a sink node over multiple hops for storage and processing. Consequently, sensing nodes adjacent to the sink node must not only transmit their own sensory data but also forward data received from other nodes. This heavy burden quickly depletes the energy of these nodes. In response to this, researchers designed a two-tier sensor network. In this two-tier sensor network, the existing sensor network is divided into multiple query units, each containing multiple sensing nodes and a storage node. The storage node is responsible for receiving, storing, and processing sensory data from the sensing nodes within the unit and also for executing query requests sent by the sink.

[0004] Since the two-layer sensor network structure adds storage nodes to receive, store and process the perception data sent by the sensing nodes within the unit, the two-layer sensor network architecture saves communication overhead. However, there is currently no method to protect the privacy of data transmitted in a two-layer sensor network. Summary of the Invention

[0005] The embodiments of the present invention provide a data storage and query method, apparatus, device and computer storage medium, which can protect the security of data in a two-layer sensor network.

[0006] In a first aspect, an embodiment of the present invention provides a data storage method, which is applied to a target sensing node in a two-layer sensor network, wherein the query unit includes a storage node and multiple sensing nodes, and the target sensing node is any one of the multiple sensing nodes, characterized in that the method includes:

[0007] Obtain the distance data between the query target and the query target within a preset period;

[0008] Encode the distance data;

[0009] According to the correspondence between the encoding of the distance data and the encoding of the bucket, the distance data is classified into the corresponding bucket;

[0010] The distance data belonging to the same bucket are encrypted according to the secret key to obtain the ciphertext block, where the secret key is synchronized from the sink node to the sensing node and the storage node through a secure channel;

[0011] The information set is sent to the storage node; the storage node is used to organize and store the obtained buckets according to the information set; the information set at least includes the information of the sensing node, the preset period, the ciphertext block, and the encoding of the distance data.

[0012] In an optional embodiment, the sensing node obtains distance data between the sensing node and the query target within a preset period, specifically including:

[0013] The incomplete distance data calculation method is used to obtain the incomplete distance data between the sensing node and the query target within a preset period.

[0014] In an optional implementation, encoding the distance data specifically includes:

[0015] Generate a filter code corresponding to the verification code according to the verification code of the distance data.

[0016] In an optional implementation, after the sensing node encrypts the distance data belonging to the same bucket according to the secret key to obtain a ciphertext block, the method further includes:

[0017] Construct a hash tree based on distance data;

[0018] Perform HMAC encoding on the distance data in the bucket;

[0019] Get the XOR value of the HMAC code corresponding to the distance data in the bucket, and use the XOR value as the verification code of the bucket;

[0020] Sort the verification codes of the buckets and match the sorted verification codes with the hash tree;

[0021] Get the root node code of the hash tree corresponding to the bucket, and use the root node code of the hash tree of the bucket as the integrity verification code.

[0022] In a second aspect, an embodiment of the present invention provides a data query method, which is applied to a sink node in a two-layer sensor network, wherein the two-layer sensor network includes: multiple query units and the sink node, each query unit includes a storage node and multiple sensing nodes, and the method includes:

[0023] Generate query signaling based on the sensing node information to be queried, the preset period, the bucket encoding, and the number of preset distance data;

[0024] Sending a query signaling to a storage node, so that the storage node queries an information set corresponding to the query signaling according to the query signaling, where the information set at least includes a ciphertext block and an encoding of the distance data, wherein the ciphertext block is obtained by encrypting the distance data belonging to the same bucket by the sensing node according to a secret key; and the encoding of the distance data is obtained by encoding the distance data by the sensing node;

[0025] Receive the information set returned by the storage node;

[0026] Decrypt the ciphertext block in the received information set according to the secret key and obtain the decrypted distance data;

[0027] Verify distance data based on integrity coding in the information;

[0028] When the distance data passes the verification, verify whether the quantity of the distance data meets the preset data quantity;

[0029] The query is completed when the number of data meets the preset number of data.

[0030] In an optional embodiment, the method further includes:

[0031] When the data quantity does not meet the preset data quantity, a second query signaling is generated according to the sensing node information to be queried, the preset period, the bucket encoding and the preset distance data quantity;

[0032] The second query signaling is sent to the storage node, so that the storage node queries information corresponding to the query signaling according to the second query signaling.

[0033] In a third aspect, an embodiment of the present invention provides a data storage transfer device, which is applied to a target sensing node in a two-layer sensor network, wherein the query unit includes a storage node and multiple sensing nodes, and the target sensing node is any one of the multiple sensing nodes, characterized in that the device includes:

[0034] An acquisition module is used to obtain distance data from a query target within a preset period;

[0035] The processing module is further used to encode the distance data;

[0036] The processing module is further configured to classify the distance data into corresponding buckets according to the corresponding relationship between the codes of the distance data and the codes of the buckets;

[0037] An encryption module, used to encrypt the distance data belonging to the same bucket according to the secret key to obtain a ciphertext block, wherein the secret key is synchronized from the sink node to the sensing node and the storage node through a secure channel;

[0038] The sending module is used to send the information set to the storage node; the storage node is used to organize and store the obtained buckets according to the information set; the information set includes at least the information of the sensing node, the preset period, the ciphertext block, and the encoding of the distance data.

[0039] In a fourth aspect, an embodiment of the present invention provides a data query device, which is applied to a sink node in a two-layer sensor network, wherein the two-layer sensor network includes: multiple query units and the sink node, each query unit includes a storage node and multiple sensing nodes, and is characterized in that the device includes:

[0040] A generation module is used to generate a query signaling according to the sensing node information to be queried, the preset period, the bucket code and the number of preset distance data;

[0041] A transmitting module, configured to send the query signaling to the storage node, so that the storage node queries the information set corresponding to the query signaling according to the query signaling, where the information set includes at least the encoding of the ciphertext block and the distance data;

[0042] A receiving module, configured to receive an information set returned by a storage node;

[0043] A decryption module, configured to decrypt the ciphertext blocks in the received information set according to the secret key and obtain the decrypted distance data;

[0044] A verification module, used to verify the distance data based on the integrity code in the information;

[0045] The verification module is further used to verify whether the quantity of the distance data meets the preset data quantity when the distance data passes the verification, and complete the query when the data quantity meets the preset data quantity.

[0046] In the fifth aspect, an embodiment of the present invention provides a data storage and query device, the device including: a memory for storing programs; a processor for running the programs stored in the memory to execute the data storage and query method provided by the first aspect, the second aspect, any optional implementation of the first aspect, or any optional implementation of the second aspect.

[0047] In the sixth aspect, an embodiment of the present invention provides a computer storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the data storage and query method provided by the first aspect, the second aspect, any optional implementation of the first aspect, or any optional implementation of the second aspect is implemented.

[0048] The data storage method, apparatus, device and computer storage medium of the embodiments of the present invention can obtain the distance data between the target and the query target within a preset period, and then generate a code corresponding to the distance data based on the obtained distance data, and then classify the distance data into a corresponding bucket according to the code corresponding to the distance data, and encrypt the bucket as an encryption unit to generate a ciphertext block, and then send the generated ciphertext block together with the information of the perception node, the preset period and the code of the distance data to the storage node. This can prevent the distance data information from being maliciously destroyed when the perception node sends the distance data to the storage node, and can protect the security of the data in the two-layer sensor network. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0050] Figure 1 This is a two-layer sensor network model diagram provided by an embodiment of the present invention;

[0051] Figure 2 This is a flow chart of a data storage method provided by an embodiment of the present invention;

[0052] Figure 3 This is a flow chart of a data query method provided by an embodiment of the present invention;

[0053] Figure 4 This is a schematic structural diagram of a data storage device provided by an embodiment of the present invention;

[0054] Figure 5 This is a structural diagram of a data query device provided by an embodiment of the present invention;

[0055] Figure 6 It is a structural diagram of a data storage and query device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0056] The features and exemplary embodiments of various aspects of the present invention will be described in detail below. In order to make the objects, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention can be implemented without the need for some of these specific details. The following description of the embodiments is merely intended to provide a better understanding of the present invention by illustrating examples of the present invention.

[0057] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0058] Wireless sensor networks (WSNs), as an important component of the perception layer of the Internet of Things, are composed of a large number of micro-sensing nodes with certain perception, computing and communication capabilities through self-organization. They are widely used in various important fields such as environmental monitoring, urban management, medical care, national defense and military, industrial and agricultural control, etc.

[0059] In traditional wireless sensor network models based on node similarity, sensing nodes need to send their sensory data to a sink node over multiple hops for storage and processing. Consequently, sensing nodes adjacent to the sink node must not only transmit their own sensory data but also forward data received from other nodes. This heavy burden quickly depletes the energy of these nodes. In response to this, researchers designed a two-tier sensor network.

[0060] like Figure 1 The following diagram shows a two-tier sensor network model provided by an embodiment of the present invention. In a two-tier sensor network, the existing sensor network is divided into multiple query units, each containing multiple sensing nodes and a storage node. The storage node is responsible for receiving, storing, and processing sensor data sent by the sensing nodes within the unit and for executing aggregated query requests. While the two-tier sensor network architecture reduces communication overhead, there is currently no method to protect the privacy and security of data transmitted within a two-tier sensor network.

[0061] For ease of understanding, the relevant algorithms involved in this application are first explained:

[0062] 1. Bucket division mechanism:

[0063] Bucket partitioning: For the data interval [A, B], divide it into k continuous and non-intersecting subintervals [a1, a2), [a2, a3), ..., [a k , a k+1 ) so that it meets the following conditions:

[0064] (1)[a1,a2)∪[a2,a3)∪…∪[a k ,a k+1 )=[A,B];

[0065] (2) For any natural number p,q, p,q∈{1,2,…,k}, if p≠q then

[0066] At this time, any interval [a p ,a p+1 ) is a bucket into which the data domain [A, B] is divided.

[0067] Bucket label: For any interval in the bucket partition [a p ,a p+1 ), there exists a mapping relation f, with:

[0068] f:[a p ,a p+1 )→T p , where p∈{1,2,…,k},T p ∈N * , and satisfy:

[0069] For any two positive integers p, q, p,q∈{1,2,…,k}, if p≠q then T p ≠T q , then Tp is called the interval [a p ,a p+1 ) corresponding bucket tag.

[0070] In the same bucket partitioning scheme, for bucket labels Tp and Tq, let the data intervals corresponding to Tp and Tq be T' p and T' q , then the following relations must hold:

[0071] (1) If T' p >T' q , for any d p ∈T' p , d q ∈T' q , then there must be d p >d q ;

[0072] (2) If T' p =T' q , then there must be T p =T q , that is, Tp and Tq are labels of the same data interval;

[0073] (3) If T'p <T' q , for any d p ∈T' p , d q ∈T' q , then there must be d p <d q .

[0074] 2. Prefix membership verification mechanism:

[0075] Numeric prefix encoding set: For a numeric value x=b1b2…b containing α binary bits α , assuming that its prefix code set can be expressed as F(x), then

[0076] F(x)={b1b2…b α ,b1b2…b α-1 *,…,b1*…*,*…*}.

[0077] Interval prefix code set: For the interval [a, b], its prefix code set S([a, b]) = {p1, p2, ..., p δ The following conditions are met:

[0078] (1)p1,p2,…,p δ is a prefix code, and its corresponding interval union is equal to [a, b];

[0079] (2){p1,p2,…,p δ} is the minimum set that satisfies (1).

[0080] For a value x and an interval [a, b], if and only if When x∈[a,b].

[0081] For values ​​x and y, x, y ≤ d max , then the linear relationship between x and y satisfies:

[0082]

[0083] 3. Bloom Filter

[0084] The prefix membership verification mechanism can convert bucket intervals into prefix membership verification codes. However, a single interval can generate many prefix membership verification codes. Directly using prefix membership verification codes or simply performing a simple hash operation on them can lead to the following problems:

[0085] (1) The amount of code uploaded by the sensing node is too large, resulting in a large amount of communication energy consumption;

[0086] (2) It is easy to obtain the true value of the perception data through the search method.

[0087] Therefore, this method uses Bloom filters to store these prefix member verification codes to avoid the occurrence of the above two problems.

[0088] Bloom filter is widely used in the concise representation of sets and the determination of the membership relationship between data elements and sets. It is a randomized data structure that is very efficient in space. Bloom filter can generally be represented as a length of l m The bit array is initialized to '0' at the beginning, and k independent hash functions h1, h2, ..., h k To represent a set of b elements X={x1,x2,…,x b}. When the Bloom filter needs to store element xi(1≤x i ≤b), first calculate h1(x i )、h2(x i ),…,h k (x i ), and then set the corresponding bit value in the bit array to '1', h1(x1) = 3, h2(x1) = 6, h3(x3) = 8, then set the (3rd, 6th, 8th) bits in the array to '1'. Similarly, to represent element x2, the (8th, 11th, 13th) bits of the array are also set to '1'. If a bit is set to '1' multiple times, only the first operation will work, and the other operations will not have any effect. When you need to determine whether element y belongs to set X, you only need to look up the bits h1(y), h2(y), ..., h3(x3) in the bit array. k Are all bit values ​​of position (y) set to '1'? If not all are '1', then y definitely does not belong to X; if all are '1', then y belongs to X with a high probability. This is because the Bloom filter has a certain amount of false positives when judging the relationship between elements and sets.

[0089] Let h be the number of hash functions, l m is the encoding length of the Bloom filter, b represents the number of elements, and the probability of a false positive judgment [2] is:

[0090] P∈[0,(1-(1-1 / l m ) hb ) h ]

[0091] in,

[0092] Let B[a,b] represent the Bloom filter code constructed by the numerical prefix code of the interval [a,b], B dDenotes a Bloom filter code constructed by encoding the numerical prefix of data d, then the following theorem holds:

[0093] If B d ∩B [a,b] ≠B d , then there must be

[0094] If B d ∩B [a,b] =B d , then d∈[a,b] holds with a greater probability.

[0095] Secondly, in order to protect the privacy and security of data in a two-layer sensor network, embodiments of the present invention provide a data storage and query method, apparatus, device, and computer storage medium.

[0096] The following first introduces the data storage method provided in an embodiment of the present invention. The data storage method is applied to a target sensing node in a two-layer sensor network. The query unit includes a storage node and multiple sensing nodes, and the target sensing node is any one of the multiple sensing nodes.

[0097] Figure 2 FIG. 1 is a flow chart showing a data storage method according to an embodiment of the present invention. Figure 2 As shown, the method may include the following steps:

[0098] Step S201: obtaining distance data from a query target within a preset period.

[0099] In an optional implementation, the sensing node uses an incomplete distance data calculation method to obtain incomplete distance data between the sensing node and the query target within a preset period.

[0100] The preset period may include a period of one hour, one day, or one week.

[0101] Methods for calculating incomplete distance data include:

[0102] For a given d-dimensional incomplete data set S, the distance Dis(p,q) between any two points p and q∈S is:

[0103]

[0104] Where Iset(o) represents the set of all complete attributes of data o, δ i (p,q) is defined as:

[0105]

[0106] From an extreme perspective, when When p and q are incomplete data, Dis(p, q) is ∞; when p and q are complete data, Dis(p, q) is the square of the Euclidean distance between p and q.

[0107] Take a specific example. For incomplete data b(-, 7, 9, 20) and c(-, 10, -, 25), the calculation method of the distance Dis(b, c) between b and c is as follows. From Iset(b) = {d2, d3, d4} and Iset(c) = {d2, d4}, it can be obtained that Iset(b) ∩ Iset(c) = {d2, d4}. Therefore,

[0108] For incomplete data, by using the incomplete data distance calculation formula to convert the distance of incomplete data into complete data for processing, the query efficiency can be improved.

[0109] Step S202: Encode the distance data.

[0110] In an optional implementation manner, the sensing node generates a filter code corresponding to the verification code according to the verification code of the distance data. [[ID=​​​​​​​​​​​​​​​​​​​​Let B[a,b] represent the Bloom filter code constructed by the numerical prefix code of the interval [a,b], and Bd represent the Bloom filter code constructed by the numerical prefix code of the distance data. If B d ∩B [a,b] =B d , then the above distance data is classified into the above buckets.

[0118] In step S204, the sensing node encrypts the distance data belonging to the same bucket according to the secret key to obtain a ciphertext block, wherein the secret key is synchronized to the sensing node and the storage node through a secure channel by the sink node.

[0119] In an optional embodiment, the sensing node encrypts the distance data belonging to a bucket as a data block, thereby obtaining a ciphertext block with the bucket as the unit. Encrypting with the bucket as the encryption unit can facilitate data transmission.

[0120] Step S205: Send the information set to the storage node, so that the storage node can sort and store the obtained buckets according to the information set. The information set includes at least the information of the sensing node, the preset period, the ciphertext block, and the encoding of the distance data.

[0121] In an alternative embodiment, the sensing node sends an information set containing the sensing node information, a preset period, a ciphertext block, and an encoding of the distance data to the storage node. After receiving the information set, the storage node may sort the buckets according to the preset encodings of the buckets in the information set and then store the sorted buckets.

[0122] Arranging the buckets by the preset codes of the buckets may include: moving the distance data in buckets with the same code into one bucket, deleting the buckets that do not contain distance data after the move, and retaining the buckets with different codes.

[0123] Optionally, in some embodiments, sending the information set to the storage node includes:

[0124] Construct a hash tree based on distance data;

[0125] Perform HMAC encoding on the distance data in the bucket;

[0126] Get the XOR value of the HMAC code corresponding to the distance data in the bucket, and use the XOR value as the verification code of the bucket;

[0127] Sort the verification codes of the buckets and match the sorted verification codes with the hash tree;

[0128] Get the root node code of the hash tree corresponding to the bucket, and use the root node code of the hash tree of the bucket as the integrity verification code;

[0129] The sensing node sends an information set to the storage node, wherein the information set at least includes the sensing node information, a preset period, a ciphertext block, a coding of the distance data, and an integrity verification coding.

[0130] In an optional embodiment, a Merkle hash tree is constructed using the distance data in the obtained buckets, and then a hash operation is performed on the distance data to obtain the HMAC code of the distance data. The XOR value of the HMAC code is then obtained, and the obtained XOR value is used as the verification code of the bucket corresponding to the distance data. The verification code of the obtained bucket is then placed at the endpoint of the hash tree. The root node code of the hash tree is then obtained, and the obtained root node code of the hash tree is used as the integrity verification code. The integrity verification code, the information of the sensing node, the preset period, the ciphertext block, and the code of the distance data are then sent to the storage node together.

[0131] In the data storage method of the embodiment of the present invention, the distance data between the target and the query target can be obtained within a preset period, and a code corresponding to the distance data can be generated according to the obtained distance data. Then, the distance data can be classified into a corresponding bucket according to the code corresponding to the distance data, and the bucket is used as an encryption unit for encryption to generate a ciphertext block. Then, a hash algorithm is used to obtain a verification code of the bucket containing the distance data, and the verification code of the bucket is used to sort to form a hash tree and the root node code of the hash tree corresponding to the bucket is obtained as an integrity verification code. Then, the generated ciphertext block, integrity verification code, information of the perception node, the preset period and the code of the distance data are sent to the storage node. This can prevent the distance data information from being maliciously destroyed when the perception node sends the distance data to the storage node, and can protect the integrity and security of the data in the two-layer sensor network.

[0132] Based on the flowchart of the above data storage method, an embodiment of the present application also provides a data query method.

[0133] Figure 3 A flow chart of a data query method provided by an embodiment of the present invention is shown as follows: Figure 3 As shown, the method includes:

[0134] Step S301: Generate query signaling based on the sensing node information to be queried, the preset period, the bucket code, and the number of preset distance data.

[0135] The perception node information to be queried includes the ID of the perception node, the bucket code includes the set of bucket codes that the sink node needs to query, and the number of preset distance data includes the number of distance data that the sink node needs to query.

[0136] Step S302: Send the query signaling to the storage node, so that the storage node queries the information set corresponding to the query signaling according to the query signaling, where the information set at least includes the encoding of the ciphertext block and the distance data.

[0137] In an optional implementation, after receiving the query signaling, the storage node queries the corresponding information set according to the ciphertext block and the encoding information of the distance data contained in the query signaling, and sends the information set to the aggregation node.

[0138] As a specific example, after receiving the query signaling, the storage node obtains the set BF of bucket codes contained in the query signaling, and then searches the stored information set, and finds the information that meets the requirements. The information set corresponding to the set of buckets is sent to the sink node. The bucket code may include

[0139] Step S303: Receive the information set returned by the storage node.

[0140] The information set of the storage nodes received by the sink node is retrieved by the storage node according to the query signaling sent by the sink node.

[0141] Step S304: decrypt the ciphertext block in the received information set according to the secret key and obtain the decrypted distance data.

[0142] In an optional embodiment, after receiving the information set, the sink node decrypts the ciphertext blocks in the information set using a secret key shared by the sink node, the sensor node, and the storage node, and obtains the distance data in the corresponding bucket. The distance data is incomplete distance data.

[0143] Step S305: verify the distance data according to the integrity code in the information set.

[0144] In an optional implementation, verifying the integrity of the distance data includes calculating an integrity code, and when the distance data obtained by calculating the integrity code is identical to the obtained distance data, the verification is passed.

[0145] Step S306: When the distance data passes the verification, verify whether the quantity of the distance data meets the preset data quantity.

[0146] In an optional implementation, when the distance data is acquired, it is determined whether the acquired distance data meets the quantity of distance data that needs to be acquired.

[0147] Step S307: When the data quantity meets the preset data quantity, the query is completed.

[0148] In an optional implementation, when the amount of distance data obtained meets the amount of distance data that needs to be obtained, the distance between the sensing node and the query target is calculated using the distance data.

[0149] Optionally, in some embodiments, the distance data is verified based on the integrity code in the information set. When the verification fails, the aggregation node regenerates the query signaling based on the perception node information to be queried, the preset period, the bucket code and the number of preset distance data, and then sends the query signaling to the storage node.

[0150] In an optional implementation, the bucket code in the regenerated query signaling may or may not overlap with the original bucket code.

[0151] Optionally, in some embodiments, when the data quantity does not meet the preset data quantity, a second query signaling is generated based on the sensing node information to be queried, the preset period, the bucket encoding, and the preset distance data quantity;

[0152] The second query signaling is sent to a storage node, so that the storage node queries information corresponding to the query signaling according to the second query signaling.

[0153] In an optional embodiment, the encoding of the bucket in the generated second query signaling may or may not overlap with the encoding of the original bucket. In the data query method of an embodiment of the present invention, the aggregation node generates a query signaling based on the perception node information to be queried, the preset period, the encoding of the bucket, and the number of preset distance data, and sends the query signaling to the storage node. The storage node retrieves the information set stored in the storage node according to the encoding of the bucket in the query signaling, and sends the information set containing the encoding of the bucket in the query signaling to the aggregation node. The aggregation node then decrypts the ciphertext block in the information set according to the pre-stored secret key to obtain the distance data in the bucket, and then verifies the integrity of the obtained distance data according to the integrity verification code in the information set. When the integrity of the decrypted distance data passes the verification, it determines whether the number of distance data obtained meets the number of distance data required to be obtained. The sink node first obtains the distance data through decryption, and then verifies the integrity of the obtained distance data, which can prevent the information from being maliciously destroyed during the transmission between the storage node and the sink node. When it is found that the information is destroyed or the obtained distance data does not meet the required data volume, the information query is performed again, realizing the automation of information query, and can efficiently query the data in the two-layer sensor network, and protect the integrity and security of the data in the two-layer sensor network during the query process.

[0154] Based on the same inventive concept, an embodiment of the present application also provides a data storage device.

[0155] Figure 4 FIG. 1 shows a schematic structural diagram of a data storage device provided by an embodiment of the present invention. Figure 4 As shown, the storage device is applied to a target sensing node in a two-layer sensor network, the query unit includes a storage node and multiple sensing nodes, and the target sensing node is any one of the multiple sensing nodes, and the device includes:

[0156] The acquisition module 401 is used to acquire the distance data to the query target within a preset period.

[0157] The processing module 402 is used to encode the distance data.

[0158] The processing module 402 is further configured to classify the distance data into corresponding buckets according to the correspondence between the codes of the distance data and the codes of the buckets;

[0159] The encryption module 403 is used to encrypt the distance data belonging to the same bucket according to the secret key to obtain a ciphertext block, wherein the secret key is synchronized from the sink node to the sensing node and the storage node through a secure channel;

[0160] The sending module 404 is used to send the information set to the storage node; the storage node is used to organize and store the obtained buckets according to the information set; the information set includes at least the information of the sensing node, the preset period, the ciphertext block, and the encoding of the distance data.

[0161] In an optional implementation, the acquisition module 401 is specifically configured to acquire incomplete distance data between the sensing node and the query target using an incomplete distance data calculation method within a preset period.

[0162] In an optional implementation, the processing module 402 is specifically configured to generate a filter code corresponding to the verification code according to the verification code of the distance data.

[0163] In an optional embodiment, the processing module is specifically used to construct a hash tree based on the distance data, perform a hash operation message authentication code HMAC encoding on the distance data in the bucket, obtain the XOR value of the HMAC code corresponding to the distance data in the bucket, and use the XOR value as the verification code of the bucket; sort the verification codes of the bucket, and correspond the sorted verification codes to the hash tree.

[0164] Get the root node code of the hash tree corresponding to the bucket, and use the root node code of the hash tree of the bucket as the integrity verification code.

[0165] In some embodiments, the information set sent by the sending module 404 to the storage node further includes an integrity verification code.

[0166] In the data storage device of the embodiment of the present invention, the distance data between the target and the query target can be obtained within a preset period, a code corresponding to the distance data can be generated according to the obtained distance data, and then the distance data can be classified into a corresponding bucket according to the code corresponding to the distance data, and the bucket is used as an encryption unit to encrypt and generate a ciphertext block, and then a hash algorithm is used to obtain the verification code of the bucket containing the distance data, and the verification code of the bucket is used to sort to form a hash tree and the root node code of the hash tree corresponding to the bucket is obtained as the integrity verification code, and then the generated ciphertext block, integrity verification code, information of the perception node, preset period and code of the distance data are sent to the storage node, which can avoid the distance data information from being maliciously destroyed when the perception node sends the distance data to the storage node, and can protect the integrity and security of the data in the two-layer sensor network.

[0167] Based on the above-mentioned data storage device, an embodiment of the present application also provides a data query device.

[0168] Figure 5 A schematic diagram of the structure of a data query device provided by an embodiment of the present invention is shown in FIG. Figure 5 As shown, the query device is applied to a sink node in a two-layer sensor network, the two-layer sensor network includes: multiple query units and the sink node, each query unit includes a storage node and multiple sensing nodes, the device includes:.

[0169] The generation module 501 is used to generate a query signaling according to the sensing node information to be queried, the preset period, the bucket code and the number of preset distance data;

[0170] The transmitting module 502 is configured to send the query signaling to the storage node, so that the storage node queries the information set corresponding to the query signaling according to the query signaling, where the information set includes at least the encoding of the ciphertext block and the distance data;

[0171] The receiving module 503 is used to receive the information set returned by the storage node;

[0172] The decryption module 504 is used to decrypt the ciphertext blocks in the received information set according to the secret key and obtain the decrypted distance data;

[0173] The verification module 505 is used to verify the distance data according to the integrity code in the information;

[0174] The verification module 505 is further configured to verify whether the quantity of the distance data satisfies a preset quantity of data when the distance data passes the verification, and complete the query when the quantity of the distance data satisfies the preset quantity of data.

[0175] In some embodiments, the generation module 501 is also used to generate a second query signaling based on the perception node information, preset period, bucket encoding and preset distance data quantity to be queried when the data quantity does not meet the preset data quantity, and send the second query signaling to the storage node so that the storage node queries the information corresponding to the query signaling according to the second query signaling.

[0176] In a data query device according to an embodiment of the present invention, a sink node generates a query signaling based on the sensor node information to be queried, a preset period, a bucket code, and a preset number of distance data, and sends the query signaling to a storage node. The storage node retrieves the information set stored in the storage node based on the bucket code in the query signaling, and sends the information set containing the bucket code in the query signaling to the sink node. The sink node then decrypts the ciphertext block in the information set using a pre-stored secret key to obtain the distance data in the bucket. The sink node then verifies the integrity of the obtained distance data based on the integrity verification code in the information set. If the integrity of the decrypted distance data passes the verification, the sink node determines whether the number of distance data obtained meets the required number of distance data. The sink node first decrypts the data before obtaining the distance data, and then verifies the integrity of the obtained distance data. This prevents malicious corruption of information during transmission between the storage node and the sink node. If information corruption is detected or the obtained distance data does not meet the required data volume, the sink node performs another information query, thus achieving automated information querying and efficiently querying data in a two-layer sensor network. The integrity and security of the data in the two-layer sensor network are protected during the query process.

[0177] Based on the same inventive concept, an embodiment of the present application also provides an electronic device.

[0178] Figure 6 A schematic diagram of the structure of a data storage and query device provided by an embodiment of the present invention is shown. Figure 6 As shown:

[0179] The data storage and query device may include a processor 601 and a memory 602 storing computer program instructions.

[0180] Specifically, the processor 601 may include a central processing unit (CPU) or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiment of the present invention.

[0181] The memory 602 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 602 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these. In one example, the memory 602 may include a removable or non-removable (or fixed) medium, or the memory 602 may be a non-volatile solid-state memory. The memory 602 may be inside or outside the integrated gateway disaster recovery device.

[0182] In one example, the memory 602 may be a read-only memory (ROM). In one example, the ROM may be a mask-programmable ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or a flash memory, or a combination of two or more of these.

[0183] The memory 602 may include read-only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical, or other physical / tangible memory storage devices. Thus, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.

[0184] The processor 601 reads and executes the computer program instructions stored in the memory 602 to implement Figures 2 to 5 The method in the embodiment shown in FIG. Figures 2 to 5 The corresponding technical effects achieved by executing the methods / steps in the illustrated example will not be repeated here for the sake of brevity.

[0185] In one example, the data storage and query device may further include a communication interface 603 and a bus 610. Figure 6 As shown, the processor 601, the memory 602, and the communication interface 603 are connected via a bus 610 and communicate with each other.

[0186] The communication interface 603 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiment of the present invention.

[0187] The bus 610 includes hardware, software, or both, coupling the components of the online data traffic metering device to each other. By way of example and not limitation, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses or a combination of two or more of these. Where appropriate, the bus 610 may include one or more buses. Although the embodiments of the present invention describe and illustrate specific buses, the present invention contemplates any suitable bus or interconnect.

[0188] The data storage and query device can execute the storage and query method in the embodiment of the present invention based on the above hardware, thereby realizing the combination of Figures 2 to 5 The storage and query method and device described.

[0189] In addition, in conjunction with the storage and query methods in the above embodiments, embodiments of the present invention may provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any one of the storage and query methods in the above embodiments is implemented.

[0190] It should be understood that the present invention is not limited to the specific configurations and processes described above and illustrated in the figures. For the sake of brevity, a detailed description of known methods is omitted. In the above embodiments, several specific steps are described and illustrated as examples. However, the method of the present invention is not limited to the specific steps described and illustrated. Those skilled in the art may make various changes, modifications, and additions, or change the order of the steps after understanding the spirit of the present invention.

[0191] The functional blocks shown in the above structured block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in unit, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium that can store or transmit information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROMs, flash memories, erasable ROMs (EROMs), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0192] It should also be noted that the exemplary embodiments described herein describe methods or systems based on a series of steps or devices. However, the present invention is not limited to the order of the steps described above. In other words, the steps may be performed in the order described in the embodiments, or in a different order, or several steps may be performed simultaneously.

[0193] Aspects of the present disclosure have been described above with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit. It is also understood that each box in the block diagram and / or flowchart and the combination of the boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs the specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0194] The above is only a specific embodiment of the present invention. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present invention is not limited to this. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be covered within the protection scope of the present invention.

Claims

1. A data storage method, applied to a target sensing node in a two-layer sensor network, the two-layer sensor network comprising: Multiple query units and aggregation nodes, the query unit includes a storage node and multiple sensing nodes, and the target sensing node is any one of the multiple sensing nodes, characterized in that the method includes: Obtain the distance data to the query target within a preset period; encoding the distance data; Classifying the distance data into corresponding buckets according to the correspondence between the codes of the distance data and the codes of the buckets; Encrypting the distance data belonging to the same bucket according to a secret key to obtain a ciphertext block, wherein the secret key is synchronized from the sink node to the sensing node and the storage node through a secure channel; Sending an information set to the storage node; for the storage node to organize and store the obtained buckets according to the information set; the information set includes at least information of the sensing node, a preset period, a ciphertext block, and an encoding of the distance data; The classifying the distance data into the corresponding bucket according to the correspondence between the encoding of the distance data and the encoding of the bucket includes: If B d ∩B [a,b] =B d , the distance data is classified into the bucket corresponding to the interval [a, b], where B[a, b] represents the code constructed by the numerical prefix code of the bucket corresponding to the interval [a, b], and Bd represents the code constructed by the numerical prefix code of the distance data.

2. The method according to claim 1, characterized in that The sensing node obtains the distance data between the sensing node and the query target within a preset period, specifically including: The incomplete distance data calculation method is used to obtain the incomplete distance data between the sensing node and the query target within a preset period.

3. The method according to claim 1, characterized in that The encoding of the distance data specifically includes: A filter code corresponding to the verification code is generated according to the verification code of the distance data.

4. The method according to claim 1, wherein After the sensing node encrypts the distance data belonging to the same bucket according to the secret key to obtain a ciphertext block, the method further includes: Constructing a hash tree according to the distance data; Perform HMAC encoding on the distance data in the bucket; Obtain the XOR value of the HMAC code corresponding to the distance data in the bucket, and use the XOR value as the verification code of the bucket; Sorting the verification codes of the buckets, and matching the sorted verification codes with the hash tree; Obtain the root node code of the hash tree corresponding to the bucket, and use the root node code of the hash tree of the bucket as the integrity verification code.

5. A data query method, applied to a sink node in a two-layer sensor network, the two-layer sensor network comprising: Multiple query units and the aggregation node, each query unit includes a storage node and multiple perception nodes, characterized in that the method includes: Generate query signaling based on the sensing node information to be queried, the preset period, the bucket encoding, and the number of preset distance data; Sending the query signaling to a storage node, so that the storage node queries an information set corresponding to the query signaling according to the query signaling, where the information set includes at least a ciphertext block and an encoding of the distance data, wherein the ciphertext block is obtained by encrypting the distance data belonging to the same bucket by the sensing node according to a secret key; and the encoding of the distance data is obtained by encoding the distance data by the sensing node; Receiving the information set returned by the storage node; Decrypting the ciphertext block in the received information set according to the secret key and obtaining the decrypted distance data; Verifying the distance data according to the integrity code in the information set; When the distance data passes the verification, verifying whether the quantity of the distance data meets a preset data quantity; The query is completed when the data quantity meets the preset data quantity.

6. The method according to claim 5, characterized in that The method further comprises: When the data quantity does not meet the preset data quantity, a second query signaling is generated according to the sensing node information to be queried, the preset period, the bucket code and the preset distance data quantity; The second query signaling is sent to a storage node, so that the storage node queries information corresponding to the query signaling according to the second query signaling.

7. A data storage device, applied to a target sensing node in a two-layer sensor network, the two-layer sensor network comprising: Multiple query units and aggregation nodes, the query unit includes a storage node and multiple sensing nodes, and the target sensing node is any one of the multiple sensing nodes, characterized in that the device includes: An acquisition module is used to obtain distance data from a query target within a preset period; A processing module, configured to encode the distance data; The processing module is further configured to classify the distance data into corresponding buckets according to a correspondence between the codes of the distance data and the codes of the buckets; an encryption module, configured to encrypt the distance data belonging to the same bucket according to a secret key to obtain a ciphertext block, wherein the secret key is synchronized from the sink node to the sensing node and the storage node through a secure channel; A sending module, configured to send an information set to the storage node, so that the storage node can organize and store the acquired buckets according to the information set; the information set includes at least information of the sensing node, a preset period, a ciphertext block, and an encoding of the distance data; The processing module is specifically used for d ∩B [a,b] =B d , the distance data is classified into the bucket corresponding to the interval [a, b], where B[a, b] represents the code constructed by the numerical prefix code of the bucket corresponding to the interval [a, b], and Bd represents the code constructed by the numerical prefix code of the distance data.

8. A data query device, applied to a sink node in a two-layer sensor network, the two-layer sensor network comprising: Multiple query units and the aggregation node, each query unit includes a storage node and multiple perception nodes, characterized in that the device includes: A generation module, configured to generate a query signaling according to the sensing node information to be queried, a preset period, a bucket code, and the number of preset distance data; a transmitting module, configured to send the query signaling to a storage node, so that the storage node queries an information set corresponding to the query signaling according to the query signaling, the information set including at least an encoding of a ciphertext block and distance data; A receiving module, configured to receive the information set returned by the storage node; a decryption module, configured to decrypt the ciphertext block in the received information set according to a secret key and obtain decrypted distance data; A verification module, configured to verify the distance data based on the integrity code in the information; The verification module is further configured to verify whether the quantity of the distance data satisfies a preset quantity of data when the distance data passes the verification, and complete the query when the quantity of the distance data satisfies the preset quantity of data.

9. A data storage and query device, characterized in that: The device includes: a processor, and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement the data storage and query method according to any one of claims 1-4 or 5-6.

10. A computer storage medium, characterized in that The computer storage medium stores computer program instructions, which, when executed by a processor, implement the data storage and query method according to any one of claims 1 to 4 or 5 to 6.

Images