Data integrity verification methods, devices, electronic equipment, and computer storage media

Abstract

The embodiment of the application provides a data integrity verification method and device, electronic equipment and a computer storage medium, the method comprises the following steps: obtaining a data integrity verification request from a first user; obtaining a first authentication code, a first authenticator and a first file label of a data block held by the first user according to the data integrity verification request; obtaining a first authorization credential corresponding to a user group to which the first user belongs; parsing the first file label, and determining whether the first user is a valid user and the validity of the first file label and the first authenticator according to the parsing result and the first authorization credential; if the first user is a valid user and the first file label and the first authenticator are both valid, the first file label and the data integrity verification request are sent to an audit end, so that the audit end generates a challenge command according to the first file label and the data integrity verification request to verify the data integrity of a data storage end. The data integrity verification method provided by the application has high applicability.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a data integrity verification method, apparatus, electronic device, and computer storage medium. Background Technology

[0002] As a derivative of cloud computing technology, cloud storage services can provide users with huge storage space. Users can upload local data to remote cloud servers. However, since cloud service providers are not fully trusted third-party entities, data security and loss issues may occur due to non-human factors such as hardware failure and human factors such as profiteering.

[0003] Currently, when users verify the integrity of data on cloud storage services, they need to download the entire data and then determine whether the data is complete based on the size of the downloaded data.

[0004] However, when the amount of data stored by users is large, the time required to download all the data is long and consumes a lot of network resources, resulting in high time costs when verifying data integrity. Therefore, the existing data integrity verification methods are not very applicable. Summary of the Invention

[0005] In view of this, embodiments of this application provide a data integrity verification method, apparatus, electronic device, and computer storage medium to at least partially solve the above-mentioned problems.

[0006] According to a first aspect of the embodiments of this application, a data integrity verification method is provided, applied to an access control terminal. The method includes: obtaining a data integrity verification request from a first user; obtaining a first authentication code, a first authenticator, and a first file tag for a data block held by the first user according to the data integrity verification request, wherein the first authenticator includes at least two first authentication codes; obtaining a first authorization credential corresponding to the user group to which the first user belongs; parsing the first file tag, and determining whether the first user is a valid user based on the parsing result and the first authorization credential, and determining the validity of the first file tag and the first authenticator; if the first user is a valid user, and the first file tag and the first authenticator are both valid, then sending the first file tag and the data integrity verification request to an auditing terminal, so that the auditing terminal generates a challenge command to verify data integrity to the data storage terminal based on the first file tag and the data integrity verification request.

[0007] In one possible implementation, parsing the first file tag and determining whether the first user is a valid user based on the parsing result and the first authorization credential, and determining the validity of the first file tag and the first authenticator, includes: parsing the first file tag to obtain the second authorization credential and the first signature contained in the first file tag; comparing the first authorization credential and the second authorization credential to determine whether the first user is a valid user; if the first user is a valid user, verifying the validity of the first file tag based on the first signature; if the first file tag is valid, determining the validity of the first authenticator through a pre-set first verification formula.

[0008] In one possible implementation, the method further includes: obtaining the revocation command of the second user; if the user group to which the second user belongs is a first-level user group, then deleting the second user from the first permission management table of the first-level user group, and assigning the second-level user group managed by the second user to the management of a third user, wherein the third user and the second user are in the same second-level user group; if the user group to which the second user belongs is a second-level user group, then deleting the second user from the second permission management table of the second-level user group, and generating a third authorization credential; and determining the third authorization credential as the first authorization credential of the second-level user group.

[0009] In one possible implementation, the method further includes: obtaining a join command from a fourth user; if the fourth user needs to join a secondary user group, obtaining a master key from the administrator of the primary user group, and obtaining an authorization key and authorization credential from the secondary user group; calculating a key corresponding to the fourth user using the master key and the authorization key, wherein the key is used to calculate the first authentication code and the first authenticator.

[0010] According to a second aspect of the embodiments of this application, a data integrity verification method is provided, applied to an auditing end. The method includes: obtaining a first file tag sent by an access control end and a data integrity verification request from a first user; verifying the validity of the first user according to the integrity verification request; if the first user is a valid user, generating a challenge command and sending the challenge command to a data storage end, so that the data storage end generates a data holding certificate according to the challenge command; obtaining the data holding certificate; and verifying data integrity according to the first file tag and the data holding certificate using a pre-set second verification formula.

[0011] According to a third aspect of the embodiments of this application, a data integrity verification device is provided, applied to an access control terminal. The device includes: a first acquisition module, configured to acquire a data integrity verification request from a first user; a second acquisition module, configured to acquire, according to the data integrity verification request, a first authentication code, a first authenticator, and a first file tag of a data block held by the first user, wherein the first authenticator includes at least two first authentication codes; a third acquisition module, configured to acquire a first authorization credential corresponding to the user group to which the first user belongs; a parsing module, configured to parse the first file tag, and determine whether the first user is a valid user based on the parsing result and the first authorization credential, and determine the validity of the first file tag and the first authenticator; and a sending module, configured to, if the first user is a valid user and the first file tag and the first authenticator are both valid, send the first file tag and the integrity verification request to an auditing terminal, so that the auditing terminal generates a challenge command based on the first file tag and the integrity verification request to verify data integrity to a data storage terminal.

[0012] According to a fourth aspect of the embodiments of this application, a data integrity verification device is provided, applied at an auditing end. The device includes: a fourth acquisition module, configured to acquire a first file tag sent by an access control terminal and a data integrity verification request from a first user; a first verification module, configured to verify the validity of the first user according to the integrity verification request; a generation module, configured to generate a challenge command if the first user is a valid user, so that a data storage terminal generates a data holding certificate according to the challenge command; a fifth acquisition module, configured to acquire the data holding certificate; and a second verification module, configured to verify data integrity according to the first file tag and the data holding certificate using a pre-set second verification formula.

[0013] According to a fifth aspect of the embodiments of this application, a data integrity verification system is provided, including: the apparatus described in the third aspect of the embodiments of this application and the apparatus described in the fourth aspect of the embodiments of this application.

[0014] According to a sixth aspect of the present application, an electronic device is provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus; the memory is used to store at least one executable instruction, wherein the executable instruction causes the processor to perform the method described in the first aspect of the present application or the method described in the second aspect of the present application.

[0015] According to a seventh aspect of the present application, a computer storage medium is provided that stores a computer program thereon, which, when executed by a processor, implements the method described in the first aspect of the present application or the method described in the second aspect of the present application.

[0016] According to the data integrity verification method provided in this application embodiment, a first authentication code, a first authenticator, and a first file tag of a data block held by a first user are obtained, as well as a first authorization credential of the user group to which the first user belongs. This allows for the determination of whether the first user is a valid user based on the first authorization credential, the first authenticator, and the first file tag. This achieves user group-based access control and verifies user permissions during data integrity verification, preventing unauthorized users from obtaining data and improving data security. Furthermore, the auditing end can generate a challenge command based on the file tag and send it to the data storage end, thus verifying data integrity without completely downloading the data, improving the efficiency of data integrity verification. This makes the data integrity verification method suitable for situations with large amounts of data, therefore, this data integrity verification method has high applicability. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings.

[0018] Figure 1 This is a flowchart of a data integrity verification method provided in an embodiment of this application;

[0019] Figure 2 A schematic diagram of a first permission management table provided for an embodiment of this application;

[0020] Figure 3 This is a schematic diagram of a second permission management table provided in an embodiment of this application;

[0021] Figure 4 This is a schematic diagram of another first permission management table provided in an embodiment of this application;

[0022] Figure 5 This is a flowchart of another data integrity verification method provided in the embodiments of this application;

[0023] Figure 6 This is a schematic diagram of a data integrity verification device provided in an embodiment of this application;

[0024] Figure 7This is a schematic diagram of another data integrity verification device provided in an embodiment of this application;

[0025] Figure 8 This is a schematic diagram of a data integrity verification system provided in an embodiment of this application;

[0026] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0027] To enable those skilled in the art to better understand the technical solutions in the embodiments of this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art should fall within the protection scope of the embodiments of this application.

[0028] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0029] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0030] Figure 1 This is a flowchart of a data integrity verification method provided in an embodiment of this application. This data integrity verification method is applied to an access control system, such as... Figure 1 As shown, the method includes the following steps 101 to 105:

[0031] Step 101: Obtain the data integrity verification request from the first user.

[0032] Receive a data integrity verification request from the first user, who is any user who stores data on a cloud storage service and requests to query the integrity of the stored data.

[0033] Step 102: Based on the data integrity verification request, obtain the first authentication code, the first authenticator, and the first file tag of the data block held by the first user, wherein the first authenticator contains at least two first authentication codes.

[0034] The first user calculates the first authentication code, the first authenticator, and the first file tag corresponding to the data block containing their stored data. The first user first uses the formula... Calculate the first authentication code for the data block, where h is the hash function {0, 1}. * →G1, sk is the key held by the first user, m i This refers to the data block corresponding to the data stored by the user. After the first user calculates the first authentication code, the set of the first authentication codes is used as the first authenticator, that is, the first authenticator is ∑={T i} 1≤i≤n Then the first user uses the formula tag = fid||A||SSig ssk (fid||A) calculates the first file tag, where A is the authorization credential held by the first user. After the first user completes the calculation, the system obtains the calculation result, that is, obtains the first authentication code, the first authenticator, and the first file tag of the data block held by the first user.

[0035] Step 103: Obtain the first authorization credential corresponding to the user group to which the first user belongs.

[0036] Obtain the first authorization credential of the user group to which the first user belongs. Different user groups have different authorization credentials.

[0037] Each user can grant other members permission to access the files they create. The file creator and its authorized users together constitute a user group, and users not in the user group cannot access the files in that user group. Therefore, each user group has corresponding authorization credentials, which can determine the user's access permissions to the data.

[0038] Step 104: Parse the first file tag, and determine whether the first user is a valid user based on the parsing result and the first authorization credential, and determine the validity of the first file tag and the first authenticator.

[0039] After obtaining the first file tag, the system parses the first file tag and determines whether the first user is valid based on the parsing result. If the first user is valid, the system determines the validity of the first file tag and the first authenticator. If the first user is invalid, the system rejects the first user's data integrity verification request.

[0040] Step 105: If the first user is a valid user, and both the first file tag and the first authenticator are valid, then the first file tag and the integrity verification request are sent to the auditing end, so that the auditing end can generate a challenge command based on the first file tag and the data integrity verification request to verify the data integrity to the data storage end.

[0041] When the first user is valid, and both the first file tag and the first authenticator are valid, set the first file tag tag = fid||A||SSig ssk (fid||A) is sent to the auditing end. The auditing end generates a challenge command based on the first file tag and the data integrity verification request from the first user, and sends the challenge command to the data storage end, thereby realizing the verification of data integrity.

[0042] It should be understood that when the first user is valid, but the first file tag is invalid and / or the first authenticator is invalid, the system considers the data integrity verification request to be issued by an unauthorized user. In this case, the system rejects the data integrity verification request issued by the user, that is, it will not send the first file tag and the data integrity verification request to the audit end.

[0043] In this embodiment, the first authentication code, first authenticator, and first file tag of the data block held by the first user are obtained, as well as the first authorization credential of the user group to which the first user belongs. This allows for the determination of whether the first user is a valid user based on the first authorization credential, first authenticator, and first file tag, thus achieving user group-based access control. Furthermore, user permissions are verified during data integrity verification, preventing unauthorized users from obtaining data and improving data security. The auditing end can generate challenge commands based on the file tag and send them to the data storage end, eliminating the need to completely download the data to verify its integrity, thereby improving the efficiency of data integrity verification. This makes the data integrity verification method suitable for situations with large amounts of data, thus demonstrating high applicability.

[0044] In one possible implementation, when parsing the first file tag and determining whether the first user is a valid user based on the parsing result and the first authorization credential, and determining the validity of the first file tag and the first authenticator, the first file tag can be parsed to obtain the second authorization credential and the first signature contained in the first file tag. Then, the first authorization credential and the second authorization credential are compared to determine whether the first user is a valid user. If the first user is a valid user, the validity of the first file tag is verified based on the first signature. If the first file tag is valid, the validity of the first authenticator is determined by a pre-set first verification formula.

[0045] Parse the first file tag to obtain the second authorization credential contained in the first file tag. Compare the authorization credential with the first authorization credential of the user group to which the first user belongs. If the two authorization credentials are the same, the first user is determined to be a valid user. If the first user is an invalid user, the data integrity verification request of the first user is rejected.

[0046] If the first user is a valid user, then the parsed first signature SSig is determined. ssk If the signature (fid||A) is invalid, then the first file tag is invalid, meaning the first user either calculated incorrectly or is an unauthorized user. If the signature is valid, then according to the formula... Determine if the authenticator is valid. If the authenticator is invalid, the first user is considered an illegitimate user. If the authenticator is valid, continue with the subsequent steps of file integrity verification.

[0047] It should be noted that if the first user fails to pass verification, no further verification steps will be performed. The three verification steps are sequential, and if any step fails, the subsequent verification will not proceed, thus improving the efficiency of verifying user validity.

[0048] In this embodiment, by parsing the file tag and determining whether the first user and the first file tag are valid, the validity of the first user and the first file tag are determined. This realizes the verification of user permissions during data integrity verification, avoids the situation where unauthorized users obtain data, and improves the security of data during data integrity verification. In the validity verification process, the three-layer verification is carried out in sequence. If the first layer of verification fails, the subsequent verification will not be carried out, which reduces the amount of computation during data integrity verification and improves the efficiency of data integrity verification.

[0049] In one possible implementation, the data integrity verification method further includes: obtaining the revocation command of the second user. If the user group to which the second user belongs is a first-level user group, then the second user is deleted from the first permission management table of that first-level user group, and the second-level user group managed by the second user is assigned to the management of a third user, wherein the third user and the second user are in the same second-level user group. If the user group to which the second user belongs is a second-level user group, then the second user is deleted from the second permission management table of that second-level user group, and a third authorization credential is generated, and the third authorization credential is determined as the first authorization credential of that second-level user group.

[0050] User access is managed based on user groups. A first-level administrator manages the entire first-level user group. Each first-level user group includes multiple second-level administrators, and each second-level administrator manages at least one second-level user group. All users in a first-level user group share all unauthorized data, while users in a second-level user group share the authorized data of users in that user group.

[0051] When a user needs to be revoked, it is determined whether the user belongs to a Level 1 user group or a Level 2 user group. If the user belongs to a Level 2 user group, the Level 1 administrator updates the number of users in the Level 1 user group to K = K - 1 (K ≥ 0), and sets the ID... j ||K||SSig(ID j ||K) Send to other users in the user group who have not been revoked, and then modify the permission storage table in the local storage.

[0052] For example, Figure 2 A schematic diagram of a first permission management table provided in an embodiment of this application, as shown below. Figure 2 As shown, the Level 1 administrator (GM) selects another user ID within the authorized group. w (1≤w≤K,w≠j) is the new Level 2 Administrator (SGM) within this authorized group, by using ID j The corresponding second permission management table AF j Link in ID w The corresponding second permission management table AF w The tail section enables the transfer of user and data access management permissions to be revoked, where ID... j Corresponding to the second user, ID w For the third user, Pr corresponds to the head pointer of the second permission management table managed by that second-level administrator.

[0053] When the second user is in the second-level user group, the new administrator of the second-level user group, i.e., the third user ID... w Delete the second user from the second permission management table and reselect a random blind value. Calculate D3 = g β Then generate a new authorization credential A = H2(ID) w ) r+β The user was then sent to other users in the secondary user group who had not yet withdrawn their accounts, thus deleting the user.

[0054] It should be understood that after the second user is deleted, new authorization credentials are generated for other users in the second-level user group to which the second user belongs. Therefore, the second user cannot perform data integrity verification due to the different authorization credentials. Thus, if the system mistakenly identifies the second user as a valid user, the user will also be unable to perform data integrity verification and access data.

[0055] For example, Figure 3 This is a schematic diagram of a second permission management table provided in an embodiment of this application. For ease of explanation, Figure 3 In the example, the second user ID j It not only manages a second-level user group, but this user is also listed as a third-level user ID as a regular user. wIn the managed secondary user groups. For example... Figure 3 As shown, the third user ID w First, delete the second user from the second-level user group you manage, that is, delete the user from the second-level permission management table AF. w Lieutenant General Second User ID j The corresponding data is deleted, and a new authorization credential A' is generated for other users in the user group. Then, the third user accesses the second user's ID. j The managed secondary user group generates new authorization credentials for other users within that group, specifically in the secondary permission management table AF. j The system generates new authorization credentials A″ for other users in the user group, thereby completing the deletion process.

[0056] It should be noted that, Figure 2 and Figure 3 In this context, NO represents the user's ID, ID represents the user's identifier, A represents the authorization credential, and AF represents the user's credential. w Used to identify the third user ID w The second permission management table corresponding to the managed second-level user groups is similar to the above and will not be repeated here.

[0057] In this embodiment, the user group to which the second user belongs is determined, and different revocation methods are applied to the second user based on the different user groups. New authorization credentials are generated for other users in the revoked user group, thereby preventing the revoked user from accessing the data shared by the user group and thus preventing data integrity verification. This ensures the security of data storage, avoids access by unauthorized users, and improves the security of data integrity verification. This makes the data integrity verification method applicable to the case of user revocation, and therefore the data integrity verification method has high applicability.

[0058] In one possible implementation, the data integrity verification method further includes: obtaining a join command from a fourth user; and determining the key and first authorization credential corresponding to the fourth user based on the user group the fourth user needs to join.

[0059] In this embodiment of the application, when a request to join from a fourth user is received, the key corresponding to the fourth user and the first authorization credential corresponding to the user group to which the fourth user needs to join are calculated according to the user group to which the fourth user needs to join. This enables the fourth user to share data with other members of the user group to which the fourth user needs to join, thus realizing the joining of members.

[0060] In one possible implementation, when determining the key and first authorization credential corresponding to the fourth user based on the user group the fourth user needs to join, if the fourth user needs to join a second-level user group, the master key from the administrator of the first-level user group is obtained, as well as the authorization key and authorization credential from the second-level user group. The key corresponding to the fourth user is calculated using the master key and the authorization key, wherein the key is used to calculate the first authentication code, the first authenticator, and the first file tag.

[0061] When a fourth user requests to join a second-level user group, the first step is to obtain the master key from the first-level administrator. This master key is generated as follows: the first-level administrator randomly selects secret parameters. And calculate the master key gsk = x·H1(GID) and the verification value D1 = g based on the group identifier GID. x Then the master key gsk is sent to the fourth user, who can then check the equation. This is used to verify the correctness of the master key gsk, where the group's identity identifier GID is public data.

[0062] After obtaining the master key, the fourth user obtains the authorization key and first authorization credential from the secondary user group that needs to join. The authorization key and authorization credential are generated as follows: the secondary administrator randomly selects... As the authorization key, ask = γ, and the verification value Y1 = g is calculated. γ Level 2 administrators are randomly selected. Calculate D2 = g α D3 = g β H2(ID) and D4 = H2(ID) α Where ID is the identifier for a level-two administrator. Then, an authorization credential A = H2(ID) is generated for the user. ask+β =H2(ID) γ+β Finally, (ask, A) is sent to the fourth user. After receiving it, the fourth user can verify the validity of A and ask according to e(A, D2) = e(D4, Y1·D3).

[0063] After receiving the master key gsk and the authorization key ask, the fourth user calculates their own key according to sk = gsk + ask. This key is used to perform calculations using the formula... Calculate the first authentication code and the first authenticator held by the fourth user.

[0064] When a fourth user requests to join a first-level user group, for example, Figure 4 This is a schematic diagram of another first permission management table provided in an embodiment of this application, such as... Figure 4 As shown, with the consent of the first-level administrator (GM), the fourth user ID will be... K+1Set as the new Level 2 Administrator (SGM), and the Level 1 Administrator (GM) will assign the fourth user ID. K+1 The second permission management table AF corresponds to the second-level user group managed by the fourth user. K+1 The relevant information is inserted into the last row of the first permission management table, and then sent to the fourth user ID. K+1 Send the master key gsk.

[0065] In this embodiment, a user join command is obtained. If the user needs to join a secondary user group, the master key and authorization key are obtained to calculate the user's key and obtain the authorization credential. This allows the user to share data with other users in the user group through the authorization credential. Furthermore, the first authentication code and the first authenticator can be calculated through the key, thereby enabling data integrity verification. This data integrity verification method is applicable to the case of user addition, thus exhibiting high applicability.

[0066] Figure 5 This is a flowchart of another data integrity verification method provided in an embodiment of this application. This data integrity verification method is applied to the auditing end, such as... Figure 5 The method includes the following steps 501 to 505:

[0067] Step 501: Obtain the first file tag sent by the permission management terminal and the data integrity verification request from the first user.

[0068] Receive the first file tag and data integrity verification request from the permission management terminal.

[0069] Step 502: Verify the validity of the first user based on the integrity verification request.

[0070] Based on the integrity verification request, determine the first authorization credential, and determine whether the first user is valid based on the first authorization credential. If the first user is invalid, stop the data integrity verification.

[0071] Step 503: If the first user is a valid user, a challenge command is generated and sent to the data storage terminal so that the data storage terminal can generate a data holding certificate based on the challenge command.

[0072] If the first user is valid, then select the set. Set I consists of c random values ​​representing the indices of data blocks. Then, for each i ∈ I, a random value is generated. Then generate the challenge command chal = {i, v} i} i∈I Then it is sent to the data storage terminal.

[0073] Step 504: Obtain proof of data ownership.

[0074] Obtain data ownership proof from the data storage terminal, where the data storage terminal generates the data ownership proof according to the following method: calculate the set of authenticators. Then the data storage terminal calculates the linear combination m′ = ∑ of the data blocks it holds. i∈I v i ·m i Then, the corresponding data holding certificate P = (T, m′) and the first file tag are generated and sent to the audit end.

[0075] Step 505: Verify data integrity using a pre-set second verification formula based on the first document label and data ownership certificate.

[0076] Upon receiving the data ownership certificate, the auditing end first checks the SSig. ssk The validity of the first file tag is verified by checking if (fid||A) is a valid signature. If valid, the following steps are used to verify P. The validity of the data ownership certificate P is verified by checking whether it is valid. If it is valid, it means that the data ownership certificate P is valid, that is, the shared data in the cloud storage is complete.

[0077] In this embodiment, after the auditing end verifies the validity of the first user, it generates a challenge command based on the data integrity verification request from the first user. This allows it to obtain data ownership proof from the data storage end and verify the data integrity according to a pre-set formula, thus achieving data integrity verification. Furthermore, during the verification process, it determines whether the first user and the first file tag are valid, preventing unauthorized users from obtaining data and improving the security of the data integrity verification method. This also enables data integrity verification without downloading the data.

[0078] Figure 6 This is a schematic diagram of a data integrity verification device provided in an embodiment of this application. This device is applied to an access control system, such as... Figure 6 As shown, the device 600 includes:

[0079] The first acquisition module 601 is used to acquire data integrity verification requests from the first user.

[0080] The second acquisition module 602 is used to acquire the first authentication code, the first authenticator, and the first file tag of the data block held by the first user according to the data integrity verification request, wherein the first authenticator contains at least two first authentication codes.

[0081] The third acquisition module 603 is used to acquire the first authorization credential corresponding to the user group to which the first user belongs.

[0082] The parsing module 604 is used to parse the first file tag, and determine whether the first user is a valid user based on the parsing result and the first authorization credential, and determine the validity of the first file tag and the first authenticator.

[0083] The sending module 605 is used to send the first file tag and integrity verification request to the auditing end if the first user is a valid user and the first file tag and the first authenticator are both valid, so that the auditing end can generate a challenge command to the data storage end to verify the data integrity based on the first file tag and integrity verification request.

[0084] In this embodiment of the application, the first acquisition module 601 can be used to execute step 101 in the above method embodiment, the second acquisition module 602 can be used to execute step 102 in the above method embodiment, the third acquisition module 603 can be used to execute step 103 in the above method embodiment, the parsing module 604 can be used to execute step 104 in the above method embodiment, and the sending module 605 can be used to execute step 105 in the above method embodiment.

[0085] In one possible implementation, the parsing module 604 can be used to parse the first file tag to obtain the second authorization credential and the first signature contained in the first file tag; compare the first authorization credential and the second authorization credential to determine whether the first user is a valid user; if the first user is a valid user, then verify the validity of the first file tag according to the first signature; if the first file tag is valid, then determine the validity of the first authenticator through a pre-set first verification formula.

[0086] In one possible implementation, the device can also be used to obtain the revocation command of the second user; if the user group to which the second user belongs is a first-level user group, then the second user is deleted from the first permission management table of the first-level user group, and the second-level user group managed by the second user is assigned to the third user group, wherein the third user and the second user are in the same second-level user group; if the user group to which the second user belongs is a second-level user group, then the second user is deleted from the second permission management table of the second-level user group, and a third authorization credential is generated; the third authorization credential is determined as the first authorization credential of the second-level user group.

[0087] In one possible implementation, the device can also be used to obtain a join command from a fourth user; if the fourth user needs to join a secondary user group, it obtains the master key from the administrator of the primary user group, as well as the authorization key and authorization credential from the secondary user group; and calculates the key corresponding to the fourth user using the master key and the authorization key, wherein the key is used to calculate the first authentication code and the first authenticator.

[0088] Figure 7This is a schematic diagram of another data integrity verification device provided in an embodiment of this application. This device is applied to the auditing end, such as... Figure 7 As shown, the device 700 includes:

[0089] The fourth acquisition module 701 is used to acquire the first file tag sent by the permission management terminal and the data integrity verification request from the first user.

[0090] The first verification module 702 is used to verify the validity of the first user based on the integrity verification request.

[0091] The generation module 703 is used to generate a challenge command if the first user is a valid user, and send the challenge command to the data storage terminal so that the data storage terminal generates a data holding certificate according to the challenge command.

[0092] The fifth acquisition module 704 is used to acquire data ownership proof.

[0093] The second verification module 705 is used to verify data integrity based on the first document label and data holding certificate using a pre-set second verification formula.

[0094] In this embodiment of the application, the fourth acquisition module 701 can be used to execute step 501 in the above method embodiment, the first verification module 702 can be used to execute step 502 in the above method embodiment, the generation module 703 can be used to execute step 503 in the above method embodiment, the fifth acquisition module 704 can be used to execute step 504 in the above method embodiment, and the second verification module 705 can be used to execute step 505 in the above method embodiment.

[0095] It should be noted that the information interaction and execution process between the modules in the above-mentioned data integrity verification device are based on the same concept as the aforementioned data integrity verification method embodiment. For details, please refer to the description in the aforementioned data integrity verification method embodiment, and it will not be repeated here.

[0096] Figure 8 This is a schematic diagram of a data integrity verification system provided in an embodiment of this application, such as... Figure 8 As shown, the system 800 includes a data integrity verification device 600 and a data integrity verification device 700.

[0097] Reference Figure 9 This document illustrates a schematic diagram of an electronic device according to an embodiment of this application. The specific embodiments of this application do not limit the specific implementation of the electronic device.

[0098] like Figure 9As shown, the electronic device may include: a processor 902, a communications interface 904, a memory 906, and a communications bus 908.

[0099] in:

[0100] The processor 902, communication interface 904, and memory 906 communicate with each other via communication bus 908.

[0101] Communication interface 904 is used to communicate with other electronic devices or servers.

[0102] The processor 902 is used to execute program 910, which can specifically execute the relevant steps in the above-described data integrity verification method embodiment.

[0103] Specifically, program 910 may include program code that includes computer operation instructions.

[0104] The processor 902 may be a central processing unit (CPU), a graphics processing unit (GPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application. The one or more processors included in the smart device may be processors of the same type, such as one or more CPUs; one or more GPUs; or they may be processors of different types, such as one or more CPUs, one or more GPUs, and one or more ASICs.

[0105] Memory 906 is used to store program 910. Memory 906 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0106] Specifically, program 910 can be used to cause processor 902 to execute the data integrity verification method in any of the foregoing embodiments.

[0107] The specific implementation of each step in program 910 can be found in the corresponding steps and units described in any of the aforementioned data integrity verification method embodiments, and will not be repeated here. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the devices and modules described above can be referred to the corresponding process descriptions in the aforementioned method embodiments, and will not be repeated here.

[0108] In this embodiment, the first authentication code, first authenticator, and first file tag of the data block held by the first user are obtained, as well as the first authorization credential of the user group to which the first user belongs. This allows for the determination of whether the first user is a valid user based on the first authorization credential, first authenticator, and first file tag, thus achieving user group-based access control. Furthermore, user permissions are verified during data integrity verification, preventing unauthorized users from obtaining data and improving data security. The auditing end can generate challenge commands based on the file tag and send them to the data storage end, eliminating the need to completely download the data to verify its integrity, thereby improving the efficiency of data integrity verification. This makes the data integrity verification method suitable for situations with large amounts of data, thus demonstrating high applicability.

[0109] This application also provides a computer program product, including computer instructions that instruct a computing device to perform an operation corresponding to any of the methods in the above-described multiple method embodiments.

[0110] It should be noted that, depending on the implementation needs, the various components / steps described in the embodiments of this application can be broken down into more components / steps, or two or more components / steps or parts of the operation of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of this application.

[0111] The methods described in the embodiments of this application can be implemented in hardware, firmware, or as software or computer code that can be stored in a recording medium (such as a CD-ROM, RAM, floppy disk, hard disk, or magneto-optical disk), or as computer code downloaded over a network that is originally stored in a remote recording medium or a non-transitory machine-readable medium and will be stored in a local recording medium. Thus, the methods described herein can be stored on a recording medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware (such as an ASIC or FPGA) for such software processing. It is understood that the computer, processor, microprocessor controller, or programmable hardware includes storage components (e.g., RAM, ROM, flash memory, etc.) capable of storing or receiving software or computer code that, when accessed and executed by the computer, processor, or hardware, implements the data integrity verification methods described herein. Furthermore, when a general-purpose computer accesses code used to implement the data integrity verification methods shown herein, the execution of the code transforms the general-purpose computer into a dedicated computer for executing the data integrity verification methods shown herein.

[0112] Those skilled in the art will recognize that the units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the embodiments of this application.

[0113] The above embodiments are only used to illustrate the embodiments of this application, and are not intended to limit the embodiments of this application. Those skilled in the art can make various changes and modifications without departing from the spirit and scope of the embodiments of this application. Therefore, all equivalent technical solutions also fall within the scope of the embodiments of this application, and the patent protection scope of the embodiments of this application should be defined by the claims.

Claims

1. A data integrity verification method applied to an authority management end, characterized in that, The method comprises the following steps: Obtaining a data integrity verification request from a first user, wherein the first user belongs to a user group, and the user group is a secondary user group managed by a primary user group; According to the data integrity verification request, obtaining a first authentication code, a first authenticator and a first file label of a data block held by the first user, wherein the first authenticator contains at least two first authentication codes; Obtaining a first authorization credential corresponding to the user group where the first user is located, wherein the first authorization credential is a third authorization credential generated and updated when a member of the secondary user group is revoked, and is used to replace the original authorization credential of the user group so that the revoked member cannot pass the validity verification; Parsing the first file label, and determining whether the first user is a valid user and the validity of the first file label and the first authenticator according to the parsing result and the first authorization credential; the step specifically comprises: parsing the first file label to obtain a second authorization credential and a first signature contained in the first file label; comparing the first authorization credential with the second authorization credential to determine whether the first user is a valid user; if the first user is a valid user, verifying the validity of the first file label according to the first signature; if the first file label is valid, determining the validity of the first authenticator through a pre-set first verification formula; If the first user is a valid user, and the first file label and the first authenticator are both valid, then the first file label and the data integrity verification request are sent to an audit end, so that the audit end generates a challenge command according to the first file label and the data integrity verification request to verify the data integrity to a data storage end.

2. The method of claim 1, wherein, The method further comprises: Obtaining a revocation command of a second user; If the user group where the second user is located is a primary user group, then the second user is deleted from a first permission management table of the primary user group, and a secondary user group managed by the second user is assigned to a third user for management, wherein the third user is in the same secondary user group as the second user; If the user group where the second user is located is a secondary user group, then the second user is deleted from a second permission management table of the secondary user group, and a third authorization credential is generated; The third authorization credential is determined as the first authorization credential of the secondary user group.

3. The method of claim 1, wherein, The method further comprises: Obtaining a join command from a fourth user; If the fourth user needs to join a secondary user group, then a master key from a primary user group administrator and an authorization key and an authorization credential from the secondary user group are obtained; A key corresponding to the fourth user is calculated through the master key and the authorization key, wherein the key is used to calculate the first authentication code and the first authenticator.

4. A data integrity verification method applied to an auditing end, characterized in that, The method comprises the following steps: Obtaining a first file label sent by a permission management end and a data integrity verification request from a first user, wherein the first user belongs to a user group, and the user group is a secondary user group managed by a primary user group; Verifying the validity of the first user according to the integrity verification request; If the first user is a valid user, a challenge command is generated and sent to a data storage end, so that the data storage end generates a data possession proof according to the challenge command; The data possession proof is obtained; Data integrity is verified according to the first file tag and the data possession proof through a pre-set second verification formula; The method further comprises: obtaining a first authentication code, a first authenticator and a first file tag of a data block held by the first user according to the data integrity verification request, wherein the first authenticator contains at least two first authentication codes; obtaining a first authorization credential corresponding to the user group to which the first user belongs, the first authorization credential being a third authorization credential generated and updated when a member of the secondary user group is revoked, and being used to replace the original authorization credential of the user group so that the revoked member cannot pass the validity verification; correspondingly, verifying the validity of the first user according to the integrity verification request comprises: parsing the first file tag and determining whether the first user is a valid user according to the parsing result and the first authorization credential, and determining the validity of the first file tag and the first authenticator comprises: parsing the first file tag to obtain a second authorization credential and a first signature contained in the first file tag; comparing the first authorization credential and the second authorization credential to determine whether the first user is a valid user; if the first user is a valid user, verifying the validity of the first file tag according to the first signature; if the first file tag is valid, determining the validity of the first authenticator through a pre-set first verification formula. 5.A data integrity verification apparatus, applied to an authority management end, characterized in that, Comprise: A first obtaining module is configured to obtain a data integrity verification request from a first user, the first user belonging to a user group, the user group being a secondary user group managed by a primary user group; A second obtaining module is configured to obtain a first authentication code, a first authenticator and a first file tag of a data block held by the first user according to the data integrity verification request, wherein the first authenticator contains at least two first authentication codes; A third obtaining module is configured to obtain a first authorization credential corresponding to the user group to which the first user belongs, the first authorization credential being a third authorization credential generated and updated when a member of the secondary user group is revoked, and being used to replace the original authorization credential of the user group so that the revoked member cannot pass the validity verification; A parsing module is configured to parse the first file tag and determine whether the first user is a valid user according to the parsing result and the first authorization credential, and determine the validity of the first file tag and the first authenticator; A sending module is configured to, if the first user is a valid user and the first file tag and the first authenticator are both valid, send the first file tag and the integrity verification request to an audit end, so that the audit end generates a challenge command according to the first file tag and the integrity verification request to verify data integrity from a data storage end. The analysis module is further configured to: analyze the first file tag to obtain a second authorization credential and a first signature contained in the first file tag; compare the first authorization credential and the second authorization credential to determine whether the first user is a valid user; if the first user is a valid user, verify validity of the first file tag according to the first signature; and if the first file tag is valid, determine validity of the first authenticator according to a first preset verification formula.

6. A data integrity verification apparatus, applied to an auditing end, characterized in that, Comprise: The fourth acquisition module is configured to acquire a first file tag sent by an authority management terminal and a data integrity verification request from a first user, the first user belongs to a user group, and the user group is a second-level user group managed by a first-level user group; The first verification module is configured to verify validity of the first user according to the integrity verification request; The generation module is configured to generate a challenge command if the first user is a valid user, and send the challenge command to a data storage terminal, so that the data storage terminal generates a data possession proof according to the challenge command; The fifth acquisition module is configured to acquire the data possession proof; The second verification module is configured to verify data integrity according to the first file tag and the data possession proof through a second preset verification formula; The first verification module is further configured to: acquire a first authentication code, a first authenticator and a first file tag of a data block held by the first user according to the data integrity verification request, wherein the first authenticator contains at least two first authentication codes; acquire a first authorization credential corresponding to the user group where the first user is located, the first authorization credential being a third authorization credential generated and updated when a member of the second-level user group is revoked, and being used to replace the original authorization credential of the user group so that the revoked member cannot pass the validity verification; analyze the first file tag and determine whether the first user is a valid user and determine validity of the first file tag and the first authenticator according to the analysis result and the first authorization credential, including: analyzing the first file tag to obtain a second authorization credential and a first signature contained in the first file tag; comparing the first authorization credential and the second authorization credential to determine whether the first user is a valid user; if the first user is a valid user, verifying validity of the first file tag according to the first signature; and if the first file tag is valid, determining validity of the first authenticator according to a first preset verification formula.

7. A data integrity verification system, characterized by, Comprise: The data integrity verification device of claim 5 and the data integrity verification device of claim 6.

8. An electronic device comprising: The processor, the memory, the communication interface and the communication bus, the processor, the memory and the communication interface complete the communication among each other through the communication bus; The memory is used to store at least one executable instruction, and the executable instruction causes the processor to execute the data integrity verification method of any one of claims 1-3 or the data integrity verification method of claim 4.

9. A computer storage medium having stored thereon a computer program which, when executed by a processor, implements the data integrity verification method of any one of claims 1-3 or the data integrity verification method of claim 4.

Images