A data verification method and related equipment

Abstract

The present application provides a data verification method, including: a network device divides a configured data block into blocks to obtain multiple sub-data blocks, generates a first hash tree based on the multiple sub-data blocks, and the data block includes the device identifiers of multiple environmental Internet of Things devices and the group identifiers of the groups to which the multiple environmental Internet of Things devices belong; the network device sends a data configuration request to a reader, and the data configuration request includes the data block and the index and block information of the data block; the network device receives the node information of the second hash tree generated by the reader according to the data configuration request; the network device performs consistency verification based on the node information of the first hash tree and the node information of the second hash tree to obtain a verification result. In this way, the consistency of data on the network side and the reader side is guaranteed to avoid causing erroneous operations and affecting the normal operation of the business. When the data is inconsistent, data synchronization on the network side and the reader side can be guaranteed with a small overhead.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a data verification method, a network device, a reader, a computer-readable storage medium, and a computer program product. Background Art

[0002] With the continuous development of communication technology, the Internet of Things (IoT) based on the new generation of communication technology has attracted widespread attention. The Internet of Things is a system of computing devices, machinery, and digital machines that have a universal unique identification code and the ability to transmit data through the network without the need for human-to-human or human-to-device interaction.

[0003] At present, relevant standardization organizations are studying the signaling control process in IoT. For ease of understanding, the ambient IoT (AIoT) example is used for explanation. For AIoT devices, the user equipment (UE) or the radio access network (RAN) can act as an intermediate node to receive AIoT messages such as AIoT device inventory or control commands transmitted from the network side. The control command can include a read or write command, and supports the aggregate transmission of AIoT messages from multiple UEs.

[0004] UE / RAN acts as an intermediate node to aggregate and transmit AIoT messages, reducing the number of messages sent. Taking RAN as an intermediate node, for example, the density of AIoT devices can reach 1 million per square kilometer, and the base station coverage on the RAN side can reach 2 square kilometers, so 2 million AIoT devices can be connected under the base station. If AIoT messages such as Inventory / Command can be aggregated and transmitted based on groups, the number of messages will be greatly reduced, effectively reducing the message transmission load of the system.

[0005] However, if the configuration relationship between the group identifier (group ID) and the device ID of AIoT devices is tampered with or updated, it may cause erroneous operations and affect the normal operation of the business. For example, if the configuration relationship between a group ID and the device ID of AIoT devices is maliciously tampered with, the AIoT devices may be maliciously paged, which may cause the AIoT devices to run out of power. Therefore, the industry urgently needs to provide a data verification method to ensure the consistency of data on the network side and the reader side. Summary of the invention

[0006] The present application provides a data verification method and related equipment, the purpose of which is to ensure the consistency of data on the network side and the reader side, avoid causing erroneous operations, and affect the normal operation of the business.

[0007] In order to achieve the above objectives, this application provides the following technical solutions:

[0008] A first aspect of the present application provides a data verification method, the method comprising:

[0009] The network device divides the configured data block into blocks to obtain multiple sub-data blocks, and generates a first hash tree according to the multiple sub-data blocks, wherein the data block includes device identifiers of multiple environmental Internet of Things devices and group identifiers of groups to which the multiple environmental Internet of Things devices belong;

[0010] The network device sends a data configuration request to the reader, wherein the data configuration request includes the data block and the index and block information of the data block;

[0011] The network device receives node information of a second hash tree generated by the reader according to the data configuration request;

[0012] The network device performs consistency verification according to the node information of the first hash tree and the node information of the second hash tree to obtain a verification result.

[0013] This can ensure the consistency of data on the network side and the reader side, avoid erroneous operations and affect the normal operation of the business.

[0014] In some possible implementations, the method further includes:

[0015] When the verification result is verification failure, the network device determines a node from the nodes of the first hash tree that is inconsistent with the nodes of the second hash tree;

[0016] The network device sends the sub-data block corresponding to the inconsistent node and the index of the sub-data block to the reader;

[0017] The network device receives the node information of the second hash tree updated by the reader according to the sub-data block corresponding to the inconsistent node and the index of the sub-data block;

[0018] The network device performs consistency verification according to the updated node information of the second hash tree and the node information of the first hash tree until the verification passes.

[0019] In this method, when the data is inconsistent, the inconsistent sub-data blocks can be transmitted to ensure data synchronization between the network side and the reader side with a small overhead.

[0020] In some possible implementations, the network device updates the data block and updates the first hash tree according to the updated data block. The network device sends a data configuration update request to the reader, where the data configuration update request is used to add, delete or modify data in the data block. The data configuration update request includes the added, deleted or modified sub-data block and the index of the sub-data block;

[0021] The network device receives the node information of the second hash tree updated by the reader according to the data configuration update request, wherein the node information of the second hash tree updated by the reader according to the data configuration update request includes the node information of the target node inserted, deleted or updated in the second hash tree, and the node information of the node affected by the target node;

[0022] The network device performs consistency verification based on the updated node information of the first hash tree and the updated node information of the second hash tree to obtain a verification result.

[0023] In this way, the consistency of data on the network side and the reader side can be guaranteed when data is updated.

[0024] In some possible implementations, the node information of the second hash tree updated by the reader according to the data configuration update request includes incremental information relative to the previous version. By incremental updating, data transmission overhead can be reduced.

[0025] In some possible implementations, the data configuration request also includes the address, name, security parameters or hash algorithm type of the environmental IoT device, where the hash algorithm type is used to indicate the hash algorithm used to perform hash operations on the data in the data block. The network device can also verify the address, name, etc. of the environmental IoT device to ensure consistency.

[0026] In some possible implementations, the hash algorithm type is determined by the network device based on the contract information of the environmental Internet of Things device in the mobile network or the information of the industry user to which the environmental Internet of Things device belongs.

[0027] In some possible implementations, the network device generates a first hash tree according to the multiple sub-data blocks, including:

[0028] The network device generates a leaf node of the first hash tree according to the multiple sub-data blocks, where the value of the leaf node is the value or hash value of the sub-data block;

[0029] The network device generates a non-leaf node of the first hash tree according to the leaf node of the first hash tree, wherein the non-leaf node includes an intermediate node or a root node, and the value of the non-leaf node is determined according to the value of the leaf node belonging to the non-leaf node.

[0030] This method generates leaf nodes based on the sub-data blocks obtained by block division, and then updates non-leaf nodes according to the values ​​of the leaf nodes, so that efficient top-down verification can be achieved during subsequent data verification.

[0031] In some possible implementations, the network device includes at least one of an environmental Internet of Things controller, an application function network element, a network open function network element, or an operation management network element.

[0032] A second aspect of the present application provides another data verification method, the method comprising:

[0033] The reader receives a data configuration request, wherein the data configuration request includes a data block and an index and block information of the data block, wherein the data block includes device identifiers of multiple environmental Internet of Things devices and group identifiers of groups to which the multiple environmental Internet of Things devices belong;

[0034] The reader generates a second hash tree according to the data configuration request;

[0035] The reader sends the node information of the second hash tree to the network device, and the node information of the second hash tree is used to perform consistency verification in combination with the node information of the first hash tree generated by the network device based on multiple sub-data blocks obtained by dividing the data block into blocks, to obtain a verification result.

[0036] In some possible implementations, the method further includes:

[0037] The reader receives, from the network device, a sub-data block corresponding to a node in the first hash tree that is inconsistent with a node in the second hash tree and an index of the sub-data block;

[0038] The reader updates the second hash tree according to the sub-data blocks corresponding to the inconsistent nodes and the indexes of the sub-data blocks;

[0039] The reader sends updated node information of the second hash tree to the network device.

[0040] In some possible implementations, the method further includes:

[0041] The reader receives a data configuration update request, the data configuration update request is used to add, delete or modify data in the data block, the data configuration update request includes a newly added, deleted or modified sub-data block and an index of the sub-data block;

[0042] The reader updates the second hash tree according to the data configuration update request, and the node information of the updated second hash tree includes the node information of the target node inserted, deleted or updated in the second hash tree, and the node information of the node affected by the target node;

[0043] The reader sends updated node information of the second hash tree to the network device.

[0044] In some possible implementations, the reader sends updated node information of the second hash tree to the network device, including:

[0045] The reader sends incremental information of the updated second hash tree relative to the previous version to the network device.

[0046] In some possible implementations, the data configuration request also includes the address, name, security parameters or hash algorithm type of the AIoT device, where the hash algorithm type is used to indicate the hash algorithm used to perform a hash operation on the data in the data block.

[0047] In some possible implementations, the hash algorithm type is determined by the network device based on the contract information of the environmental Internet of Things device in the mobile network or the information of the industry user to which the environmental Internet of Things device belongs.

[0048] In some possible implementations, the method further includes:

[0049] When the access and mobility management function AMF network element establishes a stream control transmission protocol SCTP connection, the reader obtains a hash algorithm type from the AMF network element, where the hash algorithm type is used to indicate the hash algorithm used to perform a hash operation on the data in the data block.

[0050] In some possible implementations, the reader generates a second hash tree according to the data configuration request, including:

[0051] The reader divides the data block into blocks according to the block information in the data configuration request to obtain a plurality of sub-data blocks;

[0052] The reader generates a leaf node of the second hash tree according to the multiple sub-data blocks, and the value of the leaf node is the value or hash value of the sub-data block;

[0053] The reader generates a non-leaf node of the second hash tree according to the leaf node of the second hash tree, wherein the non-leaf node includes an intermediate node or a root node, and the value of the non-leaf node is determined according to the value of the leaf node belonging to the non-leaf node.

[0054] In some possible implementations, the reader includes a terminal or an access network device.

[0055] The third aspect of the present application provides an electronic device, which may be a network device, such as an AIoT controller, a network open function network element, etc. The network device includes: a memory and at least one processor. The memory is used to store programs, and the at least one processor is used to run programs, so that the network device implements the data verification method provided by the first aspect of the present application.

[0056] The fourth aspect of the present application provides an electronic device, which may be a reader, and the reader may be a terminal or an access network device. The reader includes a memory and at least one processor. The memory is used to store a program, and the at least one processor is used to run the program, so that the reader implements the data verification method provided by the second aspect of the present application.

[0057] The fifth aspect of the present application provides a communication system, including a network device and a reader. The network device is used to execute the data verification method provided in the first aspect of the present application, and the reader is used to cooperate with the network device to execute the data verification method provided in the second aspect of the present application.

[0058] The sixth aspect of the present application provides a computer storage medium for storing a computer program. When the computer program is executed, it is used to implement the data verification method provided in the first aspect or the second aspect of the present application.

[0059] The seventh aspect of the present application provides a computer program product. The computer program product includes computer-readable instructions; the computer-readable instructions are used to implement the data verification method provided in the first aspect or the second aspect of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 An example diagram of a communication system architecture disclosed in an embodiment of the present application;

[0061] Figure 2 A schematic diagram of the process of inventorying an AIoT device disclosed in an embodiment of the present application;

[0062] Figure 3 A schematic diagram of a control process disclosed in an embodiment of the present application;

[0063] Figure 4 A flowchart of a data verification method disclosed in an embodiment of the present application;

[0064] Figure 5 A schematic diagram of generating a hash tree based on a data block disclosed in an embodiment of the present application;

[0065] Figure 6 A flowchart of another data verification method disclosed in an embodiment of the present application;

[0066] Fig. 7A A flowchart of a data verification method disclosed in an embodiment of the present application;

[0067] Figure 7B A schematic diagram of a hash tree update disclosed in an embodiment of the present application;

[0068] Figure 8 A flowchart of a data verification method disclosed in an embodiment of the present application;

[0069] Fig. 9 A flowchart of another data verification method disclosed in an embodiment of the present application;

[0070] Fig.10 A flowchart of another data verification method disclosed in an embodiment of the present application;

[0071] Fig.11 A flowchart of a data verification method disclosed in an embodiment of the present application;

[0072] Fig.12 A flowchart of another data verification method disclosed in an embodiment of the present application;

[0073] Fig.13 A schematic diagram of comparing node information of a first hash tree and node information of a second hash tree disclosed in an embodiment of the present application;

[0074] Fig.14 A flowchart of another data verification method disclosed in an embodiment of the present application;

[0075] Fig.15 This is a structural example diagram of a base station disclosed in an embodiment of the present application;

[0076] Fig.16 This is a diagram showing an example of the structure of a terminal disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0077] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. The terms used in the following embodiments are only for the purpose of describing specific embodiments and are not intended to be used as limitations on the present application. As used in the specification and the appended claims of the present application, the singular expressions "one", "a kind", "said", "above", "the" and "this" are intended to also include expressions such as "one or more", unless there is a clear contrary indication in the context. It should also be understood that in the embodiments of the present application, "one or more" refers to one, two or more; "and / or" describes the association relationship of the associated objects, indicating that three relationships may exist; for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship.

[0078] References to "one embodiment" or "some embodiments" etc. described in this specification mean that a particular feature, structure or characteristic described in conjunction with the embodiment is included in one or more embodiments of the present application. Thus, the phrases "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear at different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0079] The multiple involved in the embodiments of the present application means greater than or equal to two. It should be noted that in the description of the embodiments of the present application, the words "first", "second", etc. are only used for the purpose of distinguishing the description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying an order.

[0080] The present application embodiment is applied to a communication system, which may be a second generation (2 nd generation, 2G) communication system, third generation (3 rd It can be a fourth generation (3G) communication system, a fourth generation (4G) system such as Long-Term Evolution (LTE), a fifth generation (5G) communication system, a hybrid architecture of LTE and 5G, a 5G New Radio (5G NR) system, and new communication systems that will emerge in the future development of communications.

[0081] The communication system includes network devices and readers, which can also be called readers. Devices that support the Internet of Things, such as AIoT devices in the Ambient IoT (AIoT), can be connected to the Internet of Things through the above communication system to achieve intelligent interconnection and intelligent management.

[0082] Among them, network equipment is a device used to provide network communication functions on the network side, and is sometimes also called a network element. In the Internet of Things, such as the AIoT, network equipment can generally include but is not limited to an AIoT controller, an application function (AF) network element, a network exposure function (NEF) network element, or an operation management (OM) network element.

[0083] AIoT controller is an entity in the core network (CN) used to implement AIoT functions. AIoT controller can realize communication and coordination between different AIoT devices. AIoT controller can act as AIoT devices and servers (such as AF network elements), providing a centralized control point for managing and optimizing the performance of connected AIoT devices.

[0084] AF network elements, including various services at the application layer, can be applications within the operator or third-party AFs, such as AIoT servers.

[0085] NEF network element is used to manage externally open data and can usually be located between the core network and AF. External applications such as AF want to access the internal data of the core network, usually through the NEF network element. NEF provides corresponding security guarantees to ensure the security of external applications to the network, and provides external application quality of service (QoS) customization capability opening, mobility status event subscription, AF request distribution and other functions.

[0086] The OM network element is an entity in the core network used to manage operations. The operations can be operations on AIoT devices. For example, the operations can be the opening operation, closing operation, or mode switching operation of AIoT devices.

[0087] A reader is used to communicate with A-IoT devices by sending and receiving radio frequency signals. In some examples, the reader can be a terminal, or integrated into a terminal and located at the same location as the terminal, so that the communication between the reader and the AIoT controller uses a protocol data unit (PDU) session. A PDU session can be a data transmission channel established between communication participants. For example, the PDU session used for communication between the reader and AIoT is a data transmission channel established between the reader and the AIoT controller. In other examples, the reader can be deployed independently of the UE, for example, the reader can be an independent access network (radio access network, RAN) device or RAN node (RANNode). Among them, the RAN device may include a base station (base station, BS).

[0088] AIoT devices refer to devices that have the ability to access AIoT and realize intelligent interconnection. AIoT devices access AIoT and are usually at the end of AIoT. AIoT devices can include sensors such as temperature sensors, hygrometers, smoke sensors, etc. In the field of smart homes, AIoT devices can also include various household appliances such as air conditioners, refrigerators, washing machines, televisions, and sweeping robots. In the field of smart driving, AIoT devices can include car air conditioners, car audio, and car screens.

[0089] An example of a communication system is Figure 1 As shown, the communication system may include AIoT devices, access network nodes (RAN nodes), core networks (CNs), and AIoT servers (AIoT servers). Among them, the RAN nodes can be used as readers, and the network elements in the core network or the AIoT servers can be used as network devices for configuring the readers.

[0090] Figure 1Two topology structures of the communication system are shown: topology 1 and topology 2. In topology 1, AIoT devices are directly connected to the access network node (RAN Node), and the RAN Node acts as a reader to enable communication between AIoT devices and the AIoT server. In topology 2, AIoT devices are connected to the RAN Node through a terminal (such as UE), and the terminal acts as a reader to enable communication between AIoT devices and the AIoT server.

[0091] For AIoT, the terminal or RAN can act as an intermediate node to receive AIoT messages such as AIoT device inventory or control commands transmitted from the network side. The control commands may include read or write commands, and support the aggregated transmission of AIoT messages from multiple UEs.

[0092] To facilitate understanding, the following describes the inventory process and command process using the communication system of topology 2 architecture.

[0093] First, see Figure 2 The schematic diagram of the process of AIoT device inventory shown in the figure specifically includes the following steps:

[0094] 1. AF and UE communicate based on UE AIoT Layer messages.

[0095] UE AIoT Layer messages are messages based on the UE AIoT layer protocol, where the UE AIoT Layer protocol is a protocol between the AF and the UE in the protocol stack. The UE can communicate with the AF through the PDU session to transmit UE AIoT Layer messages to the AF. Among them, the UE AIOT layer messages include the location information and reader capability information reported by the UE.

[0096] 2. AF determines the UE for AIoT device inventory.

[0097] Specifically, the AF decides on the UE to perform the AIoT device inventory based on the positioning information and reader capability information reported by the UE in step 1.

[0098] 3. AF sends an inventory request to UE.

[0099] Among them, the AF can send an Inventory Request to the UE determined in step 2 through the PDU session of the core network and the next generation radio access network (Next Generation Radio Access Network, NG-RAN). In some examples, NG-RAN can be a 5G RAN. The Inventory Request includes the device information (device information, device info) and inventory strategy information (inventory strategy info) of the AIoT device. Among them, device info can include device identifier (device ID) and group identifier (group ID). Inventory strategy info can include inventory frequency (inventory frequency) and inventory period (inventory period).

[0100] Furthermore, the Inventory Request may also include report aggregation info. The report aggregation info is used to indicate whether the reported content needs to be aggregated, for example, whether it needs to be aggregated within a specific aggregation period.

[0101] 4. The UE interacts with the access network (RAN) for radio resource allocation.

[0102] 5. UE performs AIoT device inventory initialization.

[0103] The UE can provide a reader identifier, such as a UE ID, so that AIoT devices can understand which reader is reading them.

[0104] 6. The AIoT device reports the device ID to the UE.

[0105] Optionally, the AIoT device can also report device capacity to the UE.

[0106] 7. When report aggregation info indicates aggregation, the UE can also aggregate the data reported by AIoT devices.

[0107] 8. The UE sends an Inventory Response or Inventory Notify to the AF.

[0108] Taking Inventory Response as an example, Inventory Response can include device ID or aggregated reports.

[0109] Next, see Figure 3 The schematic diagram of a control process shown in FIG. 1 specifically includes the following steps:

[0110] 1. AF and UE communicate based on UE AIoT Layer messages.

[0111] UE AIoT Layer messages are built on the UE AIoT Layer protocol, which is a protocol between AF and UE in the protocol stack. UE can communicate with AF through PDU session to transmit UE AIoTLayer messages to AF.

[0112] 2. The AF determines the UE that executes the control command.

[0113] 3. AF sends a control command request (Command Request) to the UE.

[0114] Command Request includes control command (command), device information (device info) and result aggregation information (result aggregation info). Command can be a command executed in the AIoT device, including read, write, enable, disable or other specific commands. Device info includes device ID and group ID. Result aggregation info indicates whether the results need to be aggregated within a specific aggregation period.

[0115] Specifically, the AF decides on the UE to perform the AIoT device inventory based on the positioning information and reader capability information reported by the UE in step 1.

[0116] 4. The UE interacts with the access network (RAN) for radio resource allocation.

[0117] 5. UE sends command to the AIoT device.

[0118] 6. The AIoT device executes the above command and returns the command result to the UE.

[0119] 7. When result aggregation info indicates aggregation, the UE can also aggregate command results.

[0120] 8. The UE sends a command response (Command Response) or command notification (Command Notify) to the AF.

[0121] Taking Command Response as an example, Command Response can include result or aggregated result.

[0122] based on Figure 3 It can be seen that UE / RAN, as an intermediate node, aggregates and transmits AIoT messages, reducing the number of messages sent. However, the current solution lacks a design for data integrity protection. For example, the AIoT identifiers (device ID, group ID) under the group are configured in the base station and the AF network element on the network side. If the configuration relationship of the device ID contained in a group ID is maliciously tampered with, it will cause incorrect processing, such as causing the AIoT devices to be maliciously paged, which may lead to the exhaustion of power consumption of the AIoT devices. Alternatively, the update of the configuration relationship between the group ID and the device ID may also cause the configuration data of the RAN and AF / network side (such as the configuration relationship between the group ID and the device ID) to be out of sync, thereby causing erroneous operations.

[0123] In view of this, the present application provides a data verification method, specifically a consistency verification method for identity information of the Internet of Things. In this method, a network device (such as an AIoT controller, or an AF network element, a NEF network element, an OM network element) divides the configured data block into blocks to obtain multiple sub-data blocks. Among them, the data block includes the device identification (device ID) of multiple AIoT devices and the group identification (group ID) of the group to which the multiple AIoT devices belong. Then the network device generates a first hash tree based on the multiple sub-data blocks. The network device can send a data configuration request to the reader, and the data configuration request includes a data block and an index (index) and block information of the data block. The network device receives the node information of the second hash tree generated by the reader (for example, a UE or a RAN node) according to the data configuration request. The network device performs consistency verification based on the node information of the first hash tree and the node information of the second hash tree to obtain a verification result.

[0124] This ensures data consistency on the network side (such as AF) and the reader side, avoiding erroneous operations that affect the normal operation of the business. In addition, when data is inconsistent, the inconsistent sub-data blocks can be transmitted to ensure data synchronization on the network side and the reader side with less overhead.

[0125] In order to make the technical solution of the present application clearer and easier to understand, the data verification method of the present application is introduced from the perspectives of network equipment and reader respectively in conjunction with the accompanying drawings.

[0126] See also Figure 4 The flowchart of a data verification method shown in FIG. 1 can be performed by a network device, and the network device can include an AIoT controller, an AF network element, a NEF network element, or an OM network element on the network side. The method can include the following steps:

[0127] S402: The network device divides the configured data block into blocks to obtain multiple sub-data blocks.

[0128] The data block includes the device IDs of multiple AIoT devices and the group identifiers (group IDs) of the groups to which the multiple AIoT devices belong. The network device can configure the block size or the number of blocks, and perform a block operation on the data block according to the block size or the number of blocks to obtain multiple sub-data blocks. It should be noted that each sub-data block records the group ID and the device IDs of several AIoT devices included in the group. The device ID recorded in each sub-data block may be different.

[0129] S404: The network device generates a first hash tree according to the multiple sub-data blocks.

[0130] The network device can calculate a hash value according to the sub-data block by a hash algorithm, and generate a first hash tree according to the hash value. Specifically, the network device generates a leaf node of the first hash tree according to a plurality of sub-data blocks, and the value of the leaf node is the value of the sub-data block or the hash value. Among them, the leaf nodes of the first hash tree can be sorted according to the index of the sub-data block. For example, the leaf nodes of the first hash tree can be arranged in sequence according to the index order. The network device generates a non-leaf node of the first hash tree according to the leaf node of the first hash tree. Among them, the non-leaf node includes an intermediate node or a root node. The value of the non-leaf node is determined according to the value of the leaf node belonging to the non-leaf node. For example, the value of the non-leaf node can be determined according to the value of all leaf nodes starting from the leaf node to reach the non-leaf node. It should be noted that when generating a non-leaf node according to a leaf node, the index of the sub-data block corresponding to the leaf node can also be combined. For example, the network device can determine the leaf node used to generate the non-leaf node according to the index of the sub-data block corresponding to the leaf node.

[0131] In some possible implementations, the network device may generate a first hash tree based on multiple sub-data blocks by using a Merkle Tree (MT) algorithm. In other words, the first hash tree may be a Merkle tree. A Merkle tree is a binary tree of hash values, and each leaf node of the Merkle tree represents a piece of data or a hash value of a piece of data. The Merkle tree can be used to effectively verify the integrity of a large amount of data.

[0132] In the present application, the network device can determine the hash values ​​of the plurality of sub-data blocks through a hash algorithm according to the plurality of sub-data blocks. Figure 5As shown in the figure, data blocks can be divided into multiple sub-data blocks including L1, L2, L3 and L4. The network device performs hash operations on the multiple data blocks respectively to obtain the hash values ​​of the sub-data blocks, which are recorded as hash (L1), hash (L2), hash (L3), and hash (L4). The network device can generate multiple leaf nodes of the Merkle tree. The values ​​of the multiple leaf nodes are hash (L1), hash (L2), hash (L3), and hash (L4), which are respectively associated with the underlying sub-data blocks L1, L2, L3, and L4. Considering that the Merkle tree is a binary tree, the network device can merge the values ​​of two adjacent leaf nodes into a string, for example, concatenate hash (L1) and hash (L2), and concatenate hash (L3) and hash (L4), and perform a hash operation on the merged string to obtain the value of a non-leaf node. The non-leaf node can be an intermediate node. If the number of intermediate nodes at this level is greater than or equal to 2, the values ​​of the intermediate nodes can be merged, and the merged string can be hashed, and the hash operation can be used as the value of the non-leaf node at the previous level. When the number of non-leaf nodes at a certain level is 1, the non-leaf node is the root node.

[0133] exist Figure 5 In the example, the network device can generate leaf nodes of the first hash tree according to the hash values ​​of sub-data blocks L1, L2, L3 and L4, specifically hash0-0, hash0-1, hash1-0, hash1-1, wherein the values ​​of leaf nodes hash0-0 and hash0-1 are hash (L1) and hash (L2), and the values ​​of leaf nodes hash1-0 and hash1-1 are hash (L3) and hash (L4). The network device can merge the values ​​of leaf nodes hash0-0 and hash0-1, and then perform a hash operation on the merged string to generate an intermediate node hash0. Similarly, the network device can merge the values ​​of leaf nodes hash1-0 and hash1-1, and then perform a hash operation on the merged string to generate an intermediate node hash1. Next, the network device can merge the values ​​of intermediate nodes hash0 and hash1, and then perform a hash operation on the merged string to generate a root node, recorded as the root hash (top hash).

[0134] S406: The network device sends a data configuration request to the reader.

[0135] The data configuration request includes a data block and an index and block information of the data block. The index of the data block is a data structure that allows direct access to the data block, which is used to improve data query efficiency. For example, the index of the data block can be the address, number, etc. of the data block. The block information can include the number of blocks or the size of the blocks.

[0136] In some possible implementations, the data configuration request also includes the address, name, security parameters or hash algorithm type of the AIoT device (AIoT devices). Among them, the AIoT devices may be Internet Protocol (IP) addresses, the security parameters may include security policies, the security policies may include indication information on whether consistency verification is enabled, and further, the security policies may also include verification parameters. The hash algorithm type is used to indicate the hash algorithm used to perform hash operations on the data in the data block. For example, the hash algorithm type may include but is not limited to a secure hash algorithm (SHA) or an MD5 message digest algorithm (MD5 Message-Digest Algorithm). In some examples, the hash algorithm type may be determined by the network device based on the contract information of the AIoT device in the mobile network or the information of the industry user to which the AIoT device belongs. For example, if the AIoT device is an electric meter, the industry user to which it belongs may be a power company. The network device may determine the hash algorithm type based on the information of the power company or the contract information of the electric meter in the mobile network.

[0137] S408. The network device receives node information of the second hash tree generated by the reader according to the data configuration request.

[0138] The reader may include a terminal or a RAN device (RAN node), and the RAN device may be, for example, a base station. The reader may perform a block operation on the data block according to the block information to obtain a plurality of sub-data blocks. Then, the reader may generate a second hash tree according to the plurality of sub-data blocks through a hash operation. The specific implementation of the reader generating the second hash tree may refer to the network device generating the first hash tree according to the plurality of sub-data blocks.

[0139] The node information of the second hash tree may include the value of the node in the second hash tree. In some examples, the value of the node in the second hash tree may be a sequence formed by arranging in sequence according to a set order, for example, a sequence formed by arranging in depth-first order, or a sequence formed by arranging in breadth-first order. In other examples, the node information of the second hash tree may include a node identifier (such as a node name or a node position in a hash tree) and a node value.

[0140] S410. The network device performs consistency verification based on the node information of the first hash tree and the node information of the second hash tree to obtain a verification result.

[0141] The network device can compare the value of the node in the first hash tree with the value of the node in the second hash tree. When the value of the node in the first hash tree is consistent with the value of the node in the second hash tree, the consistency verification passes. When the value of the node in the first hash tree is inconsistent with the value of the node in the second hash tree, the consistency verification fails.

[0142] Considering the verification efficiency, the network device can compare the value of the node in the first hash tree with the value of the node in the second hash tree in a top-down manner. The network device obtains the correct root Hash from a trusted data source. For example, the network device can use the value of the root node of the first hash tree as the root hash, and verify the value of the root node in the second hash tree based on the root hash. If they are inconsistent, the network device continues to verify the nodes of the next layer (for example, the intermediate nodes). The way to verify the nodes of the next layer is similar to that of the root node, which will not be repeated here.

[0143] Based on the above description, the data verification method provided by the present application generates a first hash tree on the network device side based on the multiple sub-data blocks obtained by the block division, and sends the data block, index and block information to the reader side. The reader side can generate a second hash tree on the reader side based on the above information, and the network device can perform consistency verification based on the node information of the first hash tree and the node information of the second hash tree. In this way, the consistency of data on the network side and the reader side is guaranteed to avoid causing erroneous operations and affecting the normal operation of the business.

[0144] When the consistency verification is passed, the verification process can be ended, and when the consistency verification is not passed, the data can be resent for consistency verification.

[0145] See also Figure 6 The flowchart of another data verification method shown in FIG. 1 is used in a scenario where the verification result fails, and specifically includes the following steps:

[0146] S602: The network device determines, from the nodes of the first hash tree, nodes that are inconsistent with the nodes of the second hash tree.

[0147] Specifically, the network device can compare the node information of the first hash tree with the node information of the second hash tree, thereby determining the nodes of the first hash tree that are inconsistent with the nodes of the second hash tree. The network device can compare the node information of the first hash tree with the node information of the second hash tree one by one in a top-down manner.

[0148] by Figure 5To illustrate with an example, the network device can first compare the values ​​of the root node of the first hash tree and the root node of the second hash tree. If they are inconsistent, the intermediate nodes of the next layer are compared. If the value of the node hash0 in the first hash tree is consistent with the value of the node hash0 in the second hash tree, it means that the left subtree of the root node of the first hash tree is the same as the left subtree of the root node of the second hash tree. The network device can compare the value of the node hash1 in the first hash tree with the value of the node hash1 in the second hash tree. If the values ​​of the nodes hash1 in the first hash tree and the second hash tree are inconsistent, the values ​​of the nodes hash1-0 in the first hash tree and the second hash tree can be compared to see if they are consistent, or the values ​​of the nodes hash1-1 in the first hash tree and the second hash tree can be compared to see if they are consistent, so as to determine the sub-data blocks corresponding to the inconsistent nodes (for example, inconsistent leaf nodes). Assuming that the values ​​of hash1-0 are consistent and the values ​​of hash1-1 are inconsistent, it means that the sub-data block L4 is inconsistent.

[0149] S604: The network device sends the sub-data blocks corresponding to the inconsistent nodes and the indexes of the sub-data blocks to the reader.

[0150] In the present application, the network device resends the inconsistent sub-data blocks and their indexes without sending the entire data block, which greatly reduces the data transmission overhead.

[0151] S606: The network device receives the node information of the second hash tree updated by the reader according to the sub-data blocks corresponding to the inconsistent nodes and the indexes of the sub-data blocks.

[0152] The reader can update the second hash tree based on the resent sub-data block and the index of the sub-data block. Specifically, the reader can first update the corresponding leaf node based on the resent sub-data block. For example, the reader can perform a hash operation based on the resent sub-data block to obtain a hash value, and update the hash value to the value of the corresponding leaf node. Then the reader can update the intermediate node or root node to which the leaf node belongs based on the updated leaf node. For example, the reader can merge the value of the updated leaf node with the value of the adjacent leaf node, perform a hash operation on the merged string, and the hash operation result can be used as the value of the intermediate node of the upper layer.

[0153] The network device may receive node information of a second hash tree updated by the reader according to the sub-data block and index corresponding to the inconsistent node. The updated node information of the second hash tree includes updated information of the inconsistent node and information of the predecessor node (ancestor node) of the inconsistent node. The predecessor node may include but is not limited to a parent node and a parent node of a parent node.

[0154] It should be noted that when the reader updates the node information of the second hash tree to the network device, it can adopt an incremental update method. In this case, the updated node information of the second hash tree includes incremental information relative to the previous version.

[0155] S608: The network device performs consistency verification according to the updated node information of the second hash tree and the node information of the first hash tree until the verification passes.

[0156] Specifically, the network device can compare the node information of the updated second hash tree with the node information of the first hash tree. If the node information of the updated second hash tree is consistent with the node information of the first hash tree, the verification is successful. The specific implementation of the consistency verification performed by the network device based on the node information of the updated second hash tree and the node information of the first hash tree can be referred to the description of the relevant content above, which will not be repeated here.

[0157] Based on the above description, the data verification method provided by the present application can not only verify the consistency of data on the network device side and the reader side, but also support when the data is inconsistent, it can transmit inconsistent sub-data blocks to achieve data synchronization between the network side and the reader side with less overhead.

[0158] In some possible implementations, the network device can also update the data. For example, if a new AIoT device is added to the group, a mapping relationship between the group ID and the device ID of the AIoT device needs to be added. Accordingly, the network device needs to synchronize the update to the reader side to ensure consistency and avoid erroneous operations.

[0159] The data verification method in the update phase is described below with reference to the accompanying drawings.

[0160] See also Fig. 7A A flow chart of a data verification method is shown, the method comprising the following steps:

[0161] S702: The network device updates the data block.

[0162] The network device update data block may be data in a newly added data block, data in a modified data block, or data in a deleted data block. The data in the newly added data block may be a newly added sub-data block, the data in the modified data block may be a modified sub-data block, and the data in the deleted data block may be a deleted sub-data block.

[0163] S704: The network device updates the first hash tree according to the updated data block.

[0164] The network device may update the leaf nodes of the first hash tree according to the updated data block. For example, the network device may add a leaf node, modify a leaf node, or delete a leaf node. Then, the network device may update the parent node and ancestor node of the leaf node according to the updated leaf node.

[0165] For ease of understanding, the following is an example. Figure 7B In the schematic diagram of a hash tree update shown, the network device can insert sub-data block 0 in the data block, and accordingly, the network device can add a leaf node in the first hash tree, the leaf node is identified as 0, and then the network device can merge the leaf node identified as 0 with the value of the leaf node identified as 1, and perform a hash operation on the merged string to obtain the value of the newly added intermediate node. The network device can merge the value of the newly added intermediate node with the value of the leaf node identified as 2, and perform a hash operation on the merged string to obtain the value of another newly added intermediate node. Then, the network device can continue to merge the value of the intermediate node with the value of the parent node of the nodes identified as 3 and 4, and perform a hash operation on the merged string to obtain the value of another newly added intermediate node. By analogy, the network device can merge the value of the intermediate node with the value of the ancestor node identified as 5, 6, 7, and 8, and perform a hash operation on the merged string, and then update the value of the root node to the hash operation result.

[0166] S706: The network device sends a data configuration update request to the reader.

[0167] Specifically, the network device may generate a corresponding type of data configuration update request according to the update type of the data block. The data configuration update request is used to add, delete or modify data in the data block. The data configuration update request includes the added, deleted or modified sub-data block and the index of the sub-data block.

[0168] S708: The network device receives the node information of the second hash tree updated by the reader according to the data configuration update request.

[0169] The reader can update the second hash tree according to the sub-data blocks added, deleted or modified in the data configuration update request and the index of the sub-data blocks. The specific implementation of the reader updating the second hash tree is similar to the specific implementation of the network device updating the first hash tree, which will not be repeated here.

[0170] The network device may receive node information of a second hash tree updated by the reader according to a data configuration update request. The node information of the second hash tree updated by the reader according to the data configuration update request includes node information of a target node inserted, deleted or updated in the second hash tree, and node information of nodes affected by the target node. The target node may be a leaf node inserted, deleted or updated. The node affected by the target node may be at least one of a parent node and an ancestor node of the target node. The node information of the updated second hash tree may include incremental information relative to the previous version.

[0171] S710. The network device performs consistency verification based on the updated node information of the first hash tree and the updated node information of the second hash tree to obtain a verification result.

[0172] Specifically, the network device can compare the value of the node in the updated first hash tree with the value of the node in the updated second hash tree node by node. If they are consistent, the consistency verification is passed. If they are inconsistent, the values ​​of the nodes in the next layer are compared until the inconsistent leaf node is found. For the inconsistent leaf node, the network device can resend the sub-data block corresponding to the leaf node and the index of the sub-data block, so that the reader can update the second hash tree based on the resent data block and index.

[0173] Based on the above description, the data verification method of the present application synchronizes the data updated on the network side to the device side in the data update scenario, and the network side and the reader side respectively update the hash tree based on the updated data, and then the network side performs consistency verification based on the node information of the updated first hash tree and the node information of the updated second hash tree. In this way, the consistency of data updates can be guaranteed, erroneous operations can be avoided, and the normal operation of the business can be guaranteed.

[0174] The above-mentioned embodiments introduce the data verification method of the present application from the perspective of a network device. The following describes the data verification method of the present application from the perspective of a reader.

[0175] See also Figure 8 The flowchart of a data verification method shown in FIG. 1 can be performed by a reader, and the reader can include a terminal or an access network device (RAN device, such as a base station). The method includes the following steps:

[0176] S802: The reader receives a data configuration request.

[0177] The data configuration request includes a data block and an index and block information of the data block. The data block includes device IDs of multiple AIoT devices and group IDs of the groups to which the multiple AIoT devices belong. The block information may include the number of blocks or the size of the blocks.

[0178] The data configuration request may be generated by the network device according to the configured data block. The reader may receive the data configuration request sent by the network device to perform data configuration.

[0179] S804: The reader generates a second hash tree according to the data configuration request.

[0180] Specifically, the reader can perform a block operation on the data block according to the block information in the data configuration request to obtain multiple sub-data blocks. Then, the reader can generate a second hash tree according to the multiple sub-data blocks through a hash algorithm.

[0181] Wherein, the reader can generate a leaf node of the second hash tree according to a plurality of sub-data blocks, the value of the leaf node is the value or hash value of the sub-data block, and then the reader can generate a non-leaf node of the second hash tree according to the leaf node of the second hash tree. The non-leaf node may include an intermediate node or a root node, and the value of the non-leaf node is determined according to the value of the leaf node belonging to the non-leaf node. Wherein, the leaf node belonging to the non-leaf node may be a leaf node in a descendant node of the non-leaf node. The descendant node may include, but is not limited to, a child node and a child node of a child node.

[0182] In some possible implementations, the data configuration request also includes the address, name, security parameters, or hash algorithm type of the AIoT device. The hash algorithm type is used to indicate the hash algorithm used to perform a hash operation on the data in the data block. For example, the hash algorithm type may include SHA or SM5. Among them, the hash algorithm type can be determined by the network device based on the contract information of the AIoT device in the mobile network or the information of the industry user to which the AIoT device belongs.

[0183] In some other possible implementations, when an access and mobility management function (AMF) network element establishes a stream control transmission protocol (SCTP) connection, the AMF can read the hash algorithm type from a unified data management function (UDM) network element or a policy control function (PCF) network element, and accordingly, the reader can obtain the hash algorithm type from the AMF network element. The hash algorithm type is used to indicate the hash algorithm used to perform a hash operation on the data in the data block.

[0184] In this way, the reader can perform hash calculation on the sub-data block according to the above hash algorithm type to obtain the value of the leaf node, and perform hash calculation on the string merged from different nodes to obtain the value of the non-leaf node (intermediate node or root node).

[0185] S806. The reader sends the node information of the second hash tree to the network device.

[0186] The node information of the second hash tree is used to perform consistency verification in combination with the node information of the first hash tree generated by the network device based on multiple sub-data blocks obtained by dividing the data block into blocks, to obtain a verification result.

[0187] Based on the above description, in the data verification method provided by the present application, the reader receives a data configuration request, divides the data block according to the block information in the data configuration request, generates a second hash tree on the reader side based on the multiple sub-data blocks obtained by the block division, and sends the node information of the second hash tree to the network side, so that the network side performs consistency verification based on the node information of the first hash tree and the node information of the second hash tree. In this way, the consistency of data on the network side and the reader side is guaranteed to avoid causing erroneous operations and affecting the normal operation of the business.

[0188] Further, when the consistency verification is passed, the reader can end the verification process, and when the consistency verification is not passed, the reader can receive data resent by the network device and re-perform consistency verification.

[0189] See also Fig. 9 The flowchart of another data verification method shown in FIG. 1 is used in a scenario where the verification result fails, and specifically includes the following steps:

[0190] S902: The reader receives sub-data blocks corresponding to nodes in the first hash tree that are inconsistent with nodes in the second hash tree and indexes of the sub-data blocks sent by the network device.

[0191] S904: The reader updates the second hash tree according to the sub-data blocks corresponding to the inconsistent nodes and the indexes of the sub-data blocks.

[0192] Specifically, the reader may update the leaf node corresponding to the sub-data block in the second hash tree according to the sub-data block corresponding to the inconsistent node. For example, the reader may perform a hash calculation using a hash algorithm based on the sub-data block resent to the network device, and update the value of the corresponding leaf node according to the hash calculation result. Then, the reader updates the non-leaf nodes of the second hash tree according to the updated leaf nodes.

[0193] S906: The reader sends updated node information of the second hash tree to the network device.

[0194] The reader may adopt a full update method or an incremental update method to send the node information of the updated second hash tree to the network device. In order to reduce transmission overhead, the reader may adopt an incremental update method to send the incremental information of the second hash tree relative to the previous version to the network device. The incremental information may include information of modified, newly added or deleted nodes.

[0195] Based on the above description, in the data verification method provided by the present application, when the consistency verification fails, the reader can receive the sub-data block and its index corresponding to the inconsistent node re-sent by the network side, update the second hash tree according to the sub-data block and its index, and send the updated node information of the second hash tree to the network side to perform consistency verification again, so as to achieve data synchronization between the network side and the reader side with less overhead.

[0196] Considering that configuration data can usually be updated dynamically, the present application also provides a data verification method in a data update scenario.

[0197] See also Fig.10 A flowchart of another data verification method is shown, which is used in a data update scenario and specifically includes the following steps:

[0198] S1002: The reader receives a data configuration update request.

[0199] The data configuration update request is used to add, delete or modify data in a data block. The data configuration update request includes the sub-data block to be added, deleted or modified and the index of the sub-data block. Among them, the data configuration update request can be generated when the network device updates the data block. The specific implementation can refer to the description of the relevant content of the aforementioned embodiment.

[0200] S1004. The reader updates the second hash tree according to the data configuration update request.

[0201] and Fig. 9 Similar to the embodiment, the reader can update the leaf nodes of the second hash tree according to the sub-data blocks that are newly added, deleted or modified in the data configuration update request, and then update the non-leaf nodes according to the updated leaf nodes, thereby updating the second hash tree.

[0202] S1006. The reader sends updated node information of the second hash tree to the network device.

[0203] The node information of the updated second hash tree includes the node information of the target node inserted, deleted or updated in the second hash tree, and the node information of the node affected by the target node. It should be noted that the target node may be a leaf node, and the node affected by the target node may be an ancestor node of the leaf node.

[0204] When sending the node information of the updated second hash tree, the reader may send the full information of the updated second hash tree, or send the incremental information of the updated second hash tree. The incremental information may be the incremental information of the updated second hash tree relative to the previous version (before the update).

[0205] Based on the above description, the data verification method of the present application receives a data configuration update request sent by the network side in a data update scenario, updates the second hash tree according to the sub-data block and its index in the updated data configuration update request, and then sends the node information of the updated second hash tree to the network side, so that the network side performs consistency verification based on the node information of the updated first hash tree and the node information of the updated second hash tree. In this way, the consistency of data updates can be guaranteed, erroneous operations can be avoided, and the normal operation of the business can be guaranteed.

[0206] In order to make the technical solution of the present application clearer and easier to understand, the data verification method of the present application is introduced from an interactive perspective below.

[0207] First, see Fig.11 The flowchart of a data verification method shown in FIG. 1 specifically includes the following steps:

[0208] S1102. The network device divides the configured data block into multiple sub-data blocks, and generates a first hash tree according to the multiple sub-data blocks.

[0209] S1104. The network device sends a data configuration request to the reader.

[0210] In this example, the data configuration request includes a data block, an index of the data block, and block information. The data block may include the device ID of the AIoT devices and the group ID of the group to which it belongs. Furthermore, the data block may also include at least one of the address, name, and security parameters of the AIoT devices. The index of the data block may include the number of the data block. The block information may include the number of blocks or the size of the blocks.

[0211] In some possible implementations, the data configuration request may further include a hash algorithm type, where the hash algorithm type is used to indicate a hash algorithm for performing hash calculation on the data in the data block.

[0212] S1106. When the AMF network element establishes an SCTP connection, AMF obtains the hash algorithm type from UDM or PCF.

[0213] S1108. The reader obtains the hash algorithm type from the AMF.

[0214] S1106 and S1108 are an implementation method for a reader (such as a UE or a RAN device) to obtain the hash algorithm type. In some examples, the reader can obtain the hash algorithm type from any network element of AMF, UDM or PCF. It should be noted that the above S1106 and S1108 are optional steps of this application. For example, when the data configuration request carries the hash algorithm type, the above S1106 and S1108 may not be executed.

[0215] S1110. The reader generates a second hash tree according to the data block and the index of the data block by using the hash algorithm indicated by the hash algorithm type.

[0216] S1112. The reader sends node information of the second hash tree to the network device.

[0217] For example, the reader may send the values ​​of the root node, the intermediate nodes, and the leaf nodes of the second hash tree to the network device.

[0218] S1114. The network device compares the node information of the first hash tree with the node information of the second hash tree.

[0219] If the node information of the first hash tree is consistent with the node information of the second hash tree, it means that the consistency verification is passed and the verification process can be ended.

[0220] Next, see Fig.12 The flowchart of another data verification method shown in FIG. 1 specifically includes the following steps:

[0221] S1202: The network device divides the configured data block into multiple sub-data blocks, and generates a first hash tree according to the multiple sub-data blocks.

[0222] S1204: The network device sends a data configuration request to the reader.

[0223] S1206. When the AMF network element establishes an SCTP connection, AMF obtains the hash algorithm type from UDM or PCF.

[0224] S1208. The reader obtains the hash algorithm type from the AMF.

[0225] S1210. The reader generates a second hash tree according to the data block and the index of the data block by using the hash algorithm indicated by the hash algorithm type.

[0226] S1212. The reader sends node information of the second hash tree to the network device.

[0227] The specific implementation of S1202 to S1212 may refer to the aforementioned embodiments.

[0228] S1214: The network device compares the node information of the first hash tree with the node information of the second hash tree. If the consistency verification fails, execute S1216.

[0229] Fig.13 A schematic diagram of a network device comparing the node information of a first hash tree and the node information of a second hash tree is also shown. The network device may first compare the node information of the root node in the first hash tree and the node information of the root node in the second hash tree. If they are inconsistent, the network device continues to compare the node information of the intermediate nodes of the next layer in the first hash tree and the node information of the intermediate nodes of the next layer in the second hash tree. For example, the network device compares the node information of node 2 (Node2) in the first hash tree and the node information of node 2 in the second hash tree. If they are inconsistent, the node information of the child nodes of the node, such as node 5 (Node5), is compared. When the node information of node 5 in the first hash tree is also inconsistent with the node information of node 5 in the second hash tree, the node information of the leaf nodes under node 5 in the first hash tree and the node information of the leaf nodes under node 5 in the second hash tree are continued to be compared to determine the inconsistent leaf nodes, and then obtain inconsistent sub-data blocks. Fig.13 In the example, the inconsistent leaf nodes can be Fig.13 Node 12 marked by grayscale. In this way, the complexity of consistency verification can be O(log N), which is greatly reduced.

[0230] S1216. The network device sends an error indication to the reader.

[0231] The error indicator includes the inconsistent sub-data block and the index of the sub-data block.

[0232] S1218. The reader sends an error handling response to the network device.

[0233] Specifically, the reader can replace the local sub-data block according to the sub-data block in the error indication, and recalculate the hash value of the sub-data block to update the leaf node of the second hash tree, and update the non-leaf nodes in the second hash tree according to the updated leaf node. The reader can carry the node information of the updated second hash tree in the error handling response, and then send the error handling response to the network device. The network device re-compares the node information of the updated second hash tree in the error handling response to ensure data consistency between the reader and the network side.

[0234] Then, the data verification method for data update scenarios is introduced.

[0235] See also Fig.14 A flow chart of a data verification method is shown, the method comprising the following steps:

[0236] S1402: The network device sends a data configuration update request to the reader.

[0237] A data configuration update request (such as a Modification Request) is used to update data configuration. The data configuration update request may include an update operation type, such as add (Add), modify (Mod) or delete (Del), and the data configuration update request may also include the sub-data block to be added, deleted or modified and the index of the sub-data block.

[0238] S1404: The reader updates the second hash tree according to the sub-data block and the index of the sub-data block.

[0239] For example, when the data configuration update request is for new data, the reader can insert a leaf node corresponding to the sub-data block in the second hash tree according to the index of the sub-data block, and then update the leaf nodes affected by the leaf node, such as the ancestor nodes of the leaf node.

[0240] S1406. The reader sends an update response to the network device.

[0241] The update response (eg, Modification Response) may include node information of the updated second hash tree, such as the value of the updated root node and the values ​​of the updated intermediate nodes and leaf nodes.

[0242] S1408. The network device compares the updated node information of the first hash tree with the node information of the second hash tree to obtain a verification result.

[0243] If the node information of the updated first hash tree is consistent with the node information of the second hash tree, it means that the consistency verification is passed and the current verification process can be ended.

[0244] Generally, the AIoT controller, AF network element, NEF network element or OM network element on the network side is relatively reliable, and the AIoT controller, AF network element, NEF network element or OM network element on the network side can perform data consistency verification. In some possible implementations, if the reader is reliable, the network side can also send data, and the reader can perform data consistency verification.

[0245] The above embodiment is described by taking grouping of data as an example, in some scenarios, data including device ID may not be grouped. Accordingly, the data configuration request and data configuration update request sent by the network side may not carry the group ID.

[0246] It should be noted that the various embodiments of the present application can be combined with or referenced to each other. For specific implementation, reference can be made to the relevant content description of the aforementioned embodiments, which will not be repeated here.

[0247] Fig.15 This is an example of a composition of an electronic device provided in an embodiment of the present application. The electronic device may be a base station or a core network unit. Fig.15 A simplified schematic diagram of the base station structure is shown. The base station 1500 includes a processor 1510, a memory 1520, and a transceiver 1530. The processor 1510 is mainly used for baseband processing, controlling the base station, etc.; the processor 1510 is usually the control center of the base station, used to control the base station to perform the processing operations on the reader side in the above method embodiment. The memory 1520 is mainly used to store computer program codes and data. The transceiver 1530 is mainly used for receiving and transmitting radio frequency signals and converting radio frequency signals into baseband signals; the transceiver 1530 can generally be called a transceiver module, a transceiver, a transceiver circuit, etc. The transceiver 1530 includes an antenna 1533 and a radio frequency circuit (not shown in the figure), wherein the radio frequency circuit is mainly used for radio frequency processing. Optionally, the device used to implement the receiving function in the transceiver 1530 is regarded as a receiver, and the device used to implement the sending function is regarded as a transmitter, that is, the transceiver 1530 includes a receiver 1532 and a transmitter 1531. A receiver may also be called a receiving module, a receiver, or a receiving circuit, etc., and a transmitter may be called a transmitting module, a transmitter, or a transmitting circuit, etc.

[0248] The processor 1510 and the memory 1520 may include one or more single boards, each of which may include one or more processors and one or more memories. The processor is used to read and execute the computer program in the memory to realize the baseband processing function and the control of the base station. If there are multiple single boards, each single board can be interconnected to enhance the processing capability. As an optional implementation, multiple single boards may share one or more processors, or multiple single boards may share one or more memories, or multiple single boards may share one or more processors at the same time.

[0249] In one implementation, the transceiver 1530 is used to execute the transceiver-related processes executed by the base station in the aforementioned method embodiment. The processor 1510 is used to execute the processing-related processes executed by the base station in the aforementioned method embodiment.

[0250] It should be understood that Fig.15 This is only an example and not a limitation. The network device including the processor, memory and transceiver may not rely on Fig.15 The structure shown.

[0251] Fig.16 Another example of the composition of an electronic device provided in an embodiment of the present application. The electronic device may be a terminal, including but not limited to a mobile phone, a smart wearable device (such as a smart watch) and other electronic devices. Taking a mobile phone as an example, the electronic device may include a processor 310, an external memory interface 320, an internal memory 321, a display screen 330, a camera 340, an antenna 1, an antenna 2, a mobile communication module 350, and a wireless communication module 360, etc.

[0252] It is to be understood that the structure illustrated in this embodiment does not constitute a specific limitation on the electronic device. In other embodiments, the electronic device may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0253] The processor 310 may include one or more processing units, for example, the processor 310 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0254] It is understandable that the interface connection relationship between the modules illustrated in this embodiment is only a schematic illustration and does not constitute a structural limitation of the electronic device. In other embodiments of the present application, the electronic device may also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.

[0255] The external memory interface 320 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device. The external memory card communicates with the processor 310 through the external memory interface 320 to implement a data storage function. For example, files such as music and videos can be stored in the external memory card.

[0256] The internal memory 321 can be used to store computer executable program codes, and the executable program codes include instructions. The processor 310 executes various functional applications and data processing of the electronic device by running the instructions stored in the internal memory 321. The internal memory 321 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc. The data storage area may store data created during the use of the electronic device (such as audio data, a phone book, etc.), etc. In addition, the internal memory 321 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc. The processor 310 executes various functional applications and data processing of the electronic device by running the instructions stored in the internal memory 321, and / or the instructions stored in the memory provided in the processor.

[0257] The wireless communication function of the electronic device can be implemented through antenna 1, antenna 2, mobile communication module 350, wireless communication module 360, modem processor and baseband processor.

[0258] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in the electronic device can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization of the antennas. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0259] The mobile communication module 350 can provide solutions for wireless communications including 2G / 3G / 4G / 5G applied in electronic devices. The mobile communication module 350 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 350 can receive electromagnetic waves from the antenna 1, and filter, amplify, and process the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 350 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1. In some embodiments, at least some of the functional modules of the mobile communication module 350 can be set in the processor 310. In some embodiments, at least some of the functional modules of the mobile communication module 350 can be set in the same device as at least some of the modules of the processor 310.

[0260] In some embodiments, the electronic device initiates or receives a call request through the mobile communication module 350 and the antenna 1 .

[0261] In addition, an operating system is running on the above components. For example, an iOS operating system, an Android operating system, a Windows operating system, etc. Applications can be installed and run on the operating system. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the explanation and beneficial effects of the relevant contents in any of the electronic devices provided above can refer to the corresponding method embodiments provided above, and will not be repeated here.

[0262] The present application also provides a communication system, which may include a network device and a reader. The reader may be Fig.15 The base station shown, or Fig.16 The network device may be a core network unit, and the structure of the core network unit may refer to Fig.15 .

[0263] In the present application, the reader or network device may include a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer. The hardware layer may include hardware such as a central processing unit (CPU), a memory management unit (MMU), and a memory (also called main memory). The operating system of the operating system layer may be any one or more computer operating systems that implement business processing through processes, such as Linux operating system, Unix operating system, Android operating system, iOS operating system, or Windows operating system. The application layer may include applications such as browsers, address books, word processing software, and instant messaging software.

[0264] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0265] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0266] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0267] In addition, each functional module in each embodiment of the present application can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or software functional modules.

[0268] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the part that essentially contributes to the technical solution of the present application or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the process of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories, random access memories, magnetic disks or optical disks.

[0269] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, a person of ordinary skill in the art should understand that the technical solutions described in the aforementioned embodiments can still be modified, or some of the technical features therein can be replaced by equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A data verification method, characterized in that: The method comprises: The network device divides the configured data block into blocks to obtain multiple sub-data blocks, and generates a first hash tree according to the multiple sub-data blocks, wherein the data block includes device identifiers of multiple environmental Internet of Things devices and group identifiers of groups to which the multiple environmental Internet of Things devices belong, and each of the sub-data blocks includes the group identifier and at least one of the device identifiers included in the group; The network device sends a data configuration request to the reader, wherein the data configuration request includes the data block and the index and block information of the data block; The network device receives node information of a second hash tree generated by the reader according to the data configuration request; The network device performs consistency verification according to the node information of the first hash tree and the node information of the second hash tree to obtain a verification result.

2. The method according to claim 1, characterized in that The method further comprises: When the verification result is verification failure, the network device determines a node from the nodes of the first hash tree that is inconsistent with the nodes of the second hash tree; The network device sends the sub-data block corresponding to the inconsistent node and the index of the sub-data block to the reader; The network device receives the node information of the second hash tree updated by the reader according to the sub-data block corresponding to the inconsistent node and the index of the sub-data block; The network device performs consistency verification according to the updated node information of the second hash tree and the node information of the first hash tree until the verification passes.

3. The method according to claim 1, characterized in that The method further comprises: The network device updates the data block, and updates the first hash tree according to the updated data block; The network device sends a data configuration update request to the reader, the data configuration update request is used to add, delete or modify data in the data block, and the data configuration update request includes a newly added, deleted or modified sub-data block and an index of the sub-data block; The network device receives the node information of the second hash tree updated by the reader according to the data configuration update request, wherein the node information of the second hash tree updated by the reader according to the data configuration update request includes the node information of the target node inserted, deleted or updated in the second hash tree, and the node information of the node affected by the target node; The network device performs consistency verification based on the updated node information of the first hash tree and the updated node information of the second hash tree to obtain a verification result.

4. The method according to claim 3, characterized in that The node information of the second hash tree updated by the reader according to the data configuration update request includes incremental information relative to the previous version.

5. The method according to any one of claims 1 to 4, characterized in that: The data configuration request also includes the address, name, security parameters or hash algorithm type of the environmental Internet of Things device, and the hash algorithm type is used to indicate the hash algorithm used to perform a hash operation on the data in the data block.

6. The method according to claim 5, characterized in that The hash algorithm type is determined by the network device based on the contract information of the environmental Internet of Things device in the mobile network or the information of the industry user to which the environmental Internet of Things device belongs.

7. The method according to any one of claims 1 to 4, characterized in that: The network device generates a first hash tree according to the multiple sub-data blocks, including: The network device generates a leaf node of the first hash tree according to the multiple sub-data blocks, where the value of the leaf node is the value or hash value of the sub-data block; The network device generates a non-leaf node of the first hash tree according to the leaf node of the first hash tree, wherein the non-leaf node includes an intermediate node or a root node, and the value of the non-leaf node is determined according to the value of the leaf node belonging to the non-leaf node.

8. The method according to any one of claims 1 to 4, characterized in that: The network device includes at least one of an environmental Internet of Things device controller, an application function network element, a network open function network element or an operation management network element.

9. A data verification method, characterized in that: The method comprises: The reader receives a data configuration request, the data configuration request including a data block and an index and block information of the data block, the data block including device identifiers of a plurality of environmental Internet of Things devices and group identifiers of groups to which the plurality of environmental Internet of Things devices belong, each sub-data block including the group identifier and at least one of the device identifiers included in the group; The reader generates a second hash tree according to the data configuration request; The reader sends the node information of the second hash tree to the network device, and the node information of the second hash tree is used to perform consistency verification in combination with the node information of the first hash tree generated by the network device based on multiple sub-data blocks obtained by dividing the data block into blocks, to obtain a verification result.

10. The method according to claim 9, characterized in that The method further comprises: The reader receives, from the network device, a sub-data block corresponding to a node in the first hash tree that is inconsistent with a node in the second hash tree and an index of the sub-data block; The reader updates the second hash tree according to the sub-data blocks corresponding to the inconsistent nodes and the indexes of the sub-data blocks; The reader sends updated node information of the second hash tree to the network device.

11. The method according to claim 9, characterized in that The method further comprises: The reader receives a data configuration update request, the data configuration update request is used to add, delete or modify data in the data block, the data configuration update request includes a newly added, deleted or modified sub-data block and an index of the sub-data block; The reader updates the second hash tree according to the data configuration update request, and the node information of the updated second hash tree includes the node information of the target node inserted, deleted or updated in the second hash tree, and the node information of the node affected by the target node; The reader sends updated node information of the second hash tree to the network device.

12. The method according to claim 11, characterized in that The reader sends updated node information of the second hash tree to the network device, including: The reader sends incremental information of the updated second hash tree relative to the previous version to the network device.

13. The method according to any one of claims 9 to 12, characterized in that: The data configuration request also includes the address, name, security parameters or hash algorithm type of the environmental Internet of Things device, and the hash algorithm type is used to indicate the hash algorithm used to perform a hash operation on the data in the data block.

14. The method according to claim 13, characterized in that The type of hash algorithm is determined by the network device based on the contract information of the environmental Internet of Things device in the mobile network or the information of the industry user to which the environmental Internet of Things device belongs.

15. The method according to any one of claims 9 to 12, characterized in that: The method further comprises: When the access and mobility management function AMF network element establishes a stream control transmission protocol SCTP connection, the reader obtains a hash algorithm type from the AMF network element, where the hash algorithm type is used to indicate the hash algorithm used to perform a hash operation on the data in the data block.

16. The method according to any one of claims 9 to 12, characterized in that: The reader generates a second hash tree according to the data configuration request, including: The reader divides the data block into blocks according to the block information in the data configuration request to obtain a plurality of sub-data blocks; The reader generates a leaf node of the second hash tree according to the multiple sub-data blocks, and the value of the leaf node is the value or hash value of the sub-data block; The reader generates a non-leaf node of the second hash tree according to the leaf node of the second hash tree, wherein the non-leaf node includes an intermediate node or a root node, and the value of the non-leaf node is determined according to the value of the leaf node belonging to the non-leaf node.

17. The method according to any one of claims 9 to 12, characterized in that: The reader includes a terminal or an access network device.

18. A network device, characterized in that: The network equipment includes: Memory for storing computer programs or computer instructions; A processor, configured to execute a computer program or computer instruction stored in the memory, so that the network device executes the method according to any one of claims 1 to 8.

19. A reader, characterized in that: The reader comprises: Memory for storing computer programs or computer instructions; A processor, configured to execute a computer program or computer instructions stored in the memory, so that the reader executes the method according to any one of claims 9 to 17.

20. A communication system, characterized in that: The communication system comprises a network device and a reader, wherein the network device is used to execute the method according to any one of claims 1 to 8, and the reader is used to execute the method according to any one of claims 9 to 17.

21. A computer storage medium, characterized in that The computer storage medium is used to store a computer program, and when the computer program is executed, it is used to implement the method according to any one of claims 1 to 17.

22. A computer program product, characterized in that The method comprises computer-readable instructions; the computer-readable instructions are used to implement the method according to any one of claims 1 to 17.

Images