Data integrity verification method and related device

Abstract

The invention discloses a data integrity verification method, which is applied to a data integrity verification scene, and comprises the following steps: a block chain platform receives an audit request initiated by a cloud platform and then sends public state information to the cloud platform, and the cloud platform calculates a possession proof of a data block according to the public state information. And the cloud platform sends the possession proof of the data block to the block chain platform, and the block chain platform verifies the integrity of the data block according to the possession proof to obtain an audit record of the data block. According to the method, the cloud platform and the block chain platform cannot tamper the information in the auditing process by utilizing the non-tampering characteristic of the block chain, so that the collusion attack between a cloud service provider and a third-party auditor can be effectively resisted, and trusted data management in an incompletely trusted environment is realized.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to a data integrity verification method and related devices. Background Art

[0002] In order to improve the business continuity of enterprises, most of the current cloud disaster recovery solutions provide customers with multi-cloud and cross-cloud disaster recovery backup capabilities, realizing the multiple basic guarantees of "multi-cloud backup, cloud disaster recovery". This mode of collaborative storage of multiple cloud platforms (rich cloud mode) is difficult to guarantee the quality of backup data due to the involvement of many platforms. First of all, from the perspective of enterprises, the cloud is not completely trustworthy, because although cloud service providers have technical foundations and maintenance capabilities that ordinary users cannot compare with, they still cannot avoid the phenomenon of backup data being damaged or lost due to misoperation. In addition, when hackers attack a certain business of an enterprise, sometimes in order to ensure that the entire business is completely destroyed, they will also attack the cloud backup center of the enterprise and tamper with the data therein, making the business unable to recover. In the above scenario, the cloud service provider is likely to conceal the fact that the backup file is damaged from the user for its own interests. When the user needs to use the backup data, it is too late to find that the data has been damaged. Therefore, it is required to regularly inspect the integrity of multi-cloud backup data during daily maintenance to ensure that the backup data can be used as soon as possible when a real failure occurs.

[0003] Provable Data Possession (PDP) is a commonly used traditional cloud data auditing method. This method mainly adopts the "challenge-response" model and generally includes three entities: users, cloud service providers, and third-party auditors. Users generate a public-private key pair based on discrete logarithms in cryptography, divide the file into fixed-size data blocks, use the private key to calculate the label based on the data block audit according to the data block content, and upload the two together to the cloud server for storage. The third-party auditor uses the file information to be audited by the user as input, randomly generates the data block information to be challenged and the corresponding random number, and forms a challenge message to be sent to the cloud server. The cloud server calculates the possession proof of the specified data block in the challenge message based on the user's public key, data block set, and data block label set, and sends it to the third-party auditor for verification. The third-party auditor uses the public key and possession proof as input to perform integrity verification and obtain the audit result.

[0004] In this audit method, the reliability of the audit results depends on the credibility of the third-party auditor. However, the third-party auditor is likely to collude with the cloud service provider to attack, so the reliability of the audit results cannot be guaranteed. Summary of the invention

[0005] The present application provides a data integrity verification method and related devices for performing trusted integrity verification on data stored on a cloud platform in an incompletely trusted environment.

[0006] In a first aspect, the present application provides a data integrity verification method, which is applied to a blockchain platform. The method includes: the blockchain platform receives an audit request initiated by a cloud platform; the blockchain platform sends public status information to the cloud platform based on the audit request, and the public status information is used by the cloud platform to calculate the possession proof of the data block; the blockchain platform receives the possession proof sent by the cloud platform; the blockchain platform verifies the integrity of the data block based on the possession proof to obtain an audit record of the data block.

[0007] The user uploads the data block to the cloud platform through the client, which is the cloud data center. The client then calculates the label of the data block (i.e., audit metadata) and uploads the label to the blockchain platform for storage. The blockchain platform is deployed on the blockchain, and the audit metadata can be stored in the distributed ledger of the blockchain.

[0008] After receiving the audit request initiated by the cloud platform, the blockchain platform replies with public status information to the cloud platform. The cloud platform generates challenge information based on the public status information, selects data blocks through the challenge information, and then calculates the possession proof of the data block based on the public status information and the challenge information. After the cloud platform calculates the possession proof, it initiates an integrity verification request for the data block to the blockchain platform. The integrity verification request carries the possession proof, challenge information, and public status information of the data block. The blockchain platform first verifies the authenticity of the public status information, and then parses the data block to be audited through the challenge information, and then extracts the audit metadata of the data block, verifies the integrity of the data block based on the possession proof and audit metadata of the data block, and generates an audit record for the data block.

[0009] The first aspect of this application utilizes the tamper-proof characteristics of blockchain to make it impossible for the cloud platform and blockchain platform to tamper with the information in the audit process, which can effectively resist the collusion attack between the cloud service provider and the third-party auditor, and realize trusted data management in an incompletely trusted environment.

[0010] In a possible implementation of the first aspect, after the above step: the blockchain platform verifies the integrity of the data block based on the proof of possession, the method also includes: the blockchain platform evaluates the reputation value of the cloud platform based on integrity.

[0011] The blockchain platform evaluates the reputation of the cloud platform based on the integrity of the verified data blocks. If the integrity is verified, the reputation of the cloud platform is increased, and when a client fails and needs to switch data centers or restore backup data, the probability of choosing the cloud platform increases. If it fails to pass the verification, the reputation of the cloud platform is reduced, the frequency of use of the cloud platform is reduced, and the cloud service provider is reminded to inspect and maintain the cloud platform.

[0012] In this possible implementation, the blockchain platform will also evaluate the reputation of the cloud platform based on the integrity of the data blocks, thereby assisting users in choosing a more suitable cloud platform, and reminding the cloud service provider to maintain the cloud platform to ensure the smooth operation of the cloud platform.

[0013] In a possible implementation of the first aspect, in the above step: before the blockchain platform receives the audit request initiated by the cloud platform, the method also includes: the blockchain platform sends an instruction to the cloud platform, where the instruction is used to indicate the time when the cloud platform initiates the audit request.

[0014] The blockchain platform can agree with the cloud platform on the time to initiate the audit request. The time can be a specific time, such as 9:00, 9:30, and 9:40. It can also refer to regular audit requests, such as initiating an audit request every half hour, every hour, or every two hours.

[0015] In this possible implementation, by agreeing with the cloud platform on the time to initiate the audit request, the security of the backup data can be further improved and energy consumption can be saved.

[0016] In a possible implementation of the first aspect, the audit record carries a timestamp. In the above steps: the blockchain platform verifies the integrity of the data block based on the proof of possession, and after obtaining the audit record of the data block, the method also includes: the blockchain platform determines the compliance of the cloud platform based on the timestamp, and the compliance indicates whether the cloud platform initiates the audit request according to the time; the blockchain platform evaluates the reputation value of the cloud platform based on the compliance.

[0017] The timestamp is the time when the integrity verification result is obtained. The blockchain can determine whether the cloud platform has initiated the audit request according to the agreed time based on the timestamp, thereby obtaining the compliance status of the cloud platform. It is understandable that it takes a certain amount of time from the cloud platform initiating the audit request to the blockchain platform obtaining the integrity of the data block. Within the allowed time range, it can be considered that the cloud platform has initiated the audit request according to the agreed time. For example, it is agreed that the cloud platform will initiate the audit request at 9:30, and the timestamp in the audit record is 9:33. The extra three minutes can be considered as a reasonable time required for verification, so the cloud platform is judged to be in compliance. Alternatively, it is agreed that the cloud platform will initiate an audit request every half an hour, and the timestamps of the two audit records are 9:03 and 9:33 respectively, then it can be judged that the cloud platform is in compliance.

[0018] In this possible implementation, the cloud platform can also judge the reputation of the cloud platform by its compliance with the contract, thus expanding the application scenarios of the solution.

[0019] In a possible implementation of the first aspect, in the above-mentioned steps: after the blockchain platform verifies the integrity of the data block based on the proof of possession and obtains the audit record of the data block, the method also includes: the blockchain platform receives a coarse-grained query request initiated by the client; and the blockchain platform sends the audit record to the client based on the coarse-grained query request.

[0020] The client sends a coarse-grained query request to the blockchain platform. After receiving the coarse-grained query request, the blockchain platform sends all audit records related to the cloud platform to the client.

[0021] In this possible implementation, the client can view the audit records of the data stored on the cloud platform from the blockchain platform, thereby better helping users manage data.

[0022] In a possible implementation of the first aspect, in the above-mentioned steps: after the blockchain platform verifies the integrity of the data block based on the proof of possession and obtains the audit record of the data block, the method also includes: the blockchain platform receives a fine-grained query request initiated by the client; the blockchain platform sends the target content in the audit record to the client based on the fine-grained query request.

[0023] The client sends a fine-grained query request to the blockchain platform, which specifies the target content in the audit record. The target content can be the audit record of a cloud platform in a certain period of time, the audit record of certain data blocks, or a specified audit record. After receiving the fine-grained query request, the blockchain platform sends the specified content to the client.

[0024] In this possible implementation, the client can specify the target content of the query, thereby achieving more sophisticated management of the data.

[0025] In a possible implementation of the first aspect, the blockchain platform is deployed on the alliance chain Fabric. In addition, the blockchain platform can also be deployed on the alliance chain Corda or Quorum, which is not limited here. In this possible implementation, the type of blockchain deployed by the blockchain platform is limited, which improves the feasibility of the solution.

[0026] In a possible implementation of the first aspect, the cloud platform is a cloud backup center, which is used to back up data blocks. In addition to the above backup scenarios, the cloud platform can also be a cloud data center in scenarios such as data storage or data trading, which is not specifically limited here. In this possible implementation, the type of cloud platform is limited, which improves the feasibility of the solution.

[0027] A second aspect of the present application provides a data integrity verification method, which is applied to a cloud platform, and the method includes: the cloud platform initiates an audit request to a blockchain platform; the cloud platform receives public status information sent by the blockchain platform based on the audit request; the cloud platform calculates the possession proof of the data block based on the public status information; the cloud platform sends the possession proof to the blockchain platform, so that the blockchain platform verifies the integrity of the data block based on the possession proof.

[0028] The user uploads the data block to the cloud platform through the client, which is the cloud data center. The client then calculates the label of the data block (i.e., audit metadata) and uploads the label to the blockchain platform for storage. The blockchain platform is deployed on the blockchain, and the audit metadata can be stored in the distributed ledger of the blockchain.

[0029] The cloud platform proactively initiates an audit request for a data block to the blockchain platform, and the blockchain platform responds to the public status information after receiving it. The cloud platform generates challenge information based on the public status information, selects data blocks through the challenge information, and then calculates the possession proof of the data block based on the public status information and the challenge information. After the cloud platform calculates the possession proof, it initiates an integrity verification request for the data block to the blockchain platform, and the integrity verification request carries the possession proof, challenge information, and public status information of the data block. The blockchain platform first verifies the authenticity of the public status information, and then parses the data block to be audited through the challenge information, and then extracts the audit metadata of the data block, verifies the integrity of the data block based on the possession proof and audit metadata of the data block, and generates an audit record of the data block.

[0030] The second aspect of this application utilizes the tamper-proof nature of blockchain to make it impossible for the cloud platform and blockchain platform to tamper with the information in the audit process, which can effectively resist collusion attacks between cloud service providers and third-party auditors and achieve trusted data management in an incompletely trusted environment.

[0031] In a possible implementation of the second aspect, the above-mentioned step: before the cloud platform initiates an audit request to the blockchain platform, the method also includes: the cloud platform receives an instruction sent by the blockchain platform, the instruction is used to indicate the time when the cloud platform initiates the audit request; the above-mentioned step: the cloud platform initiates an audit request to the blockchain platform, including: the cloud platform initiates an audit request to the blockchain platform based on the agreed time.

[0032] The blockchain platform can agree with the cloud platform on the time to initiate the audit request. The time can be a specific time, such as 9:00, 9:30, and 9:40. It can also refer to regular audit requests, such as initiating an audit request every half hour, every hour, or every two hours.

[0033] In this possible implementation, the blockchain platform can further improve the security of backup data and save energy by agreeing with the cloud platform on the time to initiate an audit request.

[0034] In a possible implementation of the second aspect, the cloud platform is a cloud backup center, which is used to back up data blocks. In addition to the above backup scenarios, the cloud platform can also be a cloud data center in scenarios such as data storage or data trading, which is not specifically limited here. In this possible implementation, the type of cloud platform is limited, which improves the feasibility of the solution.

[0035] In a possible implementation of the second aspect, the blockchain platform is deployed on the alliance chain Fabric. In addition, the blockchain platform can also be deployed on the alliance chain Corda or Quorum, which is not limited here. In this possible implementation, the type of blockchain deployed by the blockchain platform is limited, which improves the feasibility of the solution.

[0036] The third aspect of the present application provides a blockchain platform, including a receiving unit, a sending unit and a verification unit. The receiving unit is used to receive an audit request initiated by a cloud platform; the sending unit is used to send public status information to the cloud platform based on the audit request, and the public status information is used by the cloud platform to calculate the possession proof of the data block; the receiving unit is also used to receive the possession proof sent by the cloud platform; the verification unit is used to verify the integrity of the data block based on the possession proof and obtain the audit record of the data block.

[0037] In a possible implementation manner of the third aspect, the device further includes an evaluation unit, configured to evaluate the reputation value of the cloud platform based on integrity.

[0038] In a possible implementation manner of the third aspect, the sending unit is further used to send an instruction to the cloud platform, where the instruction is used to indicate the time when the cloud platform initiates the audit request.

[0039] In a possible implementation of the third aspect, the audit record carries a timestamp, and the device also includes a judgment unit for judging the compliance of the cloud platform based on the timestamp, and the compliance status indicates whether the cloud platform initiates the audit request according to the time; the evaluation unit is also used to evaluate the reputation value of the cloud platform based on the compliance status.

[0040] In a possible implementation manner of the third aspect, the receiving unit is further configured to receive a coarse-grained query request initiated by the client; and the sending unit is further configured to send the audit record to the client based on the coarse-grained query request.

[0041] In a possible implementation manner of the third aspect, the receiving unit is further configured to receive a fine-grained query request initiated by the client; and the sending unit is further configured to send the target content in the audit record to the client based on the fine-grained query request.

[0042] In a possible implementation of the third aspect, the blockchain platform is deployed on the alliance chain Fabric.

[0043] In a possible implementation manner of the third aspect, the cloud platform is a cloud backup center, and the cloud backup center is used to back up the data blocks.

[0044] The blockchain platform provided in the third aspect of the present application is used to execute the method described in the first aspect or any possible implementation manner of the first aspect.

[0045] The fourth aspect of the present application provides a cloud platform, including an initiating unit, a receiving unit, a computing unit and a sending unit. The initiating unit is used to initiate an audit request to a blockchain platform; the receiving unit is used to receive public status information sent by the blockchain platform based on the audit request; the computing unit is used to calculate the possession proof of a data block based on the public status information; the sending unit is used to send the possession proof to the blockchain platform, so that the blockchain platform verifies the integrity of the data block based on the possession proof.

[0046] In a possible implementation of the fourth aspect, the receiving unit is also used to receive an instruction sent by the blockchain platform, the instruction is used to indicate the time when the cloud platform initiates the audit request; the initiating unit is specifically used to initiate the audit request to the blockchain platform based on time.

[0047] In a possible implementation manner of the fourth aspect, the cloud platform is a cloud backup center, and the cloud backup center is used to back up the data blocks.

[0048] In a possible implementation of the fourth aspect, the blockchain platform is deployed on the alliance chain Fabric.

[0049] The cloud platform provided in the fourth aspect of the present application is used to execute the method described in the second aspect or any possible implementation manner of the second aspect.

[0050] In a fifth aspect, the present application provides a blockchain platform, including a processor and a memory. The memory is used to store instructions, and the processor is used to obtain the instructions stored in the memory to execute the method described in the first aspect or any possible implementation of the first aspect.

[0051] In a sixth aspect, the present application provides a cloud platform, including a processor and a memory, wherein the memory is used to store instructions, and the processor is used to obtain the instructions stored in the memory to execute the method described in the second aspect or any possible implementation of the second aspect.

[0052] In a seventh aspect, the present application provides a computer-readable storage medium, which includes instructions. When the instructions are executed on a computer, the computer executes the method described in the first aspect or any possible implementation of the first aspect, or executes the method described in the second aspect or any possible implementation of the second aspect.

[0053] In an eighth aspect of the present application, there is provided a computer program product comprising instructions. When the computer program product is run on a computer, the computer executes the method described in the first aspect or any possible implementation of the first aspect, or executes the method described in the second aspect or any possible implementation of the second aspect.

[0054] In the ninth aspect of the present application, a chip system is provided, comprising at least one processor and a communication interface, wherein the communication interface and the at least one processor are interconnected via a line, and the at least one processor is used to run a computer program or instruction to execute the method described in the first aspect or any possible implementation of the first aspect, or to execute the method described in the second aspect or any possible implementation of the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 A schematic diagram of an application scenario of the data integrity verification method provided in an embodiment of the present application;

[0056] Figure 2 A system architecture diagram for the data integrity verification method provided in the embodiment of the present application;

[0057] Figure 3 A schematic diagram of an embodiment of a data integrity verification method provided in an embodiment of the present application;

[0058] Figure 4A schematic diagram of a process for a client to query an audit record in an embodiment of the present application;

[0059] Figure 5 A schematic diagram of another embodiment of the data integrity verification method provided in an embodiment of the present application;

[0060] Figure 6 A schematic diagram of the structure of the blockchain platform provided in the embodiment of the present application;

[0061] Figure 7 A schematic diagram of the structure of the cloud platform provided in the embodiment of the present application;

[0062] Figure 8 Another structural diagram of the blockchain platform provided in the embodiment of the present application;

[0063] Fig. 9 Another structural diagram of the cloud platform provided in an embodiment of the present application. DETAILED DESCRIPTION

[0064] The following describes the embodiments of the present application in conjunction with the accompanying drawings. Obviously, the described embodiments are only embodiments of a part of the present application, rather than all embodiments. It is known to those skilled in the art that with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0065] The terms "system" and "network" in the specification and claims of the present application and the above-mentioned drawings can be used interchangeably. Unless otherwise specified, ordinal numbers such as "first" and "second" are used to distinguish multiple objects and are not used to limit the order, timing, priority or importance of multiple objects. It should be understood that the terms used in this way can be interchangeable where appropriate, so that the embodiments described here can be implemented in an order other than the content illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0066] The embodiment of the present application provides a data integrity verification method, which can verify the trustworthy integrity of data stored in a cloud platform in an incompletely trusted environment. The embodiment of the present application also provides a corresponding device, a computer-readable storage medium, and a computer program product, etc. The following are respectively described.

[0067] See below Figure 1 , Figure 1A schematic diagram of an application scenario of the data integrity verification method provided in an embodiment of the present application.

[0068] like Figure 1 As shown in the figure, the application scenario is the integrity audit scenario of cloud backup data. This application scenario includes users, cloud platforms and third-party audits. The user is responsible for generating a public-private key pair based on discrete logarithms in cryptography, then dividing the data into data blocks of fixed size, and using the private key to calculate the label (i.e., audit metadata) based on the data block content. The user uploads the public key, data block and corresponding audit metadata to the cloud platform for backup and preservation, and also sends the data information (data block information and public key, etc.) to the third-party audit. A cloud platform is a cloud data center, and the data uploaded by the user can be backed up and stored on multiple cloud platforms.

[0069] The third-party audit is responsible for auditing the integrity of the backup data. Specifically, the third-party audit takes the data information to be audited as input, randomly generates the data block information to be challenged and the corresponding random number, and sends the challenge information to the cloud platform. The cloud platform calculates the possession proof of the specified data block in the challenge information based on the public key, data block set, and audit metadata set sent by the client, and sends it to the third-party audit for verification. The third-party audit takes the public key and the possession proof as input, and verifies the possession proof through the bilinear mapping algorithm to obtain the audit results of the relevant data blocks.

[0070] However, the reliability of the above audit results is completely dependent on the credibility of the third-party auditor. The third-party auditor is likely to collude with the cloud service provider to attack, so the reliability of the audit results cannot be guaranteed. In addition, the audit metadata is stored in the cloud platform together with the data block, which makes the audit metadata also at risk of being damaged. Once the audit metadata is damaged, the data holder (i.e., the user) can only re-download the data involved and calculate the audit metadata again. This process is relatively cumbersome, and it is not certain whether the data stored in the cloud platform is also damaged during the recalculation of the audit metadata, resulting in the problem of low credibility of the audit metadata.

[0071] In view of this, an embodiment of the present application provides a data integrity verification method, which replaces third-party audits with the help of the decentralization and smart contract technology of blockchain. The client used by the user acts as a blockchain node to store the calculated audit metadata in the distributed ledger of the blockchain platform. In order to simplify the process of user management of backup data and reduce the difficulty of user management of backup data, the process of data integrity verification in the embodiment of the present application is mainly completed between the cloud platform and the blockchain platform. First, the cloud platform initiates an integrity verification request, obtains the current public status information from the blockchain platform, calculates the challenge information based on the public status information, and selects the data block to be audited, and then calculates the possession proof of the data block. After obtaining the possession proof, an integrity verification request is initiated to the blockchain platform. The blockchain platform parses the audit metadata of the data block from the distributed ledger through a smart contract and performs integrity verification on the data block.

[0072] It should be understood that the data integrity verification method provided in the embodiment of the present application can be applied to Figure 1 In addition to the data backup scenario shown, it can also be used to verify the integrity of data in scenarios such as data storage and data transactions, which are not specifically limited here. For the convenience of description, the embodiment of the present application is described by taking the data backup scenario as an example.

[0073] See below Figure 2 , is a system architecture diagram of the data integrity verification method provided in the embodiment of the present application. Figure 2 As shown in the figure, the system mainly includes the client, cloud platform and blockchain platform. Corresponding to the blockchain network, the three are full nodes with full computing capabilities to execute all aspects of blockchain smart contracts.

[0074] Among them, the client is deployed on the data holder side (i.e. the user side), responsible for processing data in blocks, calculating the audit metadata of data, uploading backup data to the cloud platform, uploading audit metadata to the blockchain platform, and querying the audit records from the blockchain platform. The cloud platform is a cloud data center, including a storage module and a computing module. The storage module is used to back up, store and manage data, and the computing module is used to calculate the possession proof of data blocks, interact with the blockchain platform, and actively initiate integrity verification. The blockchain platform is deployed on a consortium chain, such as Fabric, Corda or Quorum, and is mainly responsible for using a distributed ledger to store the audit metadata and audit records of data blocks, and to verify integrity through blockchain smart contracts.

[0075] The client and the cloud platform mainly interact with each other to back up data, including uploading backup data to the cloud platform for storage, and downloading data from the cloud platform when restoring the backup data. The data is stored in the form of key-value pairs. During the data backup process, the client stores the long and short identifiers of the backup data in the blockchain platform.

[0076] The cloud platform and the blockchain platform are responsible for integrity verification. The cloud platform actively initiates the verification request, and the blockchain platform completes the integrity verification through smart contracts and stores the verification records in the distributed ledger. Finally, the client can query the audit records of integrity verification from the blockchain platform.

[0077] Combine the following Figure 2 The system architecture shown in Figure 3 Take the data integrity verification method provided in the embodiment of the present application as an example to illustrate. Figure 3 A schematic diagram of an embodiment of a data integrity verification method provided in an embodiment of the present application, the embodiment includes steps 301 to 312.

[0078] 301. The client uploads information to the blockchain platform and registers.

[0079] The client generates preparation data for initialization. First, based on global security, 1 q , where q is the length of the safe prime number used. Then generate the multiplicative cyclic groups G1, G2, G T , where the bilinear map e:G1×G2→G T Then select a generator g from G1 and a generator u from G2, that is, g∈G1, u∈G2, and select a generator g from the cyclic group Z. p Select a random element x (i.e. x←Z p ). Then calculate v = g x ,w=u x , so the user's private key is sk = (x) and the public key is pk = (v, w). Then the security parameters (param) shared in the blockchain network are (G1, G2, g, u, v, w), which will be used for calculations in subsequent stages.

[0080] The client uploads the public key and its own attribute information to the blockchain platform. The attribute information includes the security parameters calculated above, etc., and uses the blockchain node certificate to register and register on the blockchain platform. The blockchain platform saves this information in the distributed ledger. The blockchain platform can be deployed on a consortium chain. In one possible solution, the blockchain platform is deployed on a fabric chain.

[0081] The information uploaded by the client is stored in the form of a key-value pair on the blockchain platform, where the keyword Key is the calculated public key used to uniquely identify the user information, and the corresponding value Value is the client's attribute information. Its storage structure is shown in Table 1:

[0082] Key Value Client public key (unique identifier of user information) Client attribute information (security parameters used, etc.)

[0083] Table 1

[0084] 302. The cloud platform uploads information to the blockchain platform and registers.

[0085] The cloud platform obtains its own attribute information, including the remaining capacity, price, etc. of the cloud platform. In the data backup scenario, the cloud platform is a cloud backup center, which is used to back up and save the data uploaded by the client. It should be understood that the number of cloud platforms can be one or more, and the specific number is not limited here.

[0086] The cloud platform calculates the public and private key pair, and the calculation method is similar to step 301, which will not be described in detail here. The cloud platform uploads the public key and its own attribute information to the blockchain platform, and registers and registers on the blockchain platform using the blockchain node certificate. The blockchain platform saves this information in the distributed ledger. After receiving the information uploaded by the cloud platform, the blockchain platform checks whether the cloud platform has a previous registration record. If there is a relevant record, the reputation value r of the cloud platform and the data information stored by the cloud platform are initialized, such as a list of data files.

[0087] The information uploaded by the cloud platform is stored in the form of Key-Value in the blockchain platform, where Key is the public key of the cloud platform, which is used to uniquely identify the cloud platform, and Value is the attribute information, reputation value, and stored data information of the cloud platform. In addition, Value will be updated with the update of the reputation value of the cloud platform and the stored data. Its storage structure is shown in Table 2:

[0088]

[0089] Table 2

[0090] 303. The client divides the data into blocks to obtain data blocks, and calculates the audit metadata of the data blocks.

[0091] The client divides the data to be backed up on the cloud platform into blocks, obtains multiple data blocks, and calculates the label of each data block (i.e., audit metadata). Specifically, for the data F to be backed up, the data F is divided into n data blocks m, represented as F = {m1, m2, ..., m n}. Use hs iRepresents the hash value of different data blocks, where 1≤i≤n, then the label of each data block can be calculated The audit metadata set (label set) of data file F is Φ = {σ i} 1≤i≤n .

[0092] 304. The client uploads the data block to the cloud platform.

[0093] The client sends the data block to the cloud platform, which backs up and stores the data block. The client obtains the storage properties of the data block on the cloud platform, such as the backup retention period, storage location, etc. After storing the data block, the cloud platform updates the stored data information and its own attribute information to the blockchain platform.

[0094] 305. The client uploads the audit metadata to the blockchain platform.

[0095] The client sends the audit metadata set Φ to the blockchain platform, and the blockchain platform stores the audit metadata set in the distributed ledger. In addition, the client also sends the acquired storage attributes to the blockchain platform.

[0096] The storage format of audit metadata and storage attributes in the blockchain platform also adopts the form of Key-Value, where Key is the short identifier of data block m, which is used to uniquely identify the data block, and Value is the audit metadata corresponding to the data block and the storage attribute of the data block in the cloud platform (i.e., backup metadata). The storage attributes include the backup retention period and storage location of the data block in the cloud platform. Its storage structure is shown in Table 3:

[0097]

[0098] Table 3

[0099] 306. The cloud platform initiates an audit request to the blockchain platform.

[0100] The cloud platform proactively submits audit requests for data blocks to the blockchain platform.

[0101] In one possible solution, the blockchain platform sends an instruction to the cloud platform, which is used to indicate the time when the cloud platform initiates the audit request, and the cloud platform initiates the audit request according to the indicated time. By agreeing with the cloud platform on the time to initiate the audit request, the security of the backup data can be further improved and energy consumption can be saved.

[0102] The above time may be a specific time, such as 9:00, 9:30, and 9:40, or may refer to periodically initiating an audit request, such as initiating an audit request every half hour, every hour, or every two hours.

[0103] 307. The blockchain platform sends public status information to the cloud platform.

[0104] After receiving the audit request, the blockchain platform sends the public status information τ to the cloud platform. Exemplarily, the public status information can be the hash value of the identity document (ID) of the current event, the hash value of the time when the current event occurred, and the relevant information of the client, such as the security parameters and public key calculated by the client. For each audit request, the public status information generated by the blockchain platform is different.

[0105] The public status information is used for the cloud platform to calculate the possession proof of the data block in the future. Since the public status information is generated on the blockchain platform based on information such as ID or time, the cloud platform and the blockchain platform cannot control or tamper with the public status information, effectively avoiding the possibility of collusion attacks.

[0106] 308. The cloud platform calculates the proof of possession of data blocks.

[0107] The cloud platform generates challenge information based on the public state information τ. Specifically, the public state information τ is used as the input of a pseudo-random function F(·) to obtain: I is an index set with c elements. Then from Z p Choose a random coefficient e i (i.e. i ←Z p ), construct challenge information: chal = {(s i ,e i )} i∈I , e i This is the random number seed in the challenge, and the data block is selected through the challenge information chal. For each random s in chal i Find the corresponding challenge data block m i , and then calculate the data block m based on the public state information and challenge information i Specifically, from Z p The random selection coefficient r (i.e. r←Z p ), blind the linear combination of data blocks, and then use the proof generation algorithm in cryptography to calculate the data block m i The specific calculation process is as follows:

[0108]

[0109]

[0110] R=w r ∈G1

[0111] Get data block m i Proof of possession:

[0112] proof={μ,h μ ,R}

[0113] 309. The cloud platform sends proof of possession of the data block to the blockchain platform.

[0114] The cloud platform calculates the data block m i After the possession is proved, the data block m is sent to the blockchain platform i The integrity verification request carries data block m i The proof of possession proof, challenge information chal and public state information τ. It is understandable that the cloud platform can select multiple data blocks at a time, calculate the proof of possession of multiple data blocks, and carry the proof of possession of multiple data blocks together in one integrity verification request. Of course, in this case, the integrity verification request should also carry the corresponding challenge information.

[0115] 310. The blockchain platform verifies the integrity of data blocks.

[0116] The blockchain platform first verifies the authenticity of the public status information carried in the integrity verification request. After confirming the authenticity, it uses the challenge information to parse the data block m that needs to be verified this time. i . Then extract data block m from the blockchain ledger i The corresponding audit metadata Φ = {σ i} i∈I , and finally the proof of possession is proof = {μ,h μ , R}, the client's public key pk = (v, w) and the audit metadata Φ = {σ i} i∈I Perform a bilinear pairing test to obtain the data block m i The specific calculation is as follows:

[0117]

[0118] If the integrity verification request carries multiple challenge information and possession proofs, the blockchain platform will parse multiple data blocks based on the challenge information, extract the corresponding audit metadata from the distributed ledger, and finally perform integrity verification on different data blocks separately.

[0119] 311. The blockchain platform generates audit records and evaluates the reputation of the cloud platform.

[0120] After the blockchain platform verifies the integrity of the data block, it generates an audit record for this event. The audit record is stored in the distributed ledger in the form of Key-Value. The content of the Key value includes the information of the data holder (user side), the information of the cloud platform and the timestamp. Among them, the information on the user side is the Key value that can uniquely identify the client in the blockchain distributed ledger, the information on the cloud platform is the Key value that can uniquely identify the cloud platform in the blockchain distributed ledger, and the timestamp is the time when the audit result is obtained. The content of the Value includes challenge information, challenge seed, proof information and the verification result of this event. Among them, the challenge information includes the challenge information sent by the cloud platform and the relevant information of the data block parsed according to the challenge information. The relevant information of the data block can be the audit metadata of the data block. The challenge seed is the random number seed in the challenge information sent by the cloud platform, the proof information is the proof of possession of the data block sent by the cloud platform, and the verification result is the result of the integrity verification of the data block. Its storage structure is shown in Table 4:

[0121]

[0122] Table 4

[0123] The blockchain platform can evaluate the reputation of the cloud platform after verifying the integrity of the data block.

[0124] In one possible solution, the blockchain platform evaluates the reputation of the cloud platform based on the integrity of the verified data blocks. If the integrity is verified, the reputation of the cloud platform is increased, and when a client fails and needs to switch data centers or restore backup data, the probability of selecting the cloud platform increases. If the verification is not passed, the reputation of the cloud platform is reduced, the frequency of use of the cloud platform is reduced, and the cloud service provider is reminded to inspect and maintain the cloud platform.

[0125] In another possible solution, the blockchain platform and the cloud platform agree on the time to initiate the audit request. The blockchain platform evaluates the reputation of the cloud platform based on the compliance of the cloud platform. The compliance refers to whether the cloud platform initiates the audit request at the agreed time. If the cloud platform complies with the contract, the reputation of the cloud platform will be increased. If the cloud platform does not comply with the contract, the reputation of the cloud platform will be reduced accordingly.

[0126] The audit record carries a timestamp, which is the time when the integrity verification result is obtained. Based on the timestamp, the blockchain can determine whether the cloud platform has initiated the audit request at the agreed time, thereby obtaining the compliance status of the cloud platform. It is understandable that it takes a certain amount of time from the cloud platform initiating the audit request to the blockchain platform obtaining the integrity of the data block. Within the allowed time range, it can be considered that the cloud platform has initiated the audit request at the agreed time. For example, it is agreed that the cloud platform will initiate the audit request at 9:30, and the timestamp in the audit record is 9:33. The three minutes that exceed can be considered as a reasonable time required for verification, so the cloud platform is judged to be in compliance. Alternatively, it is agreed that the cloud platform will initiate an audit request every half an hour, and the timestamps of the two audit records are 9:03 and 9:33 respectively, then it can be judged that the cloud platform is in compliance.

[0127] In addition, after the cloud platform initiates the audit request, the public status information replied by the blockchain platform also includes time information. The blockchain platform can also determine whether the cloud platform has initiated the audit request at the agreed time based on the time information in the subsequently retrieved public status information (carried in the integrity verification request).

[0128] When evaluating the reputation of the cloud platform, we can also consider the number of audited data blocks and the confidence level α of the integrity of the overall backup data. The calculation process of the cloud platform reputation is:

[0129] P ′ =P±α·△P

[0130] Among them, P ′ is the reputation value after evaluation, P is the original reputation value, and △P is the reputation value increased or decreased by the audit cloud platform.

[0131] After the blockchain platform evaluates the reputation value of the cloud platform, the reputation value in the cloud platform related information described in step 302 is updated.

[0132] 312. The client queries the blockchain platform for audit records.

[0133] The client can query the audit records of data blocks from the blockchain platform at any time. Specifically, the client can query the audit records in a coarse-grained manner or a fine-grained manner.

[0134] In one possible solution, the client sends a coarse-grained query request to the blockchain platform, which specifies a certain cloud platform. After receiving the coarse-grained query request, the blockchain platform sends all audit records related to the cloud platform to the client. Of course, the client can also specify multiple cloud platforms, and the blockchain platform sends all audit records of multiple cloud platforms to the client.

[0135] In another possible solution, the client sends a fine-grained query request to the blockchain platform, which specifies the target content in the audit record. The target content can be the audit record of a cloud platform in a certain period of time, the audit record of certain data blocks, or a specified audit record. After receiving the fine-grained query request, the blockchain platform sends the specified content to the client.

[0136] In addition, the client can also specify a time period first. The scope of coarse-grained query and fine-grained query are both within this time period. The coarse-grained query request is to query all audit records of a certain cloud platform or several cloud platforms within this time period, and the fine-grained query request is to query the target content of the audit records within this time period, and the target content is a specified audit record.

[0137] The blockchain platform can also combine audit records with relevant information of the cloud platform to generate a data health report. Relevant information of the cloud platform includes the reputation value of the cloud platform, the remaining capacity of the cloud platform, and the price of the cloud platform. The client can query the blockchain platform for the data health report of the cloud platform.

[0138] Combine the following Figure 4 Explain client query audit records and data health reports. Figure 4 For example, medium-coarse-grained query and fine-grained query are limited to a time period. Figure 4 The process includes steps S401 to S408.

[0139] S401. The client sends a data health report query request to the blockchain platform. The query request carries the client identifier (i.e., the client public key), the cloud platform identifier (i.e., the cloud platform public key), and the time period to be queried.

[0140] S402. The blockchain platform queries for audit records that meet the requirements, that is, all audit records related to the cloud platform and the client within a specified time period.

[0141] S403: The blockchain platform evaluates the reputation of the cloud platform based on the audit records. The specific method is described in detail in step 310 and will not be repeated here.

[0142] S404. Return a data health report to the cloud platform. The data health report includes audit records and information such as the cloud platform's reputation, remaining capacity, and price.

[0143] S405. The client sends a coarse-grained query request to the blockchain platform. The query request carries the client identifier, the cloud platform identifier, and a timestamp. The time indicated by the timestamp is the query time period.

[0144] S406. The blockchain platform sends all audit records related to the cloud platform and the client within a specified time period to the client platform.

[0145] S407. The client sends a fine-grained query request to the blockchain platform. The query request carries the client identifier, the cloud platform identifier, and a timestamp. The timestamp indicates a certain moment.

[0146] S408. The blockchain platform sends the target content of the audit records within the specified time period to the client, where the target content is a specified single audit record.

[0147] The data integrity verification method provided in this embodiment utilizes the decentralized and tamper-proof characteristics of blockchain to achieve trusted data management in an incompletely trusted environment, and can resist collusion attacks between cloud service providers and third-party auditors. This embodiment is based on blockchain smart contracts and data possession proof cryptographic algorithms, and performs data integrity audits on the chain to ensure the openness, correctness and security of the audit. In addition, in this embodiment, the distributed ledger of the blockchain is used to store audit metadata and audit records of data integrity, which can effectively prevent tampering and denial, and effectively improve the credibility and security of key information such as audit metadata and audit records. In addition, in this embodiment, data integrity audits are performed regularly to ensure that the backup data is as healthy and intact as possible when restored, and is immediately available.

[0148] Combine the following Figure 5 The data integrity verification method provided in the embodiments of the present application is summarized and described.

[0149] like Figure 5 As shown, the embodiment of the present application mainly includes five stages, namely system initialization, data backup, audit initiation, integrity verification and audit record query.

[0150] The system initialization phase is Figure 3 In the embodiment shown in step 301 and step 302, the client and the cloud platform are initialized and the information is uploaded to the blockchain platform for identification registration. Figure 3 Steps 303 to 305 in the embodiment shown. This stage mainly involves the client dividing the data into blocks, calculating the audit metadata corresponding to the data blocks, and then uploading the data blocks to the cloud platform for backup storage, and uploading the audit metadata to the blockchain platform for storage. The audit initiation stage is Figure 3In the step 306 to step 308 of the embodiment, the cloud platform actively initiates the audit request, rather than a third-party auditor in the traditional method. The blockchain platform returns public status information based on the audit request, and the cloud platform generates challenge information based on the public status information, selects data blocks based on the challenge information, and finally calculates the possession proof of the data block and initiates an integrity verification request. The integrity verification stage is Figure 3 In step 309 and step 310 of the embodiment shown, the blockchain platform verifies the integrity of the data block. Specifically, the blockchain platform first verifies the authenticity of the public status information, then parses the data block that needs to be verified based on the challenge information, and finally verifies the audit metadata and possession proof of the data block by a bilinear mapping algorithm to obtain the integrity of the data block. The audit record query stage is Figure 3 In step 311 of the illustrated embodiment, at this stage the client can query the blockchain platform for the audit records and data health reports of the cloud platform.

[0151] The above describes the embodiments of the present application from the perspective of the method. The following describes the relevant devices in the embodiments of the present application from the perspective of specific device implementation.

[0152] See also Figure 6 , an embodiment of the present application provides a schematic diagram of a blockchain platform 600, wherein the blockchain platform 600 includes a receiving unit 601, a sending unit 602 and a verification unit 603.

[0153] The receiving unit 601 is used to receive an audit request initiated by the cloud platform;

[0154] A sending unit 602 is used to send public status information to the cloud platform based on the audit request, and the public status information is used by the cloud platform to calculate the possession proof of the data block;

[0155] The receiving unit 601 is also used to receive the possession certificate sent by the cloud platform;

[0156] The verification unit 603 is used to verify the integrity of the data block based on the possession proof and obtain the audit record of the data block.

[0157] Optionally, the blockchain platform 600 further includes an evaluation unit 604 for evaluating the reputation of the cloud platform based on integrity.

[0158] Optionally, the sending unit 602 is further used to send an instruction to the cloud platform, where the instruction is used to indicate the time when the cloud platform initiates the audit request.

[0159] Optionally, the audit record carries a timestamp, and the blockchain platform 600 also includes a judgment unit 605, which is used to judge the compliance of the cloud platform based on the timestamp, and the compliance status indicates whether the cloud platform initiates the audit request according to the time; the evaluation unit 604 is also used to evaluate the reputation value of the cloud platform based on the compliance status.

[0160] Optionally, the receiving unit 601 is further configured to receive a coarse-grained query request initiated by a client; and the sending unit 602 is further configured to send an audit record to the client based on the coarse-grained query request.

[0161] Optionally, the receiving unit 601 is further configured to receive a fine-grained query request initiated by a client; the sending unit 602 is further configured to send target content in the audit record to the client based on the fine-grained query request.

[0162] Optionally, the blockchain platform is deployed on the consortium chain Fabric.

[0163] Optionally, the cloud platform is a cloud backup center, and the cloud backup center is used to back up data blocks.

[0164] Each unit in the blockchain platform 600 performs the above Figures 3 to 5 The operation of the blockchain platform in the illustrated embodiment will not be described in detail here.

[0165] See also Figure 7 , an embodiment of the present application provides a schematic diagram of a cloud platform 700, wherein the cloud platform 700 includes an initiating unit 701, a receiving unit 702, a computing unit 703 and a sending unit 704.

[0166] An initiating unit 701, used to initiate an audit request to the blockchain platform;

[0167] A receiving unit 702, configured to receive public status information sent by the blockchain platform based on an audit request;

[0168] A calculation unit 703, used to calculate the possession proof of the data block based on the public state information;

[0169] The sending unit 704 is used to send the possession proof to the blockchain platform so that the blockchain platform verifies the integrity of the data block based on the possession proof.

[0170] Optionally, the receiving unit 702 is also used to receive instructions sent by the blockchain platform, and the instructions are used to indicate the time when the cloud platform initiates an audit request; the initiating unit 701 is specifically used to initiate an audit request to the blockchain platform based on time.

[0171] Optionally, the cloud platform is a cloud backup center, and the cloud backup center is used to back up data blocks.

[0172] Optionally, the blockchain platform is deployed on the consortium chain Fabric.

[0173] Each unit in the cloud platform 700 performs the above Figures 3 to 5 The operation of the cloud platform in the illustrated embodiment will not be described in detail here.

[0174] See below Figure 8 , is a possible structural diagram of a blockchain platform 800 provided in an embodiment of the present application, including a processor 801, a communication interface 802, a memory 803, and a bus 804. The processor 801, the communication interface 802, and the memory 803 are interconnected via the bus 804. In an embodiment of the present application, the processor 801 is used to control and manage the actions of the blockchain platform. For example, the processor 801 is used to execute Figure 3 The steps performed by the blockchain platform in the method embodiment shown. The communication interface 802 is used to support the blockchain platform to communicate. The memory 803 is used to store the program code and data of the blockchain platform.

[0175] Among them, the processor 801 can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It can implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the contents disclosed in this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and so on. The bus 804 can be a peripheral component interconnect standard (Peripheral Component Interconnect, PCI) bus or an extended industry standard architecture (Extended Industry Standard Architecture, EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0176] See below Fig. 9 , is a possible structural diagram of a cloud platform 900 provided in an embodiment of the present application, including a processor 901, a communication interface 902, a memory 903, and a bus 904. The processor 901, the communication interface 902, and the memory 903 are interconnected via the bus 904. In an embodiment of the present application, the processor 901 is used to control and manage the actions of the cloud platform. For example, the processor 901 is used to execute Figure 3 The steps performed by the cloud platform in the method embodiment are shown. The communication interface 902 is used to support the cloud platform to communicate. The memory 903 is used to store the program code and data of the cloud platform.

[0177] Among them, the processor 901 can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It can implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the contents disclosed in this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and so on. The bus 904 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig. 9 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0178] The embodiment of the present application also provides a computer-readable storage medium, wherein the computer-readable storage medium includes instructions, and when the instructions are executed on a computer, the computer executes the aforementioned Figures 3 to 5 The method in the illustrated embodiment.

[0179] The present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the aforementioned Figures 3 to 5 The method in the illustrated embodiment.

[0180] The embodiment of the present application also provides a chip system, the chip system includes at least one processor and a communication interface, the communication interface and the at least one processor are interconnected through a line, and the at least one processor is used to run a computer program or instruction to execute the aforementioned Figures 3 to 5 The method in the illustrated embodiment.

[0181] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0182] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0183] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0184] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0185] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk and other media that can store program code.

Claims

1. A data integrity verification method, characterized in that: The method is applied to a blockchain platform, and the method comprises: Receive audit requests initiated by the cloud platform; Sending public status information to the cloud platform based on the audit request, wherein the public status information is used by the cloud platform to calculate the possession proof of the data block; Receiving the possession certificate sent by the cloud platform; The integrity of the data block is verified based on the possession proof to obtain an audit record of the data block.

2. The method according to claim 1, characterized in that The method further comprises: A reputation value of the cloud platform is evaluated based on the integrity.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: An instruction is sent to the cloud platform, wherein the instruction is used to indicate the time when the cloud platform initiates the audit request.

4. The method according to claim 3, characterized in that The audit record carries a timestamp, and the method further comprises: Determining the compliance of the cloud platform based on the timestamp, the compliance indicating whether the cloud platform initiates the audit request according to the time; The reputation value of the cloud platform is evaluated based on the compliance status.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: Receive coarse-grained query requests initiated by the client; The audit record is sent to the client based on the coarse-grained query request.

6. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: Receive fine-grained query requests initiated by the client; The target content in the audit record is sent to the client based on the fine-grained query request.

7. The method according to any one of claims 1 to 6, characterized in that: The blockchain platform is deployed on the consortium chain Fabric.

8. The method according to any one of claims 1 to 7, characterized in that: The cloud platform is a cloud backup center, and the cloud backup center is used to back up the data blocks.

9. A data integrity verification method, characterized in that: The method is applied to a cloud platform, and the method comprises: Initiate an audit request to the blockchain platform; Receiving public status information sent by the blockchain platform based on the audit request; Calculate a proof of possession of the data block based on the public state information; The proof of possession is sent to the blockchain platform so that the blockchain platform verifies the integrity of the data block based on the proof of possession.

10. The method according to claim 9, characterized in that The method further comprises: Receiving an instruction sent by the blockchain platform, wherein the instruction is used to indicate the time when the cloud platform initiates the audit request; The audit request initiated to the blockchain platform includes: Initiate the audit request to the blockchain platform based on the time.

11. The method according to claim 9 or 10, characterized in that: The cloud platform is a cloud backup center, and the cloud backup center is used to back up the data blocks.

12. The method according to any one of claims 9 to 11, characterized in that: The blockchain platform is deployed on the consortium chain Fabric.

13. A blockchain platform, characterized in that: include: A receiving unit, used for receiving an audit request initiated by the cloud platform; A sending unit, configured to send public status information to the cloud platform based on the audit request, wherein the public status information is used by the cloud platform to calculate the possession proof of the data block; The receiving unit is further used to receive the possession certificate sent by the cloud platform; A verification unit is used to verify the integrity of the data block based on the possession proof to obtain an audit record of the data block.

14. The blockchain platform according to claim 13, characterized in that: The blockchain platform also includes: An evaluation unit is used to evaluate the reputation value of the cloud platform based on the integrity.

15. The blockchain platform according to claim 13 or 14, characterized in that: The sending unit is also used for: An instruction is sent to the cloud platform, wherein the instruction is used to indicate the time when the cloud platform initiates the audit request.

16. The blockchain platform according to claim 15, characterized in that: The audit record carries a timestamp, and the blockchain platform further includes: A judging unit, configured to judge the compliance of the cloud platform based on the timestamp, wherein the compliance indicates whether the cloud platform initiates the audit request according to the time; The evaluation unit is further configured to evaluate the reputation value of the cloud platform based on the compliance status.

17. The blockchain platform according to any one of claims 13 to 16, characterized in that: The receiving unit is also used to receive a coarse-grained query request initiated by the client; The sending unit is further configured to send the audit record to the client based on the coarse-grained query request.

18. The blockchain platform according to any one of claims 13 to 16, characterized in that: The receiving unit is also used to receive a fine-grained query request initiated by the client; The sending unit is further configured to send the target content in the audit record to the client based on the fine-grained query request.

19. The blockchain platform according to any one of claims 13 to 18, characterized in that: The blockchain platform is deployed on the consortium chain Fabric.

20. The blockchain platform according to any one of claims 13 to 19, characterized in that: The cloud platform is a cloud backup center, and the cloud backup center is used to back up the data blocks.

21. A cloud platform, characterized in that: include: The initiating unit is used to initiate an audit request to the blockchain platform; A receiving unit, configured to receive public status information sent by the blockchain platform based on the audit request; A computing unit, configured to compute a proof of possession of a data block based on the public state information; A sending unit is used to send the possession proof to the blockchain platform so that the blockchain platform verifies the integrity of the data block based on the possession proof.

22. The cloud platform according to claim 21, characterized in that: The receiving unit is further used to receive an instruction sent by the blockchain platform, wherein the instruction is used to indicate the time when the cloud platform initiates the audit request; The initiating unit is specifically used for: Initiate the audit request to the blockchain platform based on the time.

23. The cloud platform according to claim 21 or 22, characterized in that: The cloud platform is a cloud backup center, and the cloud backup center is used to back up the data blocks.

24. The cloud platform according to any one of claims 21 to 23, characterized in that: The blockchain platform is deployed on the consortium chain Fabric.

25. A blockchain platform, characterized in that: include: Processor and memory; The memory is used to store instructions; The processor is configured to execute instructions stored in the memory to implement the method according to any one of claims 1 to 8.

26. A cloud platform, characterized in that: include: Processor and memory; The memory is used to store instructions; The processor is configured to execute instructions stored in the memory to implement the method according to any one of claims 9 to 12.

27. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by one or more processors, the method according to any one of claims 1 to 8 is implemented, or the method according to any one of claims 9 to 12 is implemented.

28. A computer program product comprising instructions, characterized in that When the computer program product runs on a computer, the computer is enabled to execute the method according to any one of claims 1 to 8, or to implement the method according to any one of claims 9 to 12.

Images