A Merkle tree-based incremental backup and restore method and system

Abstract

This invention discloses a Merkle tree-based incremental data backup and recovery method, comprising: receiving and verifying a backup request or recovery request; generating a first instruction or a second instruction upon successful verification; the business system communicating encryptedly with a UKey based on the corresponding instruction; the UKey querying the first Merkle tree to generate first information; the business system determining relevant data blocks based on the first information and generating encrypted data blocks, key fingerprints, and relevant Merkle trees; the UKey performing corresponding operations based on the encrypted data blocks and relevant Merkle trees, saving the association between the key fingerprint and the encrypted data blocks to complete the backup; the business system sending a recovery data ID and a second Merkle tree; the UKey obtaining encrypted changed data blocks and their second information based on the recovery data ID, the first Merkle tree, and the second Merkle tree; and the business system performing relevant verifications sequentially based on the second information, and completing the data recovery based on the encrypted changed data blocks upon successful verification. This method improves the security and efficiency of the data backup and recovery process.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and more specifically to a method and system for incremental backup and restoration of data based on Merkle trees. Background Technology

[0002] With the rapid development of information technology, data security issues are becoming increasingly prominent in government agencies, the financial industry, the healthcare industry, and the fields of cloud computing and big data. Various industries are placing higher demands on the security, integrity, and recoverability of data. To address these challenges, different technologies and methods have been introduced into information security protection, including the application of UKey encryption devices, hash-based data integrity verification mechanisms (such as Merkle trees), and various file synchronization and data migration technologies.

[0003] Existing offline business data synchronization methods using UKeys: This method emphasizes the role of the UKey's internal encryption / decryption module, but it has limitations in practical applications. For example, it lacks encryption protection during data transmission, increasing the risk of interception; each backup requires re-encrypting all data, increasing time and resource costs; and it lacks necessary security verification steps during data restoration, failing to ensure data consistency. Existing cross-cluster data migration methods based on disk-rsync: While this method automates the migration process, its security depends on key management and network security under the SSH protocol. If the local device is attacked or key management is improper, it may lead to serious security vulnerabilities. Existing file synchronization methods, devices, equipment, and storage media: This scheme mainly relies on filenames and modification timestamps to generate hash values, ignoring changes in the file content itself, making it easy to bypass. Furthermore, performing cloud update operations without appropriate security measures also faces the risk of data leakage or tampering. Traditional data backup methods typically rely on full backups, meaning all data is copied again with each backup. This method not only consumes a large amount of storage space but also requires a long backup time. In addition, traditional backup methods lack sufficient security and are vulnerable to data leakage, tampering, or loss, especially in remote backup or cloud storage environments, where the confidentiality and integrity of data are often difficult to protect effectively.

[0004] Therefore, how to improve the security and efficiency of data backup and recovery processes, and ensure the integrity of backup data and the consistency of encryption and decryption, are problems that urgently need to be solved by those skilled in the art. Summary of the Invention

[0005] In view of this, the present invention provides a data incremental backup and restore method and system based on Merkle tree, which not only improves the security and efficiency of the data backup and recovery process, but also solves the long-standing problems of backup data integrity verification and encryption / decryption consistency that have plagued the industry, providing a more reliable data protection means for various industries.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] A Merkle tree-based incremental backup and restore method includes:

[0008] The system receives and verifies backup or restore requests based on the UKey. If the verification is successful, it generates a first instruction or a second instruction. The business system then performs encrypted communication with the UKey based on the corresponding instruction.

[0009] The UKey queries whether a first Merkle tree exists locally, and generates first information based on the query result;

[0010] The business system determines relevant data blocks based on the first information, generates encrypted data blocks, key fingerprints, and related Merkle trees based on the relevant data blocks, and establishes corresponding associations between the key fingerprints and the encrypted data blocks.

[0011] The UKey performs corresponding operations based on the encrypted data block and the relevant Merkle tree, saves the association relationship, and completes the relevant backup operations;

[0012] The business system sends the restoration data ID and the second Merkle tree to the UKey based on the second instruction and the restoration request;

[0013] The UKey obtains the encrypted change data block and its second information based on the restored data ID, the first Merkle tree, and the second Merkle tree;

[0014] The business system performs restoration verification and integrity verification sequentially based on the second information. After passing the verification, it restores the data based on the encrypted changed data block to complete the data restoration operation.

[0015] Preferably, the business system performs encrypted communication with the UKey based on corresponding instructions, specifically including:

[0016] The business system generates a public-private key pair based on the first instruction or the second instruction, and sends the public key to the UKey;

[0017] The UKey generates a key and encrypts it based on the public key to obtain an encryption key, which is then sent to the business system.

[0018] The business system decrypts the encryption key using the private key to obtain the key;

[0019] The business system encrypts the relevant data block based on the key and sends it to the UKey, thereby realizing encrypted communication between the business system and the UKey.

[0020] Preferably, the first information is generated based on the query results, specifically including:

[0021] Based on the query result, if the first Merkle tree does not exist locally, the UKey determines it as the first backup operation and sends the encryption key as the first relevant information to the business system.

[0022] If the first Merkle tree exists locally, it is determined to be an incremental backup operation, and the encryption key and the first Merkle tree are sent to the business system as the second relevant information.

[0023] The first information includes either the first related information or the second related information.

[0024] Preferably, the business system determines the relevant data blocks based on the first information, specifically including:

[0025] The business system makes a judgment based on the first information. If the first relevant information is received, the original data block is used as the first data block.

[0026] If the second relevant information is received, an integrity comparison is performed based on the first Merkle tree and the second Merkle tree maintained by itself to determine whether the comparison results are consistent. If they are consistent, it indicates that the backup has not changed compared with the previous backup, the backup is completed and an end notification is sent.

[0027] If they are inconsistent, the nodes of the first Merkle tree and the second Merkle tree are compared from top to bottom to locate the inconsistent leaf nodes. Based on the leaf nodes, the data blocks that have changed since the last backup are determined as the second data blocks.

[0028] The relevant data block includes either the first data block or the second data block.

[0029] Preferably, generating encrypted data blocks, key fingerprints, and related Merkle trees based on the relevant data blocks specifically includes:

[0030] The business system obtains the corresponding key fingerprint by performing a hash calculation based on the key.

[0031] The business system generates a first related Merkle tree or a second related Merkle tree based on the first data block or the second data block;

[0032] The relevant Merkle tree includes either the first relevant Merkle tree or the second relevant Merkle tree;

[0033] The business system encrypts the first data block or the second data block based on the key to obtain the first encrypted data block or the second encrypted data block.

[0034] The encrypted data block includes either the first encrypted data block or the second encrypted data block.

[0035] Preferably, establishing a corresponding association between the key fingerprint and the encrypted data block specifically includes:

[0036] The business system associates the key fingerprint with the first encrypted data block or the second encrypted data block to obtain a first association relationship or a second association relationship.

[0037] The corresponding association relationship includes either the first association relationship or the second association relationship;

[0038] The business system performs hash calculations based on the first data block or the second data block to generate a first hash value or a second hash value.

[0039] The first hash value or the second hash value is sent to the UKey as a data block hash value.

[0040] Preferably, the UKey performs corresponding operations based on the encrypted data block and the relevant Merkle tree, specifically including:

[0041] The UKey is determined based on the received encrypted data block;

[0042] If the first encrypted data block is received, the UKey saves the first encrypted data block and the first related Merkle tree, and marks the first related Merkle tree as the first Merkle tree;

[0043] If the second encrypted data block is received, the UKey saves the second encrypted data block and updates the first Merkle tree stored locally based on the second related Merkle tree.

[0044] Preferably, the UKey obtains the encrypted change data block and its second information based on the restored data ID, the first Merkle tree, and the second Merkle tree, specifically including:

[0045] The UKey compares the subtrees related to the restored data ID in the first Merkle tree and the second Merkle tree, and determines the encrypted data block that has changed as the encrypted change data block based on the comparison result;

[0046] The associated key is obtained by querying the ID of the encrypted change data block and the association relationship.

[0047] The associated key is encrypted using the public key to obtain the encrypted associated key;

[0048] Obtain the corresponding data block hash value based on the encrypted changed data block;

[0049] The encryption association key and the data block hash value together constitute the second information.

[0050] Preferably, the business system performs restoration verification and integrity verification sequentially based on the second information, specifically including:

[0051] The business system decrypts the encrypted association key based on the private key to obtain the association key and performs hash calculation to obtain the first key fingerprint. The second key fingerprint associated with the ID of the encrypted change data block is compared with the first key fingerprint. If they match, the restoration verification passes; otherwise, the restoration verification fails and the restoration fails.

[0052] After the restoration verification is successful, the business system decrypts the encrypted change data block based on the associated key to obtain the change data block, and performs hash calculation based on the change data block to obtain the relevant hash value;

[0053] The business system compares the relevant hash value with the corresponding data block hash value and determines whether the comparison results are consistent. If they are consistent, the integrity verification is passed; otherwise, the integrity verification fails and the restoration operation is stopped.

[0054] A Merkle tree-based incremental backup and restore system includes: a connection verification module, a judgment module, a data processing module, a data backup module, a data transmission module, a data acquisition module, and a data restore module;

[0055] The connection verification module is used to receive and verify backup or restore requests based on the UKey. If the verification is successful, a first instruction or a second instruction is generated accordingly. The business system then performs encrypted communication with the UKey based on the corresponding instruction.

[0056] The first judgment module is used to query whether a first Merkle tree exists locally based on the UKey, and generate first information based on the query result;

[0057] The data processing module is used to determine relevant data blocks based on the first information through the business system, generate encrypted data blocks, key fingerprints and related Merkle trees based on the relevant data blocks, and establish corresponding association relationships between the key fingerprints and the encrypted data blocks.

[0058] The data backup module is used to perform corresponding operations based on the encrypted data block and the relevant Merkle tree using the UKey, and to save the association relationship to complete the relevant backup operations;

[0059] The data transmission module is used to send the restoration data ID and the second Merkle tree to the UKey through the business system based on the second instruction and the restoration request;

[0060] The data acquisition module is used to obtain the encrypted change data block and its second information through the UKey based on the restored data ID, the first Merkle tree and the second Merkle tree;

[0061] The data restoration module is used to perform restoration verification and integrity verification sequentially based on the second information through the business system. After passing the verification, it restores the data based on the encrypted change data block to complete the data restoration operation.

[0062] As can be seen from the above technical solution, compared with the prior art, the present invention discloses a data incremental backup and restore method and system based on Merkle tree, which has the following beneficial effects:

[0063] 1. High-efficiency incremental backup mechanism: By constructing a Merkle tree for data blocks, this invention can back up only the data that has changed, thereby achieving incremental backup and significantly improving backup efficiency.

[0064] 2. Highly Efficient Data Restore Mechanism: This invention provides a flexible and efficient data restoration solution. It supports data restore by selecting specific data regions, allowing users to freely choose target data areas for partial data recovery based on actual needs, avoiding unnecessary full data restoration. Employing a differential restoration approach, the system only restores data blocks whose content differs from the backup file, significantly reducing the time and resource consumption required for restoration and greatly improving restoration efficiency. Users can perform data recovery more accurately and efficiently, meeting data recovery needs in various complex scenarios.

[0065] 3. Encrypted Data Transmission and Storage: This invention employs SM2 asymmetric encryption technology to achieve a high degree of confidentiality during data transmission, ensuring that only authorized recipients can decrypt and read the data, effectively preventing data theft or tampering during transmission. Furthermore, this invention combines a UKey hardware device for encrypted data storage; even if an attacker obtains the UKey, they cannot directly access or crack the stored sensitive data.

[0066] 4. Data Anti-Tampering Security Mechanism: This invention utilizes the characteristics of Merkle trees to ensure data security during backup and restore processes; any modification to a data block will cause a change in its corresponding hash value, thereby changing the root hash value of the tree; during restoration, it can detect data integrity, providing an efficient and reliable integrity check mechanism to ensure that the data has not been tampered with.

[0067] 5. Data Encryption / Decryption Consistency: Improper key management during encryption and decryption operations can lead to inconsistencies between encryption and decryption, affecting the correct recovery of data. To ensure consistency in the encryption and decryption process, this invention generates a key fingerprint and verifies it during restoration, effectively avoiding potential risks in key management and ensuring accurate data recovery. Attached Figure Description

[0068] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0069] Figure 1 The present invention provides a flowchart of an incremental backup and restore method for data based on Merkle trees.

[0070] Figure 2 The flowchart of the method for determining relevant data blocks based on first information in the business system provided by the present invention is shown.

[0071] Figure 3 A schematic diagram of a simple Merkle tree structure provided by the present invention.

[0072] Figure 4 The flowchart of the method for performing restoration verification and integrity verification sequentially based on second information in the business system provided by the present invention is shown.

[0073] Figure 5 This is a schematic diagram of the data restoration selection area provided by the present invention.

[0074] Figure 6 A schematic diagram illustrating the Merkle tree construction of the file system provided by this invention.

[0075] Figure 7 This invention provides a schematic diagram of a Merkle tree-based incremental backup and restore system architecture. Detailed Implementation

[0076] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0077] Example 1

[0078] like Figure 1 As shown, this embodiment of the invention discloses a data incremental backup and restore method based on Merkle trees, including:

[0079] The system receives and verifies backup or restore requests based on the UKey. If the verification is successful, it generates a first or second instruction. The business system then conducts encrypted communication with the UKey based on the corresponding instruction.

[0080] The UKey queries whether a first Merkle tree exists locally, and generates the first information based on the query result.

[0081] The business system determines the relevant data blocks based on the first information, generates encrypted data blocks, key fingerprints and related Merkle trees based on the relevant data blocks, and establishes corresponding associations between the key fingerprints and the encrypted data blocks.

[0082] UKey performs corresponding operations based on encrypted data blocks and related Merkle trees, saves the association relationship, and completes the relevant backup operations;

[0083] The business system sends the restore data ID and the second Merkle tree to the UKey based on the second instruction and the restore request;

[0084] UKey obtains the encrypted change data block and its second information based on the restored data ID, the first Merkle tree, and the second Merkle tree;

[0085] The business system performs restoration verification and integrity verification sequentially based on the second information. After passing the verification, it restores the data based on the encrypted changed data block to complete the data restoration operation.

[0086] Example 2

[0087] This invention discloses a Merkle tree-based incremental backup and restore method for data, including:

[0088] The system receives backup or restore requests based on the UKey and verifies them. If the verification is successful, it generates the first or second instruction accordingly.

[0089] Preferably, a UKey (USB KEY) is a small hardware device that typically plugs into a computer's USB port to enhance the security of the computer system or applications. It is a hardware device with encryption capabilities and can be used for authentication, data encryption, digital signatures, and other functions.

[0090] Preferably, based on the insertion of the UKey into the relevant device, the business system in the relevant device detects the insertion of the UKey and prompts for the input of a PIN code for verification. The UKey verifies the input PIN code. If the verification is successful, the UKey generates the corresponding first instruction or second instruction based on the backup request or restore request. If the verification fails, a backup failure prompt is sent and subsequent operations are terminated.

[0091] Preferably, the interaction between the business system and the UKey follows the "GMT 0016-2012 Smart Password Key Password Application Interface Specification".

[0092] The business system communicates with the UKey in encrypted form based on the corresponding instructions.

[0093] Preferably, the business system communicates with the UKey using encrypted commands, specifically including:

[0094] The business system generates a public-private key pair based on the first or second instruction, and sends the public key to the UKey;

[0095] UKey generates a key and encrypts it based on the public key to obtain the encryption key, which is then sent to the business system.

[0096] The business system decrypts the encryption key using the private key to obtain the key;

[0097] The business system encrypts the relevant data blocks based on the key and sends them to the UKey, thus realizing encrypted communication between the business system and the UKey.

[0098] Preferably, in this embodiment, the public-private key pair generated by the business system is an SM2 asymmetric key pair, including an SM2 public key and an SM2 private key; the key generated by the UKey is an SM4 symmetric key.

[0099] Preferably, the SM2 algorithm is one of China's national cryptographic algorithm standards, mainly used for public-key encryption and digital signatures. It is a standard based on the Elliptic Curve Cryptography (ECC) algorithm, which has high security and low computational complexity. The SM4 algorithm is a symmetric encryption algorithm in China's national commercial cryptographic algorithms, which uses a 128-bit key and a 128-bit data block, and has high encryption efficiency and security.

[0100] The UKey queries whether a first Merkle tree exists locally, and generates the first information based on the query results.

[0101] Preferably, the first information is generated based on the query results, specifically including:

[0102] UKey determines the first backup operation based on the query results. If the first Merkle tree does not exist locally, it is considered the first backup operation and the encryption key is sent to the business system as the first relevant information.

[0103] If a first Merkle tree exists locally, it is determined to be an incremental backup operation, and the encryption key and the first Merkle tree are sent to the business system as the second relevant information.

[0104] The first information includes either first relevant information or second relevant information.

[0105] The business system determines the relevant data blocks based on the first information, generates encrypted data blocks, key fingerprints and related Merkle trees based on the relevant data blocks, and establishes corresponding associations between the key fingerprints and the encrypted data blocks.

[0106] Preferred, such as Figure 2 As shown, the business system determines the relevant data blocks based on the first piece of information, specifically including:

[0107] The business system makes a judgment based on the first information. If the first relevant information is received, the original data block is used as the first data block.

[0108] If the second relevant information is received, an integrity comparison is performed based on the first Merkle tree and the second Merkle tree maintained by itself to determine whether the comparison results are consistent. If they are consistent, it means that this backup has not changed compared with the previous backup, the backup is completed and an end notification is sent.

[0109] If they are inconsistent, the nodes of the first Merkle tree and the second Merkle tree are compared from top to bottom to locate the inconsistent leaf nodes. Based on the leaf nodes, the data blocks that have changed since the last backup are determined as the second data blocks.

[0110] The relevant data block includes either the first data block or the second data block.

[0111] Preferably, a Merkle tree, also known as a hash tree, is a tree-like structure where each leaf node is labeled with the hash value of the data block, while the labels of non-leaf nodes are the cryptographic hash values ​​of their child node labels. Merkle trees are an efficient and secure method for verifying the contents of large-scale data structures; they can be viewed as an extension of hash chains.

[0112] Preferred, such as Figure 3The diagram illustrates a simplified Merkle tree structure, where leaf nodes represent the hash values ​​of data blocks within a file or set of files. Higher nodes in the tree represent the hash values ​​of their respective child nodes. The number of branches in a Merkle tree is determined by the specific application requirements; a binary tree structure is used in most scenarios. First, the hash values ​​of all data blocks are calculated using the SHA-256 cryptographic hash algorithm, and these hash values ​​serve as the leaf nodes of the Merkle tree. Next, the hash values ​​of each pair of adjacent leaf nodes are combined and hashed to generate the parent node hash. For each level of parent nodes, this process continues, combining and hashing them pairwise until only one node remains—the root node of the Merkle tree. If the number of leaf nodes is not a power of 2, dummy leaf nodes may need to be added to the last level to maintain tree balance. If the content of a data block changes, the hash value of that leaf node needs to be updated, and this update is performed level by level through the parent nodes until the root node is reached.

[0113] Preferably, when the business system compares the two Merkle trees maintained by itself and those sent by the UKey, it first compares the root hashes of the two trees. If the root hashes are different, it recursively compares the hash values ​​of the left and right subtrees until it reaches the leaf nodes. If two subtrees are found to have the same hash value during the comparison process, the subsequent comparison process is terminated to avoid invalid comparisons. Finally, the leaf node whose hash value has changed is located, indicating that the data block represented by that leaf node has changed since the last backup, thus achieving incremental backup.

[0114] Preferably, the generation of encrypted data blocks, key fingerprints, and related Merkle trees based on relevant data blocks specifically includes:

[0115] The business system uses hash calculations based on the key to obtain the corresponding key fingerprint;

[0116] The business system generates a first related Merkle tree or a second related Merkle tree based on the first data block or the second data block;

[0117] The relevant Merkel tree includes either the first relevant Merkel tree or the second relevant Merkel tree;

[0118] The business system encrypts the first data block or the second data block based on the key, thereby obtaining the first encrypted data block or the second encrypted data block.

[0119] The encrypted data block includes either a first encrypted data block or a second encrypted data block.

[0120] Preferably, in this embodiment, the SHA-256 cryptographic hash function is used to perform hash calculation on the key, and a 64-bit hexadecimal number is calculated, which is the key fingerprint of the key.

[0121] Preferably, a corresponding association is established between the key fingerprint and the encrypted data block, specifically including:

[0122] The business system associates a key fingerprint with a first encrypted data block or a second encrypted data block to obtain a first association relationship or a second association relationship.

[0123] The corresponding relationships include primary relationships or secondary relationships;

[0124] The business system performs hash calculations based on the first data block or the second data block, and generates the first hash value or the second hash value accordingly.

[0125] The first or second hash value is sent to the UKey as the data block hash value.

[0126] UKey performs corresponding operations based on encrypted data blocks and related Merkle trees, saves the association relationships, and completes the relevant backup operations.

[0127] Preferably, the UKey performs corresponding operations based on the encrypted data block and the relevant Merkle tree, specifically including:

[0128] UKey makes its judgment based on the received encrypted data block;

[0129] If the first encrypted data block is received, the UKey saves the first encrypted data block and the first related Merkle tree, marks the first related Merkle tree as the first Merkle tree, saves the first association relationship, and completes the first backup operation;

[0130] If a second encrypted data block is received, the UKey saves the second encrypted data block, updates the first Merkle tree stored locally based on the second related Merkle tree, saves the second association relationship, and completes the incremental backup operation.

[0131] Preferably, the backup method of the present invention includes two backup modes: initial backup and incremental backup. The initial backup performs a full backup, requiring encrypted transmission of all data blocks to be protected. Subsequent backups perform incremental backups, transmitting only the data blocks that have changed since the last backup. Furthermore, if the business system connected to the UKey needs to be changed, the UKey can be reset and a new initial (full) backup can be performed.

[0132] The business system sends the restore data ID and the second Merkle tree to the UKey based on the second instruction and the restore request.

[0133] Preferably, the business system obtains the data to be restored based on the restoration request, and obtains the restoration data ID based on the restoration data; the second Merkle tree is a Merkle tree stored and maintained by the business system.

[0134] Preferably, the restored data may include multiple sets of data blocks or data areas.

[0135] UKey obtains the encrypted change data block and its second information based on the restored data ID, the first Merkle tree, and the second Merkle tree.

[0136] Preferably, the UKey obtains the encrypted change data block and its second information based on the restored data ID, the first Merkle tree, and the second Merkle tree, specifically including:

[0137] UKey compares the subtrees related to the restored data ID in the first Merkle tree and the second Merkle tree, and determines the encrypted data block that has changed as the encrypted change data block based on the comparison result;

[0138] The associated key is obtained by querying the ID and association relationship of the encrypted changed data block;

[0139] The associated key is encrypted using the public key to obtain the encrypted associated key;

[0140] Obtain the corresponding data block hash value based on the encrypted modified data block;

[0141] The encryption association key and the data block hash value together constitute the second information.

[0142] The business system performs restoration verification and integrity verification sequentially based on the second information. After passing the verification, it restores the data based on the encrypted changed data block to complete the data restoration operation.

[0143] Preferred, such as Figure 4 As shown, the business system performs restoration verification and integrity verification sequentially based on the second information, specifically including:

[0144] The business system decrypts the encrypted associated key based on the private key, obtains the associated key, performs hash calculation to obtain the first key fingerprint, and determines whether the second key fingerprint associated with the ID of the encrypted changed data block is consistent with the first key fingerprint. If they are consistent, the restoration verification passes; otherwise, the restoration verification fails and the restoration fails.

[0145] After the restoration verification is successful, the business system decrypts the encrypted change data block based on the associated key to obtain the change data block, and performs hash calculation based on the change data block to obtain the relevant hash value;

[0146] The business system compares the relevant hash value with the corresponding data block hash value and determines whether the comparison results are consistent. If they are consistent, the integrity verification passes; otherwise, the integrity verification fails and the restoration operation stops.

[0147] Preferably, during data restoration, the content to be restored can be flexibly selected, and regardless of the content selected, data restoration can be completed with minimal transmission cost. For example... Figure 5As shown, the administrator selects data areas N3 and N4 for restoration, while the business system only needs to focus on the N3 and N4 subtrees in the Merkle tree. The business system sends the N3 and N4 subtrees to the UKey, which only needs to compare the two subtrees to determine which data blocks to transmit. During the comparison, if the hash value of a non-leaf node in either tree is the same, the comparison of its left and right child nodes is terminated early. In cases of large amounts of data, this method can further reduce the resource consumption and time required to locate data blocks where changes have occurred.

[0148] Example 3

[0149] The initial backup method of this invention is as follows:

[0150] Connect to the business system based on UKey.

[0151] The user enters a PIN code through the business system and sends it to the UKey. The UKey verifies the entered PIN code, and upon successful verification, the UKey generates the first instruction based on the backup request.

[0152] If the verification fails, a backup failure message will be sent, and subsequent operations will be terminated.

[0153] The business system generates an SM2 key pair based on the first instruction and sends the SM2 public key to the UKey.

[0154] The UKey generates an SM4 key and encrypts it based on the SM2 public key to obtain an encrypted SM4 key, which is then sent to the business system.

[0155] The business system generates the first relevant Merkle tree based on the original data blocks.

[0156] The business system performs hash calculations based on the original data blocks to generate the first hash value.

[0157] The business system decrypts the encrypted SM4 key using the SM2 private key to obtain the SM4 key.

[0158] The business system encrypts the original data block using the SM4 key to obtain the first encrypted data block.

[0159] The business system uses the SM4 key to perform hash calculations to obtain the corresponding key fingerprint.

[0160] The business system associates the first encrypted data block with the key fingerprint to obtain the first association relationship, that is, it marks the SM4 key fingerprint used by the first encrypted data block.

[0161] The business system sends the first related Merkle tree, the first hash value, the first encrypted data block, and the first association relationship to the UKey.

[0162] The UKey stores the first encrypted data block and records the first related Merkle tree, the first hash value, and the first association relationship, which marks that the first encrypted data block received this time was encrypted using the SM4 key, completes the first backup, and sends a backup completion prompt to the business system.

[0163] After receiving the backup completion notification, the business system will disconnect from the UKey, thus ending the first backup.

[0164] The incremental backup method of this invention is as follows:

[0165] After the initial backup, subsequent backups only require incremental backups, transferring only the data blocks that have changed since the last backup, greatly improving backup efficiency. The specific steps are as follows:

[0166] Connect to the business system based on UKey.

[0167] The user enters a PIN code through the business system and sends it to the UKey. The UKey verifies the entered PIN code, and upon successful verification, the UKey generates the first instruction based on the backup request.

[0168] If the verification fails, a backup failure message will be sent, and subsequent operations will be terminated.

[0169] The business system generates an SM2 key pair based on the first instruction and sends the SM2 public key to the UKey.

[0170] UKey generates an SM4 key and encrypts it based on the SM2 public key to obtain an encrypted SM4 key.

[0171] The UKey sends the first Merkle tree and the encrypted SM4 key stored locally to the business system.

[0172] The business system decrypts the encrypted SM4 key using the SM2 private key to obtain the SM4 key.

[0173] The business system performs an integrity comparison between the root hash of the first Merkle tree and the root hash of the second Merkle tree it maintains. If the comparison results are consistent, it means that the backup has not changed compared to the previous backup, the backup is completed, and an end notification is sent. If they are inconsistent, the system compares the nodes of the first and second Merkle trees from top to bottom, locates the inconsistent leaf nodes, and determines the data blocks that have changed since the last backup as the second data blocks based on the leaf nodes.

[0174] The business system generates a second related Merkle tree based on the second data block.

[0175] The business system performs hash calculations based on the second data block to generate a second hash value.

[0176] The business system encrypts the second data block based on the SM4 key, thus obtaining the second encrypted data block.

[0177] The business system uses the SM4 key to perform hash calculations to obtain the corresponding key fingerprint.

[0178] The business system associates the key fingerprint with the second encrypted data block to obtain a second association relationship, that is, it marks the SM4 key fingerprint used by the second encrypted data block.

[0179] The business system sends the second related Merkle tree, the second hash value, the second encrypted data block, and the second association relationship to the UKey.

[0180] The UKey stores the second encrypted data block, updates the first Merkle tree stored locally based on the second related Merkle tree, saves the second association and the second hash value, completes the incremental backup operation, and sends a backup completion prompt to the business system.

[0181] The data restoration method of this invention is as follows:

[0182] This invention provides efficient integrity verification, data consistency checks, and rapid recovery during data restoration operations, improving restoration efficiency while protecting data from tampering. The specific steps are as follows:

[0183] Connect to the business system based on UKey.

[0184] The user enters a PIN code through the business system and sends it to the UKey. The UKey verifies the entered PIN code, and upon successful verification, the UKey generates a second instruction based on the restore request.

[0185] If the verification fails, a restoration failure message will be sent, and subsequent operations will be terminated.

[0186] The business system obtains the data to be restored based on the restoration request, and can select multiple data blocks or data areas for restoration, and obtain the restoration data ID based on the restored data.

[0187] The business system generates an SM2 key pair based on the second instruction and sends the SM2 public key to the UKey.

[0188] The business system sends the second Merkle tree maintained by its own storage and the restored data ID to the UKey.

[0189] UKey compares the subtrees related to the restored data ID in the first Merkle tree and the second Merkle tree, and determines the encrypted data block that has changed as the encrypted change data block based on the comparison result.

[0190] UKey retrieves the associated SM4 key based on the ID and association of the encrypted change data block.

[0191] UKey encrypts the associated SM4 key based on the SM2 public key to obtain the encrypted associated SM4 key.

[0192] UKey obtains the corresponding data block hash value based on the encrypted change data block.

[0193] The UKey sends the encrypted change data block, the encrypted associated SM4 key, and the corresponding data block hash value to the business system.

[0194] The business system decrypts the encrypted associated SM4 key based on the SM2 private key, obtains the associated SM4 key, performs hash calculation to obtain the first key fingerprint, and compares the second key fingerprint associated with the ID of the encrypted change data block with the first key fingerprint. If they match, the restoration verification passes; otherwise, the restoration verification fails, a key fingerprint mismatch prompt is generated, and the restoration fails.

[0195] After the restoration verification is successful, the business system decrypts the encrypted change data block based on the associated SM4 key, obtains the change data block, and performs hash calculation based on the change data block to obtain the relevant hash value.

[0196] The business system compares the relevant hash value with the corresponding data block hash value and determines whether the comparison results are consistent. If they are consistent, the integrity verification passes; otherwise, the integrity verification fails, a data tampering warning is generated, and the restoration operation is stopped.

[0197] After all the above verifications are passed, the business system restores the data based on the changed data blocks, thus completing the data restoration operation.

[0198] Example 4

[0199] In large file systems, backing up and restoring critical data is not only the foundation of data protection, but also an important guarantee for system stability and security.

[0200] For this type of system, a Merkle tree can be constructed using the file system's own tree structure. For example... Figure 6 As shown, each file is treated as a data block, and the hash value of each file represents a leaf node of the Merkle tree. Each directory is treated as a data area, and the hash values ​​of its child nodes are concatenated to calculate the hash value of the directory, representing a non-leaf node of the Merkle tree. Similarly, the hash value of the root directory of the file system represents the hash value of the entire Merkle tree, i.e., the root hash.

[0201] During the initial backup of the file system, a Merkle tree is constructed, all files are encrypted using the SM4 key sent by the UKey, and the encrypted files and the Merkle tree are sent to the UKey. The file system maintains this Merkle tree and updates it whenever files are changed, added, or deleted.

[0202] In each subsequent backup, the root hash of the file system is compared with that of the Merkle tree inside the UKey to determine whether the file system has changed since the last backup. If it has changed, the hash values ​​of the child nodes are recursively compared to locate the changed files. Finally, the Merkle tree of the file system and the changed files are encrypted and passed to the UKey, thus achieving fast incremental backup.

[0203] When a file or directory in the file system is corrupted or experiences other abnormal conditions, a UKey is inserted for data restoration. For example, if the / opt directory is corrupted, the / opt data area is specified for restoration. The file system sends the subtree of its Merkle tree rooted at the hash ( / opt) node to the UKey. The UKey compares the received subtree with its own stored tree to locate data blocks with inconsistent hash values. This indicates which files in the / opt directory are inconsistent with the UKey backup files. The UKey only needs to transmit these files in encrypted form to the file system for restoration, greatly improving restoration efficiency and enabling the system to quickly return to normal operation after a disaster. This ensures that critical data in the file system is not lost and business operations are restored as quickly as possible.

[0204] Example 5

[0205] like Figure 7 As shown, a Merkle tree-based incremental data backup and restore system includes: a connection verification module, a judgment module, a data processing module, a data backup module, a data transmission module, a data acquisition module, and a data restore module;

[0206] The connection verification module is used to receive backup or restore requests based on the UKey and verify them. If the verification is successful, a first instruction or a second instruction is generated accordingly. The business system then conducts encrypted communication with the UKey based on the corresponding instruction.

[0207] The first judgment module is used to query whether the first Merkle tree exists locally based on the UKey, and generate the first information based on the query result.

[0208] The data processing module is used to determine relevant data blocks based on the first information through the business system, generate encrypted data blocks, key fingerprints and related Merkle trees based on the relevant data blocks, and establish corresponding associations between the key fingerprints and the encrypted data blocks.

[0209] The data backup module is used to perform corresponding operations based on encrypted data blocks and related Merkle trees using a UKey, and to save the association relationship to complete the relevant backup operations;

[0210] The data transmission module is used to send the restore data ID and the second Merkle tree to the UKey through the business system based on the second instruction and the restore request;

[0211] The data acquisition module is used to obtain the encrypted change data block and its second information through the UKey based on the restored data ID, the first Merkle tree, and the second Merkle tree;

[0212] The data restoration module is used to perform restoration verification and integrity verification sequentially based on the second information through the business system. After passing the verification, the data is restored based on the encrypted changed data block to complete the data restoration operation.

[0213] Preferably, the functions implemented by each module in this embodiment correspond one-to-one with the methods described above, and will not be described in detail here.

[0214] Example 6

[0215] Based on the same inventive concept, the present invention also provides a computer device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0216] Memory, used to store computer programs;

[0217] When the processor executes a program stored in memory, it is able to implement a Merkle tree-based incremental backup and restore method for data, as described in Embodiment 1, 2, or 3.

[0218] The electronic device may include a processor, a communications interface, memory, and a communication bus, wherein the processor, communications interface, and memory communicate with each other via the communication bus. The processor can invoke logical instructions in the memory to execute a Merkle tree-based incremental data backup and restore method as described in Embodiment 1, 2, or 3.

[0219] Furthermore, when the logical instructions in the aforementioned memory can be implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0220] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0221] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for incremental backup and restore of data based on Merkle trees, characterized in that, include: The UKey receives backup or restore requests and verifies them. If the verification is successful, the corresponding first or second instruction is generated. The business system communicates with the UKey in encrypted form based on the corresponding instructions; The UKey queries whether a first Merkle tree exists locally, and generates first information based on the query result; The business system determines relevant data blocks based on the first information, generates encrypted data blocks, key fingerprints, and related Merkle trees based on the relevant data blocks, and establishes corresponding associations between the key fingerprints and the encrypted data blocks. The UKey performs corresponding operations based on the encrypted data block and the relevant Merkle tree, saves the association relationship, and completes the relevant backup operations; The business system sends the restoration data ID and the second Merkle tree to the UKey based on the second instruction and the restoration request; The UKey obtains the encrypted change data block and its second information based on the restored data ID, the first Merkle tree, and the second Merkle tree; The business system performs restoration verification and integrity verification sequentially based on the second information. After passing the verification, it restores the data based on the encrypted changed data block to complete the data restoration operation.

2. The incremental backup and restore method for data based on Merkle trees according to claim 1, characterized in that, The business system communicates with the UKey in encrypted form based on corresponding instructions, specifically including: The business system generates a public-private key pair based on the first instruction or the second instruction, and sends the public key to the UKey; The UKey generates a key and encrypts it based on the public key to obtain an encryption key, which is then sent to the business system. The business system decrypts the encryption key using the private key to obtain the key; The business system encrypts the relevant data block based on the key and sends it to the UKey, thereby realizing encrypted communication between the business system and the UKey.

3. The incremental backup and restore method for data based on Merkle trees according to claim 2, characterized in that, The first piece of information is generated based on the query results, specifically including: Based on the query result, if the first Merkle tree does not exist locally, the UKey determines it as the first backup operation and sends the encryption key as the first relevant information to the business system. If the first Merkle tree exists locally, it is determined to be an incremental backup operation, and the encryption key and the first Merkle tree are sent to the business system as the second relevant information. The first information includes either the first related information or the second related information.

4. The incremental backup and restore method for data based on Merkle trees according to claim 3, characterized in that, The business system determines the relevant data blocks based on the first information, specifically including: The business system makes a judgment based on the first information. If the first relevant information is received, the original data block is used as the first data block. If the second relevant information is received, an integrity comparison is performed based on the first Merkle tree and the second Merkle tree maintained by itself to determine whether the comparison results are consistent. If they are consistent, it indicates that the backup has not changed compared with the previous backup, the backup is completed and an end notification is sent. If they are inconsistent, the nodes of the first Merkle tree and the second Merkle tree are compared from top to bottom to locate the inconsistent leaf nodes. Based on the leaf nodes, the data blocks that have changed since the last backup are determined as the second data blocks. The relevant data block includes either the first data block or the second data block.

5. The incremental backup and restore method for data based on Merkle trees according to claim 4, characterized in that, Based on the aforementioned data blocks, an encrypted data block, a key fingerprint, and a related Merkle tree are generated, specifically including: The business system obtains the corresponding key fingerprint by performing a hash calculation based on the key. The business system generates a first related Merkle tree or a second related Merkle tree based on the first data block or the second data block; The relevant Merkle tree includes either the first relevant Merkle tree or the second relevant Merkle tree; The business system encrypts the first data block or the second data block based on the key to obtain the first encrypted data block or the second encrypted data block. The encrypted data block includes either the first encrypted data block or the second encrypted data block.

6. The incremental backup and restore method based on Merkle tree according to claim 5, characterized in that, Establishing a corresponding association between the key fingerprint and the encrypted data block specifically includes: The business system associates the key fingerprint with the first encrypted data block or the second encrypted data block to obtain a first association relationship or a second association relationship. The corresponding association relationship includes either the first association relationship or the second association relationship; The business system performs hash calculations based on the first data block or the second data block to generate a first hash value or a second hash value. The first hash value or the second hash value is sent to the UKey as a data block hash value.

7. The incremental backup and restore method for data based on Merkle trees according to claim 6, characterized in that, The UKey performs corresponding operations based on the encrypted data block and the relevant Merkle tree, specifically including: The UKey makes its judgment based on the received encrypted data block; If the first encrypted data block is received, the UKey saves the first encrypted data block and the first related Merkle tree, and marks the first related Merkle tree as the first Merkle tree; If the second encrypted data block is received, the UKey saves the second encrypted data block and updates the first Merkle tree stored locally based on the second related Merkle tree.

8. The incremental backup and restore method for data based on Merkle trees according to claim 7, characterized in that, The UKey obtains the encrypted change data block and its second information based on the restored data ID, the first Merkle tree, and the second Merkle tree, specifically including: The UKey compares the subtrees related to the restored data ID in the first Merkle tree and the second Merkle tree, and determines the encrypted data block that has changed as the encrypted change data block based on the comparison result; The associated key is obtained by querying the ID of the encrypted change data block and the association relationship. The associated key is encrypted using the public key to obtain the encrypted associated key; Obtain the corresponding data block hash value based on the encrypted changed data block; The encryption association key and the data block hash value together constitute the second information.

9. The incremental backup and restore method for data based on Merkle trees according to claim 8, characterized in that, The business system performs restoration verification and integrity verification sequentially based on the second information, specifically including: The business system decrypts the encrypted association key based on the private key to obtain the association key and performs hash calculation to obtain the first key fingerprint. The second key fingerprint associated with the ID of the encrypted change data block is compared with the first key fingerprint. If they match, the restoration verification passes; otherwise, the restoration verification fails and the restoration fails. After the restoration verification is successful, the business system decrypts the encrypted change data block based on the associated key to obtain the change data block, and performs hash calculation based on the change data block to obtain the relevant hash value; The business system compares the relevant hash value with the corresponding data block hash value and determines whether the comparison results are consistent. If they are consistent, the integrity verification is passed; otherwise, the integrity verification fails and the restoration operation is stopped.

10. A Merkle tree-based incremental backup and restore system, applied to the Merkle tree-based incremental backup and restore method as described in any one of claims 1-9, characterized in that, include: The system includes a connection verification module, a judgment module, a data processing module, a data backup module, a data transmission module, a data acquisition module, and a data restoration module. The connection verification module is used to receive backup requests or restore requests based on the UKey and perform verification. If the verification is successful, a first instruction or a second instruction is generated accordingly. The business system communicates with the UKey in encrypted form based on the corresponding instructions; The first judgment module is used to query whether a first Merkle tree exists locally based on the UKey, and generate first information based on the query result; The data processing module is used to determine relevant data blocks based on the first information through the business system, generate encrypted data blocks, key fingerprints and related Merkle trees based on the relevant data blocks, and establish corresponding association relationships between the key fingerprints and the encrypted data blocks. The data backup module is used to perform corresponding operations based on the encrypted data block and the relevant Merkle tree using the UKey, and to save the association relationship to complete the relevant backup operations; The data transmission module is used to send the restoration data ID and the second Merkle tree to the UKey through the business system based on the second instruction and the restoration request; The data acquisition module is used to obtain the encrypted change data block and its second information through the UKey based on the restored data ID, the first Merkle tree and the second Merkle tree; The data restoration module is used to perform restoration verification and integrity verification sequentially based on the second information through the business system. After passing the verification, it restores the data based on the encrypted change data block to complete the data restoration operation.

Images