A complete ring-based data storage integrity checking system and method

Abstract

This invention discloses a data storage integrity verification system and method based on an integral ring, relating to the field of data security technology. It includes a data encoding module, a base generation module, a standard value library, and a measurement module. The data encoding module converts binary data to be verified into integers. The base generation module selects a base space and generates bases using a random selection method. The measurement module completes data integrity verification by calling the base generation module and the standard value library. The standard value library stores the standard integrity verification values ​​of the input data. This invention differs from conventional cryptography, which is based on mathematical problems and is vulnerable to cryptanalysis based on artificial intelligence and quantum computing. It relies solely on mathematical principles to design the integrity verification mechanism, performing data integrity verification based on the random selection of bases within an integral ring. This resists various cryptographic attacks based on artificial intelligence and quantum computing. Its security depends solely on mathematical principles and not on any mathematical problems, possessing unconditional security.

Description

TECHNICAL FIELD

[0001] The application relates to a whole ring-based data storage integrity verification system and method, and belongs to the technical field of data security. BACKGROUND

[0002] The tide of artificial intelligence and quantum computing, as the core force of new generation of technological revolution, is profoundly changing human society. Artificial intelligence and quantum computing promote social progress, while also having a profound impact on the field of network security. Artificial intelligence improves the level of automated defense of information systems, and quantum computing drives the computing revolution and realizes the secure distribution of secret keys. However, while artificial intelligence and quantum computing help the development of network security, they also pose great challenges to network security. Especially in the field of cryptography, artificial intelligence and quantum computing will reshape the pattern of cryptanalysis. Artificial intelligence breaks through the limit of cryptanalysis through deep learning, realizes the autonomous identification of encryption mechanisms and the automatic mining of cryptographic protocol vulnerabilities. Quantum computing severely reduces the security level of classical cryptographic systems. Quantum Shor algorithm can directly break RSA and elliptic curve cryptography (ECC) through the parallelism and superposition state characteristics of quantum computing. Quantum Grover algorithm can directly halve the security strength of symmetric encryption and hash algorithms. The global tide of post-quantum cryptography (PQC) is currently rising. The United States will replace PQC in its entirety before 2035. The China Commercial Cryptographic Standard Research Institute officially launched the collection of new generation of quantum-resistant cryptographic algorithms in February 2025.

[0003] The current country is developing a trusted data space, and data trusted storage is the basis for ensuring data security and building a trusted data space. Since data faces many security threats such as forgery and tampering during storage, it is of great significance to establish a high-trust integrity verification algorithm for data storage and verify the trustworthiness of stored data in real time.

[0004] In view of the great threat of artificial intelligence and quantum computing to the cryptographic system, the application proposes a whole ring-based data storage integrity verification method to resist cryptanalysis through random distribution, and its security only depends on mathematical principles, having unconditional security. SUMMARY

[0005] The technical problem to be solved by the application is to provide a whole ring-based data storage integrity verification system and method, which is different from the design of conventional cryptography based on mathematical problems, and only relies on mathematical principles to design an integrity verification mechanism to resist various cryptographic attacks based on artificial intelligence and quantum computing, thereby improving the security of data integrity verification to resist security threats from artificial intelligence and quantum computing.

[0006] To solve the above technical problems, the technical scheme adopted by the present application is: a data storage integrity verification system based on whole ring includes a data encoding module, a base generating module, a standard value library and a measurement module; the data encoding module and the base generating module are respectively connected with the standard value library and the measurement module; the data encoding module is used to convert the data to be verified in binary format into an integer, in order to prepare for the subsequent integrity verification of the measurement module; the base generating module is used to select a base space and generate a base by random selection, for the subsequent measurement of the measurement module; the measurement module completes the integrity verification of the data by calling the base generating module and the standard value library, to ensure that the data is not tampered with; the standard value library is used to store the standard integrity verification value of the input data. The data involved in this technical scheme refers to the data stored by the computing device and the network communication data.

[0007] Let be a whole ring (integer set), be a natural number set, and mod be the modulus (remainder) operation of the upper standard.

[0008] Preferably, the data encoding module converts the input data to be integrity verified into an element in the whole ring . Let the input data to be integrity verified be , where is the data tag of the data, is the length of the data, and the data content is . The data encoding module converts into an element in . At this time, the element group is formed.

[0009] Preferably, the base generating module is responsible for the selection of the base space and the base. The base space is a set with elements. The base is an element in the base space , which is randomly generated.

[0010] Preferably, the standard value library stores the standard integrity verification value of the input data to be integrity verified, according to entries, and the specific structure of each entry is as follows:

[0011]

[0012] is the data tag, is the data length of the data, are the selected base and standard verification value of the data, respectively. The number of data entries in the standard value library. All data in the standard value library is stored in secret and is only used internally by the integrity verification system.

[0013] Preferably, the metric module receives the element group , checks whether it is in the standard value library.

[0014] 1) If is not in the standard value library, the base generation module is called. The base generation module randomly selects in the base space A and returns it to the metric module. The metric module calculates

[0015]

[0016] stores in the standard library. At the same time, output data T = 2, indicating that the input data is new data, and the data integrity verification value has been generated and stored.

[0017] 2) If is in the standard value library, the metric module reads the corresponding data from the standard value library . In order to distinguish symbols, let the corresponding data read from the standard value library be . If , output data T = 0, indicating that the input data has changed relative to the original data. If , calculate the new verification value

[0018]

[0019] If , output data T = 1, indicating that the input data has not changed relative to the original data. Otherwise, output data T = 0, indicating that the input data has changed relative to the original data.

[0020] A data storage integrity verification method based on integral ring includes the following steps:

[0021] Initialization phase: the standard value library data is empty, and the number of data entries is 0. The base generation module selects the base space A.

[0022] Step one: input data, the data encoding module converts the data content of the input data into elements in the integral ring , and generates an element group, and sends the element group to the metric module.

[0023] Step two: after the metric module receives the element group, it checks whether the data tag in the element group exists in the standard value library. If it exists, go to step five.

[0024] Step 3: If the data labels in the element group do not exist in the standard value library, call the base generation module to generate a base.

[0025] Step 4: The measurement module uses the modulo operation of the elements with respect to the radix to store the data label, data length, radix, and checksum in the standard value library, incrementing the number of entries in the standard value library by 1. Simultaneously, it outputs data T=2, indicating that the input data is newly added and that the data integrity checksum has been generated and stored.

[0026] Step 5: If the data label in the element group exists in the standard value library, the measurement module will read the entry corresponding to that data label from the standard value library using the data label as an index.

[0027] Step 6: Check if the data length in the element group is equal to the data length in the entry. If they are not equal, output data T=0, indicating that the input data has been changed relative to the original data.

[0028] Step 7: If the data length in the element group is equal to the data length in the entry, then take the modulo of the element with the base of the entry to obtain a new check value. Compare the new check value with the standard check value in the entry. If they are equal, output data T=1, indicating that the input data has not changed relative to the original data.

[0029] Step 8: If the new checksum is not equal to the checksum in the entry, output data T=0, indicating that the input data has been changed relative to the original data.

[0030] The beneficial effects of this invention are:

[0031] 1. Unlike conventional cryptography which is based on mathematical problems and is therefore vulnerable to cryptanalysis based on artificial intelligence and quantum computing, this invention relies solely on mathematical principles to design an integrity verification mechanism. It performs data integrity verification based on the random selection of the basis of the entire ring to resist various cryptographic attacks based on artificial intelligence and quantum computing.

[0032] 2. The security of this invention relies solely on mathematical principles and does not depend on any mathematical problems, thus possessing unconditional security. Attached Figure Description

[0033] Figure 1 This is a framework diagram of an integrity verification system based on a complete loop.

[0034] Figure 2 This is a flowchart of the integrity verification system based on the entire loop. Detailed Implementation

[0035] The system framework diagram of this invention is as follows: Figure 1The integrity check system workflow diagram based on the whole ring is shown as Figure 2 .

[0036] The technical solutions of the present application will be described in detail below in combination with two specific examples.

[0037] Example 1: Integrity check of data storage in cloud environment

[0038] Suppose in a cloud computing environment, a user needs to transmit a large number of encrypted data blocks from a local terminal to a cloud environment for storage. In order to ensure that the data is not maliciously tampered with or damaged during storage or subsequent use, an integrity check method needs to be used. The method of the present application focuses on solving the integrity check of data after storage

[0039] Initialization phase: The cloud environment initializes its standard value library. The standard value library is used to store the check information of the data blocks, and the initial state is empty and does not contain any data entries. The data entry counter is set to 0. The base generation module of the cloud server pre-selects a suitable base space A, for example, a set of all prime numbers in ) as the base space. The elements in the base space will be used as the base for generating the check value in the subsequent steps.

[0040] Step one: The cloud environment receives the input data. The data encoding module converts the data content of each data block into an element in the whole ring , for example, assuming that the data content is 300-bit binary data “100……001”, the data encoding module converts it into the element , where the data length is required. The data encoding module generates an element group for the data block, which respectively represents the ID of the data block, the data length, and the converted element, and sends the generated element group to the measurement module of the cloud server.

[0041] Step two: The measurement module on the cloud environment receives the element group sent by the user terminal. The measurement module first checks whether the data block ID in the element group exists in the standard value library.

[0042] Step three: If the data tag in the element group does not exist in the standard value library, the base generation module is called. The base generation module uniformly and randomly selects a base q from and returns it to the measurement module.

[0043] Step four: The measurement module performs a modulo (remainder) operation on the element with respect to the selected base q to obtain the remainder r, and creates a new data entry , which is stored in the standard value library, where is the data tag.​ is the data length of the data. is the base selected for the data. is the computed remainder, as the standard check value of the data block. All data in the standard value library is stored in secret, and is only used internally by the integrity check system. The measurement module outputs data T = 2, indicating to the user terminal or other system that the received data block is a new data block, and that its integrity check value has been generated and stored securely.

[0044] Step five: When the cloud environment receives new data, repeat the process of steps one to four. When the cloud environment needs to check the integrity of a stored data block (for example, before the data is used, or periodically for integrity checks), the measurement module will perform the following steps.

[0045] Step six: The measurement module uses the ID of the data block as an index to read the corresponding stored data entry from the standard value library of the cloud environment. To distinguish, the data entry read from the standard value library is denoted as where is the stored data length, is the stored base, is the stored check value. The measurement module of the cloud environment compares the length of the retrieved data block with the data length in the corresponding data entry read from the standard value library If , the measurement module outputs data T = 0, indicating that the length of the retrieved data block has changed compared to the previously stored data block, which usually means that the data may have been tampered with.

[0046] Step seven: If the data length in the element group is equal to the data length in the entry, a new check value is obtained by taking the modulus of the base in the entry with the element , and the new check value is compared with the standard check value in the entry . If they are equal, output data T = 1, indicating that the retrieved data block is completely consistent with the previously stored data block, and no changes have occurred.

[0047] Step eight: If the new check value is not equal to the check value in the entry, output data T = 0, indicating that the content of the retrieved data block has changed compared to the previously stored data block, which usually means that the data may have been tampered with.

[0048] Example 2: Data integrity check based on TPCM

[0049] The following introduces an enhanced trusted boot scheme based on TPCM. TPCM is an integrity check system.

[0050] Initialization phase: TPCM initializes its standard value library. The standard value library is used to store the check information of data blocks, and the initial state is empty, containing no data entries. The base generation module pre-selects a suitable base space A, for example, the set of all prime numbers in ) as the base space. The elements in the base space will be used as the base for generating the check value in the subsequent steps.

[0051] Step one: In the check information generation phase, the BIOS / UEFI firmware, bootloader, operating system kernel, and other key startup components are divided into fixed-size data blocks. The data tag, data length, and data block are considered as an input data . The data encoding module converts the data content of each data block into an element in the integer ring . Taking the BIOS as an example, assuming that the data content is 300-bit binary data “100……001”, the data encoding module converts it into the element , where the data length is required to be less than 300. The data encoding module generates an element group for this data block, representing the data block ID, data length, and converted element, respectively.

[0052] Step two: In the check information generation phase, the measurement module calls the base generation module. The base generation module uniformly and randomly selects a base from and returns it to the measurement module. The measurement module calculates the check value of the BIOS data block and stores it in the standard value library, with the entry value being , representing the data tag, data length, base, and check value, respectively. At the same time, the data T = 2 is output to the user terminal or other system, indicating that the received data block is a new data block, and its integrity check value has been generated and securely stored.

[0053] Step three: In the trusted startup phase, for each data block of the key startup component to be loaded and executed, its integrity is verified in turn. Taking the BIOS as an example, the data encoding module receives and encodes the BIOS data into an element in the integer ring . The operation is the same as step one.

[0054] Step four: The measurement module accepts the result of the data encoding module, and according to the data tag , it takes out the corresponding entry from the standard value library. For distinction, the data entry read from the standard value library is denoted as , where is the original length of the data,​ is the check value of the original data. If the data length is inconsistent, the measurement module outputs data T=0, indicating that the length of the retrieved data block has changed compared with the previously stored data block, and the trusted boot process terminates.

[0055] Step five: if the input data length is equal to the data length in the standard value library entry, the check value of the input data is recalculated , the new check value and the standard check value in the entry are compared If they are equal, output data T=1, indicating that the retrieved data block is completely consistent with the previously stored data block and has not changed, and the trusted chain continues to pass. If the calculated check value is not equal to the stored check value, then output data T=0, indicating that the retrieved data block has changed compared with the previously stored data block, and the trusted boot process terminates.

[0056] The algorithm of the present application is implemented on a Xilinx FPGA 100MHZ, and compared with mainstream algorithms SM3, SHA2-256 and SHA3-256, and the results are as follows:

[0057] The present invention SM3 SHA2-256 SHA3-256 Throughput 10 Gbps 3.5 Gbps 3 Gbps 4 Gbps Occupied resources (LUT) 300 600 650 450 Occupied resources (FF) 230 500 500 380

[0058] It can be seen that the present application is superior to existing algorithms in both throughput and resource occupation.

[0059] The data involved in the technical solution refers to any record of information in electronic or other forms, and in particular, the data refers to data stored by a computing device and network communication data.

Claims

1. A data storage integrity verification system based on a complete ring, characterized in that, It includes a data encoding module, a base generation module, a standard value library, and a measurement module; the data encoding module, base generation module, and standard value library are connected to the measurement module respectively; the data involved refers to data stored in computing devices and network communication data; the data encoding module is used to convert the binary data to be verified into integers, preparing for the subsequent integrity verification by the measurement module; the data to be verified is information recorded electronically; the base generation module is used to select a base space and generate a base using a random selection method, for the measurement module to perform subsequent measurements; the measurement module completes the data integrity verification by calling the base generation module and the standard value library; the standard value library is used to store the standard integrity verification values ​​of the input data to be verified. The standard value library stores standard integrity verification values ​​by entry, and the specific structure of each entry is as follows: (ID i ,m i ,q i ,r i ),0≤i≤N* ID i The data label for the standard integrity check value, m i q is the data length of the standard integrity check value. i ,r i These are the base and standard check value selected for the standard integrity check value, respectively. N* is the number of data entries in the standard value library. All standard integrity check values ​​in the base value library are stored confidentially and used within the integrity check system. The measurement module receives element groups (IDs) i ,m i D i Check ID i Is it in the standard value library? 1) If ID i If the value is not in the standard value library, the base generation module is invoked. The base generation module randomly selects the base q selected by the standard integrity check value in the base space A. i ∈A, and return it to the measurement module, which uses D i For base q i The standard check value r selected for generating the standard integrity check value through modulo operation. i , will (ID) i ,m i ,q i ,r i The data is stored in the baseline library, and the output data T=2 indicates that the data to be verified is newly added data, and the standard integrity verification value of the data to be verified has been generated and stored. 2) If ID i In the standard value library, the measurement module reads the ID from the standard value library. i The corresponding standard integrity check value; assuming the ID is read from the standard value library. i The corresponding standard integrity check value is (ID) i ,sm i ,q i ,sr i If m i ≠sm i If the output data T = 0, it indicates that the data to be checked for integrity has changed relative to the standard integrity check value; if m i =sm i Then use D i The base q selected for the standard integrity check value i The standard check value r selected for generating a new standard integrity check value through modulo operation. i If r i =sr i If the output value is T=1, it indicates that the data to be checked for integrity has not changed relative to the standard integrity check value; otherwise, the output value is T=0, indicating that the data to be checked for integrity has changed relative to the standard integrity check value.

2. The data storage integrity verification system based on a complete ring as described in claim 1, characterized in that, The data encoding module converts the input integrity verification data into elements in the ring Z. Let the input integrity verification data be (ID, m, data), where ID is the data label of the integrity verification data, m is the data length of the integrity verification data, and data is the data content of the integrity verification data. The data encoding module converts data into element D in the ring Z, forming the element group (ID, m, D).

3. The data storage integrity verification system based on a complete ring as described in claim 1, characterized in that, base space It is a set with k elements, where k ≥ 10 6 The basis q∈A is an element in the basis space a, which is randomly generated.

4. A method for verifying the integrity of data storage using the system described in any one of claims 1-3, characterized in that, Includes the following steps: Initialization phase: The standard value library is empty, the number of data entries is 0, and the base generation module selects base space A; Step 1: Input the integrity verification data. The data encoding module converts the data content of the input integrity verification data into elements in the ring Z and generates an element group, which is then sent to the measurement module. Step 2: After receiving the element group, the measurement module checks whether the data tags of the data to be verified for integrity in the element group exist in the standard value library; if they exist, proceed to step 5. Step 3: If the data tags of the data to be verified for integrity in the element group do not exist in the standard value library, then call the base generation module to generate a base; Step 4: The measurement module uses the element modulo of the basis to store the data label, data length, basis, and standard check value of the standard integrity check value in the standard value library, and increments the number of entries in the standard value library by 1; the output data T=2 indicates that the data to be checked for integrity is newly added data, and the standard integrity check value of the data to be checked for integrity has been generated and stored; Step 5: If the data label of the data to be verified in the element group exists in the standard value library, the measurement module will read the entry corresponding to the data label from the standard value library using the data label of the data to be verified as the index; Step 6: Check if the data length of the data to be verified in the element group is equal to the data length in the entry. If they are not equal, output data T=0, indicating that the input data to be verified has been changed relative to the standard integrity verification value. Step 7: If the data length of the data to be verified in the element group is equal to the data length of the standard integrity verification value in the entry, then use the element to take the modulo of the base in the entry to obtain a new standard integrity verification value; compare the new standard integrity verification value with the standard verification value in the entry. If they are equal, output data T=1, indicating that the input data to be verified has not changed relative to the standard integrity verification value. Step 8: If the new standard integrity check value is not equal to the standard check value in the entry, output data T=0, indicating that the input integrity check data has been changed relative to the standard integrity check value.

Images