Data tampering detection system and method, electronic device, medium and product

Abstract

The embodiment of the invention provides a data tampering detection system and method, electronic equipment, a medium and a product. The system comprises a data acquisition module for generating a data change record, a detail database recording the data change record and a detection module. Wherein the data change record can comprise a data change quantity corresponding to the data change operation and a data total value before the data change operation is generated. And for two data change records sequentially generated in the detail database, if the sum of the data total value and the data variation in the current data change record is equal to the data total value in the next data change record, the detection module can determine that the data in the current data change record is not tampered. In the system, the record format reflecting the data change direction and the detection logic corresponding to the record format are designed, so that the detection module can detect whether the accumulative data is tampered or not according to the relationship between different data in two adjacent data change records.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of database security, and in particular to a data tampering detection system and method, an electronic device, a medium and a product. BACKGROUND

[0002] Data that needs to be accumulated in a database (i.e. accumulated data) such as deposits, points, etc. in user assets can be stored, and data that does not need to be accumulated (i.e. non-accumulated data) such as height, age, etc. can also be stored. For a database, an important measure to ensure data security can be to detect whether the data in the database has been tampered with.

[0003] For accumulated data in a database, how to detect whether the accumulated data has been tampered with becomes a problem to be solved. SUMMARY

[0004] Therefore, the embodiments of the present application provide a data tampering detection system and method, an electronic device, a medium and a product to detect tampering of accumulated data.

[0005] In a first aspect, the embodiments of the present application provide a data tampering detection system, comprising: a detailed database, a data collection module and a detection module.

[0006] The data collection module is configured to generate a first type of data change record in response to a data change operation, and write the first type of data change record into the detailed database.

[0007] The data change operation corresponds to accumulated data, and the first type of data change record includes a data change amount of the accumulated data corresponding to the data change operation and a total data value of the accumulated data before the data change operation.

[0008] The detection module is configured to obtain a first data change record and a second data change record generated in sequence from the first type of data change record stored in the detailed database, and determine that the data in the first data change record has not been tampered with if the sum of the total data value and the data change amount in the first data change record is equal to the total data value in the second data change record.

[0009] In a second aspect, the embodiments of the present application provide another data tampering detection system, comprising: a data processing subsystem and a data detection subsystem; the data processing subsystem comprises a data collection module and a total value database; the data detection subsystem comprises a data forwarding module, a detection module and a detailed database.

[0010] The data acquisition module is configured to respond to a data change operation by generating a first type of data change record and a second type of data change record corresponding to the data change operation; sending the first type of data change record and the second type of data change record, wherein the data change operation corresponds to cumulative data, the first type of data change record includes the data change amount of the cumulative data corresponding to the data change operation and the total data value of the cumulative data before the data change operation, the second type of data change record includes the data change amount of the cumulative data corresponding to the data change operation and the total data value of the cumulative data after the data change operation; and writing the second type of data change record into the total value database to display the generation of the second type of data change record.

[0011] The data forwarding module is used to receive the first type of data change record sent by the data acquisition module; and write the first type of data change record into the detailed database.

[0012] The detection module is used to obtain the first data change record and the second data change record generated sequentially from the first type of data change records stored in the detailed database; if the sum of the total data value and the data change amount in the first data change record is equal to the total data value in the second data change record, then it is determined that the data in the first data change record has not been tampered with.

[0013] Thirdly, embodiments of the present invention provide a data tampering detection method, including:

[0014] Obtain the first data change record and the second data change record generated sequentially. The change record is a first type of data change record generated in response to a data change operation. The data change operation corresponds to cumulative data. The first type of data change record includes the amount of data change of the cumulative data corresponding to the data change operation and the total value of the cumulative data before the data change operation.

[0015] If the sum of the total data value and the amount of data change in the first data change record is equal to the total data value in the second data change record, then it is determined that the data in the first data change record has not been tampered with.

[0016] Fourthly, embodiments of the present invention provide an electronic device, including a processor and a memory, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions, when executed by the processor, implement the data tampering detection method described in the third aspect above. The electronic device may also include a communication interface for communicating with other devices or communication networks.

[0017] Fifthly, embodiments of the present invention provide a non-transitory machine-readable storage medium storing executable code, wherein when the executable code is executed by a processor of an electronic device, the processor is able to at least implement the data tampering detection method as described in the third aspect.

[0018] In a sixth aspect, embodiments of the present invention provide a computer program product, the computer program product including a computer program or instructions, which, when executed by a processor, causes the processor to implement the data tampering detection method as described in the third aspect above.

[0019] The data tampering detection system provided in this invention includes: a data acquisition module for generating data change records, a detailed database recording the data change records, and a detection module. The data change operation corresponds to cumulative data, and the data change record may include multiple data items, namely, the amount of data change in the cumulative data corresponding to the data change operation and the total value of the cumulative data before the data change operation. For a first data change record and a second data change record generated sequentially in the detailed database, if the sum of the total value and the amount of data change in the first data change record equals the total value of the data in the second data change record, then the detection module can determine that the data in the first data change record has not been tampered with.

[0020] In the aforementioned system, a new record format was designed, in which each record contains the amount of data change corresponding to the data change operation and the total data value before the data change operation. Based on this record format, corresponding verification logic was designed, enabling the detection module to detect whether cumulative data has been tampered with by examining the data in two adjacent data change records in the detailed database. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a schematic diagram of the structure of a data tampering detection system provided in an embodiment of the present invention;

[0023] Figure 2 A flowchart of a detection logic provided in an embodiment of the present invention;

[0024] Figure 3 This is a schematic diagram of another data tampering detection system provided in an embodiment of the present invention;

[0025] Figure 4 This is a schematic diagram of the structure of another data tampering detection system provided in an embodiment of the present invention;

[0026] Figure 5 A flowchart of a data tampering detection method provided in an embodiment of the present invention;

[0027] Figure 6 This is a schematic diagram of the structure of a data tampering detection device provided in an embodiment of the present invention;

[0028] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” used in the embodiments of this invention and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise. “Multiple” generally includes at least two, but does not exclude the inclusion of at least one.

[0031] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0032] Depending on the context, the words “if” or “suppose” as used here can be interpreted as “when” or “in response to determination” or “in response to identification.” Similarly, depending on the context, the phrases “if determination” or “if identification (of the condition or event of the statement)” can be interpreted as “when determination” or “in response to determination” or “when identification (of the condition or event of the statement)” or “in response to identification (of the condition or event of the statement).”

[0033] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this invention are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0034] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a product or system comprising a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a product or system. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the product or system that includes said element.

[0035] Building upon the information provided in the background section, the following section will provide a more detailed introduction to the data types stored in the database.

[0036] It's easy to understand that the data stored in a database can be dynamic or static. Among dynamic data, some has cumulative significance; this can be called cumulative data. Other data, such as height and age, does not have cumulative significance and can be called non-cumulative data.

[0037] For cumulative data, users can perform operations to add and / or deduct data. The content of cumulative data can vary in different scenarios. For example, cumulative data can be a user's asset data, such as account balance, points, etc., which users can add or deduct. Cumulative data can also be a user's activity data, such as steps, distance, and time, which users can add. Cumulative data can also be inventory data, which users can deduct.

[0038] For static data, a common method for tampering detection is to add a checksum column to the data records. The checksum stored in the checksum column is generated in real time based on the key data in the record when it is written to the database; that is, each record has a corresponding checksum. Considering that the data is static, the checksum for each record is also unchanged. When data tampering occurs, a new ciphertext can be generated based on the key data in the tampered record. This new ciphertext is obviously different from the checksum before the tampering, at which point the tampering of static data can be detected.

[0039] However, for dynamically changing cumulative data, a new checksum is generated when the cumulative data changes, and new ciphertext is also generated based on key data in the changed data. This data change can be caused by user actions or by data tampering. Since the new checksum and ciphertext are obviously the same, it is impossible to detect whether the data has changed. Therefore, the above method is clearly unsuitable for detecting whether cumulative data has been tampered with. In this case, the system and method provided in the following embodiments of the present invention can be used to detect whether cumulative data has been tampered with.

[0040] Based on the above description, some embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Where there is no conflict between the embodiments, the following embodiments and features can be combined with each other. Furthermore, the timing of the steps in the following method embodiments is merely an example and not a strict limitation.

[0041] Figure 1 This is a schematic diagram of a data tampering detection system provided in an embodiment of the present invention. Figure 1 As shown, the system may include a detailed database, a data acquisition module, and a detection module.

[0042] Based on the above description, cumulative data can generate different content in different scenarios. For example, in a sports scenario, cumulative data can include various sports data generated from using sports services; in a financial scenario, cumulative data can include account balances generated from using transaction services; and in a shopping scenario, cumulative data can include points generated from using transaction services.

[0043] For cumulative data, users can optionally perform normal or abnormal data modification operations, with abnormal data modification operations being data tampering operations. For example, in a sports scenario, a user's walking behavior can be considered a normal data modification operation; in a financial and shopping scenario, a user's transaction operation can be considered a normal data modification operation. In different scenarios, for users who can directly modify cumulative data, the data modification operations they trigger can be considered abnormal data modification operations.

[0044] Among them, users who perform normal data change operations can typically be users of different services in different scenarios, while users who perform abnormal data change operations can typically be providers of the aforementioned different services, or detection parties that execute data tampering detection logic. Furthermore, the detection party is also used to maintain the detailed database mentioned in the following embodiments of the present invention.

[0045] Based on the above description, the working process of the data tampering detection system can be described as follows:

[0046] The detection module in the system can perform checks periodically or in response to specific operations (such as writing data change records to the detailed database) to detect whether data has been tampered with. The detection logic for this cumulative data can be described as follows: the detection module can retrieve the first and second data change records generated sequentially from the detailed database, and then detect whether the data has been tampered with based on the differences in the data contained in the two change records. Specifically, if the sum of the total data value and the data change amount in the first data change record equals the total data value in the second data change record, then it is determined that the data in the first data change record has not been tampered with.

[0047] The data change records in the detailed database can be generated in the following manner:

[0048] The data acquisition module in the system can generate data change records in response to normal data change operations on cumulative data, and further write these data change records into the detailed database. The format of the data change records in the detailed database can be shown in Table 1 below.

[0049] As shown in Table 1, any record in the detailed database can include multiple fields, namely the amount of data change corresponding to the data change operation and the total data value before the data change operation.

[0050] Table 1:

[0051] Data total (before operation) Change amount Record 1 0 100 Record 2 100 50 Record 3 150 150 …… …… ……

[0052] In Table 1, records 1 through 3 correspond to data change operations 1 through 3, respectively. The total value of record 1 is 0, indicating that record 1 is the first record written to the details database. Furthermore, under normal circumstances, the order in which data change records are written to the details database can be the same as the order in which the data change operations are generated; that is, normally, data change operation 1 is generated first, followed by data change operation 2, and then data change operation 3.

[0053] As can be seen from the data change record style illustrated in Table 1 above, the detailed database actually records the data change trajectory. It should also be noted that, since the systems and methods provided in the embodiments of this invention are applicable to detecting tampering with cumulative data, the data change amounts and the total data values ​​before and after the data change operation mentioned in the data change records of the embodiments of this invention all correspond to cumulative data.

[0054] Furthermore, based on Table 1 above, assuming that the first data change record is specifically record 1 in Table 1 and the second data change record is specifically record 2, the detection logic of the detection module is as follows: the sum of the total data value 0 in record 1 and the change amount 100 in record 1 is equal to the total data value 100 in record 2. Therefore, the detection module determines that record 1 has not been tampered with.

[0055] Optionally, the detailed database can be configured to have record writing and querying functions, but not record modification and deletion functions. Therefore, in addition to normal data change operations by users that write new data change records to the detailed database, when users directly operate on the detailed database to generate abnormal data change operations, that is, when the data in the detailed database is tampered with, the detailed database will also write the data change record corresponding to this abnormal data change operation.

[0056] When a data change record in the details database is tampered with, such as when the total value in record 1 is changed, a new record will be added to the details database, for example, record 1' will be added as follows, resulting in Table 2 as follows:

[0057] Table 2:

[0058] Data total (before operation) Change amount Record 1 0 100 Record 1' 200 100 Record 2 100 50 Record 3 150 150 …… …… ……

[0059] Since the sum of the total value 200 and the change 50 in record 1' is obviously not equal to the total value 100 in record 2, the detection module can determine that record 1' is a data change record that has been tampered with.

[0060] Following the above method, the detection module can also detect whether the second data change record has been tampered with based on the second and third data change records generated in sequence, and so on, to detect whether each record in the detailed database has been tampered with.

[0061] The above method allows for the detection of any data change record in the detailed database. The detection module's workflow can also be combined with... Figure 2 The flowchart shown is for understanding.

[0062] The detection system provided in this embodiment includes a data acquisition module for generating data change records, a detailed database containing data change records, and a detection module. The data change operation corresponds to cumulative data, and the data change record can include multiple data items: the amount of data change corresponding to the data change operation and the total data value before the data change operation. For the first and second data change records generated sequentially in the detailed database: if the sum of the total data value and the amount of data change in the first data change record equals the total data value in the second data change record, then the detection module can determine that the data in the first data change record has not been tampered with.

[0063] In the aforementioned system, a record format was designed whereby a single record contains the amount of data change corresponding to a data modification operation, as well as the total data value before the operation. Based on this record format, corresponding verification logic was designed, enabling the detection module to detect whether cumulative data has been tampered with by examining the data in two adjacent data modification records in the detailed database.

[0064] Furthermore, since at least one record in the detailed database can reflect the trajectory of cumulative data changes, any data change record in the detailed database can also be considered a trajectory data. The amount of data change in the data change record can reflect the magnitude of the cumulative data change, and the total data value can reflect the result of the cumulative data change.

[0065] Figure 1 In the illustrated embodiment, data change records are written to the detail database sequentially according to the order in which they are generated. However, in practice, considering the stability of data transmission between the data acquisition module and the detail database, the order in which data change records are written to the detail database may optionally differ from the order in which the data change operations are generated. For example, record 2 corresponding to data change operation 2 may be written to the database earlier than record 1 corresponding to data change operation 1.

[0066] To ensure the accuracy of data tampering detection, optionally, before executing the detection logic, the detection module can sort the data change records in the detailed database in ascending order according to their generation time, and then check whether the data in the detailed database has been tampered with according to the ascending sort results. Therefore, the generation time of the data change record can also be used as a field of the data change record, and the format of the data change record in the detailed database can also be as shown in Table 3 below:

[0067] Table 3:

[0068] Data total (before operation) Change amount Generation time Record 1 0 100 T1 Record 2 100 50 T2 Record 3 150 150 T3 …… …… ……

[0069] In this embodiment, sorting the data change records can improve the accuracy of data tampering detection.

[0070] Figure 1 As can be seen from the embodiments described, abnormal data change operations can be initiated by the detection party or the service provider, meaning that the detection party or the service provider can directly tamper with the data change records in the detailed database. To prevent the service provider or the detection party from tampering with the data in the detailed database, write permissions for the detailed database can optionally be set.

[0071] Specifically, in response to a data change operation, the data acquisition module can generate a first data write instruction containing the data change record. The detailed database, in response to this first data write instruction, determines the source of the instruction. If the first data write instruction was generated by the data acquisition module, it indicates that the data change record corresponds to a normal data change operation, and the data change record in the first instruction can be written to the detailed database. Optionally, the detailed database can store a first data source whitelist, which includes the data acquisition module. The detailed database can determine whether to write the data change record to the detailed database based on this first data source whitelist.

[0072] In this embodiment, a first data source whitelist is set in the detailed database so that only first-type data change records corresponding to normal data change operations generated by service users are written to the detailed database, thereby minimizing the possibility of tampering with the data in the detailed database by the detection party or the service provider. The whitelist stores various data sources that are allowed to write records to the detailed database.

[0073] Furthermore, in practice, the whitelist may become invalid. When the primary data source whitelist becomes invalid, the detection party or service provider can still directly tamper with the data in the detailed database, for example, changing Table 1 to Table 2. In this case, the detection module, based on its configured detection logic, can still detect whether the records in the detailed database have been tampered with. For the specific detection process, please refer to [link to relevant documentation]. Figure 1 The relevant content in the illustrated embodiments will not be repeated here.

[0074] comprehensive Figure 1-2 In the illustrated embodiment, corresponding data change records can be generated in the detail database in response to both normal and abnormal data change operations. The whitelist set in the detail database serves as a measure to prevent data tampering, effectively blocking data change records corresponding to abnormal data change operations, thereby reducing the possibility of direct data tampering in the detail database. When the whitelist fails, causing tampering of cumulative data in the detail database, the detection module can also detect whether data tampering has occurred using its own detection logic.

[0075] In practice, optionally, service providers can also maintain a total value database corresponding to the services they provide, so that service users can view relevant data, such as account balance, number of steps taken, etc.

[0076] but Figure 3 This is a schematic diagram of another data tampering detection system provided in an embodiment of the present invention. Figure 3 As shown, in Figure 1 Based on the system shown, the system may also include a total value database.

[0077] The data change records in the total value database can include the amount of data change corresponding to the data change operation and the total data value after the data change operation. The format of the data change records in the total value database can be shown in Table 4 below.

[0078] Table 4:

[0079] Data total (after operation) Change amount Record 1 100 100 Record 2 150 50 Record 3 300 150 …… …… ……

[0080] As shown in Tables 1 and 4, the data change records stored in the total value database and the detailed database have different formats. For the sake of brevity and clarity in the following description, the data change records in the detailed database can be referred to as the first type of data change records, and the data change records in the total value database can be referred to as the second type of data change records.

[0081] exist Figure 1 Based on the illustrated embodiment, in response to normal data change operations for cumulative data, the data acquisition module can also generate a second type of data change record, and then write the second type of data change record into the total value database. The data change records in the total value database can also be displayed to the service user.

[0082] For generating the second type of data change record, optionally, the data acquisition module can respond to a data change operation, determine the amount of data change corresponding to the data change operation, and then, based on the amount of data change corresponding to the data change operation and the total data value before the data change operation read from the total value database, determine the total data value after the data change operation. That is, the sum of the amount of data change corresponding to the data change operation and the total data value before the data change operation is determined as the total data value after the data change operation. Finally, a second type of data change record is generated, including the amount of data change and the total data value after the data change operation.

[0083] It should be noted that, according to Figure 1 and Figure 3As described in the illustrated embodiments, for normal data change operations generated by service users, the data acquisition module responds by generating a first type of data change record and a second type of data change record, and writes the different types of data change records into the corresponding databases. For abnormal data change operations, since these operations can be triggered directly by the service provider or the detection party, the data acquisition module will not detect them.

[0084] In this embodiment, in order to ensure service effectiveness, the service provider can also maintain a total value database, which can also write the change details and total value of cumulative data to facilitate service users to view.

[0085] In practice, to prevent service providers or testing parties from making abnormal data changes, that is, to prevent service providers or testing parties from tampering with the total value in the total value database, write permissions for the total value database can be set.

[0086] Specifically, in response to a data change operation, the data acquisition module can generate a second data write instruction, which includes a second type of data change record. The total value database then responds to this second data write instruction by determining its source. If the second data write instruction is generated by the data acquisition module, indicating that the data change record corresponds to a normal data change operation, the second type of data change record can be written to the total value database. Optionally, the total value database can store a second data source whitelist, which includes the data acquisition module. The total value database can then determine whether to write the total data value to the total value database based on this second data source whitelist.

[0087] In this embodiment, a second data source whitelist is set in the total value database so that only the second type of data change records corresponding to normal data change operations generated by the service user are written into the total value database, thereby minimizing the possibility of the detection party or service provider tampering with the data in the total value database.

[0088] Furthermore, in practice, the whitelist may become invalid. If the aforementioned second data source whitelist becomes invalid, the detection party or service provider can still directly tamper with the data in the total value database. In this case, the detection module, based on its configured detection logic, can still detect whether the records in the total value database have been tampered with. The specific detection process can be understood with the following example.

[0089] For example, the total value database can store Table 4 as described above. When the second data source whitelist becomes invalid, the service provider can change the total value of record 3 in Table 4 from 300 to 400. After record 3 is modified, a new data change operation occurs, and the second type of data change record corresponding to this latest data change operation (record 4 in Table 5) can also be updated in Table 4, resulting in Table 5. Simultaneously, the first type of data change record corresponding to this latest data change operation (record 4 in Table 6) can also be updated, resulting in Table 6 below.

[0090] Table 5:

[0091] Data total (after operation) Change amount Record 1 100 100 Record 2 150 50 Record 3 400 150 Record 4 500 100 …… …… ……

[0092] Table 6

[0093] Data total (before operation) Change amount Record 1 0 100 Record 2 100 50 Record 3 150 150 Record 4 400 100 …… …… ……

[0094] The generation process of record 4 in Table 5 is as follows: the data acquisition module obtains the data change amount corresponding to the latest data change operation as 100, and then reads the current total value of 400 (which has been tampered with) from the total value database. Then the total value of the value after the latest data change operation is 400 + 100 = 500.

[0095] The generation process of record 4 in Table 6 is as follows: the data acquisition module obtains the data change amount corresponding to the latest data change operation as 100, and then reads the current total value of 400 (which has been tampered with) from the total value database. At this time, record 4 can be obtained.

[0096] At this point, the detection module can perform the following analysis: The detection module can read records 3 and 4 from the detailed database. The sum of the total data value and the change in record 3 is obviously not equal to the total data value in record 4. Therefore, the detection module can detect that record 3 has been tampered with.

[0097] comprehensive Figure 3 In the illustrated embodiment, the whitelist set in the total value database can serve as a measure to prevent data tampering. Specifically, the whitelist can effectively block data change records corresponding to abnormal data change operations, thereby reducing the possibility of direct data tampering in the total value database. When the whitelist fails, causing data tampering in the total value database, the detection module can further detect whether data tampering has occurred using its own detection logic.

[0098] In practice, the detailed database and the total value database can be maintained by the detection party and the service provider respectively. Optionally, to improve the stability and reliability of the service, as well as the stability and reliability of data tampering detection, Figure 3The system shown can be further divided into a data processing subsystem and a data detection subsystem, thereby decoupling data processing and data detection. The data processing subsystem includes a data acquisition module and a total value database, while the data detection subsystem includes a detection module and a detailed database.

[0099] The data processing subsystem is used to provide services to service users. The decoupling between subsystems means that the data detection subsystem can access the data processing subsystem in a non-intrusive manner, so as to detect whether the cumulative data has been tampered with without affecting the normal provision of services.

[0100] For the decoupled data processing subsystem and data detection subsystem, optionally, in order to ensure that the detailed database can obtain the change amount corresponding to normal data change operations and the total data value after the data change, Figure 4 This is a schematic diagram of another data tampering detection system provided in an embodiment of the present invention. Figure 4 As shown, in Figure 3 Based on the system shown, the system may also include a data forwarding module. Furthermore, this data forwarding module is contained within the data detection subsystem.

[0101] The data acquisition module, in response to normal data change operations, can generate a first type of data change record and a second type of data change record. For the first type of data change record, the data acquisition module further forwards it to the data sending module, which then forwards the first type of data change record so that it is ultimately written into the detailed database.

[0102] In this embodiment, the data forwarding module can decouple the data processing subsystem and the data detection subsystem in the detection system, thereby ensuring the stability and reliability of each subsystem.

[0103] In addition, to ensure the security of data in the detailed database and the total value database, optionally, the service provider may have access to the total value database but not to the detailed database; the testing party may have access to the detailed database but not to the total value database.

[0104] The working process of the system provided in the above embodiments of the present invention can be described in detail below from the perspective of process.

[0105] Figure 5 This is a flowchart illustrating a data tampering detection method provided in an embodiment of the present invention. The method provided in this embodiment can be executed by the aforementioned data tampering detection system. Figure 5 As shown, the method may include the following steps:

[0106] S101, obtain the first data change record and the second data change record generated sequentially, wherein the change record is a first type of data change record generated in response to the data change operation, the data change operation corresponds to cumulative data, and the first type of data change record includes the data change amount of the cumulative data corresponding to the data change operation and the total data value of the cumulative data before the data change operation.

[0107] S102, if the sum of the total data value and the data change amount in the first data change record is equal to the total data value in the second data change record, then it is determined that the data in the first data change record has not been tampered with.

[0108] For cumulative data, in response to a data change operation, a first-type data change record can be generated, which can be stored in the detailed database. This first-type data change record includes the data change amount corresponding to the data change operation and the total data value before the data change operation. Furthermore, based on... Figure 1 As described in the illustrated embodiment, both normal and abnormal data changes will generate corresponding first-type data change records in the detail database. As data change operations accumulate, at least one first-type data change record will accumulate in the detail database.

[0109] For two adjacent data change records in the detailed database, namely the first data change record and the second data change record, if the sum of the total data value and the data change amount in the first data change record equals the total data value in the second data change record, then it is determined that the first data change record has not been tampered with. Following this method, each data change record in the detailed database can be checked to determine whether it has been tampered with.

[0110] Furthermore, the steps described above in this embodiment can be specifically executed by the detection module in the data tampering detection system. And for any content not described in detail in this embodiment, please refer to [link to relevant documentation]. Figure 1 The relevant descriptions in the illustrated embodiments will not be repeated here.

[0111] In this embodiment, the detailed database stores a first type of data change record. This first type of data change operation corresponds to cumulative data. The first data change record may include multiple data items, namely, the amount of data change corresponding to the data change operation and the total data value before the data change operation. For the first data change record and the second data change record generated sequentially in the detailed database, if the sum of the total data value and the amount of data change in the first data change record equals the total data value in the second data change record, then the detection module can determine that the data in the first data change record has not been tampered with.

[0112] In the aforementioned system, a record format was designed whereby a single record contains the amount of data change corresponding to a data modification operation, as well as the total data value before the operation. Based on this record format, corresponding verification logic was designed, enabling the detection module to detect whether cumulative data has been tampered with by examining the data in two adjacent data modification records in the detailed database.

[0113] Optionally, to further ensure the accuracy of data tampering detection, the first type of data change records in the detailed database can be sorted in ascending order according to their generation time, and the first and second data change records can be obtained from the ascending sort results.

[0114] Optionally, to ensure the data security of the detailed database, that is, to prevent the testing party or service provider from directly tampering with the data change records in the detailed database, write permissions for the detailed database can be set.

[0115] Specifically, the detailed database can store a whitelist of first data sources. The detailed database can then receive a first data write instruction containing first-type data change records and determine the source of that instruction. If the source of the first data write instruction is included in the first data source whitelist, it indicates that the instruction was generated by the data acquisition module, and that the first-type data change record corresponds to a normal data change operation. Therefore, the first-type data change record in the first data instruction can be written into the detailed database.

[0116] In this embodiment, a first data source whitelist is set in the detailed database so that only first-type data change records corresponding to normal data change operations generated by service users are written to the detailed database, thereby minimizing the possibility of tampering with the data in the detailed database by the detection party or the service provider. Furthermore, when the first data source whitelist fails, the detection module can still detect whether the records in the detailed database have been tampered with based on its configured detection logic. For specific detection logic, please refer to [link to relevant documentation]. Figure 1 The relevant descriptions in the illustrated embodiments are provided above. Additionally, for any content not described in detail in this embodiment and the technical effects achieved, please refer to the above descriptions. Figure 1-2 The relevant content in the illustrated embodiments will not be repeated here.

[0117] according to Figure 3 As shown in the illustrated embodiment, the service provider can also maintain the total value database corresponding to the services provided, so that service users can view the relevant data. To ensure the data security of this total value database, that is, to prevent the testing party or service provider from directly tampering with the data change records in the total value database, write permissions can optionally be set for the total value database.

[0118] Specifically, the total value database can store a whitelist of second data sources. The total value database can then receive a second data write instruction containing second-type data change records and determine the source of that instruction. If the source of the second data write instruction is included in the second data source whitelist, it indicates that the instruction was generated by the data acquisition module, and that the second-type data change record corresponds to a normal data change operation. Therefore, the second-type data change record in the second data instruction can be written into the total value database.

[0119] The second type of data change record can be generated by first determining the total data value after the data change operation based on the amount of data change corresponding to the data change operation and the total data value before the operation. It's easy to understand that the sum of the data change amount and the total data value before the operation is the total data value after the operation. Ultimately, a second type of data change record containing both the data change amount and the total data value after the operation can be generated.

[0120] In this embodiment, a whitelist is set in the total value database so that only second-type data change records corresponding to normal data change operations generated by service users are written to the total value database, thereby minimizing the possibility of the detection party or service provider tampering with the data in the detailed database. Furthermore, when the second data source whitelist fails, the detection module can still detect whether the records in the detailed database have been tampered with based on its configured detection logic.

[0121] Furthermore, the contents not described in detail in this embodiment and the technical effects that can be achieved can be found in the relevant descriptions in the above embodiments, and will not be repeated here.

[0122] The data tampering detection apparatus of one or more embodiments of the present invention will be described in detail below. Those skilled in the art will understand that the apparatus can be configured using commercially available hardware components through the steps taught in this solution.

[0123] Figure 6 This is a schematic diagram of the structure of a data tampering detection device provided in an embodiment of the present invention, as shown below. Figure 6 As shown, the device includes:

[0124] The acquisition module 11 is used to acquire the first data change record and the second data change record generated sequentially. The change record is a first type of data change record generated in response to a data change operation. The data change operation corresponds to cumulative data. The first type of data change record includes the data change amount of the cumulative data corresponding to the data change operation and the total data value of the cumulative data before the data change operation.

[0125] The detection module 12 is used to determine that the data in the first data change record has not been tampered with if the sum of the total data value and the data change amount in the first data change record is equal to the total data value in the second data change record.

[0126] Optionally, the device further includes: a record generation module 13, configured to determine the amount of data change corresponding to the data change operation in response to the data change operation;

[0127] Based on the amount of data change and the total data value before the data change operation, the first type of data change record is generated.

[0128] Optionally, the detailed database stores a whitelist of first data sources.

[0129] The device further includes an instruction generation module 14, used to generate a first data write instruction containing the first type of data change record.

[0130] The detection module 11 is used to write the first type of data change record into the detailed database if the source of the first data writing instruction is included in the first data source whitelist.

[0131] Optionally, the record generation module 13 is used to determine the total value of the cumulative data after the data change operation based on the amount of data change corresponding to the data change operation and the total value of the data before the data change operation.

[0132] A second type of data change record is generated based on the amount of data change corresponding to the data change operation and the total data value after the data change operation.

[0133] The instruction generation module 14 is used to generate a second data write instruction containing the second type of data change record.

[0134] The detection module 12 is used to write the second type of data change record into the total value database if the source of the second data writing instruction is included in the second data source whitelist, so as to display the second type of data change record. The total value database stores the second data source whitelist.

[0135] Optionally, the device further includes a sorting module 15, used to sort the first type of data change records in ascending order according to the generation time of the first type of data change records;

[0136] Retrieve the first data change record and the second data change record from the ascending sort results.

[0137] Figure 6The device shown can perform Figure 5 For the methods shown in the embodiments, the parts not described in detail in this embodiment can be referred to the following: Figure 5 The relevant descriptions of the illustrated embodiments are provided below. For the execution process and technical effects of this technical solution, please refer to [link / reference]. Figure 5 The descriptions in the illustrated embodiments will not be repeated here.

[0138] In one possible design, the data tampering detection methods provided in the above embodiments can be applied to an electronic device, such as... Figure 7 As shown, the electronic device may include a processor 21 and a memory 22. The memory 22 is used to store data that supports the electronic device in performing the above-described actions. Figure 5 The program of the data tampering detection method provided in the illustrated embodiment is such that the processor 21 is configured to execute the program stored in the memory 22.

[0139] The program includes one or more computer instructions, wherein when the one or more computer instructions are executed by the processor 21, they can perform the following steps:

[0140] Obtain the first data change record and the second data change record generated sequentially. The change record is a first type of data change record generated in response to a data change operation. The data change operation corresponds to cumulative data. The first type of data change record includes the amount of data change of the cumulative data corresponding to the data change operation and the total value of the cumulative data before the data change operation.

[0141] If the sum of the total data value and the amount of data change in the first data change record is equal to the total data value in the second data change record, then it is determined that the data in the first data change record has not been tampered with.

[0142] Optionally, the processor 21 is further configured to perform the aforementioned Figure 5 All or part of the steps in the illustrated embodiments.

[0143] The structure of the electronic device may also include a communication interface 23 for the electronic device to communicate with other devices or communication networks.

[0144] Furthermore, embodiments of the present invention provide a non-transitory machine-readable storage medium for storing computing unit instructions used in the aforementioned electronic device, which includes instructions for executing the above-mentioned... Figure 5 The procedure involved in data tampering detection is shown.

[0145] In addition, embodiments of the present invention provide a computer program product. This computer program product includes a computer program or instructions. When the computer program or instructions are executed by a processor, the processor is able to perform the above-described functions. Figure 5The steps or functions of the data tampering detection method are shown.

[0146] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data tampering detection system, characterized by, The system comprises: a detail database, a data collection module and a detection module; the data collection module is configured to generate a first type of data change record in response to a data change operation; write the first type of data change record into the detail database; wherein the data change operation corresponds to cumulative data, and the first type of data change record comprises a data change amount of the cumulative data corresponding to the data change operation and a total data value of the cumulative data before the data change operation; the detection module is configured to obtain a first data change record and a second data change record generated in sequence from the first type of data change record stored in the detail database; and if the sum of the total data value and the data change amount in the first data change record is equal to the total data value in the second data change record, it is determined that the data in the first data change record has not been tampered with.

2. The system of claim 1, wherein, The detail database stores a first data source whitelist, and the first data source whitelist comprises the data collection module; the detail database is configured to determine the source of a first data write instruction in response to the first data write instruction, and the first data write instruction comprises the first type of data change record; if the first data write instruction is generated by the data collection module, store the first type of data change record in the first data write instruction.

3. The system of claim 1, wherein, The system further comprises a total value database; the data collection module is configured to generate a second type of data change record in response to the data change operation, and the second type of data change record comprises a data change amount of the cumulative data corresponding to the data change operation and a total data value of the cumulative data after the data change operation; write the second type of data change record into the total value database to display the second type of data change record.

4. The system of claim 3, wherein, The total value database records a second data source whitelist; and the second data source whitelist comprises the data collection module; the total value database is configured to determine the source of a second data write instruction in response to the second data write instruction, and the second data write instruction comprises the second type of data change record; if the second data write instruction is generated by the data collection module, store the second type of data change record in the second data write instruction.

5. The system of claim 3, wherein, The system comprises a data processing subsystem and a data detection subsystem; the data processing subsystem comprises the data collection module and the total value database; the data detection subsystem comprises the detection module and the detail database.

6. The system of claim 5, wherein, The data detection subsystem further comprises a data forwarding module; the data collection module is configured to send the first type of data change record to the data forwarding module; the data forwarding module is configured to send the received first type of data change record to the detail database.

7. The system of any one of claims 1 to 6, wherein, The first type of data change record further comprises a generation time of the first type of data change record; the detection module is configured to sort the first type of data change record in the detail database in ascending order according to the generation time of the first type of data change record; obtaining the first data change record and the second data change record from the ascendingly sorted results.

8. A data tampering detection system, characterized by, The method comprises: a data processing subsystem and a data detection subsystem; the data processing subsystem comprises a data collection module and a total value database; the data detection subsystem comprises a data forwarding module, a detection module and a detailed database; the data collection module is configured to, in response to a data change operation, generate a first type of data change record and a second type of data change record corresponding to the data change operation; send the first type of data change record and the second type of data change record, wherein the data change operation corresponds to cumulative data, the first type of data change record comprises a data change amount of the cumulative data corresponding to the data change operation and a total value of the cumulative data before the data change operation, and the second type of data change record comprises a data change amount of the cumulative data corresponding to the data change operation and a total value of the cumulative data after the data change operation; and write the second type of data change record into the total value database to show the second type of data change record; the data forwarding module is configured to receive the first type of data change record sent by the data collection module; and write the first type of data change record into the detailed database; the detection module is configured to obtain a first data change record and a second data change record generated in sequence from the first type of data change record stored in the detailed database; and if a sum of a total value and a data change amount in the first data change record is equal to a total value in the second data change record, determine that the data in the first data change record has not been tampered with.

9. A data tamper detection method characterized by, The method comprises: obtaining a first data change record and a second data change record generated in sequence, wherein the change record is a first type of data change record generated in response to a data change operation, the data change operation corresponds to cumulative data, and the first type of data change record comprises a data change amount of the cumulative data corresponding to the data change operation and a total value of the cumulative data before the data change operation; if a sum of a total value and a data change amount in the first data change record is equal to a total value in the second data change record, determining that the data in the first data change record has not been tampered with.

10. The method of claim 9, wherein, The method further comprises: in response to the data change operation, determining a data change amount corresponding to the data change operation; generating the first type of data change record according to the data change amount and a total value of data before the data change operation.

11. The method of claim 10, wherein, The detailed database stores a first data source whitelist; the method further comprises: generating a first data write instruction containing the first type of data change record; if a source of the first data write instruction is contained in the first data source whitelist, writing the first type of data change record into the detailed database.

12. The method of claim 10, wherein, After determining the data change amount corresponding to the data change operation, the method further comprises: determining a total value of the cumulative data after the data change operation according to the data change amount corresponding to the data change operation and the total value of the data before the data change operation; generating a second type of data change record according to the data change amount corresponding to the data change operation and the total value of the data after the data change operation; generating a second data write instruction containing the second type of data change record; if the source of the second data write instruction is included in a second data source whitelist, writing the second type of data change record to the total value database to display the second type of data change record, the total value database storing the second data source whitelist.

13. The method according to any one of claims 9 to 12, characterized in that, The method further comprises: sorting the first type of data change record in ascending order according to the generation time of the first type of data change record; obtaining the first data change record and the second data change record from the ascending order sorting result.

14. An electronic device, comprising: comprise: a memory and a processor, wherein the memory stores executable code, and when the executable code is executed by the processor, the processor executes the data tampering detection method according to any one of claims 9 to 13.

15. A non-transitory machine-readable storage medium, comprising: The non-transitory machine-readable storage medium stores executable code, and when the executable code is executed by the processor of the electronic device, the processor executes the data tampering detection method according to any one of claims 9 to 13.

16. A computer program product, characterised in that, The computer program product comprises a computer program or instructions, which enable the computer program or instructions to implement the steps in the data tampering detection method according to any one of claims 9 to 13.

Images