Data storage method and device, electronic equipment, storage medium and program product

Abstract

The invention provides a data storage method and device, electronic equipment, a storage medium and a program product, relates to the technical field of information security, and is used for improving the credibility of data. The method comprises the steps that the data storage device obtains to-be-stored data, the to-be-stored data comprises N data units, and N is a positive integer larger than 1; the method comprises the following steps: receiving N data units, generating a signature string corresponding to the first data unit in the N data units, and generating a signature string corresponding to the ith data unit according to the ith data unit in the N data units and the signature string corresponding to the (i-1) th data unit in the N data units, i being a positive integer greater than 1 and less than or equal to N; according to each data unit and the signature string corresponding to each data unit, generating a signature data unit; and the data storage device associatively stores each data unit, the signature string corresponding to each data unit and the signature data unit corresponding to each data unit.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to a data storage method and device, electronic equipment, a storage medium and a program product. BACKGROUND

[0002] At present, when a data storage device stores data, the data can be encrypted by using a key, and the encrypted data is stored in the data storage device, so that only a user holding the key can use the key to decrypt the encrypted data in the data storage device to modify the data.

[0003] However, since the above-mentioned key leakage may occur, other users can also use the key to decrypt the encrypted data in the data storage device and modify the data, so that the tamper resistance of the encrypted data in the data storage device cannot be ensured, and thus the credibility of the data is low. SUMMARY

[0004] The present application provides a data storage method and device, electronic equipment, a storage medium and a program product, which are used to improve the credibility of data.

[0005] In a first aspect, the present application provides a data storage method, comprising: a data storage device acquiring to-be-stored data, the to-be-stored data comprising N data units, N being a positive integer greater than 1; and generating a signature string corresponding to a first data unit in the N data units, and generating a signature string corresponding to an i-th data unit in the N data units according to a signature string corresponding to an (i-1)-th data unit in the N data units and the i-th data unit, i being a positive integer greater than 1 and less than or equal to N; and generating a signature data unit according to each data unit and the signature string corresponding to each data unit, respectively; so that the data storage device stores each data unit, the signature string corresponding to each data unit and the signature data unit corresponding to each data unit in association.

[0006] The technical scheme provided by the present application at least brings the following beneficial effects: When a data storage device acquires data to be stored comprising N data units, it can generate a signature string corresponding to the first data unit among the N data units. Furthermore, based on the signature strings corresponding to the i-th data unit and the (i-1)-th data unit among the N data units, it can generate a signature string corresponding to the i-th data unit. This allows the signature string corresponding to the i-th data unit to be associated with the signature strings corresponding to the i-th and (i-1)-th data units. Additionally, the data storage device can generate a signature data unit based on each data unit and its corresponding signature string, thus associating each signature data unit with each data unit and its corresponding signature string. Therefore, after associating and storing each data unit, its corresponding signature string, and its corresponding signature data unit, when other users want to modify a certain data unit, in addition to modifying that data unit, they also need to modify the corresponding signature string, the corresponding signature data unit, the signature string of the data unit following that data unit, and the corresponding signature data unit of the data unit following that data unit. This significantly increases the difficulty of modifying that data unit and reduces the probability of N data units being tampered with, thus improving data trustworthiness.

[0007] One possible implementation, the above-mentioned generation of the signature string corresponding to the first data unit among N data units, includes: the data storage device performing a hash operation on the first string to obtain the signature string corresponding to the first data unit.

[0008] Another possible implementation, as described above, generates the signature string corresponding to the i-th data unit based on the signature string corresponding to the i-th data unit and the (i-1)-th data unit among the N data units, including: the data storage device performs a hash operation on the i-th data unit to obtain a second string; and generates the signature string corresponding to the i-th data unit based on the second string and the signature string corresponding to the (i-1)-th data unit.

[0009] Another possible implementation, which generates the signature string corresponding to the i-th data unit based on the second string and the signature string corresponding to the (i-1)-th data unit, includes: the data storage device combining the second string and the signature string corresponding to the (i-1)-th data unit to obtain the third string; and performing a hash operation on the third string to obtain the signature string corresponding to the i-th data unit.

[0010] Another possible implementation, after associating and storing each data unit, the signature string corresponding to each data unit, and the signature data unit corresponding to each data unit, the method further includes: the data storage device acquiring a data request message, which requests the use of N data units to perform a target operation; and, based on the data query request message, acquiring the stored N data units, the signature string corresponding to the N data units, and the signature data units corresponding to the N data units; and, based on the N data units, the signature string corresponding to the N data units, and the signature data units corresponding to the N data units, determining whether the N data units have been tampered with; and thus, if the N data units have not been tampered with, using the N data units to perform the target operation.

[0011] Another possible implementation, based on N data units, the signature strings corresponding to the N data units, and the signature data units corresponding to the N data units, determines whether the N data units have been tampered with. This includes: the data storage device determining whether the data content of each of the N data units has changed based on each data unit, the signature string corresponding to each of the N data units, and the signature data unit corresponding to each of the N data units; and determining whether any data unit in the N data units has been deleted based on the j-th data unit, the signature string corresponding to the j-th data unit, and the signature string corresponding to the (j-1)-th data unit in the N data units, where j is a positive integer greater than 1 and less than or equal to N; and determining that the N data units have not been tampered with if the data content of each data unit in the N data units has not changed and no data unit in the N data units has been deleted; otherwise, determining that the N data units have been tampered with.

[0012] Another possible implementation involves determining whether the data content of each of the N data units has changed based on each data unit in the N data units, the signature string corresponding to each data unit in the N data units, and the signature data unit corresponding to each data unit in the N data units. This includes: the data storage device generating a signature data unit to be verified based on any one of the N data units and the signature string corresponding to that data unit; and if the signature data unit to be verified matches the signature data unit corresponding to that data unit, determining that the data content of that data unit has not changed; otherwise, determining that the data content of that data unit has changed.

[0013] Another possible implementation, as described above, determines whether any data unit in the N data units has been deleted based on the j-th data unit, the signature string corresponding to the j-th data unit, and the signature string corresponding to the (j-1)-th data unit in the N data units. This includes: the data storage device performing a hash operation on the j-th data unit to obtain a fourth string; generating a signature string to be verified based on the fourth string and the signature string corresponding to the (j-1)-th data unit; and determining that no data unit in the N data units has been deleted if the signature string to be verified matches the signature string corresponding to the j-th data unit, otherwise determining that a data unit in the N data units has been deleted.

[0014] Another possible implementation involves generating a signature data unit based on each data unit and its corresponding signature string, including: the data storage device using the signature string corresponding to any one of the N data units to sign and encrypt that data unit, thereby generating the signature data unit corresponding to that data unit.

[0015] Secondly, this application provides a data storage device, comprising: an acquisition module, configured to acquire data to be stored, the data to be stored comprising N data units, where N is a positive integer greater than 1; a generation module, configured to generate a signature string corresponding to the first data unit among the N data units acquired by the acquisition module, and to generate a signature string corresponding to the i-th data unit based on the signature strings corresponding to the i-th data unit and the (i-1)-th data unit among the N data units acquired by the acquisition module, where i is a positive integer greater than 1 and less than or equal to N; and to generate a signature data unit based on each data unit and the signature string corresponding to each data unit; and a storage module, configured to associate and store each data unit, the signature string corresponding to each data unit generated by the generation module, and the signature data unit corresponding to each data unit generated by the generation module.

[0016] One possible implementation is that the aforementioned generation module is specifically used to perform a hash operation on the first string to obtain the signature string corresponding to the first data unit.

[0017] Another possible implementation is that the above-mentioned generation module is specifically used to perform a hash operation on the i-th data unit to obtain the second string; and based on the second string and the signature string corresponding to the (i-1)-th data unit, to generate the signature string corresponding to the i-th data unit. The above-mentioned generation module is specifically used to combine the second string and the signature string corresponding to the (i-1)-th data unit to obtain the third string; and to perform a hash operation on the third string to obtain the signature string corresponding to the i-th data unit.

[0018] In another possible implementation, the aforementioned acquisition module is further configured to, after the storage module associates and stores each data unit, the signature string corresponding to each data unit, and the signature data unit corresponding to each data unit, acquire a data request message. This data request message is used to request the use of N data units to perform a target operation. And, based on the data query request message, acquire the stored N data units, the signature string corresponding to the N data units, and the signature data units corresponding to the N data units. The data storage device provided in this application embodiment further includes a determination module and an execution module. The determination module is configured to determine whether the N data units have been tampered with based on the N data units, the signature string corresponding to the N data units, and the signature data units corresponding to the N data units acquired by the acquisition module. If the determination module determines that the N data units have not been tampered with, the execution module is configured to use the N data units to perform the target operation.

[0019] Another possible implementation is that the aforementioned determining module is specifically used to determine whether the data content of each of the N data units has changed based on each data unit in the N data units, the signature string corresponding to each of the N data units, and the signature data unit corresponding to each of the N data units; and to determine whether any data unit in the N data units has been deleted based on the j-th data unit in the N data units, the signature string corresponding to the j-th data unit, and the signature string corresponding to the (j-1)-th data unit in the N data units, where j is a positive integer greater than 1 and less than or equal to N; and, if the data content of each of the N data units has not changed and no data unit in the N data units has been deleted, to determine that the N data units have not been tampered with; otherwise, to determine that the N data units have been tampered with.

[0020] In another possible implementation, the aforementioned generation module is further configured to generate a signature data unit to be verified based on any one of the N data units and the signature string corresponding to that data unit. Specifically, the aforementioned determining module is configured to determine that the data content of that data unit has not changed if the signature data unit to be verified generated by the generation module matches the signature data unit corresponding to that data unit; otherwise, it determines that the data content of that data unit has changed.

[0021] In another possible implementation, the aforementioned generation module is further configured to perform a hash operation on the j-th data unit to obtain a fourth string; and based on the fourth string and the signature string corresponding to the (j-1)-th data unit, generate a signature string to be verified. Specifically, the aforementioned determining module is configured to determine that if the signature string to be verified generated by the generation module matches the signature string corresponding to the j-th data unit, then there are no deleted data units among the N data units; otherwise, it determines that there are deleted data units among the N data units.

[0022] Another possible implementation is that the above-mentioned generation module is specifically used to sign and encrypt any one of the N data units using the signature string corresponding to that data unit, thereby generating a signature data unit corresponding to that data unit.

[0023] Thirdly, this application provides an electronic device comprising: a processor and a memory; the memory storing processor-executable instructions; when the processor is configured to execute the instructions, causing the electronic device to implement the method of the first aspect described above.

[0024] Fourthly, this application provides a computer-readable storage medium comprising: computer software instructions; which, when executed in an electronic device, cause the electronic device to implement the method described in the first aspect.

[0025] Fifthly, this application provides a computer program product comprising a computer program; when the computer program is run in an electronic device, it causes the electronic device to implement the method described in the first aspect.

[0026] The beneficial effects of the second to fifth aspects mentioned above are described in the corresponding description of the first aspect and will not be repeated here. Attached Figure Description

[0027] Figure 1 This is a schematic diagram illustrating the application environment of a data storage method provided in an embodiment of this application; Figure 2 A flowchart illustrating a data storage method provided in an embodiment of this application; Figure 3 A flowchart illustrating another data storage method provided in an embodiment of this application; Figure 4 A flowchart illustrating yet another data storage method provided in an embodiment of this application; Figure 5 A flowchart illustrating yet another data storage method provided in an embodiment of this application; Figure 6 A flowchart illustrating yet another data storage method provided in an embodiment of this application; Figure 7 A flowchart illustrating yet another data storage method provided in an embodiment of this application; Figure 8 A flowchart illustrating yet another data storage method provided in an embodiment of this application; Figure 9 A flowchart illustrating yet another data storage method provided in an embodiment of this application; Figure 10A flowchart illustrating yet another data storage method provided in an embodiment of this application; Figure 11 A flowchart illustrating yet another data storage method provided in an embodiment of this application; Figure 12 A flowchart illustrating yet another data storage method provided in an embodiment of this application; Figure 13 A flowchart illustrating yet another data storage method provided in an embodiment of this application; Figure 14 This is a schematic diagram illustrating the composition of a data storage device provided in an embodiment of this application; Figure 15 This is a schematic diagram of the composition of an electronic device provided in an embodiment of this application. Detailed Implementation

[0028] The following is a detailed description of a call detail record (CDR) data recording method provided in this application, with reference to the accompanying drawings.

[0029] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0030] The terms "first" and "second," etc., used in the specification and drawings of this application are used to distinguish different objects or to distinguish different treatments of the same object, rather than to describe a specific order of objects.

[0031] Furthermore, the terms "comprising" and "having," and any variations thereof, used in the description of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0032] It should be noted that in the embodiments of this application, the words "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplarily" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplarily" or "for example" is intended to present the relevant concepts in a specific manner.

[0033] To facilitate a clear description of the technical solutions of the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish the same or similar items with essentially the same function and effect. Those skilled in the art can understand that the terms "first" and "second" are not intended to limit the quantity or execution order.

[0034] In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0035] The data storage method, apparatus, electronic device, storage medium, and program product provided in this application are applied to data storage scenarios. For example, they are applied to carbon source data storage scenarios.

[0036] Currently, when data is stored in a data storage device, a key can be used to encrypt the data, and the encrypted data can be stored in the data storage device. Only users who possess the key can use the key to decrypt the encrypted data in the data storage device and modify the data.

[0037] However, due to the potential for key leakage, other users could also use the key to decrypt and modify the encrypted data in the data storage device. This compromises the immutability of the encrypted data, resulting in low data reliability. Furthermore, blockchain technology can be used to verify, reach consensus on, and store carbon emission data through multiple consensus nodes, ensuring data transparency and immutability during use, thus guaranteeing the authenticity and reliability of the carbon source data. However, blockchain technology suffers from low transaction throughput, high transaction confirmation latency, and high storage costs, leading to inconvenience in data storage and use.

[0038] To address the aforementioned technical problems, this application provides a data storage method, apparatus, electronic device, storage medium, and program product. The approach involves: the data storage apparatus acquiring data to be stored, which includes N data units, where N is a positive integer greater than 1; generating a signature string corresponding to the first data unit among the N data units; and generating a signature string corresponding to the i-th data unit based on the signature strings corresponding to the i-th and (i-1)-th data units among the N data units, where i is a positive integer greater than 1 and less than or equal to N; and generating a signature data unit based on each data unit and its corresponding signature string; thereby, the data storage apparatus associates and stores each data unit, its corresponding signature string, and its corresponding signature data unit.

[0039] The technical solution provided in this application brings at least the following beneficial effects: In this solution, when the data storage device obtains data to be stored including N data units, it can generate a signature string corresponding to the first data unit among the N data units, and generate a signature string corresponding to the i-th data unit based on the signature strings corresponding to the i-th data unit and the (i-1)-th data unit among the N data units. This allows the signature string corresponding to the i-th data unit to be associated with the signature strings corresponding to the i-th data unit and the (i-1)-th data unit. Furthermore, the data storage device can also generate a signature data unit based on each data unit and the signature string corresponding to each data unit, thus allowing each signature data unit to be associated with each data unit and the signature string corresponding to each data unit. Therefore, after associating and storing each data unit, its corresponding signature string, and its corresponding signature data unit, when other users want to modify a certain data unit, in addition to modifying that data unit, they also need to modify the corresponding signature string, the corresponding signature data unit, the signature string of the data unit following that data unit, and the corresponding signature data unit of the data unit following that data unit. This significantly increases the difficulty of modifying that data unit and reduces the probability of N data units being tampered with, thus improving data trustworthiness.

[0040] Furthermore, the embodiments of this application can improve the credibility of data without using blockchain technology, thus avoiding the problems of low transaction throughput, high transaction confirmation delay, and high storage cost of blockchain technology, thereby improving the convenience of data storage.

[0041] The embodiments provided in this application will now be described in detail with reference to the accompanying drawings.

[0042] The data storage method provided in this application can be applied to, for example... Figure 1 The application environment shown. For example... Figure 1 As shown, the application environment includes a data storage device 101 and a front-end device 102. The data storage device 101 and the front-end device 102 are interconnected.

[0043] In some embodiments, the data storage device 101 may be a server cluster consisting of multiple servers, a single server, a computer, or a processor or processing chip in a server or computer, etc. This application does not limit the specific device form of the data storage device 101. Figure 1 The example shown is a data storage device 101 as a single server.

[0044] In some embodiments, the front-end device 102 can be a device with wireless transceiver capabilities, such as a mobile phone, tablet computer, wearable device, in-vehicle device, augmented reality (AR) / virtual reality (VR) device, laptop computer, ultra-mobile personal computer (UMPC), netbook, personal digital assistant (PDA), etc. This application embodiment does not limit the specific device form of the front-end device 102. Figure 1 The example shown is a mobile phone terminal, with the front-end device 102 as the example.

[0045] In some embodiments, assuming the data is carbon source data, if the auditor approves the carbon source data, the auditor can send an approval instruction to the data storage device 101 through the front-end device 102. The approval instruction includes the data to be stored, so the data storage device 101 can obtain the data to be stored, which includes N data units, where N is a positive integer greater than 1; and generate a signature string corresponding to the first data unit among the N data units, and generate a signature string corresponding to the i-th data unit based on the signature strings corresponding to the i-th data unit and the (i-1)-th data unit among the N data units, where i is a positive integer greater than 1 and less than or equal to N; and generate a signature data unit based on each data unit and the signature string corresponding to each data unit; thus, the data storage device associates and stores each data unit, the signature string corresponding to each data unit, and the signature data unit corresponding to each data unit.

[0046] It should be noted that the system architecture described in the embodiments of this application is for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and does not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of system architecture, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0047] See Figure 2 This is a flowchart illustrating a data storage method provided in an embodiment of this application. Figure 2 As shown, the data storage method provided in this application can be implemented by the above-mentioned data storage device, specifically including the following steps S201~S204.

[0048] S201, The data storage device acquires the data to be stored.

[0049] In this embodiment of the application, the data to be stored includes N data units, where N is a positive integer greater than 1.

[0050] In some embodiments of this application, the data to be stored may include, but is not limited to, carbon source data.

[0051] In some embodiments of this application, the above-mentioned N data units can be a row of data, a column of data, or a segment of data to be stored.

[0052] In some embodiments of this application, if the reviewer approves the data to be stored, a review approval instruction can be sent to the data storage device through the front-end device, and the review approval instruction includes the data to be stored.

[0053] S202. The data storage device generates a signature string corresponding to the first data unit among N data units, and generates a signature string corresponding to the i-th data unit based on the signature strings corresponding to the i-th data unit and the (i-1)-th data unit among N data units.

[0054] In this embodiment of the application, i is a positive integer greater than 1 and less than or equal to N.

[0055] In some embodiments of this application, the signature string may include at least one signature character, and each signature character may include, but is not limited to, any of the following: text, numbers, symbols, letters, etc.

[0056] In some embodiments of this application, the length of the signature string corresponding to each data unit may be the same or different. The length of the signature string can be understood as the number of signature characters included in the signature string.

[0057] In some embodiments of this application, the data storage device can generate a signature string corresponding to the first data unit among N data units through a data signature generation module, and generate a signature string corresponding to the i-th data unit based on the signature strings corresponding to the i-th data unit and the (i-1)-th data unit among N data units.

[0058] In some instances, the data storage device can call the interface of the data signature generation module and submit N data units to the interface. The data signature generation module can then generate a signature string corresponding to the first data unit among the N data units, and generate a signature string corresponding to the i-th data unit based on the signature strings corresponding to the i-th data unit and the (i-1)-th data unit among the N data units.

[0059] In some embodiments of this application, the data storage device performs a hash operation using a string (such as the first string in the embodiments below) to generate a signature string corresponding to the first data unit; alternatively, the data storage device can obtain at least one random number and concatenate the results based on the at least one random number to generate a signature string corresponding to the first data unit; or, the data storage device can use a preset correspondence to convert each data content in the first data unit into a corresponding character to generate a signature string corresponding to the first data unit. Here, the preset correspondence is the correspondence between data content and characters.

[0060] For example, assuming the first data unit is "AABBCCDD", the preset correspondence includes: A corresponds to a1, B corresponds to a2, C corresponds to b1, and D corresponds to b2. Thus, the data storage device can generate the signature string corresponding to the first data unit, namely a1a1a2a2b1b1b2b2.

[0061] Taking the example of a data storage device using characters to perform a hash operation to generate the signature string corresponding to the first data unit: In some instances, combined Figure 2 ,like Figure 3 As shown, the above S202 can be specifically implemented through the following S2021.

[0062] S2021. The data storage device performs a hash operation on the first string to obtain the signature string corresponding to the first data unit, and generates the signature string corresponding to the i-th data unit based on the signature strings corresponding to the i-th data unit and the (i-1)-th data unit among the N data units.

[0063] Optionally, the first string mentioned above may include, but is not limited to, at least one of the following: a default string, a random string, or a string corresponding to the data content of the first data unit.

[0064] Specifically, if the first string includes a default string, the data storage device can first obtain the default string from the data storage device and then perform a hash operation on the default string; if the first string includes a random string, the data storage device can first randomly generate a random string of a predetermined length and then perform a hash operation on the random string; if the first character includes a string corresponding to the data content of the first data unit, the data storage device can obtain the character corresponding to each data content of the first data unit, obtain the string corresponding to the data content of the first data unit, and perform a hash operation on the string.

[0065] Optionally, the data storage device can perform a hash operation on the first string in a Trusted Execution Environment (TEE) to obtain the signature string corresponding to the first data unit, thereby improving the security of generating the signature string corresponding to the first data unit.

[0066] Optionally, the data storage device may employ a hash algorithm to perform a hash operation on the first string. The hash algorithm may include, but is not limited to, at least one of the following: MD5 algorithm, SHA-1 algorithm, SHA-256 algorithm, SHA-512 algorithm, etc.

[0067] It should be noted that for the descriptions of the MD5, SHA-1, SHA-256 and SHA-512 algorithms mentioned above, please refer to the specific descriptions in the relevant technologies. The embodiments of this application will not be repeated here.

[0068] It is understandable that the data storage device can determine the hash value obtained by hashing the first string as the signature string corresponding to the first data unit.

[0069] Therefore, since the data storage device can perform a hash operation on the first string, it ensures two things: firstly, the signature string corresponding to the first data unit can be associated with the first string, facilitating verification of the signature string in subsequent steps; secondly, it ensures that the signature string corresponding to the first data unit is of a fixed length, making it easier to ensure that the length of the signature string corresponding to the first data unit is the same as the length of the signature strings corresponding to other data units, thus facilitating the subsequent verification process. This improves the ease of use for subsequent verification.

[0070] In some instances, combined Figure 2 ,like Figure 4 As shown, the above S202 can be specifically implemented through the following S2022 and S2023.

[0071] S2022. The data storage device generates a signature string corresponding to the first data unit among N data units, and performs a hash operation on the i-th data unit to obtain the second string.

[0072] It should be noted that the explanation of how the data storage device generates the signature string corresponding to the first data unit among N data units can be found in the specific description in the above embodiments, and will not be repeated here in the embodiments of this application.

[0073] Optionally, the data storage device can perform a hash operation on the i-th data unit in the TEE to obtain the second string, thereby improving the security of generating the second string.

[0074] Optionally, the data storage device can obtain the character corresponding to each data content of the i-th data unit, obtain the string corresponding to the data content of the i-th data unit, and perform a hash operation on the string to obtain the second string.

[0075] It is understandable that the data storage device can determine the second string by performing a hash operation on the string corresponding to the data content of the i-th data unit.

[0076] S2023. The data storage device generates a signature string corresponding to the i-th data unit based on the second string and the signature string corresponding to the (i-1)-th data unit.

[0077] Optionally, the data storage device can perform mathematical operations based on the second string and the string corresponding to the data content of the (i-1)th data unit, or combine the second string and the string corresponding to the data content of the (i-1)th data unit to obtain a signature string, and then perform a hash operation on the signature string to generate the signature string corresponding to the i-th data unit.

[0078] The aforementioned mathematical operations may include, but are not limited to, addition, subtraction, multiplication, and division.

[0079] It is understandable that the length of the signature string corresponding to the i-th data unit is the same as the length of the signature string corresponding to the first data unit.

[0080] Thus, it can be seen that since the data storage device can perform a hash operation on the i-th data unit to obtain a second string, which is associated with the data content of the i-th data unit, and the data storage device can generate a signature string corresponding to the i-th data unit based on the second string and the signature string corresponding to the (i-1)-th data unit, the signature string corresponding to the i-th data unit can be associated with the data content of the i-th data unit and the signature string corresponding to the (i-1)-th data unit, so as to achieve a chain-like association of signature strings corresponding to N data units. Therefore, it can increase the difficulty of modifying the signature strings corresponding to N data units and reduce the probability of N data units being tampered with, thereby improving the reliability of the data.

[0081] Taking the data storage device combining the second string and the string corresponding to the data content of the (i-1)th data unit as an example: Optionally, combined Figure 4 ,like Figure 5 As shown, the above S2023 can be specifically implemented through the following S2023a and S2023b.

[0082] S2023a, The data storage device combines the second string and the signature string corresponding to the (i-1)th data unit to obtain the third string.

[0083] For example, the data storage device may combine the second string before or after the signature string corresponding to the (i-1)th data unit, and / or may split the second string into at least two characters and insert the at least two characters into the signature string corresponding to the (i-1)th data unit to obtain the third string.

[0084] S2023b: The data storage device performs a hash operation on the third string to obtain the signature string corresponding to the i-th data unit.

[0085] It is understandable that the data storage device can determine the hash value obtained by hashing the third string as the signature string corresponding to the i-th data unit.

[0086] Thus, the data storage device can combine the second string and the signature string corresponding to the (i-1)th data unit, and perform a hash operation on the resulting third string to obtain the signature string corresponding to the ith data unit. This allows the signature string corresponding to the ith data unit to be associated with the data content of the ith data unit and the signature string corresponding to the (i-1)th data unit, forming a chain of signature strings for N data units. Therefore, it increases the difficulty of modifying the signature strings for N data units and reduces the probability of tampering with them. Furthermore, it ensures that the signature string for each data unit has the same length, thus reducing the difficulty of subsequent verification. In this way, data reliability is improved while reducing the complexity of data verification.

[0087] S203. The data storage device generates a signature data unit based on each data unit and the signature string corresponding to each data unit.

[0088] In some embodiments of this application, the data storage device can generate a signature data unit in the TEE based on each data unit and the signature string corresponding to each data unit through a data signature generation module.

[0089] In some embodiments of this application, combined with Figure 2 ,like Figure 6 As shown, the above S203 can be specifically implemented through the following S2031.

[0090] S2031. The data storage device uses the signature string corresponding to any one of the N data units to sign and encrypt the data unit, thereby generating a signed data unit corresponding to the data unit.

[0091] In some instances, the data storage device can use a signature algorithm to sign and encrypt any one of the N data units based on the signature string corresponding to that data unit, thereby generating a signed data unit corresponding to that data unit.

[0092] The signature algorithm may include, but is not limited to, at least one of the following: RSA algorithm, DSA algorithm, ECDSA algorithm, etc.

[0093] Thus, it can be seen that the data storage device can use the signature string corresponding to any one of the N data units to sign and encrypt that data unit, so as to accurately generate the signature data unit corresponding to that data unit, thereby obtaining the accurate signature data unit corresponding to each data unit.

[0094] S204. The data storage device associates and stores each data unit, the signature string corresponding to each data unit, and the signature data unit corresponding to each data unit.

[0095] In some embodiments of this application, the data storage device can associate and store each data unit, the signature string corresponding to each data unit, and the signature data unit corresponding to each data unit in an external SSO environment.

[0096] In some embodiments of this application, after the data storage device associates and stores each data unit, the signature string corresponding to each data unit, and the signature data unit corresponding to each data unit, the data storage device can also send a feedback message to the front-end device through the data signature generation module. The feedback message includes the data identifier corresponding to each data unit and the signature string corresponding to each data unit, so that the front-end device can save the signature string corresponding to each data unit to the "signature string field" corresponding to each data unit.

[0097] The following will use a specific example to illustrate the data storage method provided in the embodiments of this application.

[0098] Assume the data to be stored is carbon source data, and N data units constitute one row of data to be stored.

[0099] Figure 7 A flowchart illustrating another data storage method provided in this application embodiment is shown below. Figure 7 As shown, another data storage method provided in this application embodiment may include the following steps: Step 1: Receive the carbon source data submitted for review.

[0100] Specifically, the data storage device can receive an approval instruction from the front-end device, which includes the data to be stored (e.g., carbon source data).

[0101] Step 2: Is this the first row of data? Specifically, the data storage device can determine each data unit once (i.e., determine whether each data unit is the first data unit). If it is, then proceed to step 3; otherwise, proceed to step 4.

[0102] Step 3: The signature module dynamically generates the first line of the signature string.

[0103] Specifically, the data storage device can generate a signature string (i.e., the first line of signature string) corresponding to the first data unit through the data signature generation module (i.e., the signature module mentioned above).

[0104] Step 4: Obtain the signature string of the previous row of data.

[0105] Specifically, the data storage device can obtain the signature string corresponding to the previous data unit through the data signature generation module (i.e., the signature module mentioned above).

[0106] Step 5: Merge the signature string from the previous line with the data in the current line to generate the signature string for the current line.

[0107] Specifically, the data storage device can use a data signature generation module (i.e., the aforementioned signature module) to generate a signature string corresponding to the i-th data unit based on the signature strings corresponding to the i-th data unit and the (i-1)-th data unit among the N data units.

[0108] Step 6: Process in TEE: Generate a row signature string + key data of the current row and encrypt it.

[0109] Specifically, the data storage device can generate a signature data unit (i.e., the aforementioned key data) based on each data unit and the signature string corresponding to each data unit.

[0110] Step 7: Save the encrypted data to an external SSO environment.

[0111] Specifically, the data storage device can store each data unit, the signature string corresponding to each data unit, and the signature data unit corresponding to each data unit in an external SSO environment.

[0112] Step 8: Return the line number and the corresponding signature string.

[0113] Specifically, the data storage device can also send a feedback message to the front-end device through the data signature generation module. The feedback message includes the data identifier (i.e., the row number mentioned above) corresponding to each data unit and the signature string corresponding to each data unit, so that the front-end device can save the signature string corresponding to each data unit to the "signature string field" corresponding to each data unit.

[0114] In this embodiment, after associating and storing each data unit, its corresponding signature string, and its corresponding signature data unit, the signature strings of all data units form a "chain association" (the signature string of the next data unit depends on the signature of the previous data unit). If any intermediate data unit is deleted, the signature string of subsequent data units will no longer be associated with the signature string of the preceding data units. This allows the data storage device to quickly and accurately detect data unit deletion. Furthermore, if any intermediate data unit is modified, the data unit to be verified can be obtained by re-signing and encrypting the data unit and its corresponding signature string. The modification of the data unit can then be accurately identified by comparing the data unit to be verified with its corresponding signature data unit. In other words, deleting or modifying a data unit requires simultaneous modification of a large number of data units, thus increasing the difficulty of deleting and tampering with data.

[0115] This application provides a data storage method in which a data storage device acquires data to be stored, the data to be stored including N data units, where N is a positive integer greater than 1; generates a signature string corresponding to the first data unit among the N data units; and generates a signature string corresponding to the i-th data unit based on the signature strings corresponding to the i-th data unit and the (i-1)-th data unit among the N data units, where i is a positive integer greater than 1 and less than or equal to N; and generates a signature data unit based on each data unit and the signature string corresponding to each data unit; thereby the data storage device associates and stores each data unit, the signature string corresponding to each data unit, and the signature data unit corresponding to each data unit. When a data storage device acquires data to be stored comprising N data units, it can generate a signature string corresponding to the first data unit among the N data units. Furthermore, based on the signature strings corresponding to the i-th data unit and the (i-1)-th data unit among the N data units, it can generate a signature string corresponding to the i-th data unit. This allows the signature string corresponding to the i-th data unit to be associated with the signature strings corresponding to the i-th and (i-1)-th data units. Additionally, the data storage device can generate a signature data unit based on each data unit and its corresponding signature string, thus associating each signature data unit with each data unit and its corresponding signature string. Therefore, after associating and storing each data unit, its corresponding signature string, and its corresponding signature data unit, when other users want to modify a certain data unit, in addition to modifying that data unit, they also need to modify the corresponding signature string, the corresponding signature data unit, the signature string of the data unit following that data unit, and the corresponding signature data unit of the data unit following that data unit. This significantly increases the difficulty of modifying that data unit and reduces the probability of N data units being tampered with, thus improving data trustworthiness.

[0116] Furthermore, the embodiments of this application can improve the credibility of data without using blockchain technology, thus avoiding the problems of low transaction throughput, high transaction confirmation delay, and high storage cost of blockchain technology, thereby improving the convenience of data storage.

[0117] In some embodiments of this application, combined with Figure 2 ,like Figure 8 As shown, after S204 above, another data storage method provided in this application embodiment may further include S301 to S304 below.

[0118] S301, The data storage device obtains a data request message.

[0119] In this embodiment of the application, the data request message is used to request the use of N data units to perform the target operation.

[0120] In some instances, the aforementioned target operations may include, but are not limited to, any of the following: front-end page display, statistical analysis report generation.

[0121] In some instances, the data storage device can obtain data request messages from the front-end device through a data signature verification module.

[0122] S302. The data storage device obtains the stored N data units, the signature string corresponding to the N data units, and the signature data unit corresponding to the N data units according to the data query request message.

[0123] In some instances, the data storage device can obtain N data units, the signature strings corresponding to the N data units, and the signature data units corresponding to the N data units from an external SSO environment through a data signature verification module.

[0124] S303. The data storage device determines whether the N data units have been tampered with based on the N data units, the signature strings corresponding to the N data units, and the signature data units corresponding to the N data units.

[0125] In some instances, the data storage device can determine whether N data units have been tampered with based on N data units, the signature strings corresponding to the N data units, and the signature data units corresponding to the N data units in the TEE, thereby improving the security of determining whether N data units have been tampered with.

[0126] In some instances, the data storage device can use a data signature verification module to determine, based on N data units, the signature strings corresponding to the N data units, and the signature data units corresponding to the N data units, whether the data content of the N data units has been changed and whether any of the N data units have been deleted. If the data content of the N data units has been changed and / or if any of the N data units have been deleted, the device can determine that the N data units have been tampered with; otherwise, it can determine that the N data units have not been tampered with.

[0127] In some instances, combined Figure 8 ,like Figure 9 As shown, the above S303 can be specifically implemented through the following S3031~S3033.

[0128] S3031, the data storage device determines whether the data content of each of the N data units has changed based on each data unit in the N data units, the signature string corresponding to each data unit in the N data units, and the signature data unit corresponding to each data unit in the N data units.

[0129] It should be noted that the execution order of S3031 and S3032 is not limited in the embodiments of this application; in one instance, the data storage device may execute S3031 first and then S3032; in another instance, the data storage device may execute S3032 first and then S3031; in yet another instance, the data storage device may execute S3032 while executing S3031. Figure 9 The example in the text illustrates the process of the data storage device executing S3031 first, followed by S3032.

[0130] Optionally, combined Figure 9 ,like Figure 10 As shown, the above S3031 can be specifically implemented through the following S3031a and S031b.

[0131] S3031a. The data storage device generates a signature data unit to be verified based on any one of the N data units and the signature string corresponding to that data unit.

[0132] For example, the data storage device can use the signature string corresponding to any one of the data units to sign and encrypt the data unit to obtain the signed data unit to be verified.

[0133] S3031b: If the signature data unit to be verified matches the signature data unit corresponding to any other data unit, the data storage device determines that the data content of any other data unit has not changed; otherwise, it determines that the data content of any other data unit has changed.

[0134] For example, the above matching can be understood as: identical, or the similarity between the two is greater than or equal to the similarity threshold.

[0135] Thus, since the data storage device can use the signature string corresponding to any data unit to sign and encrypt any data unit to obtain the signature data unit to be verified, and accurately determine whether the data content of any data unit has changed based on whether the signature data unit to be verified matches the signature data unit corresponding to any data unit, the accuracy of the data storage device in identifying whether the data content of a data unit has changed can be improved.

[0136] The following will use a specific example to illustrate the data storage method provided in the embodiments of this application.

[0137] Assume the data to be stored is carbon source data, and N data units constitute one row of data to be stored.

[0138] Figure 11A flowchart illustrating another data storage method provided in this application embodiment is shown below. Figure 11 As shown, another data storage method provided in this application embodiment may include the following steps: Step 11: Trigger the data display / report generation requirement.

[0139] Specifically, the data storage device can obtain a data request message, which requests the use of N data units to perform a target operation, including front-end page display / statistical analysis report generation.

[0140] Step 12: Query the carbon source data and the corresponding signature string and signature data unit.

[0141] Specifically, the data storage device can obtain N stored data units, the signature strings corresponding to the N data units, and the signature data units corresponding to the N data units based on the data query request message.

[0142] Step 13: Submit the carbon source data and the corresponding signature string and signature data unit.

[0143] Specifically, the data storage device can submit N data units, the signature strings corresponding to the N data units, and the signature data units corresponding to the N data units to the data signature verification module.

[0144] Step 14: Execute the verification logic in the TEE.

[0145] Specifically, the data storage device can use a data signature verification module to determine whether the data content of the N data units has changed and whether any of the N data units have been deleted, based on the N data units, the signature strings corresponding to the N data units, and the signature data units corresponding to the N data units.

[0146] Step 15: Generate verification results.

[0147] Specifically, if the data content of N data units is changed and / or N data units are deleted, it is determined that N data units have been tampered with, and the verification result is failed; otherwise, it is determined that N data units have not been tampered with, and the verification result is passed.

[0148] Step 16: Return the verification result to the corresponding interface.

[0149] Specifically, the data storage device can return the verification result to the interface corresponding to the data request message. In step 11 above, if the data display requirement is triggered, the data storage device can return the verification result to the data display interface. In step 11, if the report generation requirement is triggered, the data storage device can return the verification result to the report generation interface.

[0150] Step 17: Receive the interface result.

[0151] Specifically, the interface corresponding to the data request message can receive the above verification results. For example, in step 11 above, if the data display requirement is triggered, the data storage device can receive the verification results through the data display interface. In step 11, if the report generation requirement is triggered, the data storage device can receive the verification results through the report generation interface.

[0152] Step 18: Does the verification result pass? Specifically, the data storage device can determine whether the verification result passes based on whether N data units have been tampered with. If the N data units have not been tampered with, the verification result passes and step 19 is executed; otherwise, the verification result fails and step 20 is executed.

[0153] Step 19: The data storage device continues to perform the target operation.

[0154] Step 20: The data storage device controls the front-end device to display a data tampering warning message.

[0155] The tampering warning message is used to indicate that N data units have been tampered with.

[0156] S3032. The data storage device determines whether any data unit in the N data units has been deleted based on the j-th data unit, the signature string corresponding to the j-th data unit, and the signature string corresponding to the (j-1)-th data unit in the N data units.

[0157] In this embodiment of the application, j is a positive integer greater than 1 and less than or equal to N.

[0158] Optionally, combined Figure 9 ,like Figure 12 As shown, the above S3032 can be specifically implemented through the following S3032a~S3032c.

[0159] S3032a: The data storage device performs a hash operation on the j-th data unit to obtain the fourth string.

[0160] It should be noted that, for the explanation of the hash operation performed on the j-th data unit by the data storage device, please refer to the specific description of the hash operation performed on the i-th data unit in the above embodiments, which will not be repeated here in the embodiments of this application.

[0161] S3032b: The data storage device generates a signature string to be verified based on the fourth string and the signature string corresponding to the (j-1)th data unit.

[0162] It should be noted that, regarding the explanation of how the data storage device generates the signature string to be verified based on the fourth string and the signature string corresponding to the (j-1)th data unit, please refer to the specific description in the above embodiment of generating the signature string corresponding to the ith data unit based on the second string and the signature string corresponding to the (i-1)th data unit. This application embodiment will not repeat this detail.

[0163] S3032c: If the signature string to be verified matches the signature string corresponding to the j-th data unit, the data storage device determines that N data units have no data units that have been deleted; otherwise, it determines that N data units have data units that have been deleted.

[0164] For example, the above matching can be understood as: identical, or the similarity between the two is greater than or equal to the similarity threshold.

[0165] For example, the absence of any data unit among N data units and the deletion of a data unit can be understood as: no data unit among the N data units is deleted; conversely, the presence of any data unit among N data units and the deletion of a data unit can be understood as: at least one data unit among the N data units is deleted.

[0166] Thus, it can be seen that since the data storage device can generate a signature string to be verified based on the j-th data unit, the signature string corresponding to the j-th data unit, and the signature string corresponding to the (j-1)-th data unit, and accurately determine whether any data unit has been deleted among the N data units based on whether the signature string to be verified matches the signature string corresponding to the j-th data unit, the accuracy of the data storage device in identifying whether any data unit has been deleted among the N data units can be improved.

[0167] S3033. If the data content of each of the N data units in the data storage device remains unchanged and no data unit in the N data units has been deleted, it is determined that the N data units have not been tampered with; otherwise, it is determined that the N data units have been tampered with.

[0168] Thus, it can be seen that since the data storage device can determine whether the N data units have been tampered with from different dimensions based on each data unit in the N data units, the signature string corresponding to each data unit in the N data units, and the signature data unit corresponding to each data unit in the N data units, the accuracy of the data storage device in identifying whether the N data units have been tampered with can be improved.

[0169] S304. The data storage device performs the target operation using N data units if the N data units have not been tampered with.

[0170] In this embodiment of the application, the aforementioned data tampering prompt information is used to indicate that N data units have been tampered with.

[0171] In some instances, the target operation is performed using N data units without any tampering, and the operation result is returned to the front-end device.

[0172] In some instances, if N data units are tampered with, the data storage device can send a data tampering notification message to the front-end device. This notification message indicates that N data units have been tampered with, allowing the front-end device to display the notification message.

[0173] When the front-end device receives a data tampering warning, it can also generate a log record, which includes information about the tampering of N data units.

[0174] Thus, it can be seen that, when a data storage device receives a data request message, it can first determine whether N data units have been tampered with, and only use N data units to execute the target operation if the N data units have not been tampered with. Therefore, the accuracy of executing the target operation can be improved.

[0175] The data storage method of this application embodiment is described below with reference to a specific example. The specific implementation process of this method is as follows: Figure 13 As shown.

[0176] Assume the data to be stored is carbon source data, and N data units constitute one row of data to be stored.

[0177] Combination Figure 13 Another data storage method provided in this application embodiment may include the following steps: Step 21, Auditor's operation.

[0178] Specifically, the carbon source data verification module of the front-end device can receive operations from the verification personnel.

[0179] Step 22: Initiate the approval instruction.

[0180] Specifically, the carbon source data verification module of the front-end device can generate a verification approval instruction based on the operations of the verification personnel.

[0181] Step 23: Call the signature module interface.

[0182] Specifically, the front-end device can call the interface of the data signature generation module of the data storage device and send the approval instruction to the data storage device. The approval instruction includes N data units.

[0183] Step 24: Receive data request.

[0184] Specifically, the data signature generation module of the data storage device receives the aforementioned approval instruction (i.e., data request).

[0185] Step 25: Generate the line signature string according to the rules.

[0186] Specifically, the data storage device generates a signature string corresponding to the first data unit among N data units, and generates a signature string corresponding to the i-th data unit based on the signature strings corresponding to the i-th data unit and the (i-1)-th data unit among N data units.

[0187] Step 26: Encryption processing in TEE.

[0188] Specifically, the data storage device generates a signature data unit in the TEE based on each data unit and the signature string corresponding to each data unit.

[0189] Step 27: Save to the SSO environment.

[0190] Specifically, the data storage device can associate and store each data unit, the signature string corresponding to each data unit, and the signature data unit corresponding to each data unit to an external SSO environment.

[0191] Step 28: Return the line number + signature string.

[0192] Specifically, the data storage device can also send a feedback message to the front-end device through the data signature generation module. The feedback message includes a data identifier corresponding to each data unit and a signature string corresponding to each data unit.

[0193] Step 29: Receive the signature result.

[0194] Specifically, the carbon source data verification module of the front-end device can receive the aforementioned feedback messages.

[0195] Step 30: Store the signature string and form a chain association.

[0196] Specifically, the front-end device can save the signature string corresponding to each data unit to the "signature string field" corresponding to each data unit.

[0197] Step 31: Receive data + signature string request.

[0198] Specifically, the data signature verification module of the data storage device receives a data request message from the front-end device, which requests the use of N data units to perform the target operation.

[0199] Step 32: Perform verification in TEE.

[0200] Specifically, the data signature verification module of the data storage device determines whether the N data units have been tampered with based on the N data units, the signature strings corresponding to the N data units, and the signature data units corresponding to the N data units.

[0201] Step 33: Return the verification result.

[0202] If N data units are tampered with, the verification result is "failed"; otherwise, the verification result is "passed".

[0203] Step 34: Trigger subsequent logic / tampering prompt.

[0204] Specifically, if the verification result is successful, the target operation is performed using N data units; otherwise, a data tampering warning message is displayed.

[0205] In some embodiments, this application also provides a data storage device. The data storage device may include one or more functional modules for implementing the data storage method of the above method embodiments.

[0206] For example, Figure 14 This is a schematic diagram illustrating the composition of a data storage device provided in an embodiment of this application. Figure 14 As shown, the data storage device 400 includes: an acquisition module 401, a generation module 402, and a storage module 403.

[0207] The module 401 is used to acquire data to be stored, which includes N data units, where N is a positive integer greater than 1. The generation module 402 is used to generate a signature string corresponding to the first data unit among the N data units acquired by the acquisition module 401, and to generate a signature string corresponding to the i-th data unit based on the signature strings corresponding to the i-th and (i-1)-th data units among the N data units acquired by the acquisition module 401, where i is a positive integer greater than 1 and less than or equal to N; and to generate a signature data unit based on each data unit and its corresponding signature string. The storage module 403 is used to associate and store each data unit, the signature string corresponding to each data unit generated by the generation module 402, and the signature data unit corresponding to each data unit generated by the generation module 402.

[0208] This application provides a data storage device. When the data storage device acquires data to be stored comprising N data units, it can generate a signature string corresponding to the first data unit among the N data units. Based on the signature strings corresponding to the i-th data unit and the (i-1)-th data unit among the N data units, it generates a signature string corresponding to the i-th data unit. This allows the signature string corresponding to the i-th data unit to be associated with the signature strings corresponding to the i-th and (i-1)-th data units. Furthermore, the data storage device can also generate a signature data unit based on each data unit and its corresponding signature string, thus allowing each signature data unit to be associated with each data unit and its corresponding signature string. Therefore, after associating and storing each data unit, its corresponding signature string, and its corresponding signature data unit, when other users want to modify a certain data unit, in addition to modifying that data unit, they also need to modify the corresponding signature string, the corresponding signature data unit, the signature string of the data unit following that data unit, and the corresponding signature data unit of the data unit following that data unit. This significantly increases the difficulty of modifying that data unit and reduces the probability of N data units being tampered with, thus improving data trustworthiness.

[0209] In some embodiments, the generation module 402 is specifically used to perform a hash operation on the first string to obtain the signature string corresponding to the first data unit.

[0210] In other embodiments, the generation module 402 is specifically used to perform a hash operation on the i-th data unit to obtain a second string; and to generate a signature string corresponding to the i-th data unit based on the second string and the signature string corresponding to the (i-1)-th data unit. The generation module 402 is also specifically used to combine the second string and the signature string corresponding to the (i-1)-th data unit to obtain a third string; and to perform a hash operation on the third string to obtain the signature string corresponding to the i-th data unit.

[0211] In some embodiments, the acquisition module 401 is further configured to, after the storage module 403 associates and stores each data unit, the signature string corresponding to each data unit, and the signature data unit corresponding to each data unit, acquire a data request message, which requests the use of N data units to perform a target operation; and, based on the data query request message, acquire the stored N data units, the signature string corresponding to the N data units, and the signature data units corresponding to the N data units. The data storage device provided in this application embodiment further includes a determination module and an execution module. The determination module is configured to, based on the N data units, the signature string corresponding to the N data units, and the signature data units corresponding to the N data units acquired by the acquisition module 401, determine whether the N data units have been tampered with. If the determination module determines that the N data units have not been tampered with, the execution module is configured to use the N data units to perform the target operation.

[0212] In some other embodiments, the aforementioned determining module is specifically used to determine whether the data content of each data unit in the N data units has changed based on each data unit in the N data units, the signature string corresponding to each data unit in the N data units, and the signature data unit corresponding to each data unit in the N data units; and to determine whether any data unit in the N data units has been deleted based on the j-th data unit in the N data units, the signature string corresponding to the j-th data unit, and the signature string corresponding to the (j-1)-th data unit in the N data units, where j is a positive integer greater than 1 and less than or equal to N; and, if the data content of each data unit in the N data units has not changed and no data unit in the N data units has been deleted, to determine that the N data units have not been tampered with; otherwise, to determine that the N data units have been tampered with.

[0213] In some other embodiments, the generation module 402 is further configured to generate a signature data unit to be verified based on any one of the N data units and the signature string corresponding to that data unit. Specifically, the determination module is configured to determine that the data content of the data unit has not changed if the signature data unit to be verified generated by the generation module 402 matches the signature data unit corresponding to that data unit; otherwise, it determines that the data content of the data unit has changed.

[0214] In some other embodiments, the generation module 402 is further configured to perform a hash operation on the j-th data unit to obtain a fourth string; and generate a signature string to be verified based on the fourth string and the signature string corresponding to the (j-1)-th data unit. Specifically, the determination module is configured to determine that if the signature string to be verified generated by the generation module 402 matches the signature string corresponding to the j-th data unit, then there are no deleted data units among the N data units; otherwise, it determines that there are deleted data units among the N data units.

[0215] Another possible implementation is that the above-mentioned generation module 402 is specifically used to sign and encrypt any one of the N data units using the signature string corresponding to that data unit, thereby generating a signature data unit corresponding to that data unit.

[0216] When the functions of the integrated modules described above are implemented in hardware, embodiments of the present invention provide a schematic diagram of the composition of the electronic device involved in the above embodiments. For example... Figure 15 As shown, the electronic device 500 includes: a processor 502, a communication interface 503, and a bus 504. Optionally, the electronic device 500 may also include a memory 501.

[0217] Processor 502 may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 502 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 502 may also be a combination that implements computing functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0218] Communication interface 503 is used to connect to other devices via a communication network. This communication network can be Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0219] The memory 501 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0220] In one possible implementation, the memory 501 can exist independently of the processor 502. The memory 501 can be connected to the processor 502 via a bus 504 and is used to store instructions or program code. When the processor 502 calls and executes the instructions or program code stored in the memory 501, it can implement the data storage method provided in this embodiment of the invention.

[0221] In another possible implementation, the memory 501 can also be integrated with the processor 502.

[0222] Bus 504 can be an Extended Industry Standard Architecture (EISA) bus, etc. Bus 504 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 15 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0223] Through the above description of the implementation methods, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the service calling device can be divided into different functional modules to complete all or part of the functions described above.

[0224] This application also provides a computer-readable storage medium. All or part of the processes in the above method embodiments can be executed by computer instructions instructing related hardware. The program can be stored in the aforementioned computer-readable storage medium, and when executed, it can include the processes of the above method embodiments. The computer-readable storage medium can be any of the foregoing embodiments or memory. The aforementioned computer-readable storage medium can also be an external storage device of the aforementioned service invocation device, such as a plug-in hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the aforementioned service invocation device. Further, the aforementioned computer-readable storage medium can include both internal storage units of the aforementioned service invocation device and external storage devices. The aforementioned computer-readable storage medium is used to store the aforementioned computer program and other programs and data required by the aforementioned service invocation device. The aforementioned computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0225] This application also provides a computer program product, which includes a computer program that, when run on a computer, causes the computer to execute any of the data storage methods provided in the above embodiments.

[0226] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data storage method, characterized in that, include: Obtain the data to be stored, which includes N data units, where N is a positive integer greater than 1; Generate the signature string corresponding to the first data unit among the N data units, and generate the signature string corresponding to the i-th data unit based on the signature strings corresponding to the i-th data unit and the (i-1)-th data unit among the N data units, where i is a positive integer greater than 1 and less than or equal to N; Generate a signature data unit based on each data unit and its corresponding signature string; The system associates and stores each data unit, the signature string corresponding to each data unit, and the signature data unit corresponding to each data unit.

2. The method according to claim 1, characterized in that, Generating the signature string corresponding to the first data unit among the N data units includes: Perform a hash operation on the first string to obtain the signature string corresponding to the first data unit.

3. The method according to claim 1, characterized in that, The step of generating the signature string corresponding to the i-th data unit based on the signature strings corresponding to the i-th data unit and the (i-1)-th data unit among the N data units includes: Perform a hash operation on the i-th data unit to obtain the second string; Based on the second string and the signature string corresponding to the (i-1)th data unit, the signature string corresponding to the i-th data unit is generated.

4. The method according to claim 3, characterized in that, The step of generating the signature string corresponding to the i-th data unit based on the second string and the signature string corresponding to the (i-1)-th data unit includes: Combine the second string with the signature string corresponding to the (i-1)th data unit to obtain the third string; Perform a hash operation on the third string to obtain the signature string corresponding to the i-th data unit.

5. The method according to claim 1, characterized in that, After associating and storing each data unit, the signature string corresponding to each data unit, and the signature data unit corresponding to each data unit, the method further includes: Obtain a data request message, the data request message being used to request the use of the N data units to perform a target operation; According to the data query request message, obtain the stored N data units, the signature string corresponding to the N data units, and the signature data unit corresponding to the N data units; Based on the N data units, the signature string corresponding to the N data units, and the signature data unit corresponding to the N data units, determine whether the N data units have been tampered with; If the N data units are not tampered with, the target operation is performed using the N data units.

6. The method according to claim 5, characterized in that, The step of determining whether the N data units have been tampered with based on the N data units, the signature strings corresponding to the N data units, and the signature data units corresponding to the N data units includes: Based on each of the N data units, the signature string corresponding to each of the N data units, and the signature data unit corresponding to each of the N data units, determine whether the data content of each of the N data units has changed; Based on the j-th data unit in the N data units, the signature string corresponding to the j-th data unit, and the signature string corresponding to the (j-1)-th data unit in the N data units, determine whether any data unit in the N data units has been deleted, where j is a positive integer greater than 1 and less than or equal to N; If the data content of each of the N data units remains unchanged and no data unit in the N data units has been deleted, it is determined that the N data units have not been tampered with; otherwise, it is determined that the N data units have been tampered with.

7. The method according to claim 6, characterized in that, The step of determining whether the data content of each of the N data units has changed based on each data unit in the N data units, the signature string corresponding to each data unit in the N data units, and the signature data unit corresponding to each data unit in the N data units includes: Generate a signature data unit to be verified based on any one of the N data units and the signature string corresponding to that data unit; If the signature data unit to be verified matches the signature data unit corresponding to any one of the data units, it is determined that the data content of any one of the data units has not changed; otherwise, it is determined that the data content of any one of the data units has changed.

8. The method according to claim 6, characterized in that, The step of determining whether any data unit in the N data units has been deleted, based on the j-th data unit, the signature string corresponding to the j-th data unit, and the signature string corresponding to the (j-1)-th data unit in the N data units, includes: Perform a hash operation on the j-th data unit to obtain the fourth string; Based on the fourth string and the signature string corresponding to the (j-1)th data unit, a signature string to be verified is generated; If the signature string to be verified matches the signature string corresponding to the j-th data unit, it is determined that none of the N data units have been deleted; otherwise, it is determined that some of the N data units have been deleted.

9. The method according to claim 1, characterized in that, The step of generating a signature data unit based on each data unit and its corresponding signature string includes: The signature data unit is encrypted by using the signature string corresponding to any one of the N data units to generate the signature data unit corresponding to the data unit.

10. A data storage device, characterized in that, include: The acquisition module is used to acquire data to be stored, wherein the data to be stored includes N data units, where N is a positive integer greater than 1; The generation module is used to generate a signature string corresponding to the first data unit among the N data units included in the data to be stored acquired by the acquisition module, and to generate a signature string corresponding to the i-th data unit based on the signature strings corresponding to the i-th data unit and the (i-1)-th data unit among the N data units included in the data to be stored acquired by the acquisition module, where i is a positive integer greater than 1 and less than or equal to N; and to generate a signature data unit based on each data unit and the signature string corresponding to each data unit respectively. The storage module is used to associate and store each data unit, the signature string corresponding to each data unit generated by the generation module, and the signature data unit corresponding to each data unit generated by the generation module.

11. An electronic device, characterized in that, The device includes a processor and a memory, the processor being coupled to the memory; the memory is used to store computer instructions, which are loaded and executed by the processor to enable the computer device to implement the data storage method as described in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes computer-executable instructions that, when executed on a computer, cause the computer to perform the data storage method according to any one of claims 1 to 9.

13. A computer program product, characterized in that, The computer program product includes a computer program that, when run on an electronic device, causes the electronic device to perform the data storage method as described in any one of claims 1 to 9.

Images