Data processing consistency verification method and system based on system internal enhancement verification

Abstract

The invention provides a data processing consistency verification method and system based on system internal enhancement verification, and belongs to the technical field of computer system security and data integrity protection, and the method comprises the following steps: setting an enhancement verification enabling identifier for a data instance entering a system internal processing flow; generating an enhanced check value that fuses the data content, the initialized secret value, the runtime perturbation factor, the timing information, and the contextual information; verifying the enhanced verification value in the data processing process; and processing according to a pre-configured strategy when verification fails. The system comprises a management module, a check value generation module, a check value verification module, an exception handling module and a strategy configuration module. On the premise that an existing protocol and an existing system structure are not modified, the tamper-proof capacity of data in the system is improved, the data are prevented from being abnormally modified or replayed or subjected to cross-path error multiplexing, the system safety is enhanced, and meanwhile compatibility and good performance are kept.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer system security and data integrity protection, and particularly relates to a data processing consistency verification method and system based on internal enhanced verification. BACKGROUND

[0002] In the underlying software systems such as operating system kernel, network protocol stack, embedded system, data is usually transferred between multiple processing modules and multiple processing stages in the form of data buffer or buffer object. Taking the network protocol stack as an example, a data packet may pass through device driver reception, network layer parsing, transport layer processing in turn, and finally reach the upper layer protocol or application module. In these processing processes, the data is considered to be in a trusted environment inside the system.

[0003] The prior art mainly relies on the verification mechanism of the communication protocol layer to ensure the correctness of the data, such as IP checksum, TCP / UDP checksum, etc. These verification mechanisms are mainly used to detect the error codes generated in the communication link transmission process, but do not focus on the consistency and integrity problems that may occur in the system internal data transfer process.

[0004] With the increase of kernel size and the improvement of module complexity, the system internal data in the transfer process faces the following risks: Internal module abnormal modification risk: due to program defects, illegal pointer access or logic errors, the data buffer content may be modified unexpectedly, and these modifications will not trigger protocol layer verification failure.

[0005] Error path or cross-module reuse risk: data may be incorrectly delivered to an unexpected processing path, or reused in a mismatched context, resulting in logic anomalies or security risks.

[0006] Concurrency and timing related risks: in a multi-core processing environment, data may be concurrently accessed, delayed processed or replayed, and existing mechanisms are difficult to distinguish between "legal delay" and "abnormal reuse".

[0007] Existing tamper-proofing technologies are mostly focused on storage medium verification, application layer data integrity protection, modification interception based on permissions or policies, etc. These solutions are usually not suitable for kernel internal high-frequency data transfer scenarios, either because the computational overhead is too large, or because they destroy existing data structures and interfaces. Therefore, a technical solution is needed that does not destroy the existing protocol and system structure, and can perform enhanced verification and consistency verification on the system internal data transfer process. SUMMARY

[0008] This invention aims to solve at least one of the technical problems existing in the prior art, and proposes a data processing consistency verification method and system based on enhanced internal verification to solve the problem of internal data pollution caused by program defects, illegal pointers or concurrency errors.

[0009] In a first aspect, embodiments of the present invention provide a data processing consistency verification method based on enhanced internal system verification, including: When a data instance first enters the system's internal processing flow, set an internal enhanced verification enable flag for the data instance; An enhanced verification value is generated for a data instance with an enabled enhanced verification flag. The process of generating the enhanced verification value is as follows: performing cumulative calculation based on the processor word length and position-sensitive combination processing on the tail data of the data content; using the initial secret value as the initial value of the accumulation; incorporating the runtime disturbance factor into the current accumulated value through XOR operation; binding the timing information into the current accumulated value through addition operation; and binding the context information into the current accumulated value through addition operation to obtain the final enhanced verification value. When processing the data instance subsequently, if an enhanced verification enabled flag is detected, the enhanced verification value is recalculated and compared with the stored enhanced verification value for verification. When enhanced verification fails, the corresponding action is executed according to the pre-configured exception handling strategy.

[0010] The technical advantages of the data processing consistency verification method based on enhanced internal system verification disclosed in this invention are: Improve the anti-tampering capability of internal system data without modifying existing protocol fields; To prevent data from being abnormally modified, replayed, or incorrectly reused across paths; This associates the enhanced verification results with data content, processing context, timing status, and system operating status. While ensuring compatibility, the protection capabilities are confined to the system to avoid affecting external protocols.

[0011] Furthermore, the initial secret value in the enhanced verification value generation step is generated when the system starts up and remains stable throughout the entire system operation cycle, and is stored only in a controlled memory area inside the system.

[0012] Furthermore, the runtime disturbance factor in the enhanced check value generation step includes at least one of the following: the session or connection identifier to which the current data belongs, the thread ID of the currently processed data, or the processing queue number.

[0013] Furthermore, the timing information binding in the enhanced check value generation step includes: dividing time into time windows of fixed length, with each time window corresponding to a unique identifier value; when data first enters the system processing flow, calculating the identifier of the time window based on the current time, and incorporating the identifier into the enhanced check value.

[0014] Furthermore, in the enhanced verification step, the system attempts to use the current time window identifier and its adjacent window identifiers for verification to tolerate time boundary errors.

[0015] Furthermore, the context information binding in the enhanced verification value generation step includes at least one of the following: the identifier of the processing module to which it belongs, the identifier of the interface or path through which the data enters the system, and the expected processing type or protocol type.

[0016] Furthermore, the data content processing in the enhanced checksum generation step includes: Accumulation calculation based on processor word length: The accumulation unit length is selected according to the current processor architecture, and the data content is accumulated in machine word units after being aligned by word length; Position-sensitive combination processing of tail data: When the data length is less than a complete word length, each remaining byte is shifted according to its relative position in the data, and the shifted results are combined into a word length data and then added together.

[0017] Furthermore, the processing strategies in the anomaly handling steps include at least one of the following: discarding data, recording abnormal events, triggering an alarm mechanism, and downgrading processing to rely solely on the original protocol verification.

[0018] Furthermore, the exception handling strategy is configured according to the protocol type and / or processing module, and different exception handling strategies can be configured for different protocol types and / or different processing modules.

[0019] Secondly, embodiments of the present invention also provide a data processing consistency verification system based on internal enhanced verification, used to implement the method, including: The enhanced verification management module is used to manage the activation status, policy configuration, and system statistics of the enhanced verification enable flag; The check value generation module is used to perform the calculation of enhanced check values. The checksum verification module is used to verify the correctness of the enhanced checksum during data processing. The exception handling module is used to handle verification failures according to the pre-configured strategy. The policy configuration module provides a policy configuration interface and management functions.

[0020] The technical effect of the data processing consistency verification system based on internal enhanced verification disclosed in this invention is as follows: the enhanced verification identifier is stored in the existing data buffer control field, the modular design achieves a balance between "internal enhanced protection" and "system compatibility", does not affect the external communication protocol, and adds a full-link security verification layer to the data flow without large-scale reconstruction of the existing system, thus solving the core pain point of "breaking compatibility" in traditional solutions. Attached Figure Description

[0021] Figure 1 A schematic diagram of the overall process of the data processing consistency verification method based on internal system enhancement verification provided in this embodiment of the invention; Figure 2 A detailed process diagram of the data processing consistency verification method based on internal system enhancement verification provided in this embodiment of the invention. Detailed Implementation

[0022] To enable those skilled in the art to better understand the technical solutions of the present invention, exemplary embodiments of the present invention are described below in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to aid understanding. These should be considered merely exemplary. Therefore, those skilled in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0023] A data processing consistency verification method based on internal system enhancement checks, refer to... Figure 1 and Figure 2 As shown, the specific steps include: Step S1: Enhanced verification initialization and identifier settings.

[0024] When a data instance first enters the system's internal processing flow, the system sets an internal enhanced verification enable flag for the data instance. This flag is stored in the control field of the data buffer. For example, a dedicated flag bit ecs_enabled can be added to the sk_buff control block of the operating system kernel. It uses a single bit or u8 type, where 0 represents disabled and 1 represents enabled. It occupies little space and does not change the original protocol fields and functions.

[0025] This embodiment demonstrates the specific process of implementing enhanced verification initialization and flag setting in the Linux kernel network protocol stack. In the Linux kernel, network packets are represented using the `sk_buff` structure. This embodiment adds an enhanced verification enable flag to the control block of `sk_buff`. When a packet first enters the kernel network protocol stack processing flow (e.g., in the network card driver receive function), the system calls `skb_set_ecs_enabled(skb)` to enable enhanced verification for that packet. This flag only occupies 1 bit of space and does not affect the original layout and functionality of `sk_buff`.

[0026] A lightweight enhanced verification enable flag setting is implemented without altering the original layout of the kernel data structure, maintaining full compatibility with existing kernel modules. The flag bit occupies minimal space, and its impact on system performance is negligible.

[0027] Step S2: Enhance checksum generation.

[0028] The system generates enhanced verification values ​​for data instances with enhanced verification enabled, including the following sub-steps: S2.1: Data Accumulation, based on processor word length: After aligning the data buffer to the processor word length (e.g., 32-bit or 64-bit), accumulation is performed word by word. Let the word sum of the data content be DataSum. The accumulation unit length is selected according to the current processor architecture; 32-bit accumulation is used in a 32-bit architecture, and 64-bit accumulation is used in a 64-bit architecture. After aligning the data content to the word length, accumulation is performed word by word.

[0029] S2.2: Position-sensitive combination processing of tail data: When the data length is less than a complete word, perform the following operation on the remaining bytes: Each byte is shifted according to its relative position in the data; Combine the shifted results into a single word of data; Then it participates in the accumulation operation.

[0030] Specifically, when the length (in bytes) of the data to be verified is not an integer multiple of the processor word size (e.g., 4 or 8 bytes), the remaining last few bytes (called "tail data") undergo special processing. The processing steps are as follows: a. Determine the number of tail bytes: Let the number of tail bytes be k = data_length % WordSize (WordSize is in bytes).

[0031] b. Bitwise left shift and combination: Take out the last k bytes in sequence, and denote the i-th byte as Byte[i] (i starts from 0 and corresponds to the first byte from the tail to the head). Shift each byte Byte[i] left by (8 * i) bits. Then perform a bitwise OR operation on all the shifted results and combine them into a complete machine word TailWord.

[0032] c. Add to the sum: Add the combined TailWord to the previous sum of the complete word length, DataSum.

[0033] This method ensures that each tail byte occupies a unique range of bits in the word due to its different absolute position in the data, thus making it highly sensitive to any tampering attempts to swap or modify bytes at the tail.

[0034] S2.3: Introduction of Initialization Secret Value: During the startup initialization phase, the system generates or loads an initialization secret value that is used only internally, and uses the secret value Secret as the accumulation base value, i.e., Acc = Secret; then, the accumulated data content and DataSum are added to the current Acc, i.e., Acc = Acc + DataSum. This initialization secret value remains stable throughout the entire system runtime and is stored only in a controlled memory area within the kernel or protocol stack. Before performing enhanced verification calculations, the system introduces the initialization secret value into the initial state of verification accumulation.

[0035] S2.4: Runtime Perturbation Factor Fusion: Obtain the runtime perturbation factor (RuntimeFactor, such as connection ID, thread ID) and incorporate it through an XOR operation. That is, Acc = Acc XOR RuntimeFactor. During the verification calculation, a runtime perturbation factor is introduced, including at least one of the following: Session or connection identifier: The internal identifier of the connection or session to which the current data belongs; Current processing thread or queue identifier: The thread ID or processing queue number currently processing data. The perturbation factor is fused with the current accumulated value through addition, XOR, or mixed operations.

[0036] S2.5: Time Sequence Information Binding: Calculate the time window identifier (WindowID) based on the current time and incorporate it through addition. That is, Acc = Acc + WindowID. Time-series related information is introduced into the enhanced verification calculation, dividing time into several fixed-length time windows, each corresponding to a unique identifier value. When data first enters the system processing flow and undergoes enhanced verification, the system calculates the identifier of the current time window and adds this identifier to the previously generated verification value.

[0037] S2.6: Context Information Binding: Obtain the processing context identifier ContextID (such as module ID, interface number) and incorporate it through addition. That is, Acc = Acc + ContextID. The current processing context information of the data is included in the verification calculation, including at least one of the following: Processing module identifier: A unique ID assigned to each module within the system; The interface or path identifier for data entering the system: a unique identifier for the data source interface; Expected processing type or protocol type: The type number determined based on the processing logic of the data flow stage. Context information is incorporated into the checksum through summation or XOR operations.

[0038] Therefore, the formula can be summarized as: Acc = ((Secret + DataSum) XOR RuntimeFactor) +WindowID + ContextID.

[0039] S2.7: Enhanced verification value storage: After completing the above calculations, the enhanced verification value is associated with the data instance and stored, and an enhanced verification enable flag is set.

[0040] This embodiment details the complete process of generating the enhanced checksum, using a 64-bit system architecture as an example. Assume the system is running on a 64-bit architecture and needs to process a network data packet with a length of 150 bytes. The enhanced checksum generation process is as follows: (1) Accumulation calculation based on processor word length: After the data is aligned to 8 bytes (64 bits), it is divided into 18 complete words (144 bytes) and 6 remaining bytes. The first 144 bytes are accumulated in units of 8 bytes.

[0041] (2) Position-sensitive combination processing of tail data: Process the remaining 6 bytes.

[0042] (3) Introduction of initial secret value: A 64-bit random secret value generated when the system starts up is used in the calculation.

[0043] (4) Runtime disturbance factor fusion: The identifier of the current TCP connection is used in the calculation.

[0044] (5) Time sequence information binding: Calculate the current time window identifier.

[0045] (6) Context information binding: The current processing module identifier and protocol type are used in the calculation.

[0046] (7) Final checksum storage: The generated 64-bit checksum is stored in a reserved field in the control block of sk_buff. In a buffer control block similar to Linux kernel sk_buff, there is usually a reserved array (such as cb[]) or an unused flag field for internal state storage. The checksum can be stored here.

[0047] This embodiment demonstrates the complete enhanced checksum generation process. Through the fusion of multiple factors, the checksum is not only related to the data content but also tightly bound to the system's operating state, timing, and context. This design makes it difficult for an attacker to forge a valid checksum even if they obtain the same data content, because they would need to know the secret value, the correct timing window, and the context information simultaneously.

[0048] Step S3: Enhanced Verification: When subsequent modules process the data, if an enhanced verification enabled flag is detected, the enhanced verification value is recalculated and compared with the stored enhanced verification value for verification. Any operation that modifies the content of a data instance with enhanced verification enabled must force a regeneration and update of the enhanced verification value after the modification is completed and before the data instance is passed to the next processing stage. In the system kernel or core modules, all functions that may modify data content (such as protocol field update functions, data copy functions, and load modification functions) are encapsulated or hooked. After the modification logic is executed, the ecs_update_checksum(data_instance) function is automatically called. When regenerating the verification value, the latest modified data content, the current runtime disturbance factor, the current timing window flag (or the original window ID used upon entry, set according to the anti-replay strategy), and the current processing context are used to calculate and overwrite the stored value.

[0049] When subsequent modules process this data, if an enhanced verification enabled flag is detected, the following operations are performed: Reacquire the current context, timing, and perturbation information; Recalculate the enhanced check value according to the same rules; Compare with the stored enhanced checksum; If they match, processing can continue; if they don't match, it's considered an exception.

[0050] This embodiment demonstrates the specific implementation of enhanced verification during data flow. The verification process in this embodiment is both rigorous and flexible. Rigorous in that the verification value must be recalculated according to the same rules; flexible in that it allows for a fluctuation of ±1 within the time window, which can tolerate minute time-series differences caused by system processing delays and avoid misjudgments. This design ensures security while also taking into account the actual operating characteristics of the system.

[0051] Step S4: Exception Handling. Assume that after initial processing, the data packet reaches a Netfilter hook function for further processing.

[0052] When enhanced verification fails, the system performs corresponding actions according to the pre-configured exception handling strategy, including: discarding data, recording the exception event, triggering the alarm mechanism, downgrading the process, and relying only on the original protocol for verification.

[0053] Implementation Process: First, define the exception handling strategy structure. The default strategy configuration is loaded at system startup. A dynamic configuration interface is provided at runtime. An exception handling execution function is then implemented. The exception handling mechanism provided in this embodiment is highly flexible. Different protocols and modules can be configured with different handling strategies, achieving fine-grained security control. System administrators can balance security and availability according to actual needs: during the debugging phase, it can be configured to log for easy troubleshooting; in the production environment, it can be configured to discard logs or issue alarms to improve security. This design allows the enhanced verification mechanism to adapt to various application scenarios.

[0054] This example demonstrates a complete enhanced verification workflow for processing network packets from receipt. Complete workflow example: 1. Data Reception Phase: The network card driver receives a TCP data packet and creates an sk_buff structure. The driver calls skb_set_ecs_enabled(skb) to enable enhanced checksum, and then calls generate_ecs_checksum(skb) to generate and store the enhanced checksum value.

[0055] 2. Network Layer Processing Stage: The data packet arrives at the IP layer processing function. Before processing, the enhanced checksum flag is checked, and the verification function verify_ecs_checksum(skb) is called. After successful verification, normal IP protocol processing is performed.

[0056] 3. Transport Layer Processing Stage: The data packet arrives at the TCP layer. The enhanced checksum is verified again. Because TCP layer processing is complex, it may modify the data content (such as updating the sequence number), requiring the enhanced checksum to be regenerated.

[0057] 4. Filtering Layer Processing Stage: The data packet arrives at the Netfilter framework. Depending on the configured policy, the data packet may need to be modified. The enhanced checksum needs to be updated after each modification.

[0058] 5. Application Layer Delivery Phase: Data packets are prepared for delivery to user-space applications. A final verification enhances the checksum to ensure that the data has not been abnormally modified during internal processing.

[0059] 6. Example of exception handling: Suppose that enhanced checksum verification fails at a certain stage of processing. The system searches for a matching policy based on the current module (transport layer) and protocol (TCP), and finds that the configured policy is ECS_ACTION_LOG. The system logs the exception and then degrades to continuing processing using only TCP checksum instead of directly discarding the data packet.

[0060] By performing verification at each critical processing stage and updating checksums promptly after data modification, end-to-end protection of data integrity is achieved. The flexibility of anomaly handling ensures that when a problem is detected, the system can take the most appropriate action based on its strategy, guaranteeing security while avoiding excessive disruption to normal system operation.

[0061] Key innovations of this invention: (1) Multi-layer verification factor fusion: The data content, system secret value, runtime state, timing information and context information are fused to create a highly unique and difficult-to-forge enhanced verification value.

[0062] (2) Position-sensitive tail processing: Position-based shifting and combination processing is performed on tail data that is less than the word length, which enhances the resistance to structural tampering.

[0063] (3) Time window fault tolerance verification: During verification, the time window is allowed to fluctuate by ±1, which prevents replay attacks and tolerates reasonable processing delays.

[0064] (4) Context binding prevents misuse: By binding the processing context information, it ensures that the data can only be used in the legal processing path, and prevents abnormal reuse across modules and paths.

[0065] (5) Policy-driven exception handling: Provides flexible exception handling strategies, allowing a balance between security and availability in different scenarios.

[0066] (6) Fully internalized design: The entire enhanced verification mechanism is used only within the system and does not affect external protocols and interfaces, thus maintaining the system's compatibility.

[0067] In a preferred embodiment, the initial secret value is generated in one of the following ways: Random numbers are generated using a hardware random source or a kernel random source during system startup; It is derived from the device's unique identifier information through a hybrid operation.

[0068] In a preferred embodiment, the calculation formula for the time window identifier in the timing information binding is: window_id = tick_count / ticks_per_window, where the ticks_per_window value is configured by the user according to specific circumstances.

[0069] In a preferred embodiment, during the enhanced verification process, since the time window may fluctuate, the system attempts to use three values—window_id, window_id-1, and window_id+1—for verification to tolerate boundary errors.

[0070] In a preferred embodiment, the exception handling strategy is configured in one of the following ways: Initialization configuration: Specified by kernel module loading parameters or configuration files during system startup or module loading; Runtime dynamic configuration: Allows administrators to adjust policies through a control interface; Fixed configuration at compile time: Fixed strategies are implemented through compile-time macro definitions or firmware configuration.

[0071] This invention can be widely applied in the following fields: Operating system kernel security enhancements: These are used to protect the integrity of internal kernel data structures and prevent kernel vulnerabilities from being exploited.

[0072] Network device security protection: Protocol stack implementation for network devices such as routers and switches to prevent internal data from being tampered with.

[0073] Embedded system security: Used in embedded environments such as IoT devices and industrial control systems to protect the internal data flow of the system.

[0074] Cloud platform security: Internal data protection for virtualization layers and container runtime.

[0075] Network security equipment: Used for data protection of security devices such as firewalls and intrusion detection systems.

[0076] The implementation of this invention does not require special hardware support and can be implemented entirely at the software level, exhibiting good deployability and practicality.

[0077] Based on the same inventive concept, embodiments of the present invention also provide a data processing consistency verification system based on internal system enhancement verification, used to implement the method, including: The enhanced verification management module is used to manage the activation status, policy configuration, and system statistics of the enhanced verification enable flag; The check value generation module is used to perform the calculation of enhanced check values. The checksum verification module is used to verify the correctness of the enhanced checksum during data processing. The exception handling module is used to handle verification failures according to the pre-configured strategy. The policy configuration module provides a policy configuration interface and management functions.

[0078] The enhanced verification method and system for internal data processing provided by this invention have the following beneficial effects: Enhanced data integrity protection: By introducing multiple layers of verification factors, the system's internal data anti-tampering capability is significantly improved, enabling the detection of abnormal modifications that cannot be detected by protocol layer verification.

[0079] Preventing data replay and misuse: Through time-series binding and context binding mechanisms, the system effectively prevents data from being replayed or incorrectly reused across paths, thus enhancing system security.

[0080] Compatibility and performance balance: Existing protocol fields are not modified to maintain external compatibility; adaptive word length accumulation calculation and position-sensitive tail processing are adopted to ensure high processing performance while guaranteeing security.

[0081] Flexible exception handling mechanism: Provides configurable exception handling strategies, which can take different actions according to the needs of different modules and protocols, balancing security and availability.

[0082] Internal protection layer design: The enhanced verification mechanism is used only within the system and does not participate in external communication, thus avoiding impact on external protocols and interfaces.

[0083] Example embodiments have been disclosed herein, and while specific terminology has been used, it is for illustrative purposes only and should be construed as such, and is not intended to be limiting. In some instances, it will be apparent to those skilled in the art that features, characteristics, and / or elements described in conjunction with particular embodiments may be used alone, or in combination with features, characteristics, and / or elements described in conjunction with other embodiments, unless otherwise expressly indicated. Therefore, those skilled in the art will understand that various changes in form and detail may be made without departing from the scope of the invention as set forth in the appended claims.

Claims

1. A data processing consistency verification method based on enhanced internal system verification, characterized in that, include: When a data instance first enters the system's internal processing flow, set an internal enhanced verification enable flag for the data instance; An enhanced verification value is generated for a data instance with an enabled enhanced verification flag. The process of generating the enhanced verification value is as follows: performing cumulative calculation based on the processor word length and position-sensitive combination processing on the tail data of the data content; using the initial secret value as the initial value of the accumulation; incorporating the runtime disturbance factor into the current accumulated value through XOR operation; binding the timing information into the current accumulated value through addition operation; and binding the context information into the current accumulated value through addition operation to obtain the final enhanced verification value. When processing the data instance subsequently, if an enhanced verification enabled flag is detected, the enhanced verification value is recalculated and compared with the stored enhanced verification value for verification. When enhanced verification fails, the corresponding action is executed according to the pre-configured exception handling strategy.

2. The method according to claim 1, characterized in that, The initial secret value in the enhanced verification value generation step is generated when the system starts up and remains stable throughout the entire system operation cycle, and is stored only in a controlled memory area inside the system.

3. The method according to claim 1, characterized in that, The runtime disturbance factor in the enhanced check value generation step includes at least one of the following: the session or connection identifier to which the current data belongs, the thread ID of the current data being processed, or the processing queue number.

4. The method according to claim 1, characterized in that, The timing information binding in the enhanced check value generation step includes: dividing time into time windows of fixed length, with each time window corresponding to a unique identifier value; when data first enters the system processing flow, calculating the identifier of the time window based on the current time, and incorporating the identifier into the enhanced check value.

5. The method according to claim 4, characterized in that, In the enhanced verification step, the system attempts to use the current time window identifier and its adjacent window identifiers for verification in order to tolerate time boundary errors.

6. The method according to claim 1, characterized in that, The context information binding in the enhanced verification value generation step includes at least one of the following: the identifier of the processing module to which it belongs, the identifier of the interface or path through which the data enters the system, and the expected processing type or protocol type.

7. The method according to claim 1, characterized in that, The data processing in the enhanced checksum generation step includes: Accumulation calculation based on processor word length: The accumulation unit length is selected according to the current processor architecture, and the data content is accumulated in machine word units after being aligned by word length; Position-sensitive combination processing of tail data: When the data length is less than a complete word length, each remaining byte is shifted according to its relative position in the data, and the shifted results are combined into a word length data and then added together.

8. The method according to claim 1, characterized in that, The processing strategies in the anomaly handling steps include at least one of the following: discarding data, recording abnormal events, triggering an alarm mechanism, and downgrading processing to rely solely on the original protocol verification.

9. The method according to claim 8, characterized in that, The exception handling strategy is configured according to the protocol type and / or processing module. Different exception handling strategies can be configured for different protocol types and / or different processing modules.

10. A data processing consistency verification system based on internal enhanced verification, used to implement the method described in any one of claims 1-9, characterized in that, include: The enhanced verification management module is used to manage the activation status, policy configuration, and system statistics of the enhanced verification enable flag; The check value generation module is used to perform the calculation of enhanced check values. The checksum verification module is used to verify the correctness of the enhanced checksum during data processing. The exception handling module is used to handle verification failures according to the pre-configured strategy. The policy configuration module provides a policy configuration interface and management functions.

Images