Data verification method and system based on Hash algorithm

Abstract

The invention discloses a data verification method and system based on a Hash algorithm, and the method comprises the steps: firstly building an access behavior baseline model for a target data object, recording an integrity proof chain of verification history, then intelligently starting a verification process through periodicity, during access or a predictive trigger mechanism based on risk assessment, and during verification, intelligently starting a verification process through an integrity proof chain of the verification history; the system dynamically generates a hash factor according to the current context and the check strategy hierarchy assigned for the data object, constructs a Merkle tree by using a hash algorithm corresponding to the hierarchy in combination with the data content, generates a current integrity signature, compares the signature with the newest historical signature in the proof chain, automatically starts a self-healing process if the signature is inconsistent with the newest historical signature in the proof chain, and does not start the self-healing process if the signature is not consistent with the newest historical signature in the proof chain. According to the process, the damaged data blocks can be accurately positioned and repaired from the redundant copies. According to the method, the problems that existing data verification is static and passive, the risk cannot be sensed, and the automatic repair capability is lacked are solved, and the intelligence, the safety and the system toughness of data integrity guarantee are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of computer data security technology, specifically to a data verification method and system based on a hash algorithm. Background Technology

[0002] In modern information technology systems, data integrity is the cornerstone of ensuring business continuity, security, and compliance. During data storage, data may be unexpectedly altered due to hardware failures, software defects, network errors, or malicious attacks, leading to serious consequences. Therefore, establishing an efficient and reliable data integrity verification mechanism is of paramount importance.

[0003] Currently, the most widely used data integrity verification technology in the industry is based on cryptographic hash algorithms, such as MD5, SHA-256, and SM3. The basic principle is to perform a hash operation on the data block or the entire file to generate a fixed-length hash signature. When verification is required, the hash signature is recalculated and compared with the previously stored baseline signature. If the two match, it can be considered with a high probability that the data has not been tampered with.

[0004] However, existing data verification techniques based on hash algorithms have the following drawbacks: The verification mechanism is static and passive: Traditional verification methods usually adopt a fixed and unchanging strategy, using the same hash algorithm and the same verification triggering time for all data objects. This one-size-fits-all approach cannot differentiate protection based on the importance, security level, or business value of the data object itself, which may result in insufficient protection for core data, while excessive verification of non-critical data wastes computing resources.

[0005] Lack of risk perception capability: Existing technologies often focus on the static integrity of data at a specific point in time in isolation, while ignoring the dynamic context of data access behavior. For example, a legitimate access initiated by a trusted IP during normal working hours and an access initiated by an abnormal IP with the same legitimate credentials in the early morning are considered equivalent and indistinguishable routine operations by traditional verification mechanisms. The fundamental flaw of this mechanism is that it cannot identify that high-risk access behavior is usually the preliminary reconnaissance stage of destructive attacks such as subsequent data tampering, backdoor implantation, or ransomware encryption. Therefore, it cannot trigger any effective security response when it detects early signs of potential threats, such as generating high-priority alerts, conducting mandatory audits of the access session, or leaving crucial contextual evidence for subsequent security analysis, thus missing a valuable window for intervention and blocking in the early stages of the attack chain.

[0006] The response and handling process is slow and reliant on manual intervention: When hash verification fails and data inconsistency is detected, subsequent operations often require manual intervention from the system administrator. The entire response chain is long, the processing efficiency is low, and it may lead to long-term business interruption. In complex situations, it is also prone to human error.

[0007] Therefore, there is an urgent need for a new data verification method and system that can overcome the above-mentioned defects, achieve risk perception, strategy adaptation, and have automated closed-loop repair capabilities. Summary of the Invention

[0008] To address the problems existing in the background technology, this invention proposes a data verification method and system based on hash algorithms. This addresses the issues of traditional hash verification methods, such as the static and passive nature of their verification mechanism, lack of awareness of access context risks, reliance on manual intervention in response and delayed response processes, resulting in insufficient protection of core data and poor self-healing ability when the system encounters data corruption. The invention achieves predictive verification triggering based on risk assessment, context-adaptive adjustment of verification strategies and strength, and automated closed-loop repair after detecting data inconsistency.

[0009] To achieve the above objectives, the present invention adopts the following technical solution: A data verification method based on a hash algorithm includes the following steps: S1. Register the target data object and assign a verification strategy level. Create an integrity proof chain to record the verification information of the target data object in each verification. Calculate the initial integrity signature of the target data object based on the preset hash algorithm and store the initial integrity signature as a historical signature in the integrity proof chain. Obtain the access behavior of the target data object to establish an access behavior baseline model. S2. Trigger the verification process for the target data object through at least one of the following mechanisms: periodic triggering, access-time triggering, and predictive triggering; S3. Based on the specific context that triggered this verification process and the verification strategy level of the target data object, generate a dynamic hash factor, and combine the content of the data object with the dynamic hash factor to calculate and generate the current integrity signature for this verification. S4. Compare the current integrity signature with the latest historical signature stored in the integrity proof chain. If the comparison results are consistent, generate a verification record containing the verification information and link the verification record to the end of the integrity proof chain. If the comparison results are inconsistent, determine that the integrity verification of the target data object has failed and start the automated response and self-healing process.

[0010] Specifically, in step S1, when registering data for the target data object, its static metadata and business metadata are extracted. The static metadata includes the data object's unique identifier, file type, owner information, and creation timestamp. The business metadata includes the application system identifier to which the data object belongs, data security level, and business importance label. The verification strategy hierarchy is assigned based on the business metadata extracted from the data registration, including the regular layer (L1), the important layer (L2), and the core layer (L3). The steps for establishing the access behavior baseline model are as follows: continuously collect all successful access events of the target data object within a preset time window T, and train the extracted features based on the multidimensional access features of each access event using a machine learning algorithm to generate an access behavior baseline model that represents the normal access pattern; the multidimensional access features include: visitor identity, user group or role to which the visitor belongs, access source IP address and geographical location, access time window and access operation type.

[0011] Specifically, in step S2, the periodic triggering mechanism is used to detect silent data corruption that occurs during non-access periods. The periodic triggering mechanism is as follows: based on the assigned verification strategy level, the time interval and execution time of periodic trigger verification for different data objects are determined. The time interval for the core layer L3 level is 6 hours, and the execution time is a fixed time point every day. The time interval for the important layer L2 level is 24 hours, and the execution time is during the low-peak period of system business. The time interval for the regular layer L1 level is one week, and the execution time is a fixed time point every week. The access-time triggering mechanism is used to ensure that all data used is verified. Specifically, the access-time triggering mechanism is as follows: if it is a write operation, all verification strategy levels will be forcibly triggered to perform verification; if it is a read operation, only L2 and L3 levels will be triggered to perform verification. The triggering time is when the access request for the data object arrives. Predictive triggering mechanisms are used to enforce audits and forensic investigations, and specifically include the following steps: (1) Upon receiving a current access request for the target data object, extract the multi-dimensional access features of the access request in real time; (2) Input the real-time multidimensional access features into the access behavior baseline model for risk assessment and calculate the risk score; (3) If the risk score exceeds the threshold, a real-time alarm is sent to the preset security management platform and the corresponding L3 level verification is triggered. The threshold is set according to the hierarchical level of the verification strategy. The priority order of the triggering mechanisms is: predictive triggering > access-time triggering > periodic triggering; if two or more triggering mechanisms are triggered at the same time, only the triggering mechanism with the highest priority will be executed to avoid duplicate verification.

[0012] Specifically, step S3 includes: S31. Collect the specific context information that triggered this verification, and extract the dynamic hash factor components according to the verification strategy level; the context information includes the triggering mechanism type that triggered this verification process, the metadata of the data object, the multi-dimensional access characteristics of the access request, the verification strategy level, and the current timestamp. If this verification process is triggered by a predictive triggering mechanism, then further extract the risk score as additional context information; the dynamic hash factor composition rule is: select and combine elements from the context information according to the verification strategy level. The higher the verification strategy level, the more complex the combined elements. The specific rule is as follows: Level L3: Dynamic hash factor F = Hash(data security level + application system identifier + trigger mechanism type + risk score + visitor identity identifier + access source IP address + verification strategy level); Level L2: Dynamic hash factor F = Hash(data security level + business importance label + trigger timestamp + verification strategy level); Level L1: Dynamic hash factor F = Hash(file type + creation timestamp + trigger timestamp); S32. Determine the block size for the target data object according to the verification strategy hierarchy, and divide the data object into N data blocks according to the block size. If the last data block is smaller than the block size, it is padded with a fixed padding character. S33. Calculate the hash value of each data block. The block hash is calculated using the hash algorithm corresponding to the verification strategy level. ,in This indicates byte stream concatenation; the mapping rules between the verification strategy level and the hash algorithm are as follows: L3 level uses the SHA3-512 algorithm, L2 level uses the SM3 algorithm, and L1 level uses the MD5 algorithm. S34. Construct the Merkle tree and generate the current integrity signature. The Merkle tree construction process is as follows: a. Hash all data blocks... a. As leaf nodes of the Merkle tree, sort them according to the data block order; b. For nodes at each level, group them in pairs in order, calculate the hash of the parent node of each group, and if the number of nodes at that level is odd, copy the last node as its right child; c. Repeat step b until the root node hash is calculated. The root node hash is the current integrity signature for this verification.

[0013] Specifically, step S4 includes: S41. Extract the historical integrity signature from the last valid block in the integrity proof chain. The rule for determining a valid block is as follows: blocks in the integrity proof chain are arranged in timestamp order, and blocks containing only successful verification records are considered valid blocks. S42. Transfer the current integrity signature generated in step S3. and Perform precise byte matching, if If the verification is successful, proceed to step S43; if... If the verification fails, proceed with step S44. S43. Generate a verification record, which includes a verification timestamp, a unique identifier for the data object, a verification strategy level, a trigger mechanism type, a risk score, a visitor's identity identifier, the source IP address of the visitor, and the current integrity signature. Latest historical signatures The comparison results and verification failure locations are then used to calculate the hash algorithm corresponding to the verification strategy level of the data object. =Hash(verification record || previous block) ), and verify the record with Package it into a new block and add it to the end of the integrity proof chain; S44. If the integrity verification of the target data object fails, an automated response and self-healing process will be initiated, including: (1) Generate a verification failure record containing the verification failure status, the detected inconsistent signature information and the context information that triggered this verification, and link it to the end of the integrity proof chain; at the same time, send a real-time alarm to the preset security management platform. (2) Based on the Merkle tree constructed for the target data object, compare with historical integrity signatures. The corresponding Merkle tree branch nodes can be used to quickly locate data blocks whose content has changed. (3) Obtain the healthy version of the changed data block in the trusted state before the verification failure from the redundant replica storage configured for the target data object, and replace the corresponding changed data block in the current target data object with the obtained healthy version; (4) After the data recovery operation is completed, immediately re-execute the dynamic signature generation and verification steps on the repaired target data object, and write the result of the verification after repair as a new record into the integrity proof chain.

[0014] A system for performing the above-described hash algorithm-based data verification method includes: The initialization and modeling module calculates the initial integrity signature of a specified target data object, creates an integrity proof chain to record the verification information of the target data object, stores the initial integrity signature as the first record in the integrity proof chain, and obtains the historical access behavior of the target data object to establish an access behavior baseline model. The verification triggering module triggers the verification process for the target data object through at least one of the following mechanisms: a. a periodic triggering mechanism that is automatically triggered according to a preset time strategy; b. an access-time triggering mechanism that is triggered when the target data object is requested to be accessed; c. a predictive triggering mechanism that is triggered when the deviation between the context of the current access request and the baseline model of access behavior exceeds a preset threshold. The dynamic signature generation module obtains the current context information that triggered this verification process, generates a dynamic hash factor based on the current context information, and calculates and generates the current integrity signature for this verification by combining the content of the target data object with the dynamic hash factor. The verification and recording module compares the current integrity signature with the integrity signature in the latest record stored in the integrity proof chain, and generates a verification record containing the verification information based on the comparison result, and links the verification record to the end of the integrity proof chain. The data recovery module restores and recovers data based on the healthy version stored in the redundant copy configured for the target data object.

[0015] In summary, the beneficial technical effects of the present invention are as follows: 1. Intelligent adaptive verification strategy is achieved, and system resource allocation is optimized: This invention overcomes the drawbacks of the traditional one-size-fits-all approach by introducing a hierarchical verification strategy and associating it with the business metadata of the data. The system can provide differentiated protection for data objects of different values: higher frequency and stronger algorithm verification is used for core data, while more economical strategies are used for regular data. This intelligent adaptive mechanism ensures that computing resources are used to protect the most critical assets, and significantly improves the operating efficiency and economy of the entire system without sacrificing security. 2. An automated closed loop from alarm to self-healing is achieved, greatly enhancing system resilience: This invention fully automates the response process after verification failure. When data inconsistency is detected, the system can not only accurately locate the damaged data block based on the Merkle tree, but also automatically obtain health data from redundant copies and complete the repair. Finally, it performs verification and archiving, realizing an automated closed loop of detection-location-repair-verification. This eliminates the dependence on manual intervention, shortens data recovery time, greatly reduces the risk of business interruption, and significantly improves system reliability and business continuity. 3. Enhanced security and audit traceability of the verification process: By introducing a dynamic hash factor strongly correlated with the current context, this invention makes the signature of each verification unpredictable, greatly increasing the difficulty for attackers to forge correct hash signatures. At the same time, by constructing an immutable integrity proof chain to record the complete context and result of each verification, it provides strong, credible, and traceable judicial and audit evidence for all data integrity events, meeting high-level security compliance requirements. Attached Figure Description

[0016] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a system overview diagram of the present invention. Detailed Implementation

[0017] To make the technical means, creative features, objectives and effects of this invention clearer and easier to understand, the invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

[0018] Example like Figure 1 As shown, the present invention provides a data verification method based on a hash algorithm, which specifically includes the following steps: S1. Register the target data object and assign a verification strategy level. Create an integrity proof chain to record the verification information of the target data object in each verification. Calculate the initial integrity signature of the target data object based on the preset hash algorithm and store the initial integrity signature as a historical signature in the integrity proof chain. Obtain the access behavior of the target data object to establish an access behavior baseline model. When registering data for a target data object, its static metadata and business metadata are extracted. The static metadata includes the data object's unique identifier, file type, owner information, and creation timestamp. The business metadata includes the application system identifier to which the data object belongs, data security level, and business importance label. The verification strategy level is assigned based on the business metadata extracted from the data registration. For example, if the application system to which the target data object belongs is a financial system, and its data security level is high or its business importance label is important, then a higher verification strategy level will be assigned. The verification strategy levels include the regular level L1, the important level L2, and the core level L3. The access behavior baseline model is used to characterize the normal access patterns of target data objects. Its core is to learn the feature distribution of normal access events through unsupervised machine learning algorithms, thereby identifying access that deviates from the baseline. Taking financial system transaction data as an example, the model building steps are as follows: 1. Data Acquisition: Based on the business cycle of the target data object, select a time window that covers the entire normal business cycle to ensure that the collected data includes various normal scenarios such as "peak weekdays", "off-peak weekdays", and "weekends"; the baseline model needs to learn the normal access patterns, so only successful access events are collected within the time window; store the collected access events as structured data, with fields including: visitor identity, visitor's user group / role, access source IP address and geographical location, access time and access operation type; 2. For each successful access event, extract the core features and convert them into numerical / classification features that can be processed by machine learning: (1) Visitor identity: retain the identity string; (2) Visitor's user group / role: convert the role into a classification code; (3) Access source IP address and geographic location: convert the source IP into geographic location information through the MaxMind GeoIP2 database, and then convert the geographic location into a region code through dictionary mapping; (4) Access time window: extract the access time marker to the corresponding time window code; (5) Access operation type: convert the operation_type into a classification code; 3. Model Selection and Training: The One-Class SVM algorithm, suitable for unsupervised anomaly detection, is adopted. It requires no labeled anomalous samples, learns the boundaries of normal data, and identifies anomalous accesses deviating from these boundaries. Its core advantage lies in its good generalization ability to high-dimensional data, and the expected proportion of outliers can be controlled via the `nu` parameter, meeting the business requirements for false positive rate. Based on the low false positive rate requirements of the financial system, the parameter `kernel='rbf'` is set, using radial basis functions to handle nonlinear features, `nu=0.005`, the expected outlier proportion is 0.5%, and `gamma='scale'` automatically calculates the gamma value. To adapt to the feature scale, the preprocessed feature vectors are used to form a training set X with shape [m,n], where m = number of access events and n = feature dimension. The OneClassSVM class in the scikit-learn library is used for training. After training, the model clf calculates the anomaly score for a new access event feature vector x using the clf.decision_function function, and takes the reciprocal as the risk score.

[0019] S2. Trigger the verification process for the target data object through at least one of the following mechanisms: periodic triggering, access-time triggering, and predictive triggering; The periodic triggering mechanism is used to detect silent data corruption that occurs during non-access periods. Specifically, the periodic triggering mechanism is based on the assigned verification strategy level to determine the time interval and execution time for periodic verification of different data objects. The core layer L3 level has a time interval of 6 hours and the execution time is a fixed time point every day. The important layer L2 level has a time interval of 24 hours and the execution time is during the low peak period of system business. The regular layer L1 level has a time interval of one week and the execution time is a fixed time point every week. The access-time triggering mechanism is used to ensure that all data used is verified. Specifically, the access-time triggering mechanism is as follows: if it is a write operation, all verification strategy levels will be forcibly triggered to perform verification; if it is a read operation, only L2 and L3 levels will be triggered to perform verification. The triggering time is when the access request for the data object arrives. Predictive triggering mechanisms are used to enforce audits and forensic investigations, and specifically include the following steps: (1) Upon receiving a current access request for the target data object, extract the multi-dimensional access features of the access request in real time; (2) Input the real-time multidimensional access features into the access behavior baseline model for risk assessment and calculate the risk score; (3) If the risk score exceeds the threshold, the corresponding L3 level verification is triggered. The threshold is set according to the hierarchical level of the verification strategy. The priority order of the triggering mechanisms is: predictive triggering > access-time triggering > periodic triggering; if two or more triggering mechanisms are triggered at the same time, only the triggering mechanism with the highest priority will be executed to avoid duplicate verification.

[0020] S3. Based on the specific context that triggered this verification process and the verification strategy level of the target data object, generate a dynamic hash factor. Combine the content of the data object with the dynamic hash factor to calculate and generate the current integrity signature for this verification; specifically including: S31. Collect the specific context information that triggered this verification, and extract the dynamic hash factor components according to the verification strategy level; the context information includes the triggering mechanism type that triggered this verification process, the metadata of the data object, the multi-dimensional access characteristics of the access request, the verification strategy level, and the current timestamp. If this verification process is triggered by a predictive triggering mechanism, then further extract the risk score as additional context information; the dynamic hash factor composition rule is: select and combine elements from the context information according to the verification strategy level. The higher the verification strategy level, the more complex the combined elements. The specific rule is as follows: Level L3: Dynamic hash factor F = Hash(data security level + application system identifier + trigger mechanism type + risk score + visitor identity identifier + access source IP address + verification strategy level); Level L2: Dynamic hash factor F = Hash(data security level + business importance label + trigger timestamp + verification strategy level); Level L1: Dynamic hash factor F = Hash(file type + creation timestamp + trigger timestamp); S32. Determine the block size for the target data object according to the verification strategy hierarchy. The higher the hierarchy, the smaller the block size, in order to improve the damage location accuracy. Then, divide the data object into N data blocks according to the block size. If the last data block is smaller than the block size, it is padded with a fixed padding character. S33. Calculate the hash value of each data block. The block hash is calculated using the hash algorithm corresponding to the verification strategy level. ,in This indicates byte stream concatenation; the mapping rules between the verification strategy level and the hash algorithm are as follows: L3 level uses the SHA3-512 algorithm, L2 level uses the SM3 algorithm, and L1 level uses the MD5 algorithm. S34. Construct the Merkle tree and generate the current integrity signature. The Merkle tree construction process is as follows: a. Hash all data blocks... a. As leaf nodes of the Merkle tree, sort them according to the data block order; b. For nodes at each level, group them in pairs in order, calculate the hash of the parent node of each group, and if the number of nodes at that level is odd, copy the last node as its right child; c. Repeat step b until the root node hash is calculated. The root node hash is the current integrity signature for this verification.

[0021] S4. Compare the current integrity signature with the latest historical signature stored in the integrity proof chain. If the comparison results match, generate a verification record containing the verification information and link the verification record to the end of the integrity proof chain. If the comparison results do not match, determine that the integrity verification of the target data object has failed and initiate an automated response and self-healing process; specifically including: S41. Extract the historical integrity signature from the last valid block in the integrity proof chain. The rule for determining a valid block is as follows: blocks in the integrity proof chain are arranged in timestamp order, and blocks containing only successful verification records are considered valid blocks. S42. Transfer the current integrity signature generated in step S3. and Perform precise byte matching, if If the verification is successful, proceed to step S43; if... If the verification fails, proceed with step S44. S43. Generate a verification record, which includes a verification timestamp, a unique identifier for the data object, a verification strategy level, a trigger mechanism type, a risk score, a visitor's identity identifier, the source IP address of the visitor, and the current integrity signature. Latest historical signatures The comparison results and verification failure locations are then used to calculate the hash algorithm corresponding to the verification strategy level of the data object. =Hash(verification record || previous block) ), and verify the record with Package it into a new block and add it to the end of the integrity proof chain; S44. If the integrity verification of the target data object fails, an automated response and self-healing process will be initiated, including: (1) Generate a verification failure record containing the verification failure status, the detected inconsistent signature information and the context information that triggered this verification, and link it to the end of the integrity proof chain; at the same time, send a real-time alarm to the preset security management platform. (2) Based on the Merkle tree constructed for the target data object, compare with historical integrity signatures. The corresponding Merkle tree branch nodes can be used to quickly locate data blocks whose content has changed. (3) Obtain the healthy version of the changed data block in the trusted state before the verification failure from the redundant replica storage configured for the target data object, and replace the corresponding changed data block in the current target data object with the obtained healthy version; (4) After the data recovery operation is completed, immediately re-execute the dynamic signature generation and verification steps on the repaired target data object, and write the result of the verification after repair as a new record into the integrity proof chain.

[0022] like Figure 2 As shown, the present invention provides a system for performing the above-described data verification method based on a hash algorithm, specifically comprising: The initialization and modeling module calculates the initial integrity signature of a specified target data object, creates an integrity proof chain to record the verification information of the target data object, stores the initial integrity signature as the first record in the integrity proof chain, and obtains the historical access behavior of the target data object to establish an access behavior baseline model. The verification triggering module triggers the verification process for the target data object through at least one of the following mechanisms: a. a periodic triggering mechanism that is automatically triggered according to a preset time strategy; b. an access-time triggering mechanism that is triggered when the target data object is requested to be accessed; c. a predictive triggering mechanism that is triggered when the deviation between the context of the current access request and the baseline model of access behavior exceeds a preset threshold. The dynamic signature generation module obtains the current context information that triggered this verification process, generates a dynamic hash factor based on the current context information, and calculates and generates the current integrity signature for this verification by combining the content of the target data object with the dynamic hash factor. The verification and recording module compares the current integrity signature with the integrity signature in the latest record stored in the integrity proof chain, and generates a verification record containing the verification information based on the comparison result, and links the verification record to the end of the integrity proof chain. The data recovery module restores and recovers data based on the healthy version stored in the redundant copy configured for the target data object.

[0023] Therefore, the data verification method and system based on hash algorithm provided by this invention solves the problems of insufficient protection of core assets and poor system resilience caused by the static and passive verification mechanism, lack of risk perception capability, and reliance on manual intervention in response and handling processes of traditional hash verification methods. It achieves intelligent on-demand allocation of data verification and protection resources and rapid automatic repair of data integrity failures. It provides an innovative technical solution that balances high security, high efficiency and high reliability for application scenarios with stringent requirements for data security and business continuity, such as cloud computing, distributed storage, and financial databases.

[0024] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A data verification method based on a hash algorithm, characterized in that, Includes the following steps: S1. Register the target data object and assign a verification strategy level. Create an integrity proof chain to record the verification information of the target data object in each verification. Calculate the initial integrity signature of the target data object based on the preset hash algorithm and store the initial integrity signature as a historical signature in the integrity proof chain. Acquire access behavior of the target data object to establish a baseline model of access behavior; S2. Trigger the verification process for the target data object through at least one of the following mechanisms: periodic triggering, access-time triggering, and predictive triggering; S3. Based on the specific context that triggered this verification process and the verification strategy level of the target data object, generate a dynamic hash factor, and combine the content of the data object with the dynamic hash factor to calculate and generate the current integrity signature for this verification. S4. Compare the current integrity signature with the latest historical signature stored in the integrity proof chain. If the comparison results are consistent, generate a verification record containing the verification information and link the verification record to the end of the integrity proof chain. If the comparison results are inconsistent, determine that the integrity verification of the target data object has failed and start the automated response and self-healing process.

2. The data verification method based on a hash algorithm according to claim 1, characterized in that: In step S1, when registering data for the target data object, its static metadata and business metadata are extracted. The static metadata includes the data object's unique identifier, file type, owner information, and creation timestamp. The business metadata includes the application system identifier to which the data object belongs, data security level, and business importance label. The verification strategy hierarchy is assigned based on the business metadata extracted from the data registration, including the regular layer (L1), the important layer (L2), and the core layer (L3). The steps for establishing the access behavior baseline model are as follows: continuously collect all successful access events of the target data object within a preset time window T, and train the extracted features based on the multidimensional access characteristics of each access event through machine learning algorithms to generate an access behavior baseline model that represents the normal access pattern. The multidimensional access features include: visitor identity, visitor's user group or role, access source IP address and geographical location, access time window and access operation type.

3. The data verification method based on a hash algorithm according to claim 2, characterized in that, In step S2, the periodic triggering mechanism is used to detect silent data corruption that occurs during non-access periods. Specifically, the periodic triggering mechanism is as follows: based on the assigned verification strategy level, the time interval and execution time for periodic triggering verification of different data objects are determined. The time interval for the core layer L3 level is 6 hours, and the execution time is a fixed time point every day. The time interval for the important layer L2 level is 24 hours, and the execution time is during the low-peak period of system business. The time interval for the regular layer L1 level is one week, and the execution time is a fixed time point every week. The access-time triggering mechanism is used to ensure that all data used is verified. Specifically, the access-time triggering mechanism is as follows: if it is a write operation, all verification strategy levels will be forcibly triggered to perform verification; if it is a read operation, only L2 and L3 levels will be triggered to perform verification. The triggering time is when the access request for the data object arrives. Predictive triggering mechanisms are used to enforce audits and forensic investigations, and specifically include the following steps: (1) Upon receiving a current access request for the target data object, extract the multi-dimensional access features of the access request in real time; (2) Input the real-time multidimensional access features into the access behavior baseline model for risk assessment and calculate the risk score; (3) If the risk score exceeds the threshold, the corresponding L3 level verification is triggered. The threshold is set according to the hierarchical level of the verification strategy. The priority order of the triggering mechanisms is: predictive triggering > access-time triggering > periodic triggering; if two or more triggering mechanisms are triggered at the same time, only the triggering mechanism with the highest priority will be executed to avoid duplicate verification.

4. The data verification method based on a hash algorithm according to claim 3, characterized in that, Step S3 specifically includes: S31. Collect the specific context information that triggered this verification, and extract the dynamic hash factor components according to the verification strategy level; the context information includes the triggering mechanism type that triggered this verification process, the metadata of the data object, the multi-dimensional access characteristics of the access request, the verification strategy level, and the current timestamp. If this verification process is triggered by a predictive triggering mechanism, then further extract the risk score as additional context information; the dynamic hash factor composition rule is: select and combine elements from the context information according to the verification strategy level. The higher the verification strategy level, the more complex the combined elements. The specific rule is as follows: Level L3: Dynamic hash factor F = Hash(data security level + application system identifier + trigger mechanism type + risk score + visitor identity identifier + access source IP address + verification strategy level); Level L2: Dynamic hash factor F = Hash(data security level + business importance label + trigger timestamp + verification strategy level); Level L1: Dynamic hash factor F = Hash(file type + creation timestamp + trigger timestamp); S32. Determine the block size for the target data object according to the verification strategy hierarchy, and divide the data object into N data blocks according to the block size. If the last data block is smaller than the block size, it is padded with a fixed padding character. S33. Calculate the hash value of each data block. The block hash is calculated using the hash algorithm corresponding to the verification strategy level. ,in This indicates byte stream concatenation; the mapping rules between the verification strategy level and the hash algorithm are as follows: L3 level uses the SHA3-512 algorithm, L2 level uses the SM3 algorithm, and L1 level uses the MD5 algorithm. S34. Construct the Merkle tree and generate the current integrity signature. The Merkle tree construction process is as follows: a. Hash all data blocks... a. As leaf nodes of the Merkle tree, sort them according to the data block order; b. For nodes at each level, group them in pairs in order, calculate the hash of the parent node of each group, and if the number of nodes at that level is odd, copy the last node as its right child; c. Repeat step b until the root node hash is calculated. The root node hash is the current integrity signature for this verification.

5. A data verification method based on a hash algorithm according to claim 4, characterized in that, Step S4 specifically includes: S41. Extract the historical integrity signature from the last valid block in the integrity proof chain. The rule for determining a valid block is as follows: blocks in the integrity proof chain are arranged in timestamp order, and blocks containing only successful verification records are considered valid blocks. S42. Transfer the current integrity signature generated in step S3. and Perform precise byte matching, if If the verification is successful, proceed to step S43; if... If the verification fails, proceed with step S44. S43. Generate a verification record, which includes a verification timestamp, a unique identifier for the data object, a verification strategy level, a trigger mechanism type, a risk score, a visitor's identity identifier, the source IP address of the visitor, and the current integrity signature. Latest historical signatures The comparison results and verification failure locations are then used to calculate the hash algorithm corresponding to the verification strategy level of the data object. =Hash(verification record || previous block) ), and verify the record with Package it into a new block and add it to the end of the integrity proof chain; S44. If the integrity verification of the target data object fails, an automated response and self-healing process will be initiated, including: (1) Generate a verification failure record containing the verification failure status, the detected inconsistent signature information and the context information that triggered this verification, and link it to the end of the integrity proof chain; at the same time, send a real-time alarm to the preset security management platform. (2) Based on the Merkle tree constructed for the target data object, compare with historical integrity signatures. The corresponding Merkle tree branch nodes can be used to quickly locate data blocks whose content has changed. (3) Obtain the healthy version of the changed data block in the trusted state before the verification failure from the redundant replica storage configured for the target data object, and replace the corresponding changed data block in the current target data object with the obtained healthy version; (4) After the data recovery operation is completed, immediately re-execute the dynamic signature generation and verification steps on the repaired target data object, and write the result of the verification after repair as a new record into the integrity proof chain.

6. A system for executing a data verification method based on a hash algorithm as described in any one of claims 1-5, characterized in that, include: The initialization and modeling module calculates the initial integrity signature of a specified target data object, creates an integrity proof chain to record the verification information of the target data object, stores the initial integrity signature as the first record in the integrity proof chain, and obtains the historical access behavior of the target data object to establish an access behavior baseline model. The verification triggering module triggers the verification process for the target data object through at least one of the following mechanisms: a. a periodic triggering mechanism that is automatically triggered according to a preset time strategy; b. An access-triggered mechanism that is triggered when the target data object is requested to be accessed; c. Assess the deviation between the context of the current access request and the baseline model of access behavior, and trigger a predictive triggering mechanism when the deviation exceeds a preset threshold; The dynamic signature generation module obtains the current context information that triggered this verification process, generates a dynamic hash factor based on the current context information, and calculates and generates the current integrity signature for this verification by combining the content of the target data object with the dynamic hash factor. The verification and recording module compares the current integrity signature with the integrity signature in the latest record stored in the integrity proof chain, and generates a verification record containing the verification information based on the comparison result, and links the verification record to the end of the integrity proof chain. The data recovery module restores and recovers data based on the healthy version stored in the redundant copy configured for the target data object.

Images