Complex link-oriented use and acquisition communication data integrity verification method and system

Abstract

The invention relates to the technical field of power communication network security, and discloses a complex link-oriented use and acquisition communication data integrity verification method and a complex link-oriented use and acquisition communication data integrity verification system. The method comprises the following steps: collecting service load data, calculating source end anchoring hash, and constructing an audit trace list containing the source end anchoring hash to obtain an initial service message; in the step-by-step forwarding process of the intermediate node, extracting a preorder node fingerprint and executing chained Hash calculation, and adding the generated current node fingerprint to the audit trace list to obtain an updated service message; the master station analyzes the update service message, and performs global consistency comparison based on the source end anchoring hash to obtain a judgment result; and if the judgment result shows that the audit trace list is abnormal, link step-by-step replay verification is performed on the audit trace list, abnormal nodes are locked, and reputation weights of the abnormal nodes in a preset routing table are reduced. According to the method, low-overhead full-link data integrity traceability can be realized.

Description

Technical Field

[0001] This invention relates to the field of power communication network security technology, and in particular to a method and system for verifying the integrity of communication data in complex links. Background Technology

[0002] Currently, with the comprehensive advancement of smart grid construction, the electricity consumption information collection system, as the nerve ending of the interaction between the power grid and users, is responsible for transmitting massive amounts of electricity consumption data to the main station in real time through multi-level communication links. Ensuring data security in complex communication network environments, especially ensuring the integrity and immutability of information in the transmission links, has become a core task in the construction of the power industry's information security protection system.

[0003] In a current technology, communication data verification in a data acquisition system primarily relies on end-to-end integrity verification mechanisms or segment-by-segment verification methods. End-to-end verification typically requires the master station and terminal devices to maintain high clock synchronization, determining whether data has been corrupted during transmission by comparing the hash digests of the source and destination. Segment-by-segment verification, on the other hand, requires each intermediate node in the link (such as a collector or concentrator) to have complete data storage and reassembly capabilities, decrypting, verifying, and repackaging each incoming message before forwarding it. However, in complex link environments such as low-voltage power line carrier or low-power wireless networks, communication paths often involve numerous resource-constrained intermediate forwarding nodes, and the network topology changes dynamically.

[0004] In summary, existing technologies present technical problems, such as difficulties in fault location. Summary of the Invention

[0005] This invention provides a method and system for verifying the integrity of communication data in complex links, in order to solve the technical problem of difficulty in fault location in the prior art.

[0006] Firstly, in order to solve the above-mentioned technical problems, the present invention provides a method for verifying the integrity of communication data in complex links, comprising: At the terminal node, service load data is collected, and the source anchor hash is calculated based on the service load data. An audit trace list containing the source anchor hash as the first element is constructed, and the audit trace list and the service load data are encapsulated to obtain the initial service message. The initial service message is forwarded level by level among the intermediate nodes of the communication link. During each level of forwarding, the intermediate node obtains its own node identity identifier and extracts the last element from the audit trace list of the received service message as the fingerprint of the preceding node. Based on the business load data, the node identity identifier, and the fingerprint of the preceding node, a hash calculation is performed to generate the fingerprint of the current node, and the audit record item containing the node identity identifier and the fingerprint of the current node is appended to the audit trace list to obtain the updated business message; When the main station receives the update service message, it parses and separates the service load data and the audit trace list. Calculate the local hash value of the business load data, and compare the local hash value with the first element in the audit trace list to obtain a global consistency determination result; If the global consistency determination result indicates data anomaly, then a step-by-step replay verification is performed on the audit trace list to obtain the verification result; Based on the verification result, the first inconsistent audit record item is identified, the node corresponding to the audit record item is determined as an abnormal node, and the reputation weight of the abnormal node in the preset routing table is reduced.

[0007] Secondly, the present invention provides a data integrity verification system for complex communication links, comprising: The terminal acquisition and encapsulation module is used to collect service load data at the terminal node, calculate the source anchor hash based on the service load data, construct an audit trace list containing the source anchor hash as the first element, and encapsulate the audit trace list with the service load data to obtain the initial service message. The intermediate cascading update module is used to forward the initial service message level by level among the intermediate nodes of the communication link. During each level of forwarding, the intermediate node obtains its own node identity identifier and extracts the last element from the audit trace list of the received service message as the fingerprint of the preceding node. The node audit generation module is used to perform hash calculation based on the business load data, the node identity identifier and the fingerprint of the preceding node to generate the current node fingerprint, and append the audit record item containing the node identity identifier and the current node fingerprint to the audit trace list to obtain the updated business message; The main station parsing module is used to parse and separate the business load data and the audit trace list when the main station receives the update business message; The global verification module is used to calculate the local hash value of the business load data and compare the local hash value with the first element in the audit trace list to obtain a global consistency judgment result. The replay diagnostic module is used to perform a step-by-step replay verification on the audit trace list if the global consistency judgment result indicates abnormal data, and obtain the verification result. The anomaly handling module is used to lock the first inconsistent audit record item based on the verification result, identify the node corresponding to the audit record item as an abnormal node, and reduce the reputation weight of the abnormal node in the preset routing table.

[0008] Compared with the prior art, the present invention has the following beneficial effects: (1) This invention achieves accurate anomaly localization of data across the entire link by constructing an audit trail list containing source-end anchor hashes at the terminal and appending audit records based on pre-sequence fingerprints level by level at intermediate nodes. Traditional end-to-end verification can only determine whether the data is damaged, but cannot locate the specific fault point; while segment-by-segment verification brings huge communication and storage overhead. This invention utilizes a mechanism that combines chained hashing with local replay at the main station, which significantly solves the problem of black-box faults in complex links.

[0009] (2) This invention effectively reduces resource consumption and communication latency of edge devices by centralizing complex verification logic at the main station, while intermediate nodes only perform lightweight hash calculations and append operations. This asymmetric verification architecture design is well-suited to the current situation of limited computing power and insufficient storage space of collectors and concentrators in electricity information collection systems. Intermediate nodes do not need to decrypt or store complete historical data; they only need to perform fingerprinting on the data flowing through them, which greatly reduces network load and ensures high real-time performance of massive electricity information collection data transmission.

[0010] (3) This invention achieves adaptive fault isolation and self-healing of communication networks by establishing a dynamic reputation evaluation and route replanning mechanism based on verification results. For locked abnormal nodes, the system does not stop at simple alarms, but automatically triggers path replanning strategies by reducing their reputation weight and marking them as unavailable in the routing table. This mechanism can significantly improve the overall resilience and long-term operational stability of power communication networks. Attached Figure Description

[0011] Figure 1 This is a schematic diagram of the process for verifying the integrity of communication data in complex links provided in the first embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of a communication data integrity verification system for complex links provided in the second embodiment of the present invention. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] Reference Figure 1 The first embodiment of the present invention provides a method for verifying the integrity of communication data in complex links, comprising the following steps: S11, collect service load data at the terminal node, calculate the source anchor hash based on the service load data, construct an audit trace list containing the source anchor hash as the first element, and encapsulate the audit trace list with the service load data to obtain the initial service message; S12, the initial service message is forwarded level by level among the intermediate nodes of the communication link. During each level of forwarding, the intermediate node obtains its own node identity identifier and extracts the last element from the audit trace list of the received service message as the fingerprint of the preceding node. S13, perform hash calculation based on the business load data, the node identity identifier and the previous node fingerprint to generate the current node fingerprint, and append the audit record item containing the node identity identifier and the current node fingerprint to the audit trace list to obtain the updated business message; S14, when the main station receives the update service message, it parses and separates the service load data and the audit trace list; S15, calculate the local hash value of the business load data, and compare the local hash value with the first element in the audit trace list to obtain a global consistency determination result; S16, if the global consistency determination result indicates data abnormality, then perform a step-by-step replay verification on the audit trace list to obtain the verification result; S17. Based on the verification result, the first inconsistent audit record item is locked, the node corresponding to the audit record item is identified as an abnormal node, and the reputation weight of the abnormal node in the preset routing table is reduced.

[0014] In step S11, service load data is collected at the terminal node, source anchor hash is calculated based on the service load data, an audit trail list containing the source anchor hash as the first element is constructed, and the audit trail list and the service load data are encapsulated to obtain an initial service message, including: Parse the real-time business information collected by the terminal node, embed timestamps and sequence identifiers, and generate an intermediate byte stream containing header fields and payload content; The source-end anchor hash is obtained by performing a digest operation on the intermediate byte stream using a hash algorithm. The audit trace list is initialized, the source anchor hash is written to the beginning of the audit trace list, and the audit trace list is appended to the extended tail space of the intermediate byte stream to encapsulate and generate the initial business message.

[0015] It should be noted that parsing the real-time service information collected by the terminal node and generating the intermediate byte stream is implemented using a binary serialization protocol (such as Protocol Buffers). The terminal node (such as a smart meter) reads power metering data (such as voltage, current, and active power) in real time through an analog-to-digital conversion interface and defines it as real-time service information. Embedding timestamps and sequence identifiers is to give the data uniqueness in the time domain. The system reads the terminal's local high-precision clock (synchronized to the NTP server) to obtain the current Unix timestamp (accurate to milliseconds), and reads and increments a monotonically increasing sequence identifier (Sequence ID) from the local non-volatile memory. Subsequently, the system constructs a memory buffer and writes the above data sequentially in the order of "message header (containing protocol version, source address, payload length) + timestamp + sequence identifier + real-time service information" to form a continuous binary data block, i.e., the intermediate byte stream.

[0016] It should be noted that the hash algorithm used to perform digest calculations on the intermediate byte stream is implemented using the SHA-256 secure hash algorithm. This operation takes the entire intermediate byte stream as input message M and calculates a fixed-length (256 bits, or 32 bytes) output value using the hash function H(M). This output value is the source-end anchor hash, which constitutes the digital fingerprint of the data at the time of its generation. Any minor alteration to the timestamp, sequence number, or business value will cause a drastic change in this hash value (avalanche effect), thus providing an immutable trust root for end-to-end integrity verification.

[0017] It is worth noting that the choice of hash algorithm (SHA-256) was determined based on a security assessment of the hash collision probability under the current computing power environment. By analyzing the computation time and collision resistance of MD5, SHA-1, and SHA-256 on industrial embedded chips, the algorithm that can resist existing known attack methods (such as length extension attacks) while meeting real-time requirements (e.g., single calculation time less than 5ms) was selected as the implementation algorithm.

[0018] It is worth noting that the SHA-256 algorithm has acceptable computational performance on standard general-purpose processors. For the embedded processors that may be used in the electricity information collection terminal and intermediate nodes, to ensure that the hash calculation does not affect the real-time performance of data collection and message forwarding, one or more of the following methods can be used to ensure performance: Selecting a microcontroller chip with a built-in hardware encryption engine, such as an AES / SHA accelerator; using a lightweight encryption algorithm library optimized for a specific processor instruction set, such as the ARM Cortex-M series; or, during system design, arranging the hash calculation task in a dedicated low-priority thread / task to stagger it from high-real-time communication tasks. The requirement of a single calculation time of less than 5ms is a reference design target set based on the typical power business data packet generation and forwarding cycle (such as seconds or hundreds of milliseconds), and can be met in actual product selection and software implementation using the above methods.

[0019] It should be noted that the initialization of the audit trace list and the encapsulation of the initial business message are achieved using a linked list structure initialization and memory concatenation technology. The system allocates a contiguous space in memory to store the audit trace list, which is designed as a dynamic array structure. During initialization, the system directly writes the 32-byte source anchor hash calculated in step S11 into index 0 (i.e., the first element) of the list. Subsequently, the system appends the audit trace list to the end of the intermediate byte stream and updates the total length field in the message header to include the length of the audit list. The final overall data packet is the initial business message, whose structure is "[Header][Payload][Timestamp][Sequence Number][Audit List (including source hash)]".

[0020] For example, the terminal node collects the current phase A voltage value as 220.5V. At this time, the system time is 1703923200000 (millisecond-level timestamp), and the sequence identifier is 1001. The system serializes this data into a 64-byte intermediate byte stream. Using the SHA-256 algorithm, this 64-byte data is processed to obtain a 32-byte hexadecimal hash value "A1B2...C3D4". The system initializes an audit trail list, writing "A1B2...C3D4" as the first record. Finally, the list containing this record is concatenated to the intermediate byte stream, forming an initial service message with a total length of 64 + 32 = 96 bytes (assuming no additional overhead for the list), and sent to the communication link.

[0021] In step S12, the initial service message is forwarded level by level among the intermediate nodes of the communication link. During each level of forwarding, the intermediate node obtains its own node identity identifier and extracts the last element from the audit trace list of the received service message as the fingerprint of the preceding node, including: The intermediate node captures the business message with the destination address matching through the communication interface, parses the structure of the business message, and locates the storage offset of the audit trace list; Read the last record item in the audit trace list, extract the fingerprint field from the last record item, and identify it as the fingerprint of the preceding node; Read the unique device ID stored in the current device as the identity identifier of the node.

[0022] It should be noted that the intermediate node's capture of service packets with matching destination addresses via the communication interface is achieved through a combination of hardware address filtering and protocol stack interrupt handling. In power line carrier (PLC) or low-power wireless communication networks, the communication chip of the intermediate node (such as a router) is configured with promiscuous mode. When a signal frame transmitted on the link passes through a node, the physical layer hardware automatically compares the destination MAC address in the frame header with the local MAC address (or broadcast / multicast address). If a match is found, the hardware triggers a receive interrupt, copying the underlying data frame payload to the socket buffer in the kernel space. Subsequently, the application layer program reads the buffer data, thus capturing the service packet.

[0023] It should be noted that parsing the structure of the business message and locating the storage offset is based on a predefined message format specification (Protocol Schema). Since the message generated in step S11 adopts a compact arrangement of "[Header][Payload][Audit List]", the message header contains a fixed payload length field (Length_Payload) and an audit list length field (Length_Audit). The intermediate node first reads the fixed-length header (denoted as Size_Header, for example, the first 16 bytes) and extracts the aforementioned length parameters. By calculating the base address offset, Offset_Audit = Size_Header + Length_Payload, the system can accurately obtain the starting physical address of the audit trace list in the memory data block.

[0024] Specifically, reading the last record in the audit trail list and separating the fingerprint field is achieved using pointer arithmetic. Since the audit trail list is a linear list composed of several fixed-length audit record entries (denoted as Size_Record), the system locates the end of the list using the formula Pointer_Tail = Offset_Audit + Length_Audit - Size_Record. For the first intermediate node in the link, this end position stores the source anchor hash written in step S11; for subsequent nodes, this position stores the record appended by the previous hop node. The system reads the data block at this address and, based on the internal structure of the record entry ([Node ID][Fingerprint Value]), extracts the latter 32 bytes of data using a bitmask, identifying it as the fingerprint of the preceding node.

[0025] It should be noted that reading the unique device ID stored in the current device as the node's identity is implemented by accessing the device's Hardware Security Module (HSM). This unique device ID (such as a chip serial number) is burned into the device during the manufacturing stage and cannot be changed. The system calls the underlying driver interface (such as ioctl) to read this ID and formats it into a byte sequence (e.g., 4 bytes) consistent with the message protocol, which serves as the identity of this node participating in subsequent hash calculations.

[0026] For example, an intermediate node receives a service message with a total length of 128 bytes. Parsing the header reveals that the header occupies 16 bytes, the payload occupies 64 bytes, and the remaining 48 bytes are an audit list (assuming each record is 16 bytes, and there are currently 3 records in the list). The system calculates that the list starts at an offset of 16 + 64 = 80 bytes. The end of the list is at 80 + 48 - 16 = 112 bytes. The system reads the first 16 bytes of the record starting from the 112th byte, extracts the last 12 bytes (assuming the fingerprint is 12 bytes long) of data "F1...F12" as the fingerprint of the preceding node. Simultaneously, it reads the device ID "NODE_05" from the local ROM.

[0027] In step S13, the intermediate node performs a hash calculation based on the service load data, the node identity identifier, and the fingerprint of the preceding node to generate the current node fingerprint, and appends the audit record item containing the node identity identifier and the current node fingerprint to the audit trace list to obtain an updated service message, including: The business load data, the node identity identifier, and the preceding node fingerprint are concatenated in a preset order to obtain a data block to be verified. The hash algorithm consistent with that of the terminal node is used to calculate the data block to be verified, and a fixed-length digest value is generated as the fingerprint of the current node; Construct a new audit record item containing the node identity identifier and the current node fingerprint, write the new audit record item to the end of the audit trace list, update the length field of the message header, and obtain the updated business message.

[0028] It should be noted that the concatenation of the business load data, the node identity identifier, and the preceding node fingerprint in a preset order is achieved using a memory copy operation. The system allocates a temporary buffer in memory, the size of which is equal to the sum of the business load length, the node ID length, and the fingerprint length. The system copies the byte sequences of each part into this buffer in a strict preset order, such as "business load data + node identity identifier + preceding node fingerprint". This concatenation method constructs an aggregate containing the current node's identity declaration, the previous hop integrity proof, and the original data content, namely the data block to be verified. This data block covers the complete semantics of "who I am (node ​​ID)," "what I rely on (preceding fingerprint)," and "what I protect (load)."

[0029] It is worth noting that the preset order was determined based on statistical analysis of the cache line hit rate and instruction cycle consumption of embedded processors when executing the SHA-256 algorithm. By testing the hash iteration operation time under different field arrangements (such as load front and load back) on the target hardware platform, the arrangement that maximizes memory alignment and minimizes total computation latency was selected as the preset order. For example, test data shows that placing the variable-length business load at the beginning and the fixed-length identity identifier and fingerprint at the end can reduce data padding overhead by approximately 15%.

[0030] It should be noted that using the same hash algorithm as the terminal node to calculate the data block to be verified is crucial to ensuring the closed loop of the end-to-end verification logic. The system calls the SHA-256 algorithm library, which is exactly the same as in step S11, to perform a digest operation on the data block to be verified, generating a 32-byte hash value as the fingerprint of the current node. This operation cryptographically binds the processing behavior of the current node to the state of the preceding links. Any tampering with the preceding fingerprint or forgery of the current node ID will cause unpredictable changes to the fingerprint value, thereby compromising the consistency of the chain structure.

[0031] It should be noted that the construction of the new audit record item and the resulting updated business message are achieved using packet reassembly technology. The system defines a standard audit record item structure (Struct) containing a node ID field and a fingerprint field. The system fills the current node's device ID and the calculated current node fingerprint into this structure, forming the new audit record item. Subsequently, the system locates the end address of the audit trace list in the message memory (i.e., the Pointer_Tail calculated in step S12) and writes the new record item to that address, achieving physical appending. To maintain the correctness of the message format, the system must synchronously modify the audit list length field (adding the length of one record item) and the total message length field in the message header. After this series of memory operations, the original business message has an additional record item added to the end, evolving into the updated business message carrying the latest audit information.

[0032] For example, an intermediate node with ID "NODE_05" (4 bytes) receives a preceding fingerprint of "F1...12" (32 bytes) and a business payload of 64 bytes. The system concatenates these three parts into a 100-byte block of data to be verified. A SHA-256 operation is performed on this block to obtain the fingerprint "E5...E8". The system constructs a new 36-byte (4+32) record entry "[NODE_05][E5...E8]" and appends it to the end of the message. Simultaneously, the total length field of the message header is updated from 128 to 164. At this point, the message is converted into an update business message, ready to be forwarded to the next hop.

[0033] In step S14, when the master station receives the update service message, it parses and separates the service load data and the audit trace list, including: The main station captures the update service message through the inbound interface and stores it in the temporary buffer; Parse the message header according to the preset message protocol specification, and extract the starting position index and length information of the audit trace list; The data segment at the end of the message is extracted based on the starting position index and used as the audit trace list. The remaining preceding data segment is used as the service load data.

[0034] It should be noted that the master station captures the update service messages and stores them in the temporary buffer via the inbound interface, which is achieved using a high-performance network interface card (NIC) in conjunction with Direct Memory Access (DMA) technology. The master station (such as the backend server of a power meter reading system) is deployed with a dedicated front-end communication gateway, whose physical layer interface listens for data frames from the communication link in real time. When the network adapter receives a complete message signal, the DMA controller directly moves the data packet from the NIC hardware buffer to the ring buffer in the kernel space and triggers a soft interrupt to notify the operating system. Subsequently, the data collection daemon reads the data from the kernel space using a zero-copy method (such as recvfrom) to the temporary buffer in the user space, completing the physical capture of the message.

[0035] It should be noted that parsing the message header and extracting position information according to the preset message protocol specification is achieved using fixed offset reading and field decoding technology. According to the protocol definition determined in steps S11 to S13, the first N bytes (e.g., 16 bytes) of the message constitute a fixed-format header. The system first reads the first 16 bytes of the temporary buffer and parses the total message length (Length_Total) and audit list length (Length_Audit) fields in big-endian order. Through arithmetic operations, Index_Start = Length_Total - Length_Audit, the system can accurately calculate the starting byte offset of the audit trace list within the entire message (i.e., the starting position index).

[0036] It is worth noting that the preset message protocol specification was determined based on statistical optimization of the historical payload-to-overhead ratio of the power line carrier (PLC) communication channel. By performing histogram analysis on the length distribution of massive amounts of historically collected messages, the minimum number of bytes (e.g., 16 bytes) that keeps the protocol header overhead within 5% and meets the memory alignment requirements of 32-bit processors was selected as the fixed header length. This setting ensures efficient field parsing (avoiding wasted CPU cycles due to non-aligned access) while maximizing the conservation of transmission resources in low-bandwidth networks.

[0037] It should be noted that the data segment extraction and payload separation based on the aforementioned starting position index is implemented using memory slicing. The system divides the temporary buffer into two logical regions based on the calculated Index_Start. The continuous memory block from Index_Start to the end of the message is extracted and converted into audit objects, i.e., the audit trace list; while the data segment from the end of the message header (e.g., byte 16) to before Index_Start, containing the original business data, timestamps, and sequence numbers, is extracted as a whole as the business payload data. This separation operation ensures that the evidence chain used for verification (audit list) and the factual data used for business processing (payload) are decoupled into two independent data structures, facilitating subsequent parallel processing.

[0038] For example, the master station receives an update business message with a total length of 200 bytes. The system reads the first 16 bytes of the header and parses out the audit list length to be 120 bytes. The system calculates the starting position index as 200-120=80. Therefore, the system extracts the data block from bytes 80 to 199 in the buffer and instantiates it into an audit trace list object; at the same time, it extracts the data block from bytes 16 to 79 (a total of 64 bytes) and passes it as business payload data to the subsequent verification module.

[0039] In step S15, the local hash value of the service load data is calculated, and the local hash value is compared with the first element in the audit trace list to obtain a global consistency determination result, including: The parsed business load data is processed using a hash algorithm pre-configured on the main site to generate the local hash value; Extract the element with index zero from the audit trail list as the source anchor hash; Determine whether the local hash value is equal to the source anchor hash. If they are equal, generate a global consistency determination result indicating that the verification has passed; if they are not equal, generate a global consistency determination result indicating that the data is abnormal.

[0040] It should be noted that using the hash algorithm pre-configured on the main station to process the parsed service payload data is the baseline reconstruction step for integrity verification. The main station loads the SHA-256 algorithm module that is completely identical to that of the terminal node (step S11). The system uses the clean service payload data separated in step S14 as the input stream, performs digest calculation, and obtains a 32-byte hexadecimal value, which is the local hash value. This value represents the digital fingerprint of the service data actually received by the main station in its current state. If any bit of the payload data is flipped or tampered with during transmission, the local hash value will present a result completely different from the original fingerprint.

[0041] It should be noted that extracting the element with index zero in the audit trace list as the source anchor hash is a key operation for obtaining the root of trust. Since the terminal node explicitly writes the source anchor hash to the beginning of the list (Index=0) in step S11, the data at this position is not affected by the calculation logic of subsequent intermediate nodes (subsequent nodes only append). The system directly obtains this 32-byte data by accessing the array index, Hash_Anchor=Audit_List[0]. This data is considered the truth standard for the entire verification process.

[0042] It should be noted that the equality determination and generation of a global consistency judgment result are implemented using bitwise comparison and state machine mapping techniques. The system calls a memory comparison function (such as memcmp) to compare the local hash value with the source anchor hash byte by byte. If all 32 bytes are completely identical (difference value is 0), the system generates a Boolean true value as a global consistency judgment result indicating that the verification has passed, and that the data has achieved complete end-to-end transmission without tampering. Conversely, if any byte difference exists, the system generates a Boolean false value as a global consistency judgment result indicating data anomaly, and immediately triggers the subsequent link replay diagnostic process.

[0043] For example, the business load data parsed by the main station is "Voltage=220.5V", and its local hash value obtained by SHA-256 calculation is "A1B2...C3D4". The system reads the first element of the audit trail list and finds that its value is also "A1B2...C3D4". The two are a perfect match, and the system determines that global consistency is passed, confirming the data validity. If the load data is tampered with during transmission to "Voltage=250.0V", the local calculation result becomes "E9F8...G7H6", which is inconsistent with the first element of the list "A1B2...C3D4", and the system determines that global consistency is abnormal.

[0044] In step S16, if the global consistency determination result indicates data anomaly, then a link-by-link replay verification is performed on the audit trace list to obtain the verification result, including: Initialize the traversal pointer to point to the second element of the audit trail list; In each iteration, extract the node identity and actual record fingerprint from the audit record item pointed to by the current pointer, and obtain the element in the audit trace list that is one position before the current pointer as the reference preceding fingerprint; Based on the business load data, the extracted node identity identifier, and the referenced previous fingerprint, the theoretical node fingerprint of the current node is recalculated. The theoretical node fingerprint is compared with the actual recorded fingerprint. If they do not match, a verification result containing the node's identity and abnormal state is output and the traversal is terminated. If they match, the traversal pointer is moved forward and the next loop begins.

[0045] The link-by-link replay verification mechanism identifies the node corresponding to the first inconsistent audit record as an abnormal node. Its technical logic is based on universally accepted network transmission characteristics: in a continuous, hop-by-hop communication link, if the data load is maliciously tampered with or irreversibly damaged at a certain hop, the altered data state is usually passed to subsequent nodes and does not automatically revert to its pre-tampering state. Therefore, when the master station performs replay calculations based on the currently received (potentially abnormal) load data and finds that the theoretical fingerprint from a certain node does not match the actual recorded fingerprint, it indicates that the business load data upon which the fingerprint recorded by that node depends, or its preceding fingerprint input, is irreconcilably contradictory to the data state currently used by the master station for replay calculations. In most practical scenarios, this can be attributed to the tampering or irreversible damage occurring in the processing stage of that node or in the link segment after it. By locking onto this node, this method minimizes the scope of tracing the integrity breach event, providing a precise entry point for network diagnosis and maintenance.

[0046] It should be noted that the initialization of the traversal pointer to point to the second element of the audit trace list is based on the structure definition of the audit list. Since the first element of the list (index=0) stores the source anchor hash (i.e., the root of trust), its correctness has been preliminarily referenced through the global comparison in step S15, but it is not used as the main calculation subject for link replay. Link replay aims to verify the processing logic of intermediate forwarding nodes; therefore, the initial value of the traversal pointer ptr is set to 1 (i.e., pointing to the second record in the list, corresponding to the first intermediate node in the link).

[0047] It should be noted that the extraction of data and the acquisition of the reference preceding fingerprint in each traversal loop are implemented using array index access. In the i-th loop (i starting from 1), the system reads the Audit_List[i] object, parses out the Node_ID (node ​​identity identifier) ​​and Fingerprint_Actual (actual recorded fingerprint) stored within it. Simultaneously, the system backtracks and reads the fingerprint data in Audit_List[i-1] (if i=1, it is the source anchor hash; if i>1, it is the fingerprint of the previous intermediate node), temporarily storing it as Fingerprint_Ref (reference preceding fingerprint). This step establishes the context dependencies required for hash chain verification.

[0048] It should be noted that recalculating the theoretical node fingerprint of the current node is a shadow calculation process on the master station side. The master station uses hash generation rules completely consistent with those of the intermediate nodes (such as the concatenation order and SHA-256 algorithm described in step S13) to reassemble the locally received business load data (which may have been tampered with), the extracted Node_ID, and Fingerprint_Ref into a data block to be verified. A digest operation is performed on this data block, and the result is the Fingerprint_Theoretical (theoretical node fingerprint). This value reflects "what fingerprint it should generate if the node did indeed process the load currently received by the master station, and the preceding state is as shown in the list record."

[0049] It should be noted that comparing the theoretical node fingerprint with the actual recorded fingerprint and terminating the traversal is implemented using a First-Fail Locking strategy. The system compares `Fingerprint_Theoretical` with `Fingerprint_Actual`. If they do not match, it indicates that the chain integrity logic is broken at that node. This usually means that the business load data held by the main station is inconsistent with the data processed by that node at that time (i.e., the data was tampered with after that node), or the fingerprint record of that node itself has been forged. Due to the avalanche effect of the hash chain, once a link breaks, the verification of subsequent nodes will lose its benchmark. Therefore, the system immediately stops traversing, marks the current node's `Node_ID` as the source of the anomaly, and generates a verification result containing "ID=NODE_X, Status=Mismatch". If they match, it indicates that the data is logically consistent up to the current node. The system executes `ptr=ptr+1`, moves the pointer to the next record, and enters the next loop verification until the entire list is traversed or an anomaly is found.

[0050] For example, the audit trail list contains three elements: [Index0:Hash_Src,Index1:Rec_A,Index2:Rec_B]. The payload received by the master station has been tampered with. Loop 1 is executed, with the pointer pointing to Rec_A (node ​​A). The master station extracts ID_A and the actual fingerprint Hash_A. The previous Hash_Src is obtained. Hash_Calc_A = SHA256(Tampered_Payload + ID_A + Hash_Src), where Tampered_Payload represents the tampered business payload, ID_A is the identifier of node A, and Hash_Src is the source anchor hash. Since Hash_A is calculated by node A based on the original payload, while Hash_Calc_A is calculated based on the tampered payload, the two are inconsistent, indicating a comparison failure. The system immediately terminates the traversal, outputs the verification result "Abnormal node: node A," and no longer verifies node B. This shows that data consistency fails to close the loop for the first time at the record of node A.

[0051] In step S17, based on the verification result, the first inconsistent audit record item is identified, the node corresponding to the audit record item is determined as an abnormal node, and the reputation weight of the abnormal node in the preset routing table is reduced, including: Parse the node identity identifier recorded in the verification result, retrieve the corresponding node object in the full-link topology model stored in the main station, and mark the node object as the abnormal node; Read the link reputation value associated with the abnormal node in the preset routing table, and deduct the link reputation value according to the preset penalty step size; If the deducted link reputation value is lower than the preset blocking threshold, the abnormal node will be marked as unavailable in the preset routing table, triggering a path replanning strategy.

[0052] It should be noted that parsing the verification result and marking abnormal nodes is achieved using key-value lookup and state bit flipping techniques. The main station receives the verification result structure (containing Node_ID and Error_Code) output in step S16. The system first extracts the node identity identifier and uses it as the key. It then performs a hash search in the pre-built end-to-end topology model to locate the corresponding node object instance in O(1) time complexity. Subsequently, the system calls the object's attribute setting interface to set the Is_Malicious flag in memory from "0" (normal) to "1" (abnormal) and writes the current time into the Last_Error_Time field, thus completing the locking of the abnormal state.

[0053] It is worth noting that the construction of the full-link topology model is based on the automatic networking protocol (such as IEEE 1901.1) of power line carrier communication networks. During system initialization, the master station issues a topology discovery command, collecting the neighbor lists and parent-child relationships reported by each node. The system iterates through all collected link connection information, instantiating the MAC address of each physical device as a vertex in a graph data structure, and instantiating the actual communication path as a directed edge. These are persistently stored in the master station's in-memory database in the form of an adjacency list, thus forming a complete network topology view. Subsequently, the system calls the object's attribute setting interface, setting the Is_Malicious flag in memory from "0" (normal) to "1" (abnormal), and writing the current time to the Last_Error_Time field, thus locking the abnormal state.

[0054] In one specific implementation, the master station, acting as a network controller or root node, initiates a topology discovery process during system initialization or periodically. For example, the master station can broadcast a topology discovery request command, requiring all nodes to report their device identifiers (IDs) and a list of direct neighbor node IDs and link quality indicators (LQIs) perceived through the link layer. Intermediate nodes form a hierarchical relationship when forwarding this request and converging responses. After receiving this information, the master station uses graph theory algorithms to construct a network topology graph with devices as vertices and communication links as edges, and stores it in an in-memory database. Furthermore, this model has dynamic update capabilities. When the master station locks down abnormal nodes and updates the routing table through the audit trace list verification mechanism, or detects a node offline through heartbeat detection, it can proactively or during the next periodic discovery update, removing abnormal or failed nodes and their associated links to ensure that the topology view remains consistent with the actual network availability, providing an accurate basis for precise location and path replanning.

[0055] It should be noted that the reading and deduction of link reputation values ​​is implemented based on an extended routing protocol table. The preset routing table is dynamically generated during the network initialization and networking phase, based on the DODAG topology construction process using the RPL protocol (IPv6 Routing Protocol for Low-Power and Lossy Networks). Upon system startup or when a new node joins the network, the master station broadcasts DIO (DODAG Information Object) control messages downwards and collects DAO (Destination Advertisement Object) messages from each node's uplink feedback, resolving the parent-child concatenation relationships and link quality indices (LQI) between nodes, thereby constructing a network-wide routing neighbor table in the in-memory database. The system extends the definition of the dynamic attribute field, Reputation_Score, by adding a single-precision floating-point variable to the standard routing table structure.

[0056] It is worth noting that the initialization process of this reputation value is given a clear identity authentication technical meaning. Only when a new node passes link-layer access authentication (such as based on the 802.1x protocol) and successfully verifies the legitimacy of its digital certificate will the system create an entry for that node in the routing table and initialize its reputation value field to a preset maximum threshold (e.g., 100). This initial value is not arbitrarily set, but represents a baseline trust state of "identity verified, behavior to be observed," establishing an initial security boundary that grants routing permissions only to devices that have passed legitimate identity verification.

[0057] Subsequently, the system reads the current value of this field (denoted as Score_Current) and performs an arithmetic operation: Score_New = Score_Current - Step_Penalty. This operation implements a soft penalty for the problematic node, that is, instead of immediately severing the connection, it reduces its priority weight in the routing objective function. This results in a significant increase in the routing cost of the node in subsequent path calculations (such as ETX metric calculation), thereby causing the data flow to naturally migrate to other high-reputation nodes and gradually marginalize the abnormal node.

[0058] It is worth noting that the predetermined penalty step size (Step_Penalty) is determined based on statistical analysis of historical network attack and random failure data. Hypothesis testing is performed by collecting the frequency distribution of transient interference (such as single bit errors caused by electromagnetic pulses) and persistent attacks (such as malicious node tampering) that occurred in the network over the past year. A critical value is selected that can distinguish between occasional failures (usually occurring less than 3 times consecutively) and malicious attacks (occurring frequently and densely). For example, if statistics show that 95% of occasional failures are recovered within 2 retransmissions, the penalty step size is set to 20 (so that the node's reputation drops below 60 points after 3 consecutive errors), thus achieving a balance between tolerating jitter and rapid response.

[0059] It should be noted that determining the blocking threshold and triggering path replanning is implemented using comparison logic and routing control signaling. The system compares the calculated Score_New with the preset blocking threshold (Threshold_Block). If it is lower than the threshold, the system determines that the node is untrusted. The system first sets the Route_Enable state of the node to False in the routing table, logically cutting off all data flows passing through the node. Subsequently, the system activates the route discovery engine, broadcasting a Route Request Message (RREQ) to the network or issuing a new DODAG Information Object (DIO), forcibly triggering a recalculation of the Dijkstra's shortest path algorithm for the entire network or a local area, and constructing an alternative transmission path to bypass the abnormal node.

[0060] It is worth noting that the preset blocking threshold (Threshold_Block) is determined based on a correlation analysis of historical network node reputation scores and packet loss rate (PLR). A correlation curve between reputation score and link reliability is plotted through logistic regression analysis of a large amount of historical communication logs. The reputation score corresponding to the inflection point (elbow point) of this curve where reliability drops sharply is selected as the preset value. For example, statistical data shows that when the reputation score is below 60, the node forwarding success rate drops sharply from 99% to below 80%, no longer meeting the reliability requirements for industrial control levels; therefore, 60 is set as the blocking threshold.

[0061] For example, the verification result shows that the hash of node "NODE_05" is inconsistent. The system finds this node in the topology graph and marks it as abnormal. Its current reputation value is read as 90 points. The preset penalty step size is 20 points. The system calculates a new reputation value of 90-20=70 points. The preset blocking threshold is 60 points. Since 70>60, the system only updates the reputation value to 70 and does not block it temporarily. If the node malfunctions again and its reputation value drops to 50 points, which is below the threshold, the system immediately marks it as unavailable and initiates path replanning to find an alternative path through "NODE_08".

[0062] It is worth noting that the specific values ​​of parameters such as the penalty step size, blocking threshold, and initial reputation value need to be calibrated based on the actual scale of the target network, historical node reliability data, and security level requirements. A typical calibration method includes: collecting communication logs of the target network or similar networks during stable operation and historical failure periods, and statistically analyzing the frequency and distribution of events such as node forwarding failures and data verification errors; secondly, setting the objective function of a mathematical model based on the service's requirements for reliability (e.g., 99% data integrity) and security (e.g., the number of consecutive attacks tolerated), such as an event model based on Poisson distribution or a Markov model based on reputation decay; finally, adjusting the above parameters through simulation or historical data playback, observing their impact on indicators such as fault isolation speed and network path stability, and selecting the parameter combination that optimizes the overall performance indicators as the preset value; for example, in the example above, the initial reputation value of 100, penalty step size of 20, and blocking threshold of 60 are a set of reference values ​​obtained through the above analysis, which can achieve a balance between tolerating occasional bit errors and quickly isolating malicious nodes in a typical electricity consumption information collection network environment. During implementation, these values ​​can be adjusted according to the specific scenario.

[0063] In summary, this invention establishes a physically isolated and logically interlocked end-to-end trust evidence chain by constructing an audit trail list containing source-end anchor hashes at terminal nodes and performing lightweight fingerprint appending based on prior state dependencies at each intermediate node of the communication link. Combined with the local link-by-level replay verification mechanism at the master station, accurate "black-box" tracing of data tampering or node failure locations can be achieved solely based on received packets without sending backtracking query commands to the network. Furthermore, by establishing a dynamic reputation evaluation and adaptive blocking strategy deeply coupled with the routing topology, automatic isolation and path replanning are achieved after the network detects anomalies. This effectively solves the technical challenges of traditional end-to-end verification failing to locate fault points, high communication overhead for segment-by-segment verification, and lack of network security self-healing capabilities in resource-constrained complex data acquisition communication networks, achieving high reliability, traceability, and network resilience in data acquisition data transmission.

[0064] Reference Figure 2The second embodiment of the present invention provides a data integrity verification system for complex links, comprising: The terminal acquisition and encapsulation module is used to collect service load data at the terminal node, calculate the source anchor hash based on the service load data, construct an audit trace list containing the source anchor hash as the first element, and encapsulate the audit trace list with the service load data to obtain the initial service message. The intermediate cascading update module is used to forward the initial service message level by level among the intermediate nodes of the communication link. During each level of forwarding, the intermediate node obtains its own node identity identifier and extracts the last element from the audit trace list of the received service message as the fingerprint of the preceding node. The node audit generation module is used to perform hash calculation based on the business load data, the node identity identifier and the fingerprint of the preceding node to generate the current node fingerprint, and append the audit record item containing the node identity identifier and the current node fingerprint to the audit trace list to obtain the updated business message; The main station parsing module is used to parse and separate the business load data and the audit trace list when the main station receives the update business message; The global verification module is used to calculate the local hash value of the business load data and compare the local hash value with the first element in the audit trace list to obtain a global consistency judgment result. The replay diagnostic module is used to perform a step-by-step replay verification on the audit trace list if the global consistency judgment result indicates abnormal data, and obtain the verification result. The anomaly handling module is used to lock the first inconsistent audit record item based on the verification result, identify the node corresponding to the audit record item as an abnormal node, and reduce the reputation weight of the abnormal node in the preset routing table.

[0065] It should be noted that the data integrity verification system for complex links provided in this embodiment of the invention is used to execute all the process steps of the data integrity verification method for complex links in the above embodiment. The working principles and beneficial effects of the two are one-to-one, so they will not be described again.

[0066] It should be noted that the system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the system embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0067] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A method for verifying the integrity of communication data in complex links, characterized in that, include: At the terminal node, service load data is collected, and the source anchor hash is calculated based on the service load data. An audit trace list containing the source anchor hash as the first element is constructed, and the audit trace list and the service load data are encapsulated to obtain the initial service message. The initial service message is forwarded level by level among the intermediate nodes of the communication link. During each level of forwarding, the intermediate node obtains its own node identity identifier and extracts the last element from the audit trace list of the received service message as the fingerprint of the preceding node. Based on the business load data, the node identity identifier, and the fingerprint of the preceding node, a hash calculation is performed to generate the fingerprint of the current node, and the audit record item containing the node identity identifier and the fingerprint of the current node is appended to the audit trace list to obtain the updated business message; When the main station receives the update service message, it parses and separates the service load data and the audit trace list. Calculate the local hash value of the business load data, and compare the local hash value with the first element in the audit trace list to obtain a global consistency determination result; If the global consistency determination result indicates data anomaly, then a step-by-step replay verification is performed on the audit trace list to obtain the verification result; Based on the verification result, the first inconsistent audit record item is identified, the node corresponding to the audit record item is determined as an abnormal node, and the reputation weight of the abnormal node in the preset routing table is reduced.

2. The method for verifying the integrity of communication data in complex links according to claim 1, characterized in that, The process involves collecting service load data at the terminal node, calculating the source anchor hash based on the service load data, constructing an audit trail list containing the source anchor hash as the first element, and encapsulating the audit trail list with the service load data to obtain an initial service message, including: Parse the real-time business information collected by the terminal node, embed timestamps and sequence identifiers, and generate an intermediate byte stream containing header fields and payload content; The source-end anchor hash is obtained by performing a digest operation on the intermediate byte stream using a hash algorithm. The audit trace list is initialized, the source anchor hash is written to the beginning of the audit trace list, and the audit trace list is appended to the extended tail space of the intermediate byte stream to encapsulate and generate the initial business message.

3. The method for verifying the integrity of communication data in complex links according to claim 1, characterized in that, The step of forwarding the initial service message level by level among intermediate nodes in the communication link, wherein during each level of forwarding, the intermediate node obtains its own node identity identifier and extracts the last element from the audit trace list of the received service message as the fingerprint of the preceding node, includes: The intermediate node captures the business message with the destination address matching through the communication interface, parses the structure of the business message, and locates the storage offset of the audit trace list; Read the last record item in the audit trace list, extract the fingerprint field from the last record item, and identify it as the fingerprint of the preceding node; Read the unique device ID stored in the current device as the identity identifier of the node.

4. The method for verifying the integrity of communication data in complex links according to claim 1, characterized in that, The intermediate node performs a hash calculation based on the service load data, the node identity identifier, and the fingerprint of the preceding node to generate the current node fingerprint, and appends the audit record item containing the node identity identifier and the current node fingerprint to the audit trace list to obtain an updated service message, including: The business load data, the node identity identifier, and the preceding node fingerprint are concatenated in a preset order to obtain a data block to be verified. The hash algorithm consistent with that of the terminal node is used to calculate the data block to be verified, and a fixed-length digest value is generated as the fingerprint of the current node; Construct a new audit record item containing the node identity identifier and the current node fingerprint, write the new audit record item to the end of the audit trace list, update the length field of the message header, and obtain the updated business message.

5. The method for verifying the integrity of communication data in complex links according to claim 1, characterized in that, When the main station receives the update service message, it parses and separates the service load data and the audit trace list, including: The main station captures the update service message through the inbound interface and stores it in a temporary buffer; Parse the message header according to the preset message protocol specification, and extract the starting position index and length information of the audit trace list; The data segment at the end of the message is extracted based on the starting position index and used as the audit trace list. The remaining preceding data segment is used as the service load data.

6. The method for verifying the integrity of communication data in complex links according to claim 1, characterized in that, The process of calculating the local hash value of the business load data and comparing the local hash value with the first element in the audit trail list to obtain a global consistency determination result includes: The parsed business load data is processed using a hash algorithm pre-configured on the main site to generate the local hash value; Extract the element with index zero from the audit trail list as the source anchor hash; Determine whether the local hash value is equal to the source anchor hash. If they are equal, generate a global consistency determination result indicating that the verification has passed; if they are not equal, generate a global consistency determination result indicating that the data is abnormal.

7. The method for verifying the integrity of communication data in complex links according to claim 1, characterized in that, If the global consistency determination result indicates data anomaly, then a step-by-step replay verification is performed on the audit trace list to obtain the verification result, including: Initialize the traversal pointer to point to the second element of the audit trail list; In each iteration, extract the node identity and actual record fingerprint from the audit record item pointed to by the current pointer, and obtain the element in the audit trace list that is one position before the current pointer as the reference preceding fingerprint; Based on the business load data, the extracted node identity identifier, and the referenced previous fingerprint, the theoretical node fingerprint of the current node is recalculated. The theoretical node fingerprint is compared with the actual recorded fingerprint. If they do not match, a verification result containing the node's identity and abnormal state is output and the traversal is terminated. If they match, the traversal pointer is moved forward and the next loop begins.

8. The method for verifying the integrity of communication data in complex links according to claim 1, characterized in that, The step of locking the first inconsistent audit record item based on the verification result, identifying the node corresponding to the audit record item as an abnormal node, and reducing the reputation weight of the abnormal node in the preset routing table includes: Parse the node identity identifier recorded in the verification result, retrieve the corresponding node object in the full-link topology model stored in the main station, and mark the node object as the abnormal node; Read the link reputation value associated with the abnormal node in the preset routing table, and deduct the link reputation value according to the preset penalty step size; If the deducted link reputation value is lower than the preset blocking threshold, the abnormal node will be marked as unavailable in the preset routing table, triggering a path replanning strategy.

9. A data integrity verification system for complex communication links, characterized in that, include: The terminal acquisition and encapsulation module is used to collect service load data at the terminal node, calculate the source anchor hash based on the service load data, construct an audit trace list containing the source anchor hash as the first element, and encapsulate the audit trace list with the service load data to obtain the initial service message. The intermediate cascading update module is used to forward the initial service message level by level among the intermediate nodes of the communication link. During each level of forwarding, the intermediate node obtains its own node identity identifier and extracts the last element from the audit trace list of the received service message as the fingerprint of the preceding node. The node audit generation module is used to perform hash calculation based on the business load data, the node identity identifier and the fingerprint of the preceding node to generate the current node fingerprint, and append the audit record item containing the node identity identifier and the current node fingerprint to the audit trace list to obtain the updated business message; The main station parsing module is used to parse and separate the business load data and the audit trace list when the main station receives the update business message; The global verification module is used to calculate the local hash value of the business load data and compare the local hash value with the first element in the audit trace list to obtain a global consistency judgment result. The replay diagnostic module is used to perform a step-by-step replay verification on the audit trace list if the global consistency judgment result indicates abnormal data, and obtain the verification result. The anomaly handling module is used to lock the first inconsistent audit record item based on the verification result, identify the node corresponding to the audit record item as an abnormal node, and reduce the reputation weight of the abnormal node in the preset routing table.

Images