A data verification method and device and a storage medium
Patent Information
- Application Number
- CN202510417923.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-03
- Publication Date
- 2026-10-23
AI Technical Summary
[0040]通过对公钥证书的合法性和哈希值签名的有效性的双重认证，确保了数据的真实性和完整性，避免了公钥证书与哈希值签名分开验证过程中导致的数据被篡改或伪造，还通过哈希算法的快速计算，高效地验证数据的合法性，减少验证时间和计算资源的消耗，提高了计算效率。
Smart Images
Figure CN122969801A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data processing, and in particular to a data verification method, apparatus and storage medium. Background Technology
[0002] In the digital age, data security and integrity are core requirements of information systems. Whether it's financial transactions, electronic contracts, identity authentication, or IoT device communication, data is susceptible to tampering, forgery, or theft during transmission and storage. To ensure data authenticity and reliability, digital signature technology is widely used. Common digital signature algorithms include MAC algorithms based on symmetric encryption and RSA / SHA algorithms based on asymmetric encryption. However, these algorithms have many limitations in practical applications.
[0003] Current technologies typically separate public key certificate verification from signature data verification, using different algorithms for each. Even if the public key certificate is valid, it cannot guarantee that the signature data has not been tampered with during transmission and storage. Because the validity of signature data involves multiple factors such as data integrity and the security of the signing process, the lack of coordinated verification makes it impossible to effectively prevent malicious data tampering, thereby affecting the integrity and authenticity of the data. Summary of the Invention
[0004] To address the aforementioned technical problems, this application provides a data verification method, apparatus, and storage medium.
[0005] The technical solution provided in this application is described below:
[0006] The first aspect of this application provides a data verification method, the method comprising:
[0007] Obtain a data packet, the data packet including original data, public key certificate and hash signature, the original data being the data to be verified for legitimacy, and the hash signature being the hash signature of the original data;
[0008] Verify the validity of the public key certificate;
[0009] If the public key certificate is valid, then extract the public key from the public key certificate;
[0010] The hash signature is decrypted using the public key to obtain the first hash value in the hash signature;
[0011] Determine whether the first hash value and the second hash value are consistent, wherein the second hash value is the hash value obtained by calculating the original data using a hash algorithm;
[0012] If they match, then the original data is determined to be valid data.
[0013] Optionally, before determining whether the first hash value and the second hash value are consistent, the method further includes:
[0014] If the data volume of the data packet is greater than a preset threshold, the first hash algorithm is used to perform multi-threaded packet calculation on the original data to obtain a second hash value.
[0015] Optionally, before determining whether the first hash value and the second hash value are consistent, the method further includes:
[0016] If the data volume of the data packet is less than a preset threshold, the second hash algorithm is used to perform single-threaded calculation on the original data to obtain the second hash value.
[0017] Optionally, verifying the validity of the public key certificate includes:
[0018] Extract the digital signature from the public key certificate;
[0019] The public key certificate is validated using the ECDSA algorithm based on the digital signature.
[0020] Optionally, the method further includes:
[0021] If the public key certificate is invalid, the data verification will be terminated and a verification failure message will be returned.
[0022] Optionally, extracting the public key from the public key certificate includes:
[0023] Parse the structure of the public key certificate and extract the public key information;
[0024] The format of the public key information is converted into a format that can be used for decryption.
[0025] Optionally, the method further includes:
[0026] If the first hash value and the second hash value are the same, then the hash value signature is determined to be a valid signature.
[0027] A second aspect of this application provides a data verification device, the device comprising:
[0028] An acquisition unit is used to acquire a data packet, the data packet including original data, a public key certificate and a hash signature, wherein the original data is data to be verified for legitimacy and the hash signature is a hash signature of the original data;
[0029] The verification unit is used to verify whether the public key certificate is valid;
[0030] An extraction unit is used to extract the public key from the public key certificate if the public key certificate is valid;
[0031] A decryption unit is used to decrypt the hash signature using the public key to obtain the first hash value in the hash signature;
[0032] The judgment unit is used to determine whether the first hash value and the second hash value are consistent, wherein the second hash value is a hash value calculated by a hash algorithm on the original data;
[0033] A determining unit is used to determine that the original data is valid data if there is a match.
[0034] A third aspect of this application provides a data verification device, the device comprising:
[0035] Processor, memory, input / output units, and bus;
[0036] The processor is connected to memory, input / output units, and a bus;
[0037] The memory stores a program, which the processor calls to execute the first aspect and any optional data verification method in the first aspect.
[0038] The fourth aspect of this application provides a computer-readable storage medium on which a program is stored, and when the program is executed on a computer, it performs the first aspect and any optional data verification method in the first aspect.
[0039] As can be seen from the above technical solutions, this application has the following advantages:
[0040] By dual authentication of the public key certificate's legitimacy and the hash signature's validity, the authenticity and integrity of the data are ensured. This avoids data tampering or forgery that would occur if the public key certificate and hash signature were verified separately. Furthermore, the fast calculation of the hash algorithm efficiently verifies the legitimacy of the data, reducing verification time and computational resource consumption, thus improving computational efficiency. Attached Figure Description
[0041] To more clearly illustrate the technical solutions in this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0042] Figure 1 A schematic flowchart of an embodiment of the data verification method provided in this application;
[0043] Figure 2 A schematic flowchart of an embodiment of the data verification method provided in this application for calculating the second hash value;
[0044] Figure 3 A schematic diagram of an embodiment of the data verification method provided in this application for verifying the legality of a public key certificate;
[0045] Figure 4 A schematic diagram of an embodiment of the data verification method provided in this application for verifying the validity of a hash value signature;
[0046] Figure 5 A schematic diagram of an embodiment of the data verification device provided in this application;
[0047] Figure 6 This is a schematic diagram of another embodiment of the data verification device provided in this application. Detailed Implementation
[0048] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.
[0049] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.
[0050] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.
[0051] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."
[0052] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.
[0053] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.
[0054] In the digital age, data security and integrity are core requirements of information systems. Whether it's financial transactions, electronic contracts, identity authentication, or IoT device communication, data is susceptible to tampering, forgery, or theft during transmission and storage. To ensure data authenticity and reliability, digital signature technology is widely used. Common digital signature algorithms include MAC algorithms based on symmetric encryption and RSA / SHA algorithms based on asymmetric encryption. However, these algorithms have many limitations in practical applications.
[0055] Current technologies typically separate public key certificate verification from signature data verification, using different algorithms for each. Even if the public key certificate is valid, it cannot guarantee that the signature data has not been tampered with during transmission and storage. Because the validity of signature data involves multiple factors such as data integrity and the security of the signing process, the lack of coordinated verification makes it impossible to effectively prevent malicious data tampering, thereby affecting the integrity and authenticity of the data.
[0056] Based on this, this application discloses a data verification method, apparatus, and storage medium to ensure the accuracy and consistency of data and safeguard data security.
[0057] The technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.
[0058] The method of this application can be applied to a terminal, server, or system. The following description takes the system as the execution subject.
[0059] Please see Figure 1 This application first provides an embodiment of a data verification method, which includes the following steps:
[0060] S101. Obtain the data packet, which includes the original data, public key certificate and hash signature. The original data is the data to be verified for legality, and the hash signature is the hash signature of the original data.
[0061] The system acquires data packets, selects appropriate algorithms to parse them based on security and performance requirements, and extracts the original data, public key certificate, and hash signature from the data packets to ensure data integrity and prevent data tampering during the parsing process.
[0062] S102. Verify the validity of the public key certificate;
[0063] First, check if the basic structure of the public key certificate is complete, including fields such as version number, serial number, issuer, and validity period. If the basic structure is incomplete, the public key certificate is invalid. If the basic structure is complete, then obtain the validity period of the public key certificate and check if the current time is within the validity period. If the current time is earlier than the effective date or later than the expiration date, the public key certificate is invalid. Conversely, if the current time is between the effective date and the expiration date, the public key certificate is valid.
[0064] S103. If the public key certificate is valid, extract the public key from the public key certificate;
[0065] After verifying the validity of the public key certificate, the appropriate parsing tool is used to parse the public key certificate into an operable object according to its encoding format, and then the public key information is extracted from the parsed certificate object. The format of the public key is usually RSA, ECC, etc.
[0066] S104. Decrypt the hash signature using the public key to obtain the first hash value in the hash signature;
[0067] During the digital certificate signing process, the Certificate Authority (CA) uses its private key to sign the hash value of the certificate holder's information, generating a hash signature. When verifying a digital certificate, the hash signature is decrypted using the CA's public key to obtain the first hash value.
[0068] S105. Determine whether the first hash value and the second hash value are consistent. The second hash value is the hash value obtained by calculating the original data using a hash algorithm.
[0069] The hash signature is decrypted using the public key to obtain the first hash value. The same hash algorithm is then used to calculate the second hash value on the original data. The first and second hash values are then compared bit by bit. If they match exactly, the original data has not been tampered with during transmission or storage. If they do not match, the data may have been tampered with and is therefore invalid.
[0070] S106. If they match, then the original data is determined to be valid data.
[0071] After comparison in step S105, it was found that the first hash value and the second hash value were completely identical. This indicates that the original data was not tampered with during transmission or storage, and the data source is trustworthy. Therefore, the original data is determined to be legitimate.
[0072] In this embodiment, the authenticity and integrity of the data are ensured by dual authentication of the legality of the public key certificate and the validity of the hash signature. This avoids data tampering or forgery caused by separate verification of the public key certificate and hash signature. Furthermore, the legality of the data is efficiently verified through the fast calculation of the hash algorithm, reducing verification time and consumption of computing resources, and improving computational efficiency.
[0073] In step S105 above, a second hash value is obtained by calculating the original data using a hash algorithm. Please refer to [link to relevant documentation]. Figure 2 , Figure 2 One embodiment for calculating the second hash value includes the following steps:
[0074] S201. If the data volume of the data packet is greater than the preset threshold, the first hash algorithm is used to perform multi-threaded packet calculation on the original data to obtain the second hash value.
[0075] Open the storage medium, such as a file or database connection, and read the data packet into the storage medium. If the data packet size exceeds a preset threshold, analyze the size and structure of the data packet, select an appropriate data segmentation strategy based on the size and structure of the data packet, and divide the data into multiple data packets to ensure that each data packet is of appropriate size. Then, decide whether to use multi-threaded processing based on the data volume. Specifically, create the number of threads based on system resources and data volume. Each thread is responsible for processing one data packet, and each thread calculates the feature check value of the data packet it is responsible for.
[0076] S202. If the data volume of the data packet is less than the preset threshold, the second hash algorithm is used to perform single-threaded calculation on the original data to obtain the second hash value.
[0077] The process for determining the size of the data packet is the same as in step S401. If the analysis shows that the data packet size is less than a preset threshold, a single-threaded method is used to calculate the data packet. Specifically, the data packet to be calculated is obtained, which is usually a byte array or a binary data stream. According to the verification algorithm, the hash value is initialized to a fixed initial value. Each byte of the data packet is traversed, and it is calculated with the current hash value. The hash value is then updated. After traversing all bytes, the hash value is finally processed to obtain the final hash value. The calculated hash value is returned as the second hash value of the data packet.
[0078] In this embodiment, multi-threaded packet splitting and simultaneous calculation of the second hash value of the data packet can significantly improve the calculation efficiency. Multi-threaded technology can make full use of the computing power of multi-core CPUs, divide the data into blocks for parallel processing, and reduce the overall calculation time. Dynamically selecting single-threaded or multi-threaded calculation methods according to the size of the data can flexibly adapt to different application scenarios, ensuring efficiency while avoiding resource waste.
[0079] In step S102 above, the validity of the public key certificate is verified. Please refer to [link / reference needed]. Figure 3 , Figure 3 One embodiment for verifying the legitimacy of a public key certificate includes the following steps:
[0080] S301. Extract the digital signature from the public key certificate;
[0081] The public key certificate is parsed, and the digital signature field is located within the parsed certificate. The digital signature is generated by the certificate authority (CA) hashing the certificate content and then encrypting it using the CA's private key. The digital signature field is extracted from the certificate and stored in a temporary variable or data structure for subsequent verification of the certificate's legitimacy.
[0082] S302. Verify the legitimacy of the public key certificate using the ECDSA algorithm based on the digital signature;
[0083] Verifying the legitimacy of a public key certificate using the ECDSA algorithm via digital signature involves verifying the signature of the public key certificate using the certificate authority's public key, ensuring that the certificate was issued by that certificate authority. Specifically, this is done using an ECDSA verification function, passing the certificate's signature data, the certificate's subject information, and the certificate authority's public key as parameters.
[0084] S303. If the public key certificate is invalid, terminate the data verification and return a verification failure message.
[0085] The system receives the validity verification result of the public key certificate and checks the received verification result. If the result shows that the public key certificate is invalid, the current data verification process is stopped immediately, and subsequent data verification steps are not executed. The system also returns a verification failure message, including the reason for the failure and the error code, to avoid invalid or insecure operations based on an invalid public key certificate.
[0086] In this embodiment, by verifying the legitimacy of the public key certificate, the authenticity of the data source is ensured, preventing forged or unauthorized data tampering, and maintaining data integrity and consistency. The use of the ECDSA algorithm enhances the security of data signatures, effectively resists man-in-the-middle attacks, and ensures that data is not stolen or tampered with during transmission. Timely termination of data verification of invalid public key certificates reduces the risks and losses caused by illegal data, ensures the stability and reliability of the system when processing data, and reduces the possibility of system crashes or anomalies.
[0087] In steps S103 to S105 above, the public key in the public key certificate is extracted to verify the validity of the hash value signature. Please refer to [link to relevant documentation]. Figure 3 , Figure 4 One embodiment for verifying the validity of a hash value signature includes the following steps:
[0088] S401. Parse the structure of the public key certificate and extract the public key information;
[0089] Parse the public key certificate and locate the public key information field within the parsed certificate. Public key information typically includes the public key algorithm and public key value. Extract the public key information field from the public key certificate and store the extracted public key information in a temporary variable or data structure for later use in decryption operations.
[0090] S402. Convert the format of the public key information into a format that can be used for decryption;
[0091] Identify the format of the public key information extracted from the public key certificate and parse it using the appropriate library or tool. For example, use the OpenSSL library to parse public key information in DER or PEM format, extracting the modulus and exponent or curve parameters and public key points. Convert the parsed public key information into a format that can be used for decryption, and then store the converted public key in a temporary variable or data structure.
[0092] S403. If the first hash value and the second hash value are the same, then the hash value signature is determined to be a valid signature.
[0093] The hash signature is decrypted using the public key to obtain the first hash value. The original data is then processed using the same hash algorithm (e.g., ECC / SHA3) to obtain the second hash value. The first and second hash values are then compared bit by bit. If they match exactly, the hash signature is valid. Since the hash values match, it indicates that the hash signature was generated using a legitimate private key, and the original data was not tampered with during transmission or storage. Therefore, the hash signature is determined to be valid.
[0094] In this embodiment, the public key information is parsed and extracted to obtain the public key contained in the certificate, providing a foundation for subsequent encryption, decryption, and verification operations. The extracted public key can be used to establish secure communication, ensuring the confidentiality and integrity of data transmission. Furthermore, by converting the public key format, it can be directly used by the decryption algorithm, ensuring smooth decryption operations. The converted public key format is generally compatible with common encryption libraries and tools, improving system compatibility and portability. Comparing hash values effectively verifies whether the hash signature was generated by a legitimate private key, ensuring the signature's legitimacy. Hash value consistency verification effectively prevents data from being tampered with during transmission or storage, ensuring data integrity and security.
[0095] Please see Figure 5 This application also provides a data verification device, comprising:
[0096] The acquisition unit 501 is used to acquire a data packet, which includes original data, a public key certificate, and a hash value signature. The original data is the data to be verified for legitimacy, and the hash value signature is the hash value signature of the original data.
[0097] Verification unit 502 is used to verify whether the public key certificate is valid;
[0098] Specifically, verification unit 502 is also used for:
[0099] Extract the digital signature from the public key certificate;
[0100] The public key certificate is validated using the ECDSA algorithm based on the digital signature.
[0101] Specifically, verification unit 502 is also used for:
[0102] If the public key certificate is invalid, the data verification will be terminated and a verification failure message will be returned.
[0103] Extraction unit 503 is used to extract the public key from the public key certificate if the public key certificate is valid;
[0104] Specifically, extraction unit 503 is also used for:
[0105] Parse the structure of the public key certificate and extract the public key information;
[0106] Convert the public key information into a format that can be used for decryption.
[0107] Decryption unit 504 is used to decrypt the hash signature using the public key to obtain the first hash value in the hash signature;
[0108] Specifically, it also includes the first computing unit 505:
[0109] If the data size of the data packet exceeds the preset threshold, the first hash algorithm is used to perform multi-threaded packet calculation on the original data to obtain the second hash value.
[0110] Specifically, it also includes the second computing unit 506:
[0111] If the data size of the data packet is less than the preset threshold, the second hash algorithm is used to perform single-threaded calculation on the original data to obtain the second hash value.
[0112] The judgment unit 507 is used to determine whether the first hash value and the second hash value are consistent. The second hash value is the hash value obtained by calculating the original data through a hash algorithm.
[0113] Specifically, the judgment unit 507 is also used for:
[0114] If the first hash value and the second hash value are the same, then the hash value signature is determined to be a valid signature.
[0115] Unit 508 is used to determine that if the data matches, the original data is valid.
[0116] Please see Figure 6 This application also provides a data verification device, comprising:
[0117] Processor 601, memory 602, input / output unit 603, bus 604;
[0118] The processor 601 is connected to the memory 602, the input / output unit 603, and the bus 604;
[0119] The memory 602 stores a program, and the processor 601 calls the program to execute any of the data verification methods described above.
[0120] This application also relates to a computer-readable storage medium on which a program is stored, characterized in that, when the program is run on a computer, it causes the computer to perform any of the methods described above.
[0121] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.
[0122] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.
[0123] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0124] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.
[0125] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
Claims
1. A data verification method, characterized in that, The method includes: Obtain a data packet, the data packet including original data, public key certificate and hash signature, the original data being the data to be verified for legitimacy, and the hash signature being the hash signature of the original data; Verify the validity of the public key certificate; If the public key certificate is valid, then extract the public key from the public key certificate; The hash signature is decrypted using the public key to obtain the first hash value in the hash signature; Determine whether the first hash value and the second hash value are consistent, wherein the second hash value is the hash value obtained by calculating the original data using a hash algorithm; If they match, then the original data is determined to be valid data.
2. The data verification method according to claim 1, characterized in that, Before determining whether the first hash value and the second hash value are consistent, the method further includes: If the data volume of the data packet is greater than a preset threshold, the first hash algorithm is used to perform multi-threaded packet calculation on the original data to obtain a second hash value.
3. The data verification method according to claim 1, characterized in that, Before determining whether the first hash value and the second hash value are consistent, the method further includes: If the data volume of the data packet is less than a preset threshold, the second hash algorithm is used to perform single-threaded calculation on the original data to obtain the second hash value.
4. The data verification method according to claim 1, characterized in that, The verification of the validity of the public key certificate includes: Extract the digital signature from the public key certificate; The public key certificate is validated using the ECDSA algorithm based on the digital signature.
5. The data verification method according to claim 1, characterized in that, The method further includes: If the public key certificate is invalid, the data verification will be terminated and a verification failure message will be returned.
6. The data verification method according to claim 1, characterized in that, Extracting the public key from the public key certificate includes: Parse the structure of the public key certificate and extract the public key information; The format of the public key information is converted into a format that can be used for decryption.
7. The data verification method according to any one of claims 1 to 6, characterized in that, The method further includes: If the first hash value and the second hash value are the same, then the hash value signature is determined to be a valid signature.
8. A data verification device, characterized in that, The device includes: An acquisition unit is used to acquire a data packet, the data packet including original data, a public key certificate and a hash signature, wherein the original data is data to be verified for legitimacy and the hash signature is a hash signature of the original data; The verification unit is used to verify whether the public key certificate is valid; An extraction unit is used to extract the public key from the public key certificate if the public key certificate is valid; A decryption unit is used to decrypt the hash signature using the public key to obtain the first hash value in the hash signature; The judgment unit is used to determine whether the first hash value and the second hash value are consistent, wherein the second hash value is a hash value calculated by a hash algorithm on the original data; A determining unit is used to determine that the original data is valid data if there is a match.
9. A data verification device, characterized in that, The device includes: Processor, memory, input / output units, and bus; The processor is connected to the memory, the input / output unit, and the bus; The memory stores a program, which the processor invokes to execute the data verification method as described in any one of claims 1 to 7.
10. A computer-readable storage medium having a program stored thereon, the program performing the data verification method as described in any one of claims 1 to 7 when executed on a computer.