A remote computing data security verification method based on data security

Abstract

The application discloses a remote computing data security verification method based on data security, which comprises the following steps: receiving a remote computing task, generating a task structure table, a basic credential and an input summary; constructing a real computing credential track, inserting a shadow witness segment, and forming a double-track credential task data; executing the double-track data according to stages, generating stage credential records and authentication labels; constructing a stage credential snapshot graph, generating a gating group and rewriting credential edge weights, and forming a credential state vector; inputting the credential state vector into an improved EvolveGCN structure to obtain a double-track stage output representation; tracing result credential data and comparing the shadow witness to generate a security verification result. The application relates to the technical field of data security and remote computing security, realizes credible verification of a remote computing process, and improves abnormal positioning accuracy and result credibility.

Description

Technical Field

[0001] This invention relates to the fields of data security and remote computing security technology, and in particular to a remote computing data security verification method based on data security. Background Technology

[0002] In remote computing scenarios, the data sending end delivers the computing task, the data to be computed, or the data digest to the remote computing node for execution. The remote computing node returns the computing results, execution logs, and authentication tags. The data sending end then completes the data security verification through digest comparison, signature verification, log verification, or trusted execution environment proof.

[0003] Existing remote computing data verification methods mostly revolve around final result summaries, node authentication, and execution log integrity, focusing on the task initiation and result return ends. These methods struggle to cover the data flow path within the computation phase and cannot form a continuous verification chain for the progressive process of phase numbers, operator numbers, data block numbers, phase path markers, and authentication tags.

[0004] In phased remote computing tasks, if remote computing nodes exhibit phase jumps, result substitutions, path tampering, environment substitutions, or forged execution behaviors, comparison with a single result summary and static logs is insufficient to pinpoint the phase path where the anomaly occurred. Existing methods lack a mechanism for parallel execution of the real computing credential track and shadow witness fragments, and lack dynamic edge weight rewriting processing for dual-track execution edges, identity-environment binding edges, and tag progression edges in the phase credential snapshot diagram, making it difficult to transform phase verification results into an evolvable credential state vector.

[0005] Current remote computing data verification methods lack a graph structure evolution processing approach for continuous stages, and cannot utilize the improved EvolveGCN structure to progressively update stage voucher status. Reverse closure tracing, shadow witness comparison, and voucher status vectors do not form a unified verification judgment table, and security verification results lack traceable and locatable anomaly markers. Therefore, providing a data security-based remote computing data security verification method is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] One objective of this invention is to propose a remote computing data security verification method based on data security. This invention adopts dual-track credential task data, phased security gating groups, and an improved EvolveGCN structure to perform phased verification, reverse tracing, and shadow witness comparison on the remote computing process. It has the advantages of complete verification chain, accurate anomaly location, and high result reliability.

[0007] A remote computing data security verification method based on data security according to an embodiment of the present invention includes the following steps: Receive remote computing tasks, generate a remote computing task structure table and task basic credentials, and generate an input data digest for the data block to be computed. Based on the remote computing task structure table, task base voucher, and input data summary, generate the real computing voucher track, insert the shadow witness fragment into the same path position of the real computing voucher track, and generate dual-track voucher task data. Send the dual-track voucher task data to the remote computing node, execute the dual-track voucher task data according to the stage number, and generate stage voucher records and current stage authentication tags; Construct a phase credential snapshot diagram based on the phase credential record and the current phase authentication label, and input the phase credential snapshot diagram arranged by phase number into the improved EvolveGCN structure; Before graph convolution propagation in the improved EvolveGCN structure, a stage security gating group is generated based on the stage verification results in the stage voucher snapshot graph. The stage security gating group is written into the voucher edge, the voucher edge weight is rewritten, and the voucher state vector is generated by summarizing the rewritten voucher edge weights according to the stage. The voucher state vector is written into the parameter evolution unit in the improved EvolveGCN structure according to the stage number, the graph convolution weight matrix and bias vector are updated, and graph convolution propagation is performed on the dual-track voucher task data to obtain the dual-track stage output representation. Receive the result voucher data returned by the remote computing node, perform reverse closure tracing and shadow witness comparison based on the result voucher data, write the reverse closure tracing result, shadow witness comparison result and voucher status vector into the verification judgment table, and generate the remote computing data security verification result.

[0008] Optionally, the operations of generating the remote computing task structure table, task base credentials, and input data summary include: Configure task numbers for remote computing tasks, and configure data block numbers, operator numbers and stage numbers according to the data blocks to be computed, computing operators and computing stages. Write the data block numbers, operator numbers, stage numbers, input fields, output fields, result fields and same path position markers into the remote computing task structure table. Generate basic credentials for the task, which include the task number, initial random number, initial computation token, and initial authentication tag digest. Perform digest calculation on the data block to be computed according to the data block number, and generate the input data digest bound to the data block number.

[0009] Optionally, the operation of generating the actual computational credential track includes: Compile the remote computing task structure table, task basic credentials, and input data summary by task number; The records in the remote computing task structure table are sorted by path according to the stage number, operator number and same path position mark to form a stage path sequence; A stage voucher unit is established based on each record in the stage path sequence, and the stage voucher unit is configured with stage number, operator number, data block number, same path position mark and stage path mark; Load the input data digest bound to the data block number into the corresponding stage credential unit, and bind the initial computation token and initial authentication tag digest in the task base credential to the starting stage credential unit of the stage path sequence. Establish a document progression relationship based on the stage number and path position mark of adjacent document units in the stage path sequence, and arrange the stage document units after establishing the document progression relationship into the actual calculation document track.

[0010] Optionally, the operation of generating dual-track voucher task data includes: Based on the initial random number, data block number, and stage number in the task base certificate, determine the shadow source data block and the corresponding stage path marker in the stage path sequence; Replace the data values ​​of the shadow source data block while preserving the field format, data length, and same path location markers to generate a shadow witness fragment; Perform local computation on the shadow witness fragment to generate the expected shadow output; Locate the stage voucher unit in the actual calculation voucher track according to the corresponding stage path mark, and establish a shadow voucher unit carrying shadow witness fragments and shadow expected outputs. The shadow voucher unit and the stage voucher unit obtained from the location are registered side by side to generate dual-track voucher task data.

[0011] Optionally, the operations of generating the stage credential record and the current stage authentication tag include: Send the dual-track voucher task data to the remote computing node and match the stage voucher unit and shadow voucher unit according to the stage number and stage path mark. Perform real track calculations based on stage voucher units to generate real stage output summaries, and perform shadow track calculations based on shadow voucher units to generate shadow stage output summaries. Register the phase number, phase path marker, input data digest, real phase output digest, shadow phase output digest, remote node identity, computing environment identifier, and phase timestamp as phase credential records; The current stage authentication tag is generated by combining the stage credential record with the previous authentication tag digest and performing digest calculation. Write the current stage authentication tag into the stage credential record, which will serve as the summary of the preceding authentication tag for the next stage.

[0012] Optionally, the operation of the credential snapshot during the construction phase includes: The stage voucher records are collected by stage number and stage path mark, and each stage voucher record is converted into a graphical voucher record; In the graphical voucher record, the input data summary is attached to the real stage output summary and the shadow stage output summary respectively, forming a dual-track execution edge; The remote node identity and computing environment identity are merged into a node operation credential, and the node operation credential is attached to the current stage authentication tag to form an identity-environment binding edge. By attaching the previous authentication tag summary to the current stage authentication tag, a tag progression edge is formed; Merge the graphical voucher records, dual-track execution edges, identity and environment binding edges, and tag progression edges according to the stage number to generate a stage voucher snapshot diagram.

[0013] Optionally, the operation of performing phase security gating rewriting on the phase credential snapshot image includes: Read the snapshot image of the stage voucher according to the stage number, perform stage verification on the dual-track execution edge, identity environment binding edge and tag progression edge, and generate the stage verification result of the corresponding voucher edge; Convert the phase verification results into phase security gating groups; Write the phased security gating group into the corresponding document edge according to the document edge type; Read the original edge weight and corresponding threshold value of the voucher edge. When the threshold value is in the pass state, retain the original edge weight. When the threshold value is in the doubt state, rewrite the original edge weight as a decay edge weight. When the threshold value is in the failure state, rewrite the original edge weight as a blocking edge weight to obtain the rewritten voucher edge weight.

[0014] Optionally, the operation of generating the credential state vector and obtaining the dual-track stage output representation through the improved EvolveGCN structure includes: Summarize the rewritten voucher edge weights in the voucher snapshot diagram according to the stage number, and generate a voucher status vector; Input the credential state vector into the parameter evolution unit in the improved EvolveGCN structure to update the graph convolution weight matrix and bias vector; Based on the updated graph convolution weight matrix, bias vector, and rewritten voucher edge weights, perform graph convolution propagation on the stage voucher snapshot graph; The dual-track stage output representation is obtained by aggregating the graph convolution propagation results of the real track record and the shadow track record respectively.

[0015] Optionally, the operation of performing reverse closed tracing and shadow witness comparison based on the result voucher data includes: The parsing results voucher data yields result summary data, stage voucher data, and dual-track output data. Starting with the results summary data, a reverse voucher traceability chain is generated in reverse order along the stage numbers; The reverse voucher tracing chain is compared with the actual calculated voucher track to generate a reverse closed tracing result. Extract shadow track data from the dual-track output data, and match the expected shadow output by stage path markers; The shadow track data is compared with the expected shadow output to generate the shadow witness comparison result.

[0016] Optionally, the operation of generating remote computing data security verification results includes: Establish a verification and judgment table according to the task number, and group the reverse closure tracing results, shadow witness comparison results and voucher status vectors under the same task into a judgment unit according to the stage path mark. Set the abnormal state of the judgment unit, set the result replacement flag when the reverse closure tracing result is in an unclosed state, set the forgery execution flag when the shadow witness comparison result is in an inconsistent state, set the stage security abnormal flag when the voucher state vector contains blocking edge weight, and set the stage record abnormal flag when the voucher state vector contains attenuation edge weight and the label progression edge is in a suspicious state. The abnormal status setting results in each judgment unit are folded and summarized according to the task number to obtain the remote computing data security verification result.

[0017] The beneficial effects of this invention are: (1) The present invention establishes a pre-calculation voucher basis by using a remote computing task structure table, task basic voucher, input data summary and real computing voucher track, and incorporates data block number, operator number, stage number and stage path mark into a unified verification chain, so that the remote computing task has traceable voucher records from input data to stage path.

[0018] (2) The present invention constructs a parallel verification process of real track and shadow track by using shadow witness fragments, shadow expected output and dual-track voucher task data. During the execution stage of remote computing node, a real stage output summary and a shadow stage output summary are formed, which can perform path-level identification of forged execution, stage jump calculation and result replacement.

[0019] (3) This invention uses stage credential snapshot diagram, stage security gating group, credential state vector and improved EvolveGCN structure to dynamically rewrite the edge weights of dual-track execution edge, identity environment binding edge and tag progression edge, and combines reverse closure tracing and shadow witness comparison to generate remote computing data security verification results, thereby improving the integrity of remote computing process verification, anomaly location accuracy and result credibility. Attached Figure Description

[0020] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of a remote computing data security verification method based on data security proposed in this invention; Figure 2 This is a schematic diagram of the structure of dual-track voucher task data in a remote computing data security verification method based on data security proposed in this invention; Figure 3 This is a flowchart illustrating the generation of the verification judgment table for a remote computing data security verification method based on data security proposed in this invention. Detailed Implementation

[0021] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0022] refer to Figures 1-3 A remote computing data security verification method based on data security includes the following steps: Receive remote computing tasks, generate a remote computing task structure table and task basic credentials, and generate an input data digest for the data block to be computed. Based on the remote computing task structure table, task base voucher, and input data summary, generate the real computing voucher track, insert the shadow witness fragment into the same path position of the real computing voucher track, and generate dual-track voucher task data. Send the dual-track voucher task data to the remote computing node, execute the dual-track voucher task data according to the stage number, and generate stage voucher records and current stage authentication tags; Construct a phase credential snapshot diagram based on the phase credential record and the current phase authentication label, and input the phase credential snapshot diagram arranged by phase number into the improved EvolveGCN structure; Before graph convolution propagation in the improved EvolveGCN structure, a stage security gating group is generated based on the stage verification results in the stage voucher snapshot graph. The stage security gating group is written into the voucher edge, the voucher edge weight is rewritten, and the voucher state vector is generated by summarizing the rewritten voucher edge weights according to the stage. The voucher state vector is written into the parameter evolution unit in the improved EvolveGCN structure according to the stage number, the graph convolution weight matrix and bias vector are updated, and graph convolution propagation is performed on the dual-track voucher task data to obtain the dual-track stage output representation. Receive the result voucher data returned by the remote computing node, perform reverse closure tracing and shadow witness comparison based on the result voucher data, write the reverse closure tracing result, shadow witness comparison result and voucher status vector into the verification judgment table, and generate the remote computing data security verification result.

[0023] In this embodiment, the operations for generating the remote computing task structure table, task basic credentials, and input data summary include: Configure task numbers for remote computing tasks, and configure data block numbers, operator numbers and stage numbers according to the data blocks to be computed, computing operators and computing stages. Write the data block numbers, operator numbers, stage numbers, input fields, output fields, result fields and same path position markers into the remote computing task structure table. Generate basic credentials for the task, which include the task number, initial random number, initial computation token, and initial authentication tag digest. Perform digest calculation on the data block to be computed according to the data block number, and generate the input data digest bound to the data block number.

[0024] Upon receiving a remote computing task, the system reads the data to be computed, the operator call relationship, the stage execution order, and the target result field from the remote computing task, and configures a task number for the remote computing task. The data block number, operator number, stage number, task base certificate, and input data summary generated under the same remote computing task are all written to the same task number.

[0025] The data to be calculated is divided into multiple data blocks according to the preset data block boundaries. Each data block records the start position, end position, and length of the data block. The data block numbers are configured according to the order of the data blocks in the remote computing task, and the data block numbers correspond one-to-one with the data blocks to be calculated.

[0026] The computation operators are configured with operator numbers according to the operator calling order in the remote computation task, and the computation stages are configured with stage numbers according to the stage execution order in the remote computation task. The operator numbers called within the same computation stage are written to the record with the corresponding stage number, the data items read by the computation stage are written to the input field, the data items generated by the computation stage are written to the output field, and the data items finally returned by the remote computation task are written to the result field.

[0027] Each row in the remote computing task structure table corresponds to a record of a data block to be computed being called by a computing operator within a computing stage; each row contains the task number, data block number, operator number, stage number, input field, output field, result field, and same path location marker.

[0028] The same path location marker is formed by combining the stage number, operator number, input field position, and path sequence number; the input field position is configured according to the arrangement of the input field in the current calculation stage, and the path sequence number is configured according to the arrangement order of multiple input fields under the same operator number; the same path location marker is written to the row record corresponding to the data block number in the remote calculation task structure table.

[0029] The basic task credentials are generated according to the task number, and the initial random number is generated by the user-side random number generator; the initial calculation token is generated according to the data block number, and each data block to be calculated corresponds to one initial calculation token. The initial calculation token is obtained by performing digest calculation after combining the task number, the initial random number and the data block number; the initial authentication tag digest is obtained by performing digest calculation after combining the task number, the initial random number and the initial calculation token.

[0030] When performing digest calculation on the data block to be calculated, the digest input string is formed by concatenating the task number, data block number, content of the data block to be calculated and the initial random number. The digest input string is then input into a preset digest algorithm, which outputs a fixed-length digest value. This fixed-length digest value is then used as the input data digest.

[0031] After the input data summary is generated, it is written to a summary record, which includes the task number, data block number, and input data summary. The summary record is then associated with the row record in the remote computing task structure table that has the same task number and the same data block number.

[0032] The plaintext content of the data block to be computed is not written into the remote computing task structure table; the path location marker is associated with and stored with the data block number, operator number and stage number.

[0033] In this embodiment, the operation of generating the actual calculation voucher track includes: Compile the remote computing task structure table, task basic credentials, and input data summary by task number; The records in the remote computing task structure table are sorted by path according to the stage number, operator number and same path position mark to form a stage path sequence; A stage voucher unit is established based on each record in the stage path sequence, and the stage voucher unit is configured with stage number, operator number, data block number, same path position mark and stage path mark; Load the input data digest bound to the data block number into the corresponding stage credential unit, and bind the initial computation token and initial authentication tag digest in the task base credential to the starting stage credential unit of the stage path sequence. Establish a document progression relationship based on the stage number and path position mark of adjacent document units in the stage path sequence, and arrange the stage document units after establishing the document progression relationship into the actual calculation document track.

[0034] The task number serves as a unified index for remote computing tasks. The remote computing task structure table, task base credentials, and input data digest all carry the task number. When generating the actual computing credential track, the stage records in the remote computing task structure table, the initial random number in the task base credentials, the initial computing token and the initial authentication tag digest, and the data block number and digest value in the input data digest are all collected according to the same task number.

[0035] When sorting paths, the records in the remote computing task structure table are arranged in ascending order of stage number; under the same stage number, the records are arranged according to the operator number; under the same stage number and the same operator number, the records are arranged according to the same path position mark, forming a stage path sequence.

[0036] The stage number corresponds to the execution order of the remote computing task, the operator number corresponds to the calling order of the computing operators, and the same path position mark corresponds to the position of the data block to be computed entering the computing path; each item in the stage path sequence corresponds to the path record of a data block to be computed processed by a computing operator within a computing stage.

[0037] When establishing a stage voucher unit, a single path record in the stage path sequence is used as the unit basis. The stage number, operator number, data block number, and same path position mark are written into the stage voucher unit. The stage path mark is generated by concatenating the stage number, operator number, and same path position mark in a preset order and then written into the stage voucher unit.

[0038] When loading the input data summary, the data block number in the stage voucher unit is matched with the data block number in the input data summary; if the match is found, the input data summary is written to the input summary field of the corresponding stage voucher unit.

[0039] When determining the initial stage voucher unit, select the stage voucher unit corresponding to the stage number that is first in the stage path sequence; when there are multiple stage voucher units under the same first stage number, select the initial stage voucher unit according to the order of operator number and the position mark of the same path.

[0040] When binding the task base credentials, the initial computation token and the initial authentication tag digest are obtained from the task base credentials, and the initial computation token and the initial authentication tag digest are written into the initial stage credential unit.

[0041] When establishing a progressive relationship between vouchers, under the same stage number, adjacent stage voucher units are connected according to the order of operator numbers; between different stage numbers, the previous stage voucher unit and the next stage voucher unit are connected according to the same path position marker.

[0042] The actual calculation voucher track consists of stage voucher units and voucher progression relationships. When generating the actual calculation voucher track, the stage voucher units are arranged according to the stage path sequence, and the voucher progression relationships are registered between adjacent stage voucher units.

[0043] In this embodiment, the operation of generating dual-track voucher task data includes: Based on the initial random number, data block number, and stage number in the task base certificate, determine the shadow source data block and the corresponding stage path marker in the stage path sequence; Replace the data values ​​of the shadow source data block while preserving the field format, data length, and same path location markers to generate a shadow witness fragment; Perform local computation on the shadow witness fragment to generate the expected shadow output; Locate the stage voucher unit in the actual calculation voucher track according to the corresponding stage path mark, and establish a shadow voucher unit carrying shadow witness fragments and shadow expected outputs. The shadow voucher unit and the stage voucher unit obtained from the location are registered side by side to generate dual-track voucher task data.

[0044] When selecting a shadow source data block, the process involves entering the stage path sequence according to the task number, reading the data block number and stage number in the stage path sequence, and concatenating the initial random number, data block number, and stage number in a preset order to form a shadow selection input string. The number of stage voucher units in the stage path sequence is used as the modulo base, and modulo mapping is performed on the shadow selection input string to obtain the position of the shadow source data block in the stage path sequence.

[0045] The shadow source data block is the data block to be calculated selected by the modulo mapping result in the stage path sequence; the corresponding stage path mark is the stage path mark in the stage voucher unit where the shadow source data block is located. The corresponding stage path mark is formed by concatenating the stage number, operator number and same path position mark in a preset order.

[0046] When replacing the data value of the shadow source data block, the field position, field type and data length in the shadow source data block are read, and the original data value is replaced with the shadow data value. The shadow data value is obtained by concatenating the initial random number, data block number and field position and then performing a digest truncation. The shadow data value is truncated or filled according to the data length of the shadow source data block and then written to the original field position.

[0047] The field format includes the field type and the field order. When generating a shadow witness fragment, the field format, data length and same path position marker of the shadow source data block are preserved. The replaced shadow data value is written to the original field position to form a shadow witness fragment that is in the same path position as the shadow source data block.

[0048] Local computation is performed on the side that initiates the remote computation task. When performing local computation, the local operator is called according to the operator number corresponding to the shadow witness fragment. The shadow data value in the shadow witness fragment is used as the input data of the local operator to obtain the local computation output, and the local computation output is registered as the shadow expected output.

[0049] The actual calculation voucher track is retrieved according to the corresponding stage path marker. When the stage path marker carried by the stage voucher unit in the actual calculation voucher track is consistent with the corresponding stage path marker, the stage voucher unit is identified as the stage voucher unit obtained by positioning.

[0050] When establishing a shadow credential unit, the shadow witness fragment, the shadow expected output, and the corresponding stage path marker are written into the shadow credential unit; the shadow credential unit and the stage credential unit obtained by positioning use the same corresponding stage path marker.

[0051] When registering in parallel, retain the stage voucher unit obtained from the location and the original voucher progression relationship, and add a shadow voucher unit under the same corresponding stage path mark; register the stage voucher unit obtained from the location as the real track record, and register the shadow voucher unit as the shadow track record.

[0052] Dual-track voucher task data is saved according to the stage path sequence; when generating dual-track voucher task data, the real track record and the shadow track record are written into the same dual-track index item, and the dual-track index item is saved in the order of the stage path sequence.

[0053] In this embodiment, the operations for generating stage credential records and current stage authentication tags include: Send the dual-track voucher task data to the remote computing node and match the stage voucher unit and shadow voucher unit according to the stage number and stage path mark. Perform real track calculations based on stage voucher units to generate real stage output summaries, and perform shadow track calculations based on shadow voucher units to generate shadow stage output summaries. Register the phase number, phase path marker, input data digest, real phase output digest, shadow phase output digest, remote node identity, computing environment identifier, and phase timestamp as phase credential records; The current stage authentication tag is generated by combining the stage credential record with the previous authentication tag digest and performing digest calculation. Write the current stage authentication tag into the stage credential record, which will serve as the summary of the preceding authentication tag for the next stage.

[0054] In this process, after the dual-track voucher task data is sent to the remote computing node, the remote computing node receives the dual-track voucher task data according to the task number, retrieves the dual-track index item according to the stage number, and matches the real track record and shadow track record according to the stage path mark under the same stage number.

[0055] Stage credential units are obtained from the real track record, and shadow credential units are obtained from the shadow track record. When matching stage credential units and shadow credential units, the stage path marker in the stage credential unit is compared with the stage path marker in the shadow credential unit. Stage credential units and shadow credential units with the same stage path marker are registered as the same stage execution group.

[0056] During the calculation of the real track, the remote calculation node calls the remote calculation operator according to the operator number in the stage voucher unit, takes the data block to be calculated corresponding to the stage voucher unit as the input data of the real track, and completes the calculation of the current stage according to the input fields and output fields in the stage voucher unit to obtain the output data of the real stage.

[0057] The actual stage output digest is obtained by performing digest calculation on the actual stage output data. During digest calculation, the actual output digest input string is formed in the order of task number, stage number, stage path marker, actual stage output data, and stage timestamp. The actual output digest input string is then input into a preset digest algorithm to obtain the actual stage output digest.

[0058] During shadow track calculation, the remote calculation node calls the same remote calculation operator according to the operator number in the shadow voucher unit, takes the shadow witness fragment in the shadow voucher unit as the shadow track input data, and completes the current stage calculation according to the field format, data length and same path position mark carried by the shadow witness fragment to obtain the shadow stage output data.

[0059] The shadow stage output digest is obtained by performing digest calculation on the shadow stage output data. During digest calculation, the shadow output digest input string is formed in the order of task number, stage number, stage path marker, shadow stage output data, and stage timestamp. The shadow output digest input string is then input into a preset digest algorithm to obtain the shadow stage output digest.

[0060] Within the same execution group, the real track calculation and the shadow track calculation are performed according to the same operator number; the real stage output summary and the shadow stage output summary are written to the stage voucher record corresponding to the same stage number and the same stage path marker.

[0061] The remote node identity is formed by the node certificate number or the node public key digest of the remote computing node; the computing environment identifier is obtained by combining the execution image digest, the operator version number and the running configuration digest and then calculating the execution digest; the stage timestamp is generated by the remote computing node when the current stage ends.

[0062] Stage credential records are established according to stage number and stage path marker. Each stage credential record contains stage number, stage path marker, input data summary, real stage output summary, shadow stage output summary, remote node identity, computing environment identifier, and stage timestamp.

[0063] The preceding authentication tag digest is taken from the initial authentication tag digest in the task base credential in the stage credential record corresponding to the first stage number; in the stage credential record corresponding to a different stage number, the preceding authentication tag digest is taken from the current stage authentication tag generated in the previous stage under the same stage path mark.

[0064] When generating the current stage authentication label, the authentication label input string is formed in the following order: stage number, stage path marker, input data digest, real stage output digest, shadow stage output digest, remote node identity identifier, computing environment identifier, stage timestamp, and previous authentication label digest. The authentication label input string is then input into a preset digest algorithm to obtain the current stage authentication label.

[0065] After the current stage authentication label is generated, the stage credential record corresponding to the same stage number and the same stage path mark is written; when entering the next stage number, the current stage authentication label in the previous stage credential record is used as the previous stage's preceding authentication label summary.

[0066] In this embodiment, the operation of the certificate snapshot image during the construction phase includes: The stage voucher records are collected by stage number and stage path mark, and each stage voucher record is converted into a graphical voucher record; In the graphical voucher record, the input data summary is attached to the real stage output summary and the shadow stage output summary respectively, forming a dual-track execution edge; The remote node identity and computing environment identity are merged into a node operation credential, and the node operation credential is attached to the current stage authentication tag to form an identity-environment binding edge. By attaching the previous authentication tag summary to the current stage authentication tag, a tag progression edge is formed; Merge the graphical voucher records, dual-track execution edges, identity and environment binding edges, and tag progression edges according to the stage number to generate a stage voucher snapshot diagram.

[0067] When collecting stage voucher records, stage voucher records belonging to the same remote computing task are filtered according to the same task number. Under the same task number, stage record groups are divided according to stage number. Within the same stage record group, stage voucher records are arranged according to stage path mark.

[0068] The graphical credential record is derived from the stage credential record. During the transformation, the input data digest, the actual stage output digest, the shadow stage output digest, the remote node identity identifier, the computing environment identifier, the stage timestamp, the previous authentication tag digest, and the current stage authentication tag are extracted from the stage credential record. The above contents are then registered in the same graphical credential record according to the stage path marking.

[0069] In the graphical voucher record, voucher items and voucher edges are set. Input data summary, real-stage output summary, shadow-stage output summary, node execution voucher, preceding authentication tag summary, and current-stage authentication tag are registered as voucher items; dual-track execution edges, identity-environment binding edges, and tag progression edges are registered as voucher edges. A link is a directed association between two voucher items. When registering a link relationship, the starting voucher item identifier is written as the link start point, the ending voucher item identifier is written as the link end point, and the edge type, stage number, and stage path marker are written as the link relationship.

[0070] When forming a dual-track execution edge, the input data digest is used as the attachment start point and the real stage output digest is used as the first attachment end point to register the real track execution edge; the same input data digest is used as the attachment start point and the shadow stage output digest is used as the second attachment end point to register the shadow track execution edge; the real track execution edge and the shadow track execution edge are jointly registered as a dual-track execution edge.

[0071] A node operation credential is formed by combining the remote node identity identifier and the computing environment identifier. When forming a node operation credential, the operation credential input string is formed in the order of the remote node identity identifier and the computing environment identifier, and the operation credential input string is registered as the node operation credential.

[0072] When forming an identity-environment binding edge, the node operation certificate is used as the attachment starting point and the current stage authentication label is used as the attachment ending point to register the identity-environment binding edge.

[0073] When forming a tag progression edge, the previous authentication tag summary is used as the attachment starting point, and the current stage authentication tag is used as the attachment ending point, and the tag progression edge is registered.

[0074] The preceding authentication tag digest is taken from the initial authentication tag digest in the task base credential in the graphical credential record corresponding to the first stage number, and from the current stage authentication tag generated in the previous stage under the same stage path mark in the graphical credential record corresponding to a non-first stage number.

[0075] When generating a stage voucher snapshot, the graphical voucher records, dual-track execution edges, identity environment binding edges, and tag progression edges within the same stage record group are merged according to the stage number to obtain the stage voucher snapshot under the corresponding stage number.

[0076] In this embodiment, the operation of performing phase security gating rewriting on the phase voucher snapshot image includes: Read the snapshot image of the stage voucher according to the stage number, perform stage verification on the dual-track execution edge, identity environment binding edge and tag progression edge, and generate the stage verification result of the corresponding voucher edge; Convert the phase verification results into phase security gating groups; Write the phased security gating group into the corresponding document edge according to the document edge type; Read the original edge weight and corresponding threshold value of the voucher edge. When the threshold value is in the pass state, retain the original edge weight. When the threshold value is in the doubt state, rewrite the original edge weight as a decay edge weight. When the threshold value is in the failure state, rewrite the original edge weight as a blocking edge weight to obtain the rewritten voucher edge weight.

[0077] Among them, the stage voucher snapshot image is read according to the stage number, and each stage number corresponds to a stage voucher snapshot image; when reading the stage voucher snapshot image, the graph voucher record, dual-track execution edge, identity environment binding edge and tag progression edge under the stage number are extracted.

[0078] Phase verification is performed according to the voucher edge type. The voucher edge record contains the voucher edge type, phase number, phase path marker, attachment start point, attachment end point, and original edge weight. When performing phase verification, the voucher items corresponding to the attachment start point and attachment end point are read according to the voucher edge type, and the binding relationship between the voucher items is compared.

[0079] When performing edge verification on dual tracks, the input data summary, the actual stage output summary, and the shadow stage output summary under the same stage path mark are read. When performing edge verification on the actual track, the summary closure comparison is performed according to the stage calculation records between the input data summary and the actual stage output summary. When performing edge verification on the shadow track, the shadow stage output summary and the shadow expected output are read, and a consistency comparison is performed between the two.

[0080] When performing phase verification on the identity environment binding edge, the remote node identity identifier and computing environment identifier are read from the node running credential, the phase credential record corresponding to the current phase authentication tag is read, the remote node identity identifier is compared with the remote node identity identifier in the phase credential record, and the computing environment identifier is compared with the computing environment identifier in the phase credential record.

[0081] When performing stage verification on the tag progression edge, read the previous authentication tag digest corresponding to the attachment start point of the tag progression edge, and read the current stage authentication tag corresponding to the attachment end point; recalculate the authentication tag according to the stage credential record, the previous authentication tag digest, and the preset digest algorithm, and compare the recalculated authentication tag with the current stage authentication tag.

[0082] The stage verification results are registered as passed, suspicious, or failed. When the comparison items are complete and consistent, the stage verification result of the corresponding voucher edge is registered as passed; when the comparison items are missing, the stage path marker is missing, or the voucher edge type is missing, the stage verification result of the corresponding voucher edge is registered as suspicious; when any comparison item is inconsistent, the stage verification result of the corresponding voucher edge is registered as failed.

[0083] Phase security gating groups are established according to phase numbers. When establishing a phase security gating group, the phase verification results of the dual-track execution edge are converted into dual-track execution gates, the phase verification results of the identity-environment binding edge are converted into identity-environment gates, and the phase verification results of the tag progression edge are converted into tag progression gates.

[0084] When the phased security gating group writes the corresponding credential edge, the dual-track execution edge writes the corresponding dual-track execution gate, the identity and environment binding edge writes the corresponding identity and environment gate, and the tag progression edge writes the corresponding tag progression gate.

[0085] The corresponding threshold is determined by the gate state of the write credential edge. When the gate state is "pass", the corresponding threshold is registered as the reserved threshold; when the gate state is "suspicious", the corresponding threshold is registered as the attenuation threshold; when the gate state is "failure", the corresponding threshold is registered as the blocking threshold.

[0086] When performing edge weight rewriting, if the corresponding threshold is a retention threshold, the original edge weight is retained as the rewritten voucher edge weight; if the corresponding threshold is a decay threshold, the original edge weight is rewritten as a decay edge weight according to the preset decay rule; if the corresponding threshold is a blocking threshold, the original edge weight is rewritten as a blocking edge weight.

[0087] The rewritten voucher edge weights are written back to the corresponding voucher edge records; after the edge weights are rewritten, the attachment start point, attachment end point, stage number, and stage path marker of the voucher edge remain unchanged.

[0088] In this embodiment, the operation of generating the credential state vector and obtaining the dual-track stage output representation through the improved EvolveGCN structure includes: Summarize the rewritten voucher edge weights in the voucher snapshot diagram according to the stage number, and generate a voucher status vector; Input the credential state vector into the parameter evolution unit in the improved EvolveGCN structure to update the graph convolution weight matrix and bias vector; Based on the updated graph convolution weight matrix, bias vector, and rewritten voucher edge weights, perform graph convolution propagation on the stage voucher snapshot graph; The dual-track stage output representation is obtained by aggregating the graph convolution propagation results of the real track record and the shadow track record respectively.

[0089] When generating the voucher status vector, the rewritten voucher edge weights and corresponding threshold values ​​in the voucher snapshot diagram of the corresponding stage are read according to the stage number. The number of retained edges, the number of attenuated edges, the number of blocked edges, and the cumulative value of edge weights are counted according to the voucher edge type. The counted number of retained edges, the number of attenuated edges, the number of blocked edges, and the cumulative value of edge weights are arranged in a preset order to form the voucher status vector corresponding to the stage number.

[0090] After the voucher state vector is bound to the stage number, it is input into the parameter evolution unit in the improved EvolveGCN structure. The parameter evolution unit reads the graph convolution weight matrix of the previous stage, the bias vector of the previous stage, and the voucher state vector of the current stage, and generates weight adjustment data and bias adjustment data based on the voucher state vector of the current stage.

[0091] When updating the graph convolution weight matrix and bias vector, the graph convolution weight matrix from the previous stage is combined with the weight adjustment data to obtain the graph convolution weight matrix for the current stage; the bias vector from the previous stage is combined with the bias adjustment data to obtain the bias vector for the current stage. The graph convolution weight matrix and bias vector corresponding to the first stage number use a preset initial graph convolution weight matrix and a preset initial bias vector.

[0092] During graph convolution propagation, the snapshot graph of the stage voucher under the current stage number is converted into a node representation matrix, and the rewritten voucher edge weights are written into the weighted adjacency matrix according to the voucher edge attachment relationship. The row vectors in the node representation matrix correspond to the voucher items in the graph-based voucher record, and the non-zero elements in the weighted adjacency matrix correspond to the rewritten voucher edge weights.

[0093] During graph convolution propagation, the rewritten voucher edge weights participate in the weighted propagation between adjacent voucher items, and the updated graph convolution weight matrix and bias vector participate in the update of the node representation at the current stage, resulting in the propagated node representation matrix.

[0094] When aggregating the results of graph convolution propagation, the node representations corresponding to the real track records are extracted from the node representation matrix after propagation according to the stage path labels, and then aggregated to obtain the output representation of the real track stage; the node representations corresponding to the shadow track records are extracted from the node representation matrix after propagation according to the same stage path labels, and then aggregated to obtain the output representation of the shadow track stage.

[0095] The dual-track stage output representation consists of the real track stage output representation and the shadow track stage output representation. When generating the dual-track stage output representation, the real track stage output representation, the shadow track stage output representation, the stage number, the stage path marker, and the voucher status vector are written into the stage output representation record.

[0096] In this embodiment, the operations of performing reverse closed tracing and shadow witness comparison based on the result voucher data include: The parsing results voucher data yields result summary data, stage voucher data, and dual-track output data. Starting with the results summary data, a reverse voucher traceability chain is generated in reverse order along the stage numbers; The reverse voucher tracing chain is compared with the actual calculated voucher track to generate a reverse closed tracing result. Extract shadow track data from the dual-track output data, and match the expected shadow output by stage path markers; The shadow track data is compared with the expected shadow output to generate the shadow witness comparison result.

[0097] The result voucher data is returned by the remote computing node after completing the dual-track voucher task data. When parsing the result voucher data, it is split into result summary data, stage voucher data, and dual-track output data according to the task number. The result summary data includes the final result summary and the final stage number. The stage voucher data includes the stage voucher record corresponding to each stage number and the current stage authentication tag. The dual-track output data includes the dual-track stage output representation corresponding to each stage number and stage path mark.

[0098] The result summary data is registered according to the final stage number, and the final result summary is obtained by remote computing nodes performing summary calculations on the final results. The stage voucher data is arranged according to the stage number and stage path marker, and each stage voucher data corresponds to a stage voucher record under a stage path marker.

[0099] Dual-track output data is registered according to stage number, stage path marker, and track record type. Track record types include real track records and shadow track records. Real track records correspond to the real track stage output representation, and shadow track records correspond to the shadow track stage output representation.

[0100] When generating a reverse voucher traceability chain, starting from the final stage number corresponding to the final result summary, the stage voucher data is read backwards according to the stage number; under the current stage number, the real stage output summary corresponding to the final result summary is read, and the stage path marker where the real stage output summary is located is extracted.

[0101] When tracing back in reverse order along the stage number, under the same stage path marker, the input data digest of the current stage is paired with the real stage output digest of the previous stage, and the current stage authentication label of the current stage is paired with the previous authentication label digest read in the next stage, forming a reverse credential tracing chain.

[0102] Each traceability node in the reverse credential traceability chain records the stage number, stage path marker, input data summary, real stage output summary, current stage authentication label, and previous authentication label summary; the traceability nodes are arranged in descending order of stage number.

[0103] During the closed comparison, the stage path markers in the reverse voucher tracing chain are compared item by item with the stage path markers in the actual calculation voucher track; when the stage path markers match, the corresponding tracing node is paired with the stage voucher unit in the actual calculation voucher track.

[0104] During the summary closure comparison, the input data summary in the traceability node is compared with the input data summary corresponding to the same stage path mark in the actual calculation voucher track, and the actual stage output summary in the traceability node is compared with the actual stage output summary corresponding to the same stage path mark in the stage voucher record.

[0105] During the authentication closure comparison, the prior authentication tag summary corresponding to the first stage number is compared with the initial authentication tag summary in the task base credential; the prior authentication tag summary corresponding to a non-first stage number is compared with the current stage authentication tag generated by the previous stage under the same stage path mark.

[0106] The reverse closure tracing results are registered according to the stage path markers. When the path comparison, summary comparison, and authentication comparison are all consistent, the reverse closure tracing result under the corresponding stage path marker is registered as closed; when any comparison is inconsistent, the reverse closure tracing result under the corresponding stage path marker is registered as unclosed.

[0107] When extracting shadow track data, read the record items of track record type shadow track record from the dual track output data, and extract the shadow track stage output representation, shadow stage output summary, stage number and stage path marker.

[0108] When matching the expected shadow output, the expected shadow output record is retrieved according to the stage path marker in the shadow track data; if the stage path marker in the expected shadow output record matches the stage path marker in the shadow track data, the expected shadow output record is determined as the matched expected shadow output.

[0109] Perform a digest calculation on the expected output of the shadow to obtain the expected output digest of the shadow; compare the output digest of the shadow stage in the shadow track data with the expected output digest of the shadow to generate the shadow witness comparison result.

[0110] The results of the shadow witness comparison are registered according to the stage path markers. When the shadow stage output summary is consistent with the shadow expected output summary, the shadow witness comparison result under the corresponding stage path marker is registered as consistent; when the shadow stage output summary is inconsistent with the shadow expected output summary, the shadow witness comparison result under the corresponding stage path marker is registered as inconsistent.

[0111] In this embodiment, the operation of generating remote computing data security verification results includes: Establish a verification and judgment table according to the task number, and group the reverse closure tracing results, shadow witness comparison results and voucher status vectors under the same task into a judgment unit according to the stage path mark. Set the abnormal state of the judgment unit, set the result replacement flag when the reverse closure tracing result is in an unclosed state, set the forgery execution flag when the shadow witness comparison result is in an inconsistent state, set the stage security abnormal flag when the voucher state vector contains blocking edge weight, and set the stage record abnormal flag when the voucher state vector contains attenuation edge weight and the label progression edge is in a suspicious state. The abnormal status setting results in each judgment unit are folded and summarized according to the task number to obtain the remote computing data security verification result.

[0112] The verification judgment table is established according to the task number, with each task number corresponding to one verification judgment table. The verification judgment table sets the stage path marker, reverse closure tracing result, shadow witness comparison result, voucher status vector, result replacement marker, forgery execution marker, stage security anomaly marker, and stage record anomaly marker.

[0113] When establishing the verification decision table, the stage path markers under the same task number are read, and the decision table row index is generated according to the arrangement order of stage number and operator number; the same stage path marker corresponds to a row of decision records in the verification decision table.

[0114] When merging into a decision unit, the single-row decision record in the verification decision table is used as the merging position. The reverse closure tracing result, shadow witness comparison result, and voucher status vector under the same task number and the same stage path mark are read and merged into the same decision record to form a decision unit.

[0115] The decision unit includes stage path markers, reverse closure tracing results, shadow witness comparison results, and credential status vectors. The four types of markers in the decision unit are all set to the non-triggered state in the initial state. The four types of markers include result replacement marker, forgery execution marker, stage security anomaly marker, and stage record anomaly marker.

[0116] When the abnormal state is set, the reverse closure tracing result in the judgment unit is read; when the reverse closure tracing result is in a closed state, the result replacement flag is kept in an untriggered state; when the reverse closure tracing result is in an unclosed state, the result replacement flag is set to a triggered state, and the corresponding stage number and stage path flag are recorded.

[0117] Read the shadow witness comparison result in the judgment unit; when the shadow witness comparison result is consistent, the forgery execution flag remains in an untriggered state; when the shadow witness comparison result is inconsistent, set the forgery execution flag to a triggered state and record the corresponding stage number and stage path flag.

[0118] Read the voucher status vector in the decision unit, and retrieve the rewritten voucher edge weights item by item according to the voucher edge type; when a blocking edge weight is retrieved, set the stage security anomaly mark to the trigger state, and record the voucher edge type, stage number and stage path mark corresponding to the blocking edge weight.

[0119] Continue reading the voucher status vector in the judgment unit and retrieve the attenuation edge weight; when the attenuation edge weight is retrieved, read the label progression edge status under the same stage path mark; when the label progression edge status is a suspicious status, set the stage record abnormal mark position to the trigger status, and record the attenuation edge weight, label progression edge status, stage number and stage path mark.

[0120] When folding and summarizing, read all judgment units in the verification judgment table according to the task number, and perform similar merging on the result replacement flag, forged execution flag, stage security exception flag, and stage record exception flag in each judgment unit.

[0121] When merging similar tasks, if the result replacement flag of any decision unit under the same task number is in the triggered state, the result replacement summary state will be set to the triggered state; if the forged execution flag of any decision unit is in the triggered state, the forged execution summary state will be set to the triggered state; if the stage security exception flag of any decision unit is in the triggered state, the stage security exception summary state will be set to the triggered state; if the stage record exception flag of any decision unit is in the triggered state, the stage record exception summary state will be set to the triggered state.

[0122] The remote computing data security verification results are generated according to the task number. The remote computing data security verification results include the task number, result replacement summary status, forgery execution summary status, stage security anomaly summary status, stage record anomaly summary status, and anomaly details; the anomaly details record the stage number, stage path marker, and marker name corresponding to the trigger status.

[0123] When all summary states are in an untriggered state, the remote computing data security verification result is registered as passed; when any summary state is in a triggered state, the remote computing data security verification result is registered as failed.

[0124] Example 1: To verify the feasibility of this invention in practice, it was applied to a remote computing data security verification scenario. The scenario includes four types of remote computing tasks: batch data analysis, model inference, encrypted statistics, and report generation. The data sender does not directly trust the final results returned by the remote computing nodes; the verification focuses on the stage path, operator execution, environment binding, and the progression of authentication tags. Existing digest verification methods only compare the final result digest, while log signature verification methods add execution logs and node signature tags. However, when faced with stage jumps, path tampering, environment replacement, and forged execution, problems such as incomplete anomaly localization and a high number of missed detections still exist.

[0125] This invention generates a remote computing task structure table, a task base certificate, and an input data digest at the data sending end. The remote computing task structure table records data block numbers, operator numbers, stage numbers, input fields, output fields, result fields, and same-path position markers. The data sending end forms a real computing certificate track based on the remote computing task structure table, task base certificate, and input data digest, and determines the shadow source data block based on an initial random number, data block number, and stage number. After replacing the data values, a shadow witness fragment is formed.

[0126] The shadow witness fragment performs local calculations at the data sending end to obtain the expected shadow output. It is then inserted into the same path position of the real calculation voucher track according to the stage path marker, forming dual-track voucher task data. After receiving the dual-track voucher task data, the remote computing node performs real track calculations and shadow track calculations according to the stage number, generating a real stage output summary, a shadow stage output summary, a stage voucher record, and a current stage authentication tag.

[0127] The data sender converts the stage credential record into a stage credential snapshot image, setting dual-track execution edges, identity-environment binding edges, and tag-progressive edges. The stage security gating group performs stage verification on the three types of credential edges, converting the verification status into retained edge weights, decayed edge weights, and blocked edge weights. The improved EvolveGCN structure reads the stage credential snapshot image and credential state vector, updates the graph convolution weight matrix and bias vector, and outputs a dual-track stage output representation.

[0128] After the remote computing node returns the result voucher data, the data sending end generates a reverse voucher traceability chain. This chain is then compared with the actual computed voucher track to generate a reverse closed traceability result. Shadow track data is extracted, and the expected shadow output is matched according to the stage path markers to generate a shadow witness comparison result. The verification judgment table merges the reverse closed traceability result, the shadow witness comparison result, and the voucher status vector according to the stage path markers. After abnormal status setting and folding summarization, a task-level security verification result is generated.

[0129] The test process included 12 remote computation tasks, comprising 1860 data blocks to be computed, 84 computation stages, and 252 stage path markers. 638 anomalies were injected into the test data, covering result replacement, stage jumps, forged execution, path tampering, identity / environment anomalies, and tag progression anomalies. Existing digest verification methods validate the final result digest; log signature verification methods validate the final result digest, remote node signatures, and execution logs; the method of this invention validates the actual computation credential track, shadow witness fragments, stage credential snapshots, credential state vectors, and verification judgment table. The comparison results are shown in the table below: Table 1: Comparison of Remote Computing Data Security Verification Implementations

[0130] All three methods were compared under the same test conditions: 12 test tasks, 1860 data blocks to be calculated, and 638 injected anomalies for each method. The basic data remained consistent; the differences in the table mainly stemmed from the different verification methods. Existing digest verification methods only verify the final result digest, while log signature verification methods incorporate execution logs and signature tags. The method of this invention introduces a real calculation credential track, shadow witness fragments, stage credential snapshots, and a verification judgment table.

[0131] The data in the table shows that, in terms of anomaly detection capabilities, the result replacement detection rate of the method of this invention is 96.9%, higher than the 78.3% of existing digest verification methods and the 84.6% of existing log signature verification methods; the stage jump detection rate is 94.7%, higher than 41.8% and 63.5%; the forged execution detection rate is 95.2%, higher than 35.6% and 58.9%; and the path tampering detection rate is 96.1%, higher than 46.9% and 69.4%. The data indicates that the method of this invention has more complete coverage for identifying anomalies within the computation process.

[0132] Regarding identity environment and authentication progression verification, the method of this invention achieves an anomaly detection rate of 97.3% for identity environment, 81.7% for log signature verification, and 52.4% for existing digest verification methods; the anomaly detection rate for tag progression is 96.5%, 76.8% for log signature verification, and 44.2% for existing digest verification methods. This invention utilizes identity environment binding edges and tag progression edges in stage verification, enabling changes in the node environment and broken authentication tags to enter the judgment process.

[0133] Regarding anomaly localization and result recording, the anomaly stage localization accuracy of the method of this invention is 95.8%, significantly higher than the 38.7% of existing digest verification methods and the 72.1% of log signature verification methods; the number of missed detections is 22, lower than 262 and 139 respectively; and the result recording completeness rate is 98.6%, higher than 86.5% and 91.4%. These data demonstrate that the method of this invention can reduce missed detections and retain more complete stage paths and anomaly determination records.

[0134] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A remote computing data security verification method based on data security, characterized in that, Includes the following steps: Receive remote computing tasks, generate a remote computing task structure table and task basic credentials, and generate an input data digest for the data block to be computed. Based on the remote computing task structure table, task base voucher, and input data summary, generate the real computing voucher track, insert the shadow witness fragment into the same path position of the real computing voucher track, and generate dual-track voucher task data. Send the dual-track voucher task data to the remote computing node, execute the dual-track voucher task data according to the stage number, and generate stage voucher records and current stage authentication tags; Construct a phase credential snapshot diagram based on the phase credential record and the current phase authentication label, and input the phase credential snapshot diagram arranged by phase number into the improved EvolveGCN structure; Before graph convolution propagation in the improved EvolveGCN structure, a stage security gating group is generated based on the stage verification results in the stage voucher snapshot graph. The stage security gating group is written into the voucher edge, the voucher edge weight is rewritten, and the voucher state vector is generated by summarizing the rewritten voucher edge weights according to the stage. The voucher state vector is written into the parameter evolution unit in the improved EvolveGCN structure according to the stage number, the graph convolution weight matrix and bias vector are updated, and graph convolution propagation is performed on the dual-track voucher task data to obtain the dual-track stage output representation. Receive the result voucher data returned by the remote computing node, perform reverse closure tracing and shadow witness comparison based on the result voucher data, write the reverse closure tracing result, shadow witness comparison result and voucher status vector into the verification judgment table, and generate the remote computing data security verification result.

2. The remote computing data security verification method based on data security according to claim 1, characterized in that, The operations for generating the remote computing task structure table, task base credentials, and input data summary include: Configure task numbers for remote computing tasks, and configure data block numbers, operator numbers and stage numbers according to the data blocks to be computed, computing operators and computing stages. Write the data block numbers, operator numbers, stage numbers, input fields, output fields, result fields and same path position markers into the remote computing task structure table. Generate basic credentials for the task, which include the task number, initial random number, initial computation token, and initial authentication tag digest. Perform digest calculation on the data block to be computed according to the data block number, and generate the input data digest bound to the data block number.

3. The remote computing data security verification method based on data security according to claim 2, characterized in that, The operation of generating the actual calculation voucher track includes: Compile the remote computing task structure table, task basic credentials, and input data summary by task number; The records in the remote computing task structure table are sorted by path according to the stage number, operator number and same path position mark to form a stage path sequence; A stage voucher unit is established based on each record in the stage path sequence, and the stage voucher unit is configured with stage number, operator number, data block number, same path position mark and stage path mark; Load the input data digest bound to the data block number into the corresponding stage credential unit, and bind the initial computation token and initial authentication tag digest in the task base credential to the starting stage credential unit of the stage path sequence. Establish a document progression relationship based on the stage number and path position mark of adjacent document units in the stage path sequence, and arrange the stage document units after establishing the document progression relationship into the actual calculation document track.

4. The remote computing data security verification method based on data security according to claim 3, characterized in that, The operation of generating dual-track voucher task data includes: Based on the initial random number, data block number, and stage number in the task base certificate, determine the shadow source data block and the corresponding stage path marker in the stage path sequence; Replace the data values ​​of the shadow source data block while preserving the field format, data length, and same path location markers to generate a shadow witness fragment; Perform local computation on the shadow witness fragment to generate the expected shadow output; Locate the stage voucher unit in the actual calculation voucher track according to the corresponding stage path mark, and establish a shadow voucher unit carrying shadow witness fragments and shadow expected outputs. The shadow voucher unit and the stage voucher unit obtained from the location are registered side by side to generate dual-track voucher task data.

5. The remote computing data security verification method based on data security according to claim 4, characterized in that, The operations for generating stage credential records and current stage authentication tags include: Send the dual-track voucher task data to the remote computing node and match the stage voucher unit and shadow voucher unit according to the stage number and stage path mark. Perform real track calculations based on stage voucher units to generate real stage output summaries, and perform shadow track calculations based on shadow voucher units to generate shadow stage output summaries. Register the phase number, phase path marker, input data digest, real phase output digest, shadow phase output digest, remote node identity, computing environment identifier, and phase timestamp as phase credential records; The current stage authentication tag is generated by combining the stage credential record with the previous authentication tag digest and performing digest calculation. Write the current stage authentication tag into the stage credential record, which will serve as the summary of the preceding authentication tag for the next stage.

6. The remote computing data security verification method based on data security according to claim 5, characterized in that, The operations for constructing the document snapshot image include: The stage voucher records are collected by stage number and stage path mark, and each stage voucher record is converted into a graphical voucher record; In the graphical voucher record, the input data summary is attached to the real stage output summary and the shadow stage output summary respectively, forming a dual-track execution edge; The remote node identity and computing environment identity are merged into a node operation credential, and the node operation credential is attached to the current stage authentication tag to form an identity-environment binding edge. By attaching the previous authentication tag summary to the current stage authentication tag, a tag progression edge is formed; Merge the graphical voucher records, dual-track execution edges, identity and environment binding edges, and tag progression edges according to the stage number to generate a stage voucher snapshot diagram.

7. The remote computing data security verification method based on data security according to claim 6, characterized in that, The operation of performing phase security gating rewriting on the phase voucher snapshot image includes: Read the snapshot image of the stage voucher according to the stage number, perform stage verification on the dual-track execution edge, identity environment binding edge and tag progression edge, and generate the stage verification result of the corresponding voucher edge; Convert the phase verification results into phase security gating groups; Write the phased security gating group into the corresponding document edge according to the document edge type; Read the original edge weight and corresponding threshold value of the voucher edge. When the threshold value is in the pass state, retain the original edge weight. When the threshold value is in the doubt state, rewrite the original edge weight as a decay edge weight. When the threshold value is in the failure state, rewrite the original edge weight as a blocking edge weight to obtain the rewritten voucher edge weight.

8. A remote computing data security verification method based on data security according to claim 7, characterized in that, The operation of generating the credential state vector and obtaining the dual-track stage output representation through the improved EvolveGCN structure includes: Summarize the rewritten voucher edge weights in the voucher snapshot diagram according to the stage number, and generate a voucher status vector; Input the credential state vector into the parameter evolution unit in the improved EvolveGCN structure to update the graph convolution weight matrix and bias vector; Based on the updated graph convolution weight matrix, bias vector, and rewritten voucher edge weights, perform graph convolution propagation on the stage voucher snapshot graph; The dual-track stage output representation is obtained by aggregating the graph convolution propagation results of the real track record and the shadow track record respectively.

9. A remote computing data security verification method based on data security according to claim 8, characterized in that, The operations of performing reverse closed tracing and shadow witness comparison based on the result voucher data include: The parsing results voucher data yields result summary data, stage voucher data, and dual-track output data. Starting with the results summary data, a reverse voucher traceability chain is generated in reverse order along the stage numbers; The reverse voucher tracing chain is compared with the actual calculated voucher track to generate a reverse closed tracing result. Extract shadow track data from the dual-track output data, and match the expected shadow output by stage path markers; The shadow track data is compared with the expected shadow output to generate the shadow witness comparison result.

10. A remote computing data security verification method based on data security according to claim 9, characterized in that, The operation of generating remote computing data security verification results includes: Establish a verification and judgment table according to the task number, and group the reverse closure tracing results, shadow witness comparison results and voucher status vectors under the same task into a judgment unit according to the stage path mark. Set the abnormal state of the judgment unit, set the result replacement flag when the reverse closure tracing result is in an unclosed state, set the forgery execution flag when the shadow witness comparison result is in an inconsistent state, set the stage security abnormal flag when the voucher state vector contains blocking edge weight, and set the stage record abnormal flag when the voucher state vector contains attenuation edge weight and the label progression edge is in a suspicious state. The abnormal status setting results in each judgment unit are folded and summarized according to the task number to obtain the remote computing data security verification result.

Images