Data verification method and related device

Abstract

Provided in the present application is a data verification method. The method comprises: a network device dividing a configured data block, so as to obtain a plurality of data sub-blocks, and generating a first hash tree on the basis of the plurality of data sub-blocks, wherein the data block comprises device identifiers of a plurality of ambient Internet-of-Things devices and a group identifier of a group to which the plurality of ambient Internet-of-Things devices belong; the network device sending a data configuration request to a reader, wherein the data configuration request comprises the data block and an index and division information of the data block; the network device receiving node information of a second hash tree generated by the reader on the basis of the data configuration request; and the network device performing consistency verification on the basis of node information of the first hash tree and the node information of the second hash tree, so as to obtain a verification result. In this way, the consistency of data on a network side and a reader side is ensured, thereby avoiding causing an erroneous operation to affect the normal operation of a service. When the data is inconsistent, data synchronization between the network side and the reader side can be ensured by means of a relatively low overhead.

Description

Data verification method and related device

[0001] The present application claims priority to the Chinese patent application No. 202410990412.8, filed on July 23, 2024, and entitled "A data verification method and related device", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] The present application relates to the field of communication technology, and in particular to a data verification method, a network device, a reader, a computer readable storage medium, and a computer program product. BACKGROUND

[0003] With the continuous development of communication technology, the Internet of Things (IoT) based on new generation communication technology has attracted widespread attention. The Internet of Things is a system of computing devices, machines, and digital machines that are interconnected, have a universal unique identifier, and have the ability to transmit data over a network without human-to-human or human-to-device interaction.

[0004] Currently, relevant standardization organizations are studying the signaling control process in IoT. For ease of understanding, an Ambient IoT (AIoT) example is used for illustration. For AIoT devices, a terminal (user equipment, UE) or a radio access network (RAN) can act as an intermediate node to receive AIoT messages such as AIoT device inventory or control commands (Command) transmitted by the network side, wherein the control command can include a read or write command, and the aggregation transmission of AIoT messages of multiple UEs is supported.

[0005] The UE / RAN as an intermediate node for AIoT message aggregation transmission reduces the number of messages sent. Taking the RAN as an intermediate node as an example, the density of AIoT devices can reach 1 million per square kilometer, and the coverage of the base station on the RAN side can reach 2 square kilometers. Therefore, the connection of 2 million AIoT devices can be achieved under the base station. If the AIoT messages such as Inventory / Command can be transmitted based on Group aggregation, the number of messages will be greatly reduced, effectively reducing the message transmission load of the system.

[0006] However, if the configuration relationship between the group identifier (group ID) and the device identifier of the AIoT device is tampered with or updated, an error operation can be caused, affecting the normal operation of the service. For example, if the configuration relationship between a certain group ID and the device identifier of the AIoT device is maliciously tampered with, the AIoT device can be maliciously paged, and thus the power consumption of the AIoT device can be exhausted. Therefore, the industry urgently needs to provide a data verification method to ensure the consistency of data on the network side and the reader side. SUMMARY

[0007] The present application provides a data verification method and related equipment, aiming to ensure the consistency of data on the network side and the reader side, and avoid causing an error operation to affect the normal operation of the service.

[0008] To achieve the above purpose, the present application provides the following technical solutions:

[0009] The first aspect of the present application provides a data verification method, comprising:

[0010] The network device divides a configured data block into blocks to obtain a plurality of sub-data blocks, and generates a first hash tree according to the plurality of sub-data blocks, wherein the data block includes device identifiers of a plurality of environmental Internet of Things devices and group identifiers of groups to which the plurality of environmental Internet of Things devices belong;

[0011] The network device sends a data configuration request to a reader, wherein the data configuration request includes the data block, an index of the data block, and block information;

[0012] The network device receives node information of a second hash tree generated by the reader according to the data configuration request;

[0013] The network device performs consistency verification according to the node information of the first hash tree and the node information of the second hash tree, and obtains a verification result.

[0014] In this way, the consistency of data on the network side and the reader side can be ensured, and an error operation can be avoided to affect the normal operation of the service.

[0015] In some possible implementation manners, the method further comprises:

[0016] When the verification result is a verification failure, the network device determines, from the nodes of the first hash tree, a node that is inconsistent with a node of the second hash tree;

[0017] The network device sends, to the reader, a sub-data block corresponding to the inconsistent node and an index of the sub-data block.

[0018] The network device receives node information of the second hash tree updated by the reader according to the inconsistent node and the index of the sub data block corresponding to the inconsistent node;

[0019] The network device performs consistency verification according to the updated node information of the second hash tree and the node information of the first hash tree until the verification is passed.

[0020] In the method, when the data is inconsistent, the inconsistent sub data block can be transmitted to realize data synchronization between the network side and the reader with small overhead.

[0021] In some possible implementation manners, the network device updates a data block, and updates a first hash tree according to the updated data block. The network device sends a data configuration update request to the reader, and the data configuration update request is used to add, delete or modify data in the data block. The data configuration update request includes an added, deleted or modified sub data block and an index of the sub data block.

[0022] The network device receives node information of the second hash tree updated by the reader according to the data configuration update request, and the node information of the second hash tree updated by the reader according to the data configuration update request includes node information of a target node inserted, deleted or updated in the second hash tree and node information of a node affected by the target node.

[0023] The network device performs consistency verification according to the updated node information of the first hash tree and the updated node information of the second hash tree, and obtains a verification result.

[0024] In this way, consistency of data between the network side and the reader side can also be ensured when the data is updated.

[0025] In some possible implementation manners, the node information of the second hash tree updated by the reader according to the data configuration update request includes incremental information relative to a previous version. Through incremental update, data transmission overhead can be reduced.

[0026] In some possible implementation manners, the data configuration request further includes an address, a name, a security parameter or a hash algorithm type of the environmental Internet of Things device, and the hash algorithm type is used to indicate a hash algorithm used for hash operation on data in the data block. The network device can also check the address and the name of the environmental Internet of Things device, to ensure consistency.

[0027] In some possible implementation manners, the hash algorithm type is determined by the network device according to subscription information of the environmental Internet of Things device in a mobile network or information of an industry user to which the environmental Internet of Things device belongs.

[0028] In some possible implementation manners, the network device generates a first hash tree according to the plurality of sub-data blocks, including:

[0029] The network device generates leaf nodes of the first hash tree according to the plurality of sub-data blocks, a value of the leaf node being a value or a hash value of the sub-data block.

[0030] The network device generates non-leaf nodes of the first hash tree according to the leaf nodes of the first hash tree, the non-leaf nodes including intermediate nodes or a root node, a value of the non-leaf node being determined according to values of the leaf nodes belonging to the non-leaf node.

[0031] The method can realize efficient top-down verification when subsequent data verification is performed, by generating leaf nodes based on the sub-data blocks obtained by block division, and then updating non-leaf nodes according to values of the leaf nodes.

[0032] In some possible implementation manners, the network device includes at least one of an environmental Internet of Things controller, an application function network element, a network exposure function network element, or an operation management network element.

[0033] A second aspect of the present application provides another data verification method, including:

[0034] The reader receives a data configuration request, the data configuration request including a data block and index and block information of the data block, the data block including device identifiers of a plurality of environmental Internet of Things devices and group identifiers of groups to which the plurality of environmental Internet of Things devices belong.

[0035] The reader generates a second hash tree according to the data configuration request.

[0036] The reader sends node information of the second hash tree to the network device, the node information of the second hash tree being used to perform consistency verification with node information of a first hash tree generated by the network device based on a plurality of sub-data blocks obtained by block division of the data block, to obtain a verification result.

[0037] In some possible implementation manners, the method further includes:

[0038] The reader receives, from the network device, a sub-data block corresponding to a node of the first hash tree that is inconsistent with a node of the second hash tree and an index of the sub-data block.

[0039] The reader updates the second hash tree according to the sub-data block corresponding to the inconsistent node and the index of the sub-data block.

[0040] The reader sends the updated node information of the second hash tree to the network device.

[0041] In some possible implementation manners, the method further includes:

[0042] The reader receives a data configuration update request for adding, deleting, or modifying data in the data block, the data configuration update request including an added, deleted, or modified sub-data block and an index of the sub-data block;

[0043] The reader updates the second hash tree according to the data configuration update request, the updated node information of the second hash tree including node information of a target node inserted, deleted, or updated in the second hash tree and node information of nodes affected by the target node;

[0044] The reader sends the updated node information of the second hash tree to the network device.

[0045] In some possible implementation manners, the reader sends the updated node information of the second hash tree to the network device, including:

[0046] The reader sends, to the network device, incremental information of the updated second hash tree relative to a previous version.

[0047] In some possible implementation manners, the data configuration request further includes an address, a name, a security parameter, or a hash algorithm type of the AIoT device, the hash algorithm type being used to indicate a hash algorithm used for hash operation on data in the data block.

[0048] In some possible implementation manners, the hash algorithm type is determined by the network device according to subscription information of the environmental Internet of Things device in a mobile network or information of an industry user to which the environmental Internet of Things device belongs.

[0049] In some possible implementation manners, the method further includes:

[0050] When an access and mobility management function (AMF) network element establishes a stream control transmission protocol (SCTP) connection, the reader obtains, from the AMF network element, a hash algorithm type used to indicate a hash algorithm used for hash operation on data in the data block.

[0051] In some possible implementation manners, the reader generates the second hash tree according to the data configuration request, including:

[0052] The reader divides the data block according to the block information in the data configuration request to obtain a plurality of sub-data blocks.

[0053] The reader generates leaf nodes of the second hash tree according to the plurality of sub-data blocks, a value of the leaf node being a value or a hash value of the sub-data block;

[0054] The reader generates non-leaf nodes of the second hash tree according to the leaf nodes of the second hash tree, the non-leaf nodes including intermediate nodes or a root node, a value of the non-leaf node being determined according to values of the leaf nodes belonging to the non-leaf node.

[0055] In some possible implementation manners, the reader includes a terminal or an access network device.

[0056] A third aspect of the present application provides an electronic device, which can be a network device, such as an AIoT controller, a network exposure function network element, or the like. The network device includes a memory and at least one processor. The memory is configured to store a program, and the at least one processor is configured to execute the program, so that the network device implements the data verification method provided in the first aspect of the present application.

[0057] A fourth aspect of the present application provides an electronic device, which can be a reader, and the reader can be a terminal or an access network device. The reader includes a memory and at least one processor. The memory is configured to store a program, and the at least one processor is configured to execute the program, so that the reader implements the data verification method provided in the second aspect of the present application.

[0058] A fifth aspect of the present application provides a communication system, including a network device and a reader. The network device is configured to execute the data verification method provided in the first aspect of the present application, and the reader is configured to cooperate with the network device to execute the data verification method provided in the second aspect of the present application.

[0059] A sixth aspect of the present application provides a computer storage medium, configured to store a computer program. When the computer program is executed, the computer program is configured to implement the data verification method provided in the first aspect or the second aspect of the present application.

[0060] A seventh aspect of the present application provides a computer program product. The computer program product includes computer readable instructions. The computer readable instructions are configured to implement the data verification method provided in the first aspect or the second aspect of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0061] FIG. 1 is an example diagram of a communication system architecture disclosed in an embodiment of the present application;

[0062] FIG. 2 is a flow diagram of an AIoT device inventory disclosed in an embodiment of the present application;

[0063] FIG. 3 is a schematic diagram of a control flow disclosed in an embodiment of the present application;

[0064] FIG. 4 is a flow chart of a data verification method disclosed by an embodiment of the present application;

[0065] FIG. 5 is a schematic diagram of generating a hash tree based on data blocks disclosed by an embodiment of the present application;

[0066] FIG. 6 is a flow chart of another data verification method disclosed by an embodiment of the present application;

[0067] FIG. 7A is a flow chart of a data verification method disclosed by an embodiment of the present application;

[0068] FIG. 7B is a schematic diagram of hash tree updating disclosed by an embodiment of the present application;

[0069] FIG. 8 is a flow chart of a data verification method disclosed by an embodiment of the present application;

[0070] FIG. 9 is a flow chart of another data verification method disclosed by an embodiment of the present application;

[0071] FIG. 10 is a flow chart of yet another data verification method disclosed by an embodiment of the present application;

[0072] FIG. 11 is a flow chart of a data verification method disclosed by an embodiment of the present application;

[0073] FIG. 12 is a flow chart of another data verification method disclosed by an embodiment of the present application;

[0074] FIG. 13 is a schematic diagram of comparing node information of a first hash tree and node information of a second hash tree disclosed by an embodiment of the present application;

[0075] FIG. 14 is a flow chart of yet another data verification method disclosed by an embodiment of the present application;

[0076] FIG. 15 is a structural example diagram of a base station disclosed by an embodiment of the present application;

[0077] FIG. 16 is a structural example diagram of a terminal disclosed by an embodiment of the present application. DETAILED DESCRIPTION

[0078] The technical solutions in the embodiments of the present application will be described clearly and completely in the following with reference to the drawings in the embodiments of the present application. The terms used in the following embodiments are only for the purpose of describing the specific embodiments and are not intended to be limiting to the present application. As used in the specification and the appended claims of the present application, the singular forms “a,” “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “one or more,” “at least one,” “one or more than one,” “and / or,” and the like, as used in the embodiments of the present application, are intended to encompass the singular form as well as the plural form. For example, “A / B” means only A, only B, or both A and B; “A and / or B” means only A, only B, or both A and B; and “one of A and B” means only A, only B, or both A and B.

[0079] In this specification, the reference to “one embodiment” or “some embodiments” means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrases “in one embodiment,” “in some embodiments,” “in other embodiments,” “in additional embodiments,” and so on, in various places in the specification are not necessarily all referring to the same embodiment, unless otherwise specifically noted. Rather, the term “in one embodiment” or “in some embodiments” means “in at least one embodiment” and the terms “in one embodiment” or “in some embodiments” or “in other embodiments” or “in additional embodiments” do not necessarily refer to the same embodiment although they can. The terms “including,” “comprising,” “having” and variations thereof mean “including but not limited to,” unless expressly specified otherwise.

[0080] The pluralities referred to in the embodiments of the present application mean greater than or equal to two. It should be noted that in the description of the embodiments of the present application, the terms “first,” “second,” and the like are used only for the purpose of distinguishing the described embodiments, and cannot be understood as indicating or implying relative importance or indicating or implying an order.

[0081] The embodiments of the present application are applied to a communication system, which can be a second generation (2G) communication system, a third generation (3G) communication system, a fourth generation (4G) system such as Long-Term Evolution (LTE), a fifth generation (5G) communication system, a hybrid architecture of LTE and 5G, a 5G New Radio (5G NR) system, and a new communication system to be developed in future communication development.

[0082] The communication system includes a network device and a reader, which can also be referred to as a reader. Internet of Things (IoT) enabled devices, such as AIoT devices in an Ambient IoT (AIoT), can access the IoT through the above communication system to achieve intelligent interconnection and intelligent management.

[0083] The network device is a device on the network side for providing network communication functions, and is also referred to as a network element in some cases. In the Internet of Things, for example, in the Ambient IoT (AIoT), the network device can generally include, but is not limited to, an AIoT controller, an application function (AF) network element, a network exposure function (NEF) network element, or an operation management (OM) network element.

[0084] The AIoT controller is an entity in the core network (CN) for implementing AIoT functions. The AIoT controller can implement communication and coordination between different AIoT devices. The AIoT controller can act as an AIoT device and a server (such as an AF network element) to provide a centralized control point for managing and optimizing the performance of connected AIoT devices.

[0085] The AF network element, including various services at the application layer, can be an application within an operator or a third-party AF, such as an AIoT server.

[0086] The NEF network element is used to manage externally exposed data and can generally be located between the core network and the AF. External applications such as AFs usually need to pass through the NEF network element to access internal data of the core network. The NEF provides corresponding security guarantees to ensure the security of external applications to the network, provides QoS customization capabilities for external application services, mobility state event subscription, AF request distribution, and other functions.

[0087] The OM network element is an entity in the core network for managing operations. The operation can be an operation on the AIoT device. For example, the operation can be an AIoT device start operation, a shutdown operation, or a mode switching operation.

[0088] A reader is used to communicate with A-IoT devices by transmitting and receiving radio frequency signals. In some examples, the reader can be a terminal, or integrated into a terminal and located in the same location as the terminal, so that communication between the reader and the AIoT controller uses a Protocol Data Unit (PDU) session. A PDU session can be a data transmission channel established between the communication participants. For example, the PDU session used for communication between the reader and the AIoT is a data transmission channel established between the reader and the AIoT controller. In other examples, the reader can be deployed independently of the UE; for example, the reader can be a standalone radio access network (RAN) device or RAN node. The RAN device can include a base station (BS).

[0089] AIoT devices refer to devices capable of accessing and connecting to the AIoT ecosystem. AIoT devices connect to the AIoT network and are typically at the edge of the AIoT chain. AIoT devices can include sensors such as temperature sensors, hygrometers, and smoke sensors. In the smart home field, AIoT devices can also include various home appliances such as air conditioners, refrigerators, washing machines, televisions, and robot vacuum cleaners. In the field of autonomous driving, AIoT devices can include in-vehicle air conditioners, in-vehicle audio systems, and in-vehicle screens.

[0090] An example of a communication system is shown in Figure 1. The communication system may include AIoT devices, RAN nodes, a core network (CN), and an AIoT server. The RAN node can act as a reader, and network elements in the core network or the AIoT server can act as network devices configuring the reader.

[0091] Figure 1 illustrates two topology structures for the communication system: topology 1 and topology 2. In topology 1, AIoT devices are directly connected to the access network node (RAN Node), which acts as a reader to enable communication between the AIoT devices and the AIoT server. In topology 2, AIoT devices connect to the RAN Node through a terminal (such as a UE), which acts as a reader to enable communication between the AIoT devices and the AIoT server.

[0092] For AIoT, the terminal or RAN can act as an intermediate node to receive AIoT messages such as AIoT device inventory or control commands transmitted from the network side. The control commands can include read or write commands, and the aggregation and transmission of AIoT messages from multiple UEs is supported.

[0093] For ease of understanding, the Inventory process and command process will be explained below using a communication system based on the topology 2 architecture.

[0094] First, referring to Figure 2, a flowchart of an AIoT device inventory process is shown, which specifically includes the following steps:

[0095] 1. AF and UE communicate based on UE AIoT Layer messages.

[0096] UE AIoT Layer messages are messages based on the UE AIoT Layer protocol, which is the protocol located between the AF and the UE in the protocol stack. The UE can communicate with the AF through a PDU session to transmit UE AIoT Layer messages to the AF. These UE AIoT layer messages include location information and reader capability information reported by the UE.

[0097] 2. AF determines the UE to perform AIoT device inventory.

[0098] Specifically, the AF determines the UE to perform AIoT device inventory based on the location information and reader capability information reported by the UE in step 1.

[0099] 3. The AF sends an inventory request to the UE.

[0100] In this process, the AF can send an Inventory Request to the UE determined in step 2 through a PDU session in the core network and the Next Generation Radio Access Network (NG-RAN). In some examples, NG-RAN can be 5G RAN. The Inventory Request includes device information (device info) and inventory strategy info for the AIoT device. The device info may include the device identifier (device ID) and group ID. The inventory strategy info may include the inventory frequency and inventory period.

[0101] Furthermore, the Inventory Request may also include report aggregation info. Report aggregation info indicates whether the reported content needs to be aggregated, such as whether aggregation is needed within a specific aggregation period.

[0102] 4. The UE interacts with the access network (RAN) to perform radio resource allocation.

[0103] 5. The UE performs AIoT device inventory initialization.

[0104] The UE can provide a reader identifier, such as a UE ID, so that AIoT devices can know which reader is reading their data.

[0105] 6. The AIoT device reports the device ID to the UE.

[0106] Optionally, AIoT devices can also report device capabilities to the UE.

[0107] 7. When the report aggregation info indicates aggregation, the UE can also aggregate data reported by AIoT devices.

[0108] 8. The UE sends an inventory response or inventory notification to the AF.

[0109] Using the Inventory Response example, an Inventory Response can include a device ID or aggregated reports.

[0110] Next, referring to Figure 3, a schematic diagram of a control flow is shown, which specifically includes the following steps:

[0111] 1. AF and UE communicate based on UE AIoT Layer messages.

[0112] UE AIoT Layer messages are built on the UE AIoT Layer protocol, which is the protocol between the AF and the UE in the protocol stack. The UE can communicate with the AF through a PDU session to transmit UE AIoT Layer messages to the AF.

[0113] 2. AF determines the UE that executes the control command.

[0114] 3. The AF sends a control command request to the UE.

[0115] Command Request includes control commands, device info, and result aggregation info. The command can be an instruction executed within the AIoT device, including read, write, enable, disable, or other specific commands. Device info includes the device ID and group ID. Result aggregation info indicates whether results need to be aggregated within a specific aggregation period.

[0116] Specifically, the AF determines the UE to perform AIoT device inventory based on the location information and reader capability information reported by the UE in step 1.

[0117] 4. The UE interacts with the access network (RAN) to perform radio resource allocation.

[0118] 5. The UE sends a command to the AIoT device.

[0119] 6. The AIoT device executes the above command and returns the command result to the UE.

[0120] 7. When the result aggregation info indicates aggregation, the UE can also aggregate command results.

[0121] 8. The UE sends a command response or command notification to the AF.

[0122] As illustrated by the Command Response example, a Command Response can include a result or an aggregated result.

[0123] As shown in Figure 3, the UE / RAN acts as an intermediate node for AIoT message aggregation and transmission, reducing the number of messages sent. However, the current solution lacks data integrity protection. For example, AIoT identifiers (device ID, group ID) under a group are configured in the AF network elements on the base station and network side. If the configuration relationship of device IDs contained under a certain group ID is maliciously tampered with, it will cause incorrect processing, such as causing AIoT devices to be maliciously paged, which may lead to the exhaustion of AIoT device power. Alternatively, updates to the configuration relationship between group ID and device ID may also cause the configuration data (such as the configuration relationship between group ID and device ID) on the RAN and AF / network side to become out of sync, leading to incorrect operations.

[0124] In view of this, this application provides a data verification method, specifically a consistency verification method for identity information in the Internet of Things (IoT). In this method, a network device (such as an AIoT controller, or an AF, NEF, or OM network element) divides a configured data block into multiple sub-data blocks. Each data block includes device IDs for multiple AIoT devices and group IDs for the groups to which the AIoT devices belong. The network device then generates a first hash tree based on the multiple sub-data blocks. The network device can send a data configuration request to a reader, which includes data blocks, their indexes, and block division information. The network device receives node information from the reader (e.g., a UE or RAN node) generated based on the data configuration request, representing the second hash tree. The network device performs consistency verification based on the node information of the first and second hash trees to obtain the verification result.

[0125] This ensures data consistency on the network side (such as AF) and the reader side, preventing erroneous operations that could disrupt normal business operations. Furthermore, when data is inconsistent, data synchronization between the network side and the reader side can be achieved with minimal overhead by transmitting inconsistent sub-data blocks.

[0126] To make the technical solution of this application clearer and easier to understand, the data verification method of this application will be described below from the perspectives of network devices and readers, with reference to the accompanying drawings.

[0127] Referring to Figure 4, a flowchart of a data verification method is shown. This method can be executed by a network device, which may include an AIoT controller, AF network element, NEF network element, or OM network element on the network side. The method may include the following steps:

[0128] S402. The network device divides the configured data block into multiple sub-data blocks.

[0129] Each data block includes the device IDs of multiple AIoT devices and the group IDs of the groups to which these AIoT devices belong. Network devices can configure the block size or the number of blocks, and then perform a block division operation according to this size or number of blocks to obtain multiple sub-data blocks. It should be noted that each sub-data block records the group ID and the device IDs of the AIoT devices included in that group. The device IDs recorded in each sub-data block can be different.

[0130] S404. The network device generates a first hash tree based on multiple sub-data blocks.

[0131] The network device can calculate hash values ​​based on sub-data blocks using a hash algorithm, and generate a first hash tree based on these hash values. Specifically, the network device generates leaf nodes of the first hash tree based on multiple sub-data blocks, where the value of each leaf node is either the value of the sub-data block or its hash value. The leaf nodes of the first hash tree can be sorted according to the indices of the sub-data blocks. For example, the leaf nodes of the first hash tree can be arranged sequentially according to their indices. The network device then generates non-leaf nodes of the first hash tree based on the leaf nodes. Non-leaf nodes include intermediate nodes or the root node. The value of a non-leaf node is determined based on the values ​​of the leaf nodes to which it belongs. For example, the value of a non-leaf node can be determined based on the values ​​of all leaf nodes that originate from a leaf node and are accessible from that leaf node. It should be noted that the index of the sub-data block corresponding to the leaf node can also be used when generating non-leaf nodes. For example, the network device can determine the leaf nodes used to generate non-leaf nodes based on the index of the sub-data block corresponding to the leaf node.

[0132] In some possible implementations, network devices can generate a first hash tree based on multiple sub-data blocks using the Merkle Tree (MT) algorithm. In other words, the first hash tree can be a Merkle tree. A Merkle tree is a binary tree of hash values, where each leaf node represents a piece of data or the hash value of a piece of data. Merkle trees can be used to efficiently verify the integrity of large amounts of data.

[0133] In this application, the network device can determine the hash values ​​of multiple sub-data blocks using a hash algorithm. As shown in Figure 5, data blocks can be divided into multiple sub-data blocks, including L1, L2, L3, and L4. The network device performs hash operations on each of the multiple data blocks to obtain the hash values ​​of the sub-data blocks, denoted as hash(L1), hash(L2), hash(L3), and hash(L4). The network device can generate multiple leaf nodes of a Merkle tree, with the values ​​of the leaf nodes being hash(L1), hash(L2), hash(L3), and hash(L4), respectively, corresponding to the underlying sub-data blocks L1, L2, L3, and L4. Given that a Merkle tree is a binary tree, network devices can merge the values ​​of two adjacent leaf nodes into a single string. For example, they can concatenate hash(L1) and hash(L2), and hash(L3) and hash(L4). A hash operation is then performed on the merged string to obtain the value of a non-leaf node. This non-leaf node can be an intermediate node. If the number of intermediate nodes at a given level is greater than or equal to two, the values ​​of these intermediate nodes can be merged, and the merged string can be hashed. This hash result is then used as the value of the non-leaf node at the next higher level. When the number of non-leaf nodes at a certain level is one, that non-leaf node becomes the root node.

[0134] In the example in Figure 5, the network device can generate leaf nodes of the first hash tree based on the hash values ​​of sub-data blocks L1, L2, L3, and L4, specifically hash0-0, hash0-1, hash1-0, and hash1-1. The values ​​of leaf nodes hash0-0 and hash0-1 are hash(L1) and hash(L2), respectively, while the values ​​of leaf nodes hash1-0 and hash1-1 are hash(L3) and hash(L4), respectively. The network device can merge the values ​​of leaf nodes hash0-0 and hash0-1 and then perform a hash operation on the merged string to generate the intermediate node hash0. Similarly, the network device can merge the values ​​of leaf nodes hash1-0 and hash1-1 and then perform a hash operation on the merged string to generate the intermediate node hash1. Next, the network device can merge the values ​​of intermediate nodes hash0 and hash1 and then perform a hash operation on the merged string to generate the root node, denoted as the root hash (top hash).

[0135] S406. The network device sends a data configuration request to the reader.

[0136] The data configuration request includes data blocks and their indexes and partitioning information. The data block index is a data structure that allows direct access to the data block, improving data query efficiency. For example, the data block index could be the block's address or number. Partitioning information can include the number of blocks or the block size.

[0137] In some possible implementations, the data configuration request may also include the address, name, security parameters, or hash algorithm type of the AIoT devices. The AIoT devices may be Internet Protocol (IP) addresses, and the security parameters may include security policies. Security policies may include indications of whether to enable consistency verification, and further, verification parameters. The hash algorithm type indicates the hash algorithm used to perform hash operations on the data in the data block. For example, the hash algorithm type may include, but is not limited to, the Secure Hash Algorithm (SHA) or the MD5 Message-Digest Algorithm. In some examples, the hash algorithm type may be determined by the network device based on the AIoT device's subscription information on the mobile network or information about the industry user to which the AIoT device belongs. For example, if the AIoT device is an electricity meter, the industry user to which it belongs may be a power company. The network device may determine the hash algorithm type based on the power company's information or the electricity meter's subscription information on the mobile network.

[0138] S408. The network device receives the node information of the second hash tree generated by the reader based on the data configuration request.

[0139] The reader can include a terminal or a RAN device (RAN node), such as a base station. The reader can perform a block division operation on the data block based on the block information to obtain multiple sub-data blocks. Then, the reader can generate a second hash tree based on these multiple sub-data blocks through hash operations. The specific implementation of the reader generating the second hash tree can refer to the network device's method for generating a first hash tree based on multiple sub-data blocks.

[0140] The node information of the second hash tree can include the values ​​of the nodes in the second hash tree. In some examples, the values ​​of the nodes in the second hash tree can be a sequence arranged in a predetermined order, such as a depth-first order or a breadth-first order. In other examples, the node information of the second hash tree can include node identifiers (such as node names or the node's position in the hash tree) and node values.

[0141] S410: The network device performs consistency verification based on the node information of the first hash tree and the node information of the second hash tree, and obtains the verification result.

[0142] Network devices can compare the values ​​of nodes in the first hash tree with the values ​​of nodes in the second hash tree. If the values ​​of nodes in the first hash tree and the values ​​of nodes in the second hash tree are the same, the consistency verification passes. If the values ​​of nodes in the first hash tree are different from the values ​​of nodes in the second hash tree, the consistency verification fails.

[0143] To ensure verification efficiency, network devices can use a top-down approach to compare the values ​​of nodes in the first hash tree and the second hash tree. The network device obtains the correct root hash from a trusted data source; for example, it can use the value of the root node of the first hash tree as the root hash. Based on this root hash, it verifies the value of the root node in the second hash tree. If they do not match, the network device continues to verify the nodes at the next level (e.g., intermediate nodes). The method for verifying the nodes at the next level is similar to that for the root node and will not be elaborated further.

[0144] Based on the above description, the data verification method provided in this application divides data blocks into sub-blocks. A first hash tree is generated on the network device side based on the multiple sub-blocks obtained from this division. The data blocks, indexes, and block information are then sent to the reader side. The reader side can generate a second hash tree based on this information. The network device can perform consistency verification based on the node information of the first and second hash trees. This ensures data consistency between the network and reader sides, preventing erroneous operations and ensuring the normal operation of services.

[0145] If the consistency verification passes, the verification process can end; if the consistency verification fails, the data can be resent for consistency verification. The following is an explanation with reference to an example.

[0146] Refer to the flowchart of another data validation method shown in Figure 6. This method is used for scenarios where the validation result fails, and specifically includes the following steps:

[0147] S602. The network device determines the nodes that are inconsistent with the nodes of the second hash tree from the nodes of the first hash tree.

[0148] Specifically, the network device can compare the node information of the first hash tree and the node information of the second hash tree to determine the nodes in the first hash tree that are inconsistent with the nodes in the second hash tree. The network device can compare the node information of the first hash tree and the node information of the second hash tree one by one in a top-down manner.

[0149] Using Figure 5 as an example, the network device can first compare the values ​​of the root nodes of the first and second hash trees. If they are inconsistent, it then compares the intermediate nodes of the next lower level. If the value of node hash0 in the first hash tree matches the value of node hash0 in the second hash tree, it means that the left subtree of the root node of the first hash tree is the same as the left subtree of the root node of the second hash tree. The network device can then compare the value of node hash1 in the first hash tree with the value of node hash1 in the second hash tree. If the values ​​of node hash1 in the first and second hash trees are inconsistent, the device can then compare whether the values ​​of node hash1-0 in the first and second hash trees are consistent, or compare whether the values ​​of node hash1-1 in the first and second hash trees are consistent, thereby determining the sub-data block corresponding to the inconsistent nodes (e.g., inconsistent leaf nodes). Assuming that the values ​​of hash1-0 are consistent, but the values ​​of hash1-1 are inconsistent, it means that sub-data block L4 is inconsistent.

[0150] S604. The network device sends the sub-data blocks corresponding to inconsistent nodes and the indexes of the sub-data blocks to the reader.

[0151] In this application, the network device retransmits inconsistent sub-data blocks and their indexes instead of sending the entire data block, which greatly reduces data transmission overhead.

[0152] S606, The network device receives the node information of the second hash tree updated by the reader based on the sub-data blocks corresponding to inconsistent nodes and the index of the sub-data blocks.

[0153] The reader can update the second hash tree based on the retransmitted sub-data block and its index. Specifically, the reader can first update the corresponding leaf node based on the retransmitted sub-data block. For example, the reader can perform a hash operation on the retransmitted sub-data block to obtain a hash value, and then update the value of the corresponding leaf node with that hash value. Then, the reader can update the intermediate node or root node to which the updated leaf node belongs. For example, the reader can merge the updated leaf node value with the values ​​of adjacent leaf nodes, perform a hash operation on the merged string, and use the hash result as the value of the intermediate node in the next higher level.

[0154] The network device can receive node information from the reader based on the sub-data blocks corresponding to inconsistent nodes and the updated second hash tree. The updated node information of the second hash tree includes the updated information of the inconsistent nodes and the information of the ancestor nodes of the inconsistent nodes. Among them, ancestor nodes may include, but are not limited to, parent nodes and parent nodes' parent nodes.

[0155] It should be noted that when updating the node information of the second hash tree to the network device, the reader can use an incremental update method. In this case, the updated node information of the second hash tree includes incremental information relative to the previous version.

[0156] S608: The network device performs consistency verification based on the updated node information of the second hash tree and the node information of the first hash tree until the verification is successful.

[0157] Specifically, the network device can compare the updated node information of the second hash tree with the node information of the first hash tree. If the updated node information of the second hash tree matches the node information of the first hash tree, the verification passes. The specific implementation of the consistency verification based on the updated node information of the second and first hash trees can be found in the description above, and will not be repeated here.

[0158] Based on the above description, the data verification method provided in this application can not only verify the consistency of data on the network device side and the reader side, but also supports the transmission of inconsistent sub-data blocks when data is inconsistent, thereby ensuring data synchronization between the network side and the reader side with minimal overhead.

[0159] In some possible implementations, network devices can also update data. For example, if a new AIoT device is added to a group, a new mapping relationship between the group ID and the AIoT device's device ID needs to be established. Accordingly, the network device needs to synchronize the update to the reader side to ensure consistency and avoid erroneous operations.

[0160] The data verification method during the update phase will be explained below with reference to the accompanying diagram.

[0161] Referring to the flowchart of a data validation method shown in Figure 7A, the method includes the following steps:

[0162] S702, Network Device Update Data Block.

[0163] Network devices can update data blocks by adding data to a data block, modifying data in a data block, or deleting data from a data block. Adding data to a data block can mean adding a sub-data block, modifying data in a data block can mean modifying a sub-data block, and deleting data from a data block can mean deleting a sub-data block.

[0164] S704. The network device updates the first hash tree based on the updated data block.

[0165] Network devices can update the leaf nodes of the first hash tree based on updated data blocks. For example, a network device can add, modify, or delete leaf nodes. Then, the network device can update the parent and ancestor nodes of the updated leaf node.

[0166] To facilitate understanding, an example is provided below. Referring to Figure 7B, which illustrates a hash tree update, the network device can insert a sub-data block 0 into a data block. Correspondingly, the network device can add a leaf node to the first hash tree, with the leaf node identified as 0. The network device can then merge the values ​​of the leaf node identified as 0 with those of the leaf node identified as 1, and perform a hash operation on the merged string to obtain the value of the newly added intermediate node. The network device can then merge the value of this newly added intermediate node with the value of the leaf node identified as 2, and perform a hash operation on the merged string to obtain the value of another newly added intermediate node. Next, the network device can continue to merge the value of this intermediate node with the values ​​of the parent nodes identified as 3 and 4, and perform a hash operation on the merged string to obtain yet another newly added intermediate node. This process continues until the network device merges the value of this intermediate node with the values ​​of its ancestor nodes identified as 5, 6, 7, and 8, performs a hash operation on the merged string, and then updates the root node's value with the hash operation result.

[0167] S706, The network device sends a data configuration update request to the reader.

[0168] Specifically, network devices can generate corresponding data configuration update requests based on the type of update to the data block. Data configuration update requests are used to add, delete, or modify data within a data block. These requests include the added, deleted, or modified sub-data blocks and their indexes.

[0169] S708, The network device receives the node information of the second hash tree that is updated according to the data configuration update request.

[0170] The reader can update the second hash tree based on the added, deleted, or modified sub-data blocks and their indices in the data configuration update request. The specific implementation of the reader updating the second hash tree is similar to that of the network device updating the first hash tree, and will not be elaborated further here.

[0171] The network device can receive node information of the second hash tree updated by the reader according to a data configuration update request. This node information includes the node information of the target node inserted, deleted, or updated in the second hash tree, as well as the node information of nodes affected by the target node. The target node can be a leaf node that is inserted, deleted, or updated. Nodes affected by the target node can be at least one of the target node's parent node or ancestor node. The updated node information of the second hash tree can include incremental information relative to the previous version.

[0172] S710: The network device performs consistency verification based on the updated node information of the first hash tree and the updated node information of the second hash tree, and obtains the verification result.

[0173] Specifically, the network device can compare the values ​​of nodes in the updated first hash tree with the values ​​of nodes in the updated second hash tree node by node. If they match, the consistency verification passes; if they do not match, the comparison continues with the values ​​of nodes in the next layer until an inconsistent leaf node is found. For an inconsistent leaf node, the network device can resend the corresponding sub-data block and its index, so that the reader can update the second hash tree based on the resent data block and index.

[0174] Based on the above description, the data verification method of this application synchronizes the updated data from the network side to the device side in the data update scenario. The network side and the reader side update the hash tree based on the updated data, and then the network side performs consistency verification based on the node information of the updated first hash tree and the node information of the updated second hash tree. In this way, the consistency of data updates can be guaranteed, erroneous operations can be avoided, and the normal operation of business can be guaranteed.

[0175] The foregoing embodiments describe the data verification method of this application from the perspective of network devices. The following describes the data verification method of this application from the perspective of readers.

[0176] Referring to Figure 8, a flowchart of a data verification method is shown. This method can be performed by a reader, which may include a terminal or access network equipment (RAN equipment, such as a base station). The method includes the following steps:

[0177] S802, The reader receives a data configuration request.

[0178] The data configuration request includes data blocks and their indexes and segmentation information. Each data block contains device IDs for multiple AIoT devices and group IDs for the groups to which these AIoT devices belong. Segmentation information may include the number of segments or the segment size.

[0179] A data configuration request can be generated by a network device based on configured data blocks. A reader can receive data configuration requests sent by a network device to perform data configuration.

[0180] S804, The reader generates a second hash tree based on the data configuration request.

[0181] Specifically, the reader can perform a block splitting operation on the data block based on the block splitting information in the data configuration request, obtaining multiple sub-data blocks. Then, the reader can generate a second hash tree based on the multiple sub-data blocks using a hash algorithm.

[0182] The reader can generate leaf nodes of a second hash tree based on multiple sub-data blocks. The value of each leaf node is either the value or hash value of a sub-data block. Then, the reader can generate non-leaf nodes of the second hash tree based on the leaf nodes. Non-leaf nodes can include intermediate nodes or the root node, and their values ​​are determined by the values ​​of the leaf nodes belonging to them. The leaf nodes belonging to a non-leaf node can be leaf nodes among its descendant nodes. Descendant nodes can include, but are not limited to, child nodes and child nodes of child nodes.

[0183] In some possible implementations, the data configuration request may also include the AIoT device's address, name, security parameters, or hash algorithm type. The hash algorithm type indicates the hash algorithm used to perform hash operations on the data in the data block. For example, the hash algorithm type may include SHA or SM5. The hash algorithm type may be determined by the network device based on the AIoT device's subscription information on the mobile network or information about the industry user to which the AIoT device belongs.

[0184] In other possible implementations, when the Access and Mobility Management Function (AMF) network element establishes a Stream Control Transmission Protocol (SCTP) connection, the AMF can read the hash algorithm type from the Unified Data Management (UDM) network element or the Policy Control Function (PCF) network element. Correspondingly, the reader can obtain the hash algorithm type from the AMF network element. This hash algorithm type indicates the hash algorithm used to perform hash operations on the data in the data block.

[0185] Thus, the reader can perform hash calculations on the sub-data blocks according to the above hash algorithm types to obtain the values ​​of the leaf nodes, and perform hash calculations on the strings of different nodes to obtain the values ​​of the non-leaf nodes (intermediate nodes or root nodes).

[0186] S806, The reader sends the node information of the second hash tree to the network device.

[0187] The node information of the second hash tree is used to perform consistency verification by combining the node information of the first hash tree generated by the network device based on multiple sub-data blocks obtained by dividing the data block into blocks, and to obtain the verification result.

[0188] Based on the above description, the data verification method provided in this application involves a reader receiving a data configuration request, dividing the data block into smaller blocks according to the block information in the request, generating a second hash tree on the reader's backup side based on the multiple sub-data blocks obtained from the block division, and sending the node information of the second hash tree to the network side. This allows the network side to perform consistency verification based on the node information of the first and second hash trees. This ensures data consistency between the network side and the reader side, preventing erroneous operations and impacting normal business operations.

[0189] Furthermore, if the consistency verification passes, the reader can end the verification process; if the consistency verification fails, the reader can receive the data retransmitted by the network device and re-perform the consistency verification. This will be explained below with reference to an embodiment.

[0190] Refer to Figure 9 for a flowchart of another data validation method. This method is used for scenarios where the validation result fails, and specifically includes the following steps:

[0191] S902, The reader receives the sub-data blocks and their indices from the nodes of the first hash tree that are inconsistent with the nodes of the second hash tree sent by the network device.

[0192] S904, The reader updates the second hash tree based on the sub-data blocks corresponding to inconsistent nodes and the indexes of the sub-data blocks.

[0193] Specifically, the reader can update the leaf node in the second hash tree corresponding to the sub-data block that corresponds to the inconsistent node. For example, the reader can perform a hash calculation using a hash algorithm based on the sub-data block retransmitted to the network device, and update the value of the corresponding leaf node based on the hash calculation result. Then, the reader updates the non-leaf nodes of the second hash tree based on the updated leaf nodes.

[0194] S906, The reader sends updated node information of the second hash tree to the network device.

[0195] The reader can send updated node information of the second hash tree to the network device using either a full update or an incremental update method. To reduce transmission overhead, the reader can use an incremental update method, sending incremental information about the second hash tree relative to the previous version to the network device. This incremental information can include information about modified, added, or deleted nodes.

[0196] Based on the above description, in the data verification method provided in this application, when the consistency verification fails, the reader can receive the sub-data blocks and their indexes corresponding to the inconsistent nodes resent by the network side, update the second hash tree according to the sub-data blocks and their indexes, and send the updated node information of the second hash tree to the network side to perform consistency verification again. In this way, data synchronization between the network side and the reader side can be guaranteed with a small overhead.

[0197] Considering that configuration data can usually be updated dynamically, this application also provides a data verification method in data update scenarios.

[0198] Referring to the flowchart of another data verification method shown in Figure 10, this method is used in data update scenarios and specifically includes the following steps:

[0199] S1002, The reader receives a data configuration update request.

[0200] A data configuration update request is used to add, delete, or modify data in a data block. The data configuration update request includes the added, deleted, or modified sub-data blocks and their indexes. This data configuration update request can be generated when the network device updates a data block; for specific implementation details, please refer to the description in the foregoing embodiments.

[0201] S1004. The reader updates the second hash tree based on the data configuration update request.

[0202] Similar to the embodiment in Figure 9, the reader can update the leaf nodes of the second hash tree based on the sub-data blocks added, deleted, or modified in the data configuration update request, and then update the non-leaf nodes based on the updated leaf nodes, thereby updating the second hash tree.

[0203] S1006. The reader sends the updated node information of the second hash tree to the network device.

[0204] The updated node information of the second hash tree includes the node information of the target node that is inserted, deleted, or updated in the second hash tree, as well as the node information of the nodes affected by the target node. It should be noted that the target node can be a leaf node, and the nodes affected by the target node can be the ancestor nodes of that leaf node.

[0205] When sending updated node information for the second hash tree, the reader can send either the full updated second hash tree or incremental updated second hash tree information. The incremental information can be the updated second hash tree relative to the previous version (before the update).

[0206] Based on the above description, the data verification method of this application receives a data configuration update request sent by the network side in a data update scenario, updates the second hash tree according to the sub-data blocks and their indexes in the updated data configuration update request, and then sends the node information of the updated second hash tree to the network side so that the network side can perform consistency verification based on the node information of the updated first hash tree and the node information of the updated second hash tree. In this way, the consistency of data updates can be guaranteed, erroneous operations can be avoided, and the normal operation of business can be guaranteed.

[0207] To make the technical solution of this application clearer and easier to understand, the data verification method of this application will be introduced from the perspective of interaction below.

[0208] First, refer to the flowchart of a data verification method shown in Figure 11, which specifically includes the following steps:

[0209] S1102. The network device divides the configured data block into multiple sub-data blocks and generates a first hash tree based on the multiple sub-data blocks.

[0210] S1104. The network device sends a data configuration request to the reader.

[0211] In this example, the data configuration request includes a data block, a data block index, and block information. The data block may include the device ID of the AIoT device and the group ID of its group. Furthermore, the data block may also include at least one of the AIoT device's address, name, and security parameters. The data block index may include the data block number. The block information may include the number of blocks or the block size.

[0212] In some possible implementations, the data configuration request may also include a hash algorithm type, which indicates the hash algorithm used to perform hash calculations on the data in the data block.

[0213] S1106. When an AMF network element establishes an SCTP connection, the AMF obtains the hash algorithm type from the UDM or PCF.

[0214] S1108, The reader obtains the hash algorithm type from the AMF.

[0215] S1106 and S1108 are one implementation method for a reader (such as a UE or RAN device) to obtain the hash algorithm type. In some examples, the reader can obtain the hash algorithm type from any network element such as AMF, UDM, or PCF. It should be noted that S1106 and S1108 are optional steps in this application. For example, when a data configuration request carries a hash algorithm type, S1106 and S1108 may not be executed.

[0216] S1110, The reader generates a second hash tree based on the data block and its index, using the hash algorithm indicated by the hash algorithm type.

[0217] S1112, The reader sends the node information of the second hash tree to the network device.

[0218] For example, the reader can send the values ​​of the root node, intermediate nodes, and leaf nodes of the second hash tree to the network device.

[0219] S1114. The network device compares the node information of the first hash tree with the node information of the second hash tree.

[0220] If the node information of the first hash tree is consistent with the node information of the second hash tree, then the consistency verification is successful and the verification process can be terminated.

[0221] Next, refer to the flowchart of another data verification method shown in Figure 12, which specifically includes the following steps:

[0222] S1202. The network device divides the configured data block into multiple sub-data blocks and generates a first hash tree based on the multiple sub-data blocks.

[0223] S1204. The network device sends a data configuration request to the reader.

[0224] S1206. When an AMF network element establishes an SCTP connection, the AMF obtains the hash algorithm type from the UDM or PCF.

[0225] S1208, The reader obtains the hash algorithm type from the AMF.

[0226] S1210, The reader generates a second hash tree based on the data block and its index, using the hash algorithm indicated by the hash algorithm type.

[0227] S1212, The reader sends the node information of the second hash tree to the network device.

[0228] The specific implementation of S1202 to S1212 can be referred to the aforementioned embodiments.

[0229] S1214. The network device compares the node information of the first hash tree with the node information of the second hash tree. If the consistency verification fails, proceed to S1216.

[0230] Figure 13 also illustrates a schematic diagram of a network device comparing node information of the first hash tree and the second hash tree. The network device can first compare the node information of the root node in the first hash tree and the root node in the second hash tree. If they are inconsistent, it continues to compare the node information of the intermediate nodes in the next level of the first hash tree and the intermediate nodes in the next level of the second hash tree. For example, the network device compares the node information of node 2 in the first hash tree and the node information of node 2 in the second hash tree. If they are inconsistent, it compares the node information of the child nodes of that node, such as node 5. When the node information of node 5 in the first hash tree is also inconsistent with the node information of node 5 in the second hash tree, it continues to compare the node information of the leaf nodes under node 5 in the first hash tree and the leaf nodes under node 5 in the second hash tree to determine the inconsistent leaf nodes, and thus obtain the inconsistent sub-data blocks. In the example of Figure 13, the inconsistent leaf node can be node 12, which is identified by grayscale in Figure 13. Thus, the complexity of consistency verification can be O(log N), resulting in a significant reduction in complexity.

[0231] S1216. The network device sends an error indication to the reader.

[0232] An error indicator includes an inconsistent sub-data block and its index.

[0233] S1218, The reader sends an error handling response to the network device.

[0234] Specifically, the reader can replace its local sub-data block with the sub-data block indicated in the error message, recalculate the hash value of that sub-data block to update the leaf nodes of the second hash tree, and update the non-leaf nodes in the second hash tree based on the updated leaf nodes. The reader can include the updated node information of the second hash tree in its error handle response and then send the error handle response to the network device. The network device re-compares the data based on the updated node information of the second hash tree in the error handle response to ensure data consistency between the reader and the network side.

[0235] Next, we will introduce the data verification methods for data update scenarios.

[0236] Referring to Figure 14, a flowchart of a data validation method is shown. The method includes the following steps:

[0237] S1402, The network device sends a data configuration update request to the reader.

[0238] Data configuration update requests (such as Modification Requests) are used to update data configuration. A data configuration update request can include the type of update operation, such as Add, Modify, or Delete. It can also include the added, deleted, or modified sub-data blocks and their indexes.

[0239] S1404. The reader updates the second hash tree based on the sub-data blocks and their indexes.

[0240] For example, when the data configuration update request is for adding new data, the reader can insert the leaf node corresponding to the sub-data block into the second hash tree according to the index of the sub-data block, and then update the leaf nodes affected by the leaf node according to the leaf node, such as the ancestor node of the leaf node.

[0241] S1406, The reader sends an update response to the network device.

[0242] An update response (such as a Modification Response) may include updated node information of the second hash tree, such as the updated root node value and the updated intermediate and leaf node values.

[0243] S1408. The network device compares the updated node information of the first hash tree and the node information of the second hash tree to obtain the verification result.

[0244] If the node information of the updated first hash tree is consistent with the node information of the second hash tree, then the consistency verification is successful and the current verification process can be terminated.

[0245] Typically, the AIoT controller, AF network element, NEF network element, or OM network element on the network side are relatively reliable, and data consistency verification can be performed by these network-side components. In some possible implementations, if the reader is reliable, data can also be sent from the network side, and the reader can perform data consistency verification.

[0246] The foregoing embodiments illustrate the example of grouping data. In some scenarios, data, including device IDs, may not be grouped. Accordingly, data configuration requests and data configuration update requests sent by the network side may also omit the aforementioned group identifier, group ID.

[0247] It should be noted that the various embodiments of this application can be combined with or referenced to each other. Specific implementations can be found in the descriptions of the foregoing embodiments, and will not be repeated here.

[0248] Figure 15 illustrates an example of the composition of an electronic device provided in an embodiment of this application. This electronic device can be a base station or a core network unit. Figure 15 shows a simplified schematic diagram of a base station structure. The base station 1500 includes a processor 1510, a memory 1520, and a transceiver 1530. The processor 1510 is mainly used for baseband processing and controlling the base station; the processor 1510 is typically the control center of the base station, used to control the base station to perform the processing operations on the reader side in the above method embodiments. The memory 1520 is mainly used to store computer program code and data. The transceiver 1530 is mainly used for transmitting and receiving radio frequency signals and converting radio frequency signals to baseband signals; the transceiver 1530 can generally be referred to as a transceiver module, transceiver, transceiver circuit, etc. The transceiver 1530 includes an antenna 1533 and a radio frequency circuit (not shown in the figure), wherein the radio frequency circuit is mainly used for radio frequency processing. Optionally, the device in transceiver 1530 used to implement the receiving function is regarded as a receiver, and the device used to implement the transmitting function is regarded as a transmitter. That is, transceiver 1530 includes receiver 1532 and transmitter 1531. Receiver can also be called receiving module, receiver, or receiving circuit, etc., and transmitter can be called transmitting module, transmitter, or transmitting circuit, etc.

[0249] Processor 1510 and memory 1520 may include one or more circuit boards, each circuit board may include one or more processors and one or more memories. The processor is used to read and execute computer programs in the memory to implement baseband processing functions and control the base station. If multiple circuit boards exist, they can be interconnected to enhance processing capabilities. As an alternative implementation, multiple circuit boards may share one or more processors, or multiple circuit boards may share one or more memories, or multiple circuit boards may simultaneously share one or more processors.

[0250] In one implementation, transceiver 1530 is used to execute the transmit / receive related processes performed by the base station in the aforementioned method embodiments. Processor 1510 is used to execute the processing related processes performed by the base station in the aforementioned method embodiments.

[0251] It should be understood that Figure 15 is merely an example and not a limitation, and the network devices described above, including processors, memory, and transceivers, may not depend on the structure shown in Figure 15.

[0252] Figure 16 illustrates another example of the composition of an electronic device provided in an embodiment of this application. This electronic device can be a terminal, including but not limited to mobile phones, smart wearable devices (such as smartwatches), and other electronic devices. Taking a mobile phone as an example, the electronic device may include a processor 310, an external memory interface 320, an internal memory 321, a display screen 330, a camera 340, antenna 1, antenna 2, a mobile communication module 350, and a wireless communication module 360, etc.

[0253] It is understood that the structure illustrated in this embodiment does not constitute a specific limitation on the electronic device. In other embodiments, the electronic device may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0254] Processor 310 may include one or more processing units, such as: application processor (AP), modem processor, graphics processing unit (GPU), image signal processor (ISP), controller, video codec, digital signal processor (DSP), baseband processor, and / or neural network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0255] It is understood that the interface connection relationships between the modules illustrated in this embodiment are merely illustrative and do not constitute a limitation on the structure of the electronic device. In other embodiments of this application, the electronic device may also employ different interface connection methods or combinations of multiple interface connection methods as described in the above embodiments.

[0256] The external storage interface 320 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device. The external memory card communicates with the processor 310 through the external storage interface 320 to perform data storage functions. For example, music, video, and other files can be saved on the external memory card.

[0257] Internal memory 321 can be used to store executable program code, including instructions. Processor 310 executes various functional applications and data processing of the electronic device by running the instructions stored in internal memory 321. Internal memory 321 may include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback, image playback, etc.), etc. The data storage area may store data created during the use of the electronic device (such as audio data, phonebook, etc.). Furthermore, internal memory 321 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, universal flash storage (UFS), etc. Processor 310 executes various functional applications and data processing of the electronic device by running instructions stored in internal memory 321 and / or instructions stored in memory located within the processor.

[0258] The wireless communication function of electronic devices can be realized through antenna 1, antenna 2, mobile communication module 350, wireless communication module 360, modem processor and baseband processor, etc.

[0259] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in the electronic device can be used to cover one or more communication frequency bands. Different antennas can also be reused to improve antenna utilization. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antennas can be used in conjunction with a tuning switch.

[0260] The mobile communication module 350 can provide solutions for wireless communication applications including 2G / 3G / 4G / 5G in electronic devices. The mobile communication module 350 may include at least one filter, switch, power amplifier, low noise amplifier (LNA), etc. The mobile communication module 350 can receive electromagnetic waves via antenna 1, and perform filtering, amplification, and other processing on the received electromagnetic waves before transmitting them to a modem processor for demodulation. The mobile communication module 350 can also amplify the signal modulated by the modem processor and convert it into electromagnetic waves for radiation via antenna 1. In some embodiments, at least some functional modules of the mobile communication module 350 may be housed in the processor 310. In some embodiments, at least some functional modules of the mobile communication module 350 and at least some modules of the processor 310 may be housed in the same device.

[0261] In some embodiments, the electronic device initiates or receives call requests via the mobile communication module 350 and the antenna 1.

[0262] Furthermore, an operating system runs on top of the aforementioned components. Examples include iOS, Android, and Windows operating systems. Applications can be installed and run on this operating system. Those skilled in the art will understand that, for the sake of convenience and brevity, explanations and beneficial effects of the relevant content in any of the above-described electronic devices can be found in the corresponding method embodiments provided above, and will not be repeated here.

[0263] This application also provides a communication system, which may include a network device and a reader. The reader may be a base station as shown in Figure 15, or a terminal as shown in Figure 16. The network device may be a core network unit, the structure of which can be referred to Figure 15.

[0264] In this application, the reader or network device may include a hardware layer, an operating system layer running on top of the hardware layer, and an application layer running on top of the operating system layer. The hardware layer may include hardware such as a central processing unit (CPU), a memory management unit (MMU), and memory (also known as main memory). The operating system layer may be any one or more computer operating systems that implement business processing through processes, such as Linux, Unix, Android, iOS, or Windows. The application layer may include applications such as browsers, address books, word processing software, and instant messaging software.

[0265] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and modules described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0266] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between devices or modules, and may be electrical, mechanical, or other forms.

[0267] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0268] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0269] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the essential contribution of the technical solution of this application, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the processes of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory, random access memory, magnetic disks, or optical disks.

[0270] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

A data verification method, characterized in that, The method comprises: The network device blocks the configured data block to obtain a plurality of sub-data blocks, generates a first hash tree according to the plurality of sub-data blocks, the data block comprising device identifiers of a plurality of environmental Internet of Things devices and grouping identifiers of groupings to which the plurality of environmental Internet of Things devices belong; The network device sends a data configuration request to the reader, the data configuration request comprising the data block and an index of the data block, block information; The network device receives node information of a second hash tree generated by the reader according to the data configuration request; The network device performs consistency verification according to the node information of the first hash tree and the node information of the second hash tree, and obtains a verification result. The method of claim 1, wherein The method further comprises: When the verification result is a verification failure, the network device determines, from the nodes of the first hash tree, nodes that are inconsistent with the nodes of the second hash tree; The network device sends, to the reader, a sub-data block corresponding to the inconsistent nodes and an index of the sub-data block; The network device receives node information of the second hash tree updated by the reader according to the sub-data block corresponding to the inconsistent nodes and the index of the sub-data block; The network device performs consistency verification according to the updated node information of the second hash tree and the node information of the first hash tree until the verification passes. The method of claim 1, wherein The method further comprises: The network device updates the data block and updates the first hash tree according to the updated data block; The network device sends a data configuration update request to the reader, the data configuration update request being used to add, delete or modify data in the data block, the data configuration update request comprising an added, deleted or modified sub-data block and an index of the sub-data block; The network device receives node information of the second hash tree updated by the reader according to the data configuration update request, the node information of the second hash tree updated by the reader according to the data configuration update request comprising node information of a target node inserted, deleted or updated in the second hash tree, and node information of nodes affected by the target node; The network device performs consistency verification according to the updated node information of the first hash tree and the updated node information of the second hash tree, and obtains a verification result. The method according to claim 3, characterized in that The node information of the second hash tree updated by the reader according to the data configuration update request comprises incremental information relative to a previous version. The method according to any one of claims 1 to 4, characterized in that The data configuration request further comprises an address, a name, a security parameter or a hash algorithm type of the environmental Internet of Things device, the hash algorithm type being used to indicate a hash algorithm used for hash operation on data in the data block. The method according to claim 5, characterized in that The hash algorithm type is determined by the network device according to subscription information of the environmental Internet of Things device in a mobile network or information of an industry user to which the environmental Internet of Things device belongs. The method according to any one of claims 1 to 4, characterized in that The network device generates a first hash tree according to the plurality of sub-data blocks, comprising: The network device generates leaf nodes of the first hash tree according to the plurality of sub-data blocks, a value of the leaf node being a value or a hash value of the sub-data block; The network device generates non-leaf nodes of the first hash tree according to the leaf nodes of the first hash tree, the non-leaf nodes including intermediate nodes or a root node, a value of the non-leaf node being determined according to values of the leaf nodes belonging to the non-leaf node. The method according to any one of claims 1 to 4, characterized in that The network device includes at least one of an environmental Internet of Things device controller, an application function network element, a network exposure function network element, or an operation management network element. A data verification method characterized by comprising: The method includes: The reader receives a data configuration request, the data configuration request including a data block and an index of the data block, and block information, the data block including device identifiers of a plurality of environmental Internet of Things devices and group identifiers of groups to which the plurality of environmental Internet of Things devices belong; The reader generates a second hash tree according to the data configuration request; The reader sends node information of the second hash tree to a network device, the node information of the second hash tree being used to perform consistency verification with node information of a first hash tree generated by the network device based on a plurality of sub-data blocks obtained by block division of the data block, to obtain a verification result. The method of claim 9, wherein The method further includes: The reader receives, from the network device, a sub-data block corresponding to a node of the first hash tree that is inconsistent with a node of the second hash tree, and an index of the sub-data block; The reader updates the second hash tree according to the sub-data block corresponding to the inconsistent node and the index of the sub-data block; The reader sends node information of the updated second hash tree to the network device. The method of claim 9, wherein The method further includes: The reader receives a data configuration update request, the data configuration update request being used to add, delete, or modify data in the data block, the data configuration update request including an added, deleted, or modified sub-data block and an index of the sub-data block; The reader updates the second hash tree according to the data configuration update request, node information of the updated second hash tree including node information of a target node inserted, deleted, or updated in the second hash tree, and node information of nodes affected by the target node; The reader sends node information of the updated second hash tree to the network device. The method of claim 11, wherein The reader sends node information of the updated second hash tree to the network device, including: The reader sends, to the network device, incremental information of the updated second hash tree relative to a previous version. The method according to any one of claims 9 to 12, characterized in that The data configuration request further includes an address, a name, a security parameter, or a hash algorithm type of the environmental Internet of Things device, the hash algorithm type being used to indicate a hash algorithm used for hash operation on data in the data block. The method of claim 13, wherein The hash algorithm type is determined by the network device according to subscription information of the environmental Internet of Things device in a mobile network or information of an industry user to which the environmental Internet of Things device belongs. The method according to any one of claims 9 to 12, characterized in that The method further includes: When an access and mobility management function, AMF, network element establishes a stream control transmission protocol, SCTP, connection, the reader obtains a hash algorithm type from the AMF network element, the hash algorithm type being used to indicate a hash algorithm used for hashing data in the data block. The method according to any one of claims 9 to 12, characterized in that The reader generates a second hash tree according to the data configuration request, including: The reader blocks the data block according to block information in the data configuration request, to obtain a plurality of sub-data blocks; The reader generates leaf nodes of the second hash tree according to the plurality of sub-data blocks, a value of the leaf node being a value or a hash value of the sub-data block; The reader generates non-leaf nodes of the second hash tree according to the leaf nodes of the second hash tree, the non-leaf nodes including intermediate nodes or a root node, a value of the non-leaf node being determined according to values of the leaf nodes belonging to the non-leaf node. The method according to any one of claims 9 to 12, characterized in that The reader includes a terminal or an access network device. A network device, characterized in that The network device includes: a memory for storing computer programs or computer instructions; a processor for executing the computer programs or computer instructions stored in the memory, so that the network device executes the method according to any one of claims 1 to 8. A reader, characterized by The reader includes: a memory for storing computer programs or computer instructions; a processor for executing the computer programs or computer instructions stored in the memory, so that the reader executes the method according to any one of claims 9 to 17. A communication system characterized by The communication system includes a network device and a reader, the network device being configured to execute the method according to any one of claims 1 to 8, and the reader being configured to execute the method according to any one of claims 9 to 17. A computer storage medium, characterized by The computer storage medium is configured to store a computer program, the computer program being executed to implement the method according to any one of claims 1 to 17. A computer program product, characterized in that The computer storage medium includes computer readable instructions; the computer readable instructions are used to implement the method according to any one of claims 1 to 17. The computer storage medium includes computer readable instructions; the computer readable instructions are used to implement the method according to any one of claims 1 to 17.

Images