CN115913572A - Data verification method, device, equipment, medium and system for mimicry storage system - Google Patents

Abstract

The invention discloses a data verification method, device, equipment, medium and system of a mimetic storage system. The method receives a file and a hash key uploaded by a client; calls a mimetic defense system to calculate each data according to the hash key The homomorphic hash value of the block receives the data verification request sent by the client; based on the data verification request, the data block to be verified and the corresponding homomorphic hash value are obtained, and at least two homomorphic verification executions are called The entity calculates the data aggregation value and the hash aggregation value respectively, so that the client uses a homomorphic hash function to calculate the data aggregation value to obtain a homomorphic hash tag, and according to the homomorphic hash tag and the Whether the above hash aggregation values are the same, determine whether the file to which the data block corresponding to the data verification request belongs is correctly held, the embodiment of the present invention uses a mimic defense system to defend against external attacks, improves system security performance, and introduces a homomorphic hash algorithm Encrypt to reduce the risk of data leakage.

Description

Mimic storage system data verification method, device, equipment, medium and system

technical field

The present invention relates to the technical field of electric power information security, in particular to a data verification method, device, equipment, medium and system of a mimetic storage system.

Background technique

The secure access gateway of the electric power Internet of things is a network security encryption device applied in the secure access area of the main station of the electric power system to ensure the security of communication data. At present, the security protection of the secure access gateway of the electric power Internet of things adopts Technical measures such as code security detection, administrator authentication and authentication, data encryption storage verification, network access control, operating system kernel tailoring, and security reinforcement. However, in the current high-intensity actual combat environment such as national-level network attack and defense drills, 0DAY vulnerabilities and unknown attacks continue to bring new threats, and the existing security protection measures for the secure access gateway of the power Internet of Things need to be strengthened.

In order to comprehensively improve the security of power information and the security performance of the storage system, it is necessary to prove the possession of the data stored in the server. The existing research work mainly focuses on the provable data possession scheme and the recoverable proof scheme. The scheme is vulnerable to attacks during data verification, and the output results are transmitted in plain text, which faces the risk of data leakage and insufficient security performance.

Contents of the invention

In view of this, the embodiments of the present invention provide a data verification method, device, equipment, medium and system of a mimetic storage system, so as to solve the technical problem of insufficient security performance of the existing technical solution.

The technical scheme that the present invention proposes is as follows:

The first aspect of the embodiments of the present invention provides a method for verifying data in a mimetic storage system, which is applied to a storage server, including:

Receive the file and the hash key uploaded by the client, the file includes several data blocks; call at least two homomorphic verification execution bodies in the mimic defense system to calculate the homomorphism of each data block according to the hash key State hash value, judge the homomorphic hash value, and store the homomorphic hash value and the corresponding data block that passed the judgment; receive the data verification request sent by the client; based on the data verification The verification request obtains the data block to be verified and the corresponding homomorphic hash value, and at least two homomorphic verification executive bodies are called to calculate the data aggregation value and the corresponding homomorphic hash value of the data block to be verified. The hash aggregation value of the homomorphic hash value, adjudicating the data aggregation value and the hash aggregation value; returning the data aggregation value and the hash aggregation value passed through the ruling to the client so that the client uses a homomorphic hash function to calculate the data aggregation value to obtain a homomorphic hash tag, and according to whether the homomorphic hash tag and the hash aggregation value are the same, determine the data calibration Check whether the file to which the data block corresponding to the request belongs is correctly held.

Optionally, invoking at least two homomorphic verification executives in the mimic defense system to calculate the homomorphic hash value of each data block according to the hash key, including: combining the hash key and data The block is distributed to at least two homomorphic verification executives in the mimic defense system; receiving at least two homomorphic verification executives uses different hardware systems and/or different languages to implement the homomorphic hash tag algorithm respectively and according to the hash The homomorphic hash value of each data block calculated by the hash key.

Optionally, making a ruling on the homomorphic hash value includes:

Obtain a target homomorphic hash value that satisfies preset rules from the homomorphic hash values calculated by different homomorphic verification executors; use the target homomorphic hash value as the homomorphic hash value Hash value; give abnormal feedback to the homomorphic verification executive body whose calculated homomorphic hash value is different from the said homomorphic hash value passed by the ruling; perform offline or replace.

Optionally, calling at least two homomorphic verification executives to calculate the data aggregation value of the data block to be verified and the corresponding hash aggregation value of the homomorphic hash value, including: data verification will be performed The verified data block and the corresponding homomorphic hash value are distributed to at least two homomorphic verification executives in the mimic defense system; the data to be verified is received by at least two homomorphic verification executives The sum of the blocks and the product of the corresponding homomorphic hash value, the data aggregation value is the sum of the data blocks to be verified, and the hash aggregation value is the corresponding homomorphic hash value product.

Optionally, arbitrating the data aggregation value and the hash aggregation value includes: obtaining from the data aggregation value and the hash aggregation value calculated by different homomorphic verification executives The target data aggregate value and the target hash aggregate value of the rule; the target data aggregate value and the target hash aggregate value are used as the data aggregate value and the hash aggregate value passed by the ruling; the calculation of the The homomorphic verification execution body whose data aggregation value and the hash aggregation value are different from the data aggregation value passed by the ruling and the hash aggregation value is abnormally fed back; Offline or replace.

Optionally, the data verification request includes a random key and the number of data blocks to be verified; A state hash value, comprising: calculating the position coordinates of each data block to be verified and the corresponding homomorphic hash value according to the random key and the number of data blocks to be verified; The location coordinates acquire the data block to be verified and the corresponding homomorphic hash value.

The second aspect of the embodiment of the present invention provides a data verification device for a mimetic storage system, including:

The first receiving module is used to receive the file and the hash key uploaded by the client, and the file includes several data blocks; the storage module is used to call at least two homomorphic verification execution bodies in the mimic defense system according to the specified The hash key calculates the homomorphic hash value of each data block, arbitrates the homomorphic hash value, and stores the homomorphic hash value and the corresponding data block passed through the ruling; the second receiving module, configured to receive the data verification request sent by the client; the evidence acquisition module, configured to obtain the data block to be verified and the corresponding homomorphic hash value based on the data verification request, and call at least The two homomorphic verification executives respectively calculate the data aggregation value of the data block to be verified and the corresponding hash aggregation value of the homomorphic hash value, and calculate the data aggregation value and the hash aggregation value value; the response module is used to return the data aggregation value and the hash aggregation value passed by the arbitration to the client, so that the client uses a homomorphic hash function to the data aggregation value Perform calculation to obtain a homomorphic hash tag, and determine whether the file to which the data block corresponding to the data verification request belongs is correctly held according to whether the homomorphic hash tag and the hash aggregation value are the same.

The third aspect of the embodiment of the present invention provides an electronic device, including: a memory and a processor, the memory and the processor are connected to each other in communication, the memory stores computer instructions, and the processor executes the Computer instructions, so as to execute the data verification method of the mimetic storage system according to the first aspect of the embodiment of the present invention and any one of the first aspect.

The fourth aspect of the embodiments of the present invention provides a computer-readable storage medium, the computer-readable storage medium stores computer instructions, and the computer instructions are used to make the computer execute the first aspect and the first aspect of the present invention. The data verification method of the mimetic storage system described in any one of the aspects.

The fifth aspect of the embodiment of the present invention provides a data verification system for a mimic storage system, including a client and a storage server, and the storage server includes a mimic defense system and a data node;

The client is used to generate a hash key, upload the hash key and the file to be stored to the storage server, and send a data verification request to the storage server;

The storage server is configured to, after receiving the file and the hash key uploaded by the client, call at least two homomorphic verification execution bodies in the mimic defense system to calculate each data block according to the hash key The homomorphic hash value, adjudicating the homomorphic hash value, and storing the homomorphic hash value and the corresponding data block associatively stored in the data node, the server is also used to accept After receiving the data verification request, obtain the data block to be verified and the corresponding homomorphic hash value based on the data verification request, and call at least two homomorphic verification executives to calculate the The data aggregation value of the data block of the data verification and the hash aggregation value of the corresponding homomorphic hash value, arbitrating the data aggregation value and the hash aggregation value, and arbitrating the data that passed the adjudication value and said hash aggregated value are returned to said client;

The client is further configured to, after receiving the data aggregation value and the hash aggregation value returned by the server, use a homomorphic hash function to calculate the data aggregation value to obtain a homomorphic hash tag, and Confirm whether the homomorphic hash tag and the hash aggregation value are the same, so as to determine whether the file to which the data block for data verification belongs is correctly held.

It can be seen from the above technical solutions that the embodiments of the present invention have the following advantages:

In the data verification method, device, device medium and system of a mimic storage system provided by the embodiments of the present invention, by receiving the file and the hash key uploaded by the client, the file includes several data blocks; calling the mimic defense system At least two homomorphic verification executive bodies respectively calculate the homomorphic hash value of each data block according to the hash key, arbitrate the homomorphic hash value, and pass the homomorphic hash value value and the corresponding data block for storage; receive the data verification request sent by the client; obtain the data block for data verification and the corresponding homomorphic hash value based on the data verification request, and call at least two The homomorphic verification executive body separately calculates the data aggregation value of the data block to be verified and the corresponding hash aggregation value of the homomorphic hash value, and performs a calculation on the data aggregation value and the hash aggregation value. Ruling: returning the data aggregation value and the hash aggregation value passed through the ruling to the client, so that the client uses a homomorphic hash function to calculate the data aggregation value to obtain a homomorphic hash tag, and according to whether the homomorphic hash tag and the hash aggregation value are the same, determine whether the file to which the data block corresponding to the data verification request belongs is correctly held. In the embodiment of the present invention, during data verification, at least two homomorphic verification execution bodies in the mimic defense system are called to calculate the data aggregation value of the data block to be verified and the hash value of the corresponding homomorphic hash value respectively. Aggregating value, adjudicating the data aggregation value and the hash aggregation value, returning the data aggregation value and the hash aggregation value passed through the ruling to the client, and using the mimic defense system to defend against external attacks, thereby improving system security performance, and introducing a homomorphic hash algorithm for encryption to reduce the risk of data leakage.

Description of drawings

In order to express the technical solutions of the embodiments of the present invention more clearly, the following will briefly introduce the accompanying drawings required for the description of the embodiments. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For Those of ordinary skill in the art can also obtain other drawings based on these drawings without making creative efforts.

Fig. 1 is the flow chart of the method for verifying the data of the mimetic storage system in the embodiment of the present invention;

Fig. 2 is the modular block diagram of the data verification device of the mimic storage system in the embodiment of the present invention;

3 is a schematic structural diagram of a data verification system of a mimetic storage system in an embodiment of the present invention;

4 is a schematic structural diagram of an electronic device in an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a computer-readable storage medium in an embodiment of the present invention.

Detailed ways

In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

As the company's core border security protection measures, the security access gateway of the power Internet of Things is also very important for its own security protection. In order to comprehensively improve the comprehensive defense capabilities of the power Internet of Things security access gateway, and solve the problems existing in the current power Internet of Things security access gateway in terms of unknown vulnerability protection, unknown attack defense, and integrated security protection, the concept of endogenous security is introduced, and the use of mimicry, etc. The technical theory transforms the secure access gateway of the power Internet of Things to enhance the endogenous security immunity of the power network security boundary.

Mimic defense is an inclusive, open and proactive revolutionary defense technology system that tries to "change the current rules of the game". Mimic defense no longer seeks to establish a flawless, flawless, and flawless defense system to combat cyberspace security threats, but adopts diverse and ever-changing evaluation and deployment mechanisms and strategies to build a dynamic , heterogeneous, redundant, and uncertain system architectures, resulting in difficulties such as "difficult detection, penetration, attack incentives, and attack results utilization", breaking the static and deterministic network architecture on which the attack chain is formed And the similarity greatly increases the attacker's attack cost. Mimic defense expects to increase the dynamics of the system to reduce the detectability of the system, increase the randomness of the system to reduce the permeability of the system, use the dynamic heterogeneous redundant architecture of the system to force attackers to face the problem of coordinated attacks, and comprehensively utilize the system The dynamics, randomness, and diversity of attacks destroy the stability or effective utilization of the attack chain. When deploying and operating networks and systems, by reducing their determinism, similarity, and staticity, the difficulty of attacks including unknown vulnerabilities and backdoors, as well as the difficulty of exploiting the results of attacks, is significantly improved, completely reversing the "easy to attack and difficult to attack" "defense" strategic pattern.

Among the verdict schemes of the mimic defense system, majority consensus verdict is the most commonly used strategy. The advantage of this solution is that it is simple to implement and can handle most abnormal output situations, but the disadvantage is that it cannot give further judgment when most inconsistencies cannot be reached. This problem can be solved by adopting a decision strategy based on weight. When most of the consistent conditions cannot be met, the system will give the output result of the executive body with the highest weight. Although the competitive adjudication model can improve the efficiency of adjudication, it does not improve the correctness of the adjudication results. The outlier-based mimic judgment optimization scheme quantifies the outlier value of the executive output data by constructing the output data set of the heterogeneous executive body of the mimic system and training the deep learning anomaly detection model, and then uses the weight optimization algorithm to optimize the weight distribution and select the optimal weight The result is used as the voting output, but this scheme does not consider the distribution of cloud server vulnerabilities.

Existing solutions generally optimize the weights of heterogeneous executives based on high-order heterogeneity, historical confidence, and executive heterogeneity to improve system security. After the system based on the historical confidence judgment method is continuously attacked by the same kind of malicious attacker, its executive body will continue to produce approximate output, and the scheduling strategy will be affected. If the adjudication module selects the output result of the executive body with a higher historical confidence for adjudication, it ignores the problem that the execution body with a lower degree of heterogeneity will give consistent results. In this case, the probability of common mode escape will increase. In the judgment method based on the degree of heterogeneity of the execution body, the introduction of the degree of heterogeneity in the judgment scheme will also lead to the ranking of the execution bodies according to the degree of heterogeneity, which weakens the dynamics of the mimic defense system.

In summary, although optimizing the weight of the executive body can delay the time of being attacked, it cannot fundamentally solve the security problem, and may even bring new security risks. In addition, the above-mentioned schemes all adopt plain text during data transmission, and do not pay attention to the security of the data itself. However, problems such as untrustworthy servers and opaque permissions of server providers will cause data leakage risks. Aiming at the problem of data security, the researchers proposed a design method of a mimetic scheduling arbitrator based on software and hardware collaboration. This method gives the judgment module high authority, protects data security at the hardware level, and ensures the accuracy and credibility of the adjudication. Fully secured by secondary modules. However, the execution result of this scheme is still in plain text, facing the risk of data leakage. According to the above analysis, the security of the existing adjudication scheme is still insufficient, and it is necessary to design a mimetic defense adjudication scheme with higher strength and applied to data possession verification.

Based on this, the embodiment of the present invention provides a mimetic storage system data verification method, which is applied to the storage server, as shown in Figure 1, including:

Step S100, receiving the file and the hash key uploaded by the client, the file includes several data blocks. The client and the storage server interact through the network, and the storage server includes a mimic defense system and multiple data nodes. Check the execution body and the policy/scheduling module, and the role of the data node is to store the data transmitted during the interaction process. The user decomposes the file to be stored into n data blocks through the client, that is, the file to be stored F=(b ₁ ,b ₂ ,...,b _n ), each data block _bi includes m sub-blocks, and then File F is uploaded to the storage server.

At the same time, the client generates a hash key according to the initial value, and generates a hash key K=(p,q,g) through KeyGeneration(λ _p ,λ _q ,m,s). λ _p and λ _q are discrete logarithmic security parameters, which are respectively the length digits of the random large prime number p and the random large prime number q, m is the number of sub-blocks of each data block, and its value is m=[β/(λ _q -1)], β represents the size of the data block. The process of generating the hash key is as follows: Firstly, a large random prime number q is generated according to the discrete logarithm security parameter λ _q and the generation function qGeneration(λ _q ). Then call pGeneration(q,λ _p ) to generate a random large prime p according to the random large prime q and the discrete logarithm security parameter λ _p , while guaranteeing p|(q-1). After obtaining the random large prime number p and the random large prime number q, use the g _i Generation(p,q) function to generate the block label g _i of each data block, and g is the row vector of all sub-block labels g _i , that is, g →(g ₁ ,g ₂ ,...,g _m ). The functions applied during hash key generation are as follows:

1) Function qGeneration(λ _q ):

do

while q is not prime done

return q

2) Function pGeneration(q,λ _p ):

do

for i＝1 to 4λ _p do

c←X(mod 2q)

p←X-c+1//p≡1(mod2q)

if p is prime then return p

done

return 0

3) Function g _i Generation(p,q)

do

for i＝1 to m do

x←f(p-1)+1

g _i ←x ^(p-1)/q (modp)

while _i = 1 done

done

g←(g ₁ ,g ₂ ,...,g _m )

return(p,q,g)

Step S200, call at least two homomorphic verification executives in the mimic defense system to calculate the homomorphic hash value of each data block according to the hash key, make a judgment on the homomorphic hash value, and pass the same The state hash value and the corresponding data block are stored. Specifically, after receiving the file and the hash key uploaded by the client, the storage server uses the idea of mimicry defense for each data block of the uploaded file to call at least two homomorphic verification execution bodies in multiple mimicry defense systems, respectively Execute the homomorphic hash algorithm, and the obtained result enters the judgment module for judgment and abnormal feedback. The homomorphic hash value passed by the ruling can be attached to the data block as a data label and stored in association with the corresponding data block. The function for the homomorphic verification executive to execute the homomorphic hash algorithm to obtain the homomorphic hash value is as follows:

4)Function F'Gen(K,F)

K=(p,q,g), F=(b ₁ ,b ₂ ,...,b _n )

for i＝1 to _n do

x←f(p-1)+1

Done

F'=(b ₁ ,b ₂ ,...,b _n ; T ₁ ,T ₂ ,...,T _n )

Return F'

Step S300, receiving a data verification request sent by the client. After the data is stored on the storage server, the client can initiate a challenge to verify the data integrity at any time. The client randomly extracts some data blocks to initiate verification, and the data verification request includes the information of the extracted data blocks, such as the storage location of the data blocks. specifically. The extracted data blocks are part of the data blocks of the file to be verified, and there is no need to verify all files, reducing the amount of calculation.

Step S400: Obtain the data block to be verified and the corresponding homomorphic hash value based on the data verification request, and call at least two homomorphic verification executives to calculate the data aggregation value of the data block to be verified respectively And the hash aggregation value of the corresponding homomorphic hash value, and judge the data aggregation value and hash aggregation value. Specifically, the data verification request includes a random key and the number of data blocks to be subjected to data verification.

Obtain the data block to be verified and the corresponding homomorphic hash value based on the data verification request, including: calculate each data to be verified according to the random key and the number of data blocks to be verified The location coordinates of the block and the corresponding homomorphic hash value; according to the location coordinates, the data block to be verified and the corresponding homomorphic hash value are obtained. For example, the client first needs to generate a random key e according to a random number generator and at the same time determine the number c of data blocks to be verified, and send the data verification request containing the random key e and the number c to <e, c>sent to the storage server, after the storage server receives the data verification request <e,c>, it enters the evidence generation stage, and the storage server calls the function r _i =σ _e (i), (1≤i≤c) to calculate the client The location coordinates of the data blocks that initiate the challenge, and then use the strategy/scheduling module in the mimicry defense system to call the homomorphic verification execution body, and at the same time, the input agent retrieves each data block and homomorphic verification in the corresponding data node according to the coordinates. The hash values are sent to the above-mentioned homomorphic verification executive body respectively, and the homomorphic verification executive body calculates the proof of possession, that is, the data aggregation value B of the data block and the hash aggregation value T of the corresponding homomorphic hash value, and send this evidence to the adjudication module. After receiving the data aggregation value B and the hash aggregation value T, the ruling module executes the ruling plan, and returns the result output to the client as a response. The data aggregation value B is the sum of the data blocks to be verified, and the hash aggregation value T is the product of the corresponding homomorphic hash values. The calculation functions of the data aggregation value B and the hash aggregation value T are as follows:

5) Function ProofGen(e,c,F')→(B,T)

B=0, T=1

for i＝1to _c do

r _i =σ _e (i)

done

return(B,T)

Step S500, return the data aggregation value and hash aggregation value passed by the ruling to the client, so that the client uses a homomorphic hash function to calculate the data aggregation value to obtain a homomorphic hash tag, and according to the homomorphic hash tag Whether it is the same as the hash aggregation value determines whether the file to which the data block corresponding to the data verification request belongs is correctly held. In the evidence verification stage, the client receives the data possession evidence (, T) returned by the storage server, that is, the hash aggregation value T of the data aggregation value B and the corresponding homomorphic hash value, and uses the same hash value T according to the data aggregation value B The state hash function calculates the homomorphic hash tag, that is, h _K ()=T′, judges whether the homomorphic hash tag T′ is equal to the hash aggregation value T returned by the storage server, and if they are equal, the data for data verification The file to which the block belongs is intact, otherwise the data is corrupted. Every time the client initiates a verification, it only needs to calculate the data aggregation value B to determine whether the file is complete. The amount of calculation is small, and only a small amount of data needs to be transmitted during the verification process, reducing the occupation of network resources.

A method for verifying data in a mimetic storage system according to an embodiment of the present invention, by receiving a file and a hash key uploaded by a client, the file includes several data blocks; calling at least two homomorphic verification execution bodies in the mimetic defense system respectively Calculate the homomorphic hash value of each data block according to the hash key, make a judgment on the homomorphic hash value, and store the homomorphic hash value and the corresponding data block after the ruling; receive the data calibration sent by the client verification request; obtain the data block to be verified and the corresponding homomorphic hash value based on the data verification request; call at least two homomorphic verification executives to calculate the data aggregation value of the data block to be verified respectively And the hash aggregation value of the corresponding homomorphic hash value, arbitrate the data aggregation value and hash aggregation value; return the data aggregation value and hash aggregation value passed by the ruling to the client, so that the client adopts homomorphism The hash function calculates the data aggregation value to obtain the homomorphic hash tag, and according to whether the homomorphic hash tag and the hash aggregation value are the same, determine whether the file to which the data block corresponding to the data verification request belongs is correctly held. In the embodiment of the invention, during data verification, at least two homomorphic verification executives in the mimic defense system are called to calculate the data aggregation value of the data block to be verified and the hash aggregation value of the corresponding homomorphic hash value , make a ruling on the data aggregation value and hash aggregation value, and return the data aggregation value and hash aggregation value that passed the ruling to the client, which can use the mimic defense system to defend against external attacks, thereby improving system security performance, and introducing homomorphic hashing Greek algorithm for encryption to reduce the risk of data leakage.

In one embodiment, invoking at least two homomorphic verification executives in the mimic defense system respectively calculates the homomorphic hash value of each data block according to the hash key, including: distributing the hash key and the data block Give at least two homomorphic verification execution bodies in the mimic defense system; receive at least two homomorphic verification execution bodies using different hardware systems and/or different languages to implement the homomorphic hash tag algorithm and calculate according to the hash key The homomorphic hash value of each data block of .

Specifically, after receiving the data block and the hash key, the storage server distributes the data block to each homomorphic verification executive in the mimic defense system through the input agent of the mimic defense system, and each homomorphic verification execution body is based on Different hardware systems and different languages complete the homomorphic hash tag algorithm, and the homomorphic hash value of each data block is calculated according to the hash key. A dynamic, heterogeneous, redundant, and uncertain architecture is realized through the homomorphic verification executive body of the homomorphic hash tag algorithm based on different hardware systems and different languages to improve system security.

In an embodiment, arbitrating on the homomorphic hash value includes: obtaining a target homomorphic hash value that satisfies preset rules from the homomorphic hash values calculated by different homomorphic verification executives; The target homomorphic hash value is used as the homomorphic hash value passed by the ruling; the homomorphic verification executive body whose calculated homomorphic hash value is different from the homomorphic hash value passed by the ruling Perform abnormal feedback; offline or replace the homomorphic verification execution body of abnormal feedback.

Specifically, the preset rule is the majority consensus rule, that is, the majority consistent homomorphic hash value is the homomorphic hash value that passes the ruling. The judgment module judges the homomorphic hash value calculated by the homomorphic verification executive body, and obtains the majority consistent homomorphic hash value based on the judgment strategy, among which the majority consistent homomorphic hash value is the majority of the homomorphic verification execution body Calculate the same homomorphic hash value, such as counting the number of homomorphic hash values calculated by each homomorphic verification execution body, if more than 80% of the homomorphic hash values calculated by the homomorphic verification execution body are the same, then the homomorphic hash value is the target homomorphic hash value. And find out the abnormal homomorphic verification execution body whose calculation result is different from the value calculated by most other homomorphic verification execution bodies, and feed back the abnormal homomorphic verification execution body to the strategy/scheduling module, and the strategy/scheduling module runs The scheduling algorithm performs scheduling in the time domain, and processes the homomorphic verification execution body according to the abnormal feedback results, for example, the abnormal homomorphic verification execution body is processed offline and other homomorphic verification execution bodies are added to replace it. By continuously detecting and updating the homomorphic verification execution body, the probability of the system being attacked is reduced, and the system security performance is improved.

In one embodiment, calling at least two homomorphic verification executive bodies to calculate the data aggregation value of the data block to be verified and the hash aggregation value of the corresponding homomorphic hash value respectively, including: The verified data block and the corresponding homomorphic hash value are distributed to at least two homomorphic verification executives in the mimic defense system; the data blocks to be verified are received by at least two homomorphic verification executives The sum and the product of the corresponding homomorphic hash value, the data aggregation value is the sum of the data blocks to be verified, and the hash aggregation value is the product of the corresponding homomorphic hash value.

The sum of the data blocks to be verified by the homomorphic verification executive and the product of the corresponding homomorphic hash values are obtained to obtain the data aggregation value and the hash aggregation value, that is, it is not necessary to return each data block and the same The client only needs to calculate the hash value of the data aggregation value to verify whether the data is complete, reducing the amount of calculation on the client.

In one embodiment, arbitrating the data aggregation value and the hash aggregation value includes:

Obtain a target data aggregation value and a target hash aggregation value satisfying a preset rule from the data aggregation value and the hash aggregation value calculated by different homomorphic verification executives; combine the target data aggregation value and the hash aggregation value The target hash aggregate value is used as the data aggregate value and the hash aggregate value passed by the ruling; the calculated data aggregate value and the hash aggregate value and the data aggregate value and the The homomorphic verification execution body whose hash aggregation value is not the same gives abnormal feedback; the homomorphic verification execution body with abnormal feedback is offline or replaced.

Specifically, the preset rule is a majority consensus rule, that is, the data aggregation value and the hash aggregation value that are most consistent are the data aggregation value and the hash aggregation value that pass the ruling. The judgment module judges the data aggregation value and hash aggregation value calculated by the homomorphic verification execution body, and obtains the most consistent data aggregation value and hash aggregation value based on the ruling strategy, among which the most consistent data aggregation value and hash aggregation value The same data aggregate and hash aggregate values computed for most homomorphic verification actors. And find out the abnormal homomorphic verification execution body whose calculation result is different from the value calculated by most other homomorphic verification execution bodies, and feed back the abnormal homomorphic verification execution body to the strategy/scheduling module, and the strategy/scheduling module runs The scheduling algorithm performs scheduling in the time domain, and processes the homomorphic verification execution body according to the abnormal feedback results, for example, the abnormal homomorphic verification execution body is processed offline and other homomorphic verification execution bodies are added to replace it. By continuously detecting and updating the homomorphic verification execution body, the probability of the system being attacked is reduced, and the system security performance is improved.

To sum up, the advantages of a data verification method for a mimic storage system in the embodiment of the present invention include: first, protecting the system security of the storage server, using the DHR architecture of the mimic defense system to defend against external attacks; second, enriching system functions and introducing homomorphic Hash algorithm, which retains the function of the algorithm, supports dynamic update of data, unlimited verification and integrity verification; finally, it ensures the efficiency of the system, and ensures the speed of the system after calling multiple executives, with less storage redundancy.

The embodiment of the present invention also provides a mimetic storage system data verification device, as shown in Figure 2, including:

The first receiving module 201 is configured to receive the file and the hash key uploaded by the client, and the file includes several data blocks. For specific content, refer to the corresponding part of the foregoing method embodiment, and details are not repeated here.

The storage module 202 is used to call at least two homomorphic verification executives in the mimic defense system to calculate the homomorphic hash value of each data block according to the hash key, and make a judgment on the homomorphic hash value, and the judgment The passed homomorphic hash value and the corresponding data block are stored. For specific content, refer to the corresponding part of the foregoing method embodiment, and details are not repeated here.

The second receiving module 203 is configured to receive the data verification request sent by the client. For specific content, refer to the corresponding part of the foregoing method embodiment, and details are not repeated here.

Evidence acquisition module 204, configured to obtain the data block to be verified and the corresponding homomorphic hash value based on the data verification request, and call at least two homomorphic verification executives to calculate the data to be verified respectively The data aggregation value of the block and the hash aggregation value of the corresponding homomorphic hash value are used to judge the data aggregation value and the hash aggregation value. For specific content, refer to the corresponding part of the foregoing method embodiment, and details are not repeated here.

The response module 205 is used to return the data aggregation value and hash aggregation value passed by the ruling to the client, so that the client uses a homomorphic hash function to calculate the data aggregation value to obtain a homomorphic hash tag, and according to the homomorphic Whether the hash tag and the hash aggregation value are the same determines whether the file to which the data block corresponding to the data verification request belongs is correctly held. For specific content, refer to the corresponding part of the foregoing method embodiment, and details are not repeated here.

A device for verifying data in a mimic storage system according to an embodiment of the present invention receives a file and a hash key uploaded by a client, and the file includes several data blocks; calls at least two homomorphic verification execution entities in the mimic defense system, respectively Calculate the homomorphic hash value of each data block according to the hash key, make a judgment on the homomorphic hash value, and store the homomorphic hash value and the corresponding data block after the ruling; receive the data calibration sent by the client verification request; obtain the data block to be verified and the corresponding homomorphic hash value based on the data verification request; call at least two homomorphic verification executives to calculate the data aggregation value of the data block to be verified respectively And the hash aggregation value of the corresponding homomorphic hash value, arbitrate the data aggregation value and hash aggregation value; return the data aggregation value and hash aggregation value passed by the ruling to the client, so that the client adopts homomorphism The hash function calculates the data aggregation value to obtain the homomorphic hash tag, and according to whether the homomorphic hash tag and the hash aggregation value are the same, determine whether the file to which the data block corresponding to the data verification request belongs is correctly held. In the embodiment of the invention, the mimetic defense system is used to defend against external attacks during data verification to improve system security performance, and a homomorphic hash algorithm is introduced for encryption to reduce the risk of data leakage.

The embodiment of the present invention also provides a data verification system for a mimic storage system. As shown in FIG. 3 , the system includes a client and a storage server, and the storage server includes a mimic defense system and data nodes. The rest of the architecture, including input agent, ruling module, homomorphic verification executive body and policy/scheduling module, the input agent and the ruling module form the meta-service node to interact with the client.

The client is used to generate a hash key, upload the hash key and the file to be stored to the storage server, and send a data verification request to the storage server;

After receiving the file and hash key uploaded by the client, the storage server calls at least two homomorphic verification execution bodies in the mimic defense system to calculate the homomorphic hash value of each data block according to the hash key , make a judgment on the homomorphic hash value, associate and store the passed homomorphic hash value and the corresponding data block to the data node, and the storage server is also used to obtain the data based on the data verification request after receiving the data verification request For the data block to be verified and the corresponding homomorphic hash value, call at least two homomorphic verification executives to calculate the data aggregation value of the data block to be verified and the corresponding homomorphic hash value Hash aggregation value, adjudicating the data aggregation value and hash aggregation value, and returning the data aggregation value and hash aggregation value that passed the ruling to the client;

The client is also used to calculate the data aggregation value using the homomorphic hash function to obtain the homomorphic hash tag after receiving the data aggregation value and hash aggregation value returned by the server, and confirm the homomorphic hash tag and hash aggregation value Whether the values are the same to determine whether the file to which the data block for data verification belongs is correctly held.

The operating principle of the data verification system of the mimetic storage system in the embodiment of the present invention is as follows: the client generates an initial key during initialization, and uploads the hash key and the file to be stored to the storage server. In the data labeling stage, the client interacts with the storage server through the network, performs homomorphic hash operations on all data blocks through the mimic defense system of the storage server, and generates homomorphic hash values as data labels and data blocks to be stored in the storage node , the homomorphic hash value serves as the basis for proof of possession and provides integrity protection. After the preparation phase is completed, the client can initiate a challenge to the storage server at any time and send a data verification request for integrity verification. After the storage server receives the data verification request, the meta service node establishes a connection with the online homomorphic verification execution body. Distribute and judge data blocks, distribute the data blocks to be verified and the corresponding homomorphic hash values to each homomorphic verification executive, and the homomorphic verification executive calculates the data blocks to be verified The data aggregation value and the hash aggregation value of the corresponding homomorphic hash value, and then output the result to the adjudication module for adjudication. After the adjudication module completes the adjudication, it sends the adjudication result to the strategy/scheduling module, which receives the adjudication result. According to the ruling result, the scheduling algorithm is run to schedule in the time domain, and at the same time, the homomorphic verification executive body information is sent to the meta-service node.

In the mimetic storage system data verification system of the embodiment of the present invention, the client is used to generate a hash key, upload the hash key and the file to be stored to the storage server, and send a data verification request to the storage server; After receiving the file and hash key uploaded by the client, the server invokes at least two homomorphic verification execution bodies in the mimic defense system to calculate the homomorphic hash value of each data block according to the hash key, Judgment is made on the homomorphic hash value, and the homomorphic hash value passed by the ruling and the corresponding data block are associated and stored in the data node. After receiving the data verification request, the server is also used to obtain the The data block for data verification and the corresponding homomorphic hash value, call at least two homomorphic verification executives to calculate the data aggregation value of the data block to be verified and the corresponding hash value of the homomorphic hash value Aggregate value, judge the data aggregate value and hash aggregate value, and return the data aggregate value and hash aggregate value passed by the ruling to the client; the client is also used to receive the data aggregate value and hash aggregate value returned by the server Finally, use the homomorphic hash function to calculate the data aggregation value to obtain the homomorphic hash tag, and confirm whether the homomorphic hash tag and the hash aggregation value are the same to determine whether the file to which the data block for data verification belongs is correct hold. Through the embodiment of the present invention, the mimetic defense system is used to defend against external attacks during data verification, the system security performance is improved, and a homomorphic hash algorithm is introduced for encryption to reduce the risk of data leakage.

The embodiment of the present invention also provides an electronic device, as shown in FIG. 4 , including: a memory 501 and a processor 502, the memory 501 and the processor 502 are connected by communication, the memory 501 stores computer instructions, and the processor 502 passes Executing computer instructions, thereby executing the data verification method of the mimetic storage system in the above-mentioned embodiments of the present invention. The processor 502 and the memory 501 may be connected through a bus or in other ways. The processor 502 may be a central processing unit (Central Processing Unit, CPU). The processor 502 can also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), field programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete Chips such as gate or transistor logic devices, discrete hardware components, or a combination of the above types of chips. As a non-transitory computer storage medium, the memory 501 can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as corresponding program instructions/modules in the embodiments of the present invention. The processor 502 executes various functional applications and data processing of the processor 502 by running the non-transitory software programs, instructions and modules stored in the memory 501, that is, to realize the data verification method of the mimetic storage system in the above method embodiment . The memory 501 may include a program storage area and a data storage area, wherein the program storage area may store an application program required by the operating device and at least one function; the data storage area may store data created by the processor 502 and the like. In addition, the memory 501 may include a high-speed random access memory 501, and may also include a non-transitory memory 501, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state storage devices. In some embodiments, the memory 501 may optionally include memory 501 remotely located relative to the processor 502, and these remote memory 501 may be connected to the processor 502 through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof. One or more modules are stored in the memory 501, and when executed by the processor 502, the method for verifying data in a mimetic storage system as in the above method embodiment is executed. The specific details of the foregoing electronic device can be understood corresponding to the corresponding descriptions and effects in the foregoing method embodiments, and details are not repeated here.

The embodiment of the present invention also provides a computer-readable storage medium, as shown in FIG. 5 , on which a computer program 13 is stored. When the instruction is executed by a processor, the steps of the method for verifying the data of the mimetic storage system in the above-mentioned embodiments are implemented. The storage medium also stores audio and video stream data, feature frame data, interaction request signaling, encrypted data, and preset data sizes. Wherein, the storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a flash memory (FlashMemory), a hard disk (HardDiskDrive, abbreviation: HDD) or A solid-state drive (Solid-State Drive, SSD), etc.; the storage medium may also include a combination of the above-mentioned types of memories. Those skilled in the art can understand that all or part of the processes in the method of the above-mentioned embodiments can be completed by instructing related hardware through a computer program. The computer program 13 can be stored in a computer-readable storage medium. During execution, it may include the processes of the embodiments of the above-mentioned methods. Wherein, the storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a flash memory (FlashMemory), a hard disk (HardDiskDrive, abbreviation: HDD) or A solid-state drive (Solid-State Drive, SSD), etc.; the storage medium may also include a combination of the above-mentioned types of memories.

Above, the above embodiments are only used to illustrate the technical solutions of the present invention, not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be applied to the foregoing embodiments The technical solutions described in the examples are modified, or some of the technical features are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (10)

1. A data verification method of a mimicry storage system is applied to a storage server and comprises the following steps:

receiving a file and a hash key uploaded by a client, wherein the file comprises a plurality of data blocks;

calling at least two homomorphic check executors in the mimicry defense system to respectively calculate the homomorphic hash value of each data block according to the hash key, judging the homomorphic hash value, and storing the homomorphic hash value passing the judgment and the corresponding data block;

receiving a data verification request sent by a client;

acquiring a data block to be subjected to data verification and the corresponding homomorphic hash value based on the data verification request, calling at least two homomorphic verification executors to respectively calculate a data aggregation value of the data block to be subjected to data verification and a corresponding hash aggregation value of the homomorphic hash value, and judging the data aggregation value and the hash aggregation value;

and returning the data aggregation value and the hash aggregation value which pass the judgment to the client so that the client calculates the data aggregation value by adopting a homomorphic hash function to obtain a homomorphic hash label, and determining whether the file to which the data block corresponding to the data verification request belongs is correctly held according to whether the homomorphic hash label is the same as the hash aggregation value.

2. The data verification method for the mimicry storage system according to claim 1, wherein the step of calling at least two homomorphic verification executors in the mimicry defense system to calculate the homomorphic hash value of each data block according to the hash key comprises the following steps:

distributing the hash key and the data block to at least two homomorphic check executors in a mimicry defense system;

and receiving homomorphic hash values of each data block, which are calculated by at least two homomorphic check executors according to the hash key, wherein the homomorphic check executors respectively realize homomorphic hash label algorithms by adopting different hardware systems and/or different languages.

3. The data verification method of the mimicry storage system of claim 1, wherein arbitrating the homomorphic hash values comprises:

acquiring a target homomorphic hash value meeting a preset rule from the homomorphic hash values calculated by different homomorphic check executors;

taking the target homomorphic hash value as the homomorphic hash value passing the arbitration;

performing exception feedback on homomorphic check executors which are different from the homomorphic hash value passing the arbitration and the homomorphic hash value;

and (4) performing off-line or replacement on the homomorphic check executive body fed back by the exception.

4. The data verification method of the mimicry storage system according to claim 1, wherein invoking at least two homomorphic verification executors to respectively calculate a data aggregation value of a data block to be subjected to data verification and a hash aggregation value of the corresponding homomorphic hash value, includes:

the data block to be subjected to data verification and the corresponding homomorphic hash value are distributed to at least two homomorphic verification executors in the mimicry defense system;

receiving the sum of data blocks to be subjected to data verification calculated by at least two homomorphic verification executors and the product of the corresponding homomorphic hash values, wherein the data aggregation value is the sum of the data blocks to be subjected to data verification, and the hash aggregation value is the product of the corresponding homomorphic hash values.

5. The data verification method of the mimicry storage system of claim 1, wherein arbitrating the data aggregation value and the hash aggregation value comprises:

acquiring a target data aggregation value and a target hash aggregation value which meet a preset rule from the data aggregation value and the hash aggregation value calculated by different homomorphic check executors;

taking the target data aggregation value and the target hash aggregation value as the data aggregation value and the hash aggregation value which are decided to pass;

performing exception feedback on the calculated data aggregation value, the hash aggregation value and the homomorphic check executive body which passes the arbitration and is different from the hash aggregation value;

and carrying out off-line or replacement on the homomorphic check executive body fed back by the exception.

6. The mimicry storage system data checking method according to claim 1, wherein the data checking request includes a random key and a number of data blocks to be checked for data;

the obtaining of the data block to be subjected to data verification and the corresponding homomorphic hash value based on the data verification request includes:

calculating the position coordinates of each data block to be subjected to data verification and the corresponding homomorphic hash value according to the random key and the number of the data blocks to be subjected to data verification;

and acquiring a data block to be subjected to data verification and the corresponding homomorphic hash value according to the position coordinates.

7. A data verification device for a mimicry storage system, comprising:

the first receiving module is used for receiving a file and a hash key uploaded by a client, wherein the file comprises a plurality of data blocks;

the storage module is used for calling at least two homomorphic check executors in the mimicry defense system to respectively calculate the homomorphic hash value of each data block according to the hash key, judging the homomorphic hash values and storing the homomorphic hash values and the corresponding data blocks which pass the judgment;

the second receiving module is used for receiving a data verification request sent by the client;

an evidence obtaining module, configured to obtain a data block to be subjected to data verification and the corresponding homomorphic hash value based on the data verification request, and call at least two homomorphic verification executors to calculate a data aggregation value of the data block to be subjected to data verification and a hash aggregation value of the corresponding homomorphic hash value, respectively, and decide the data aggregation value and the hash aggregation value;

and the response module is used for returning the data aggregation value and the hash aggregation value which pass the judgment to the client so as to enable the client to calculate the data aggregation value by adopting a homomorphic hash function to obtain a homomorphic hash label, and determining whether the file to which the data block corresponding to the data verification request belongs is correctly held according to whether the homomorphic hash label is the same as the hash aggregation value.

8. An electronic device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the data verification method of the mimicry storage system according to any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that the computer-readable storage medium stores computer instructions for causing the computer to execute the mimicry storage system data checking method according to any one of claims 1 to 5.

10. The data verification system of the mimicry storage system is characterized by comprising a client and a storage server, wherein the storage server comprises a mimicry defense system and data nodes;

the client is used for generating a hash key, uploading the hash key and a file to be stored to a storage server, and sending a data verification request to the storage server;

the storage server is used for calling at least two homomorphic check executors in a mimicry defense system to respectively calculate a homomorphic hash value of each data block according to the hash key after receiving the file and the hash key uploaded by the client, arbitrating the homomorphic hash value, and storing the homomorphic hash value and the corresponding data block which are arbitrated to pass in an associated manner to the data node;

and the client is further used for calculating the data aggregation value by adopting a homomorphic hash function to obtain a homomorphic hash tag after receiving the data aggregation value and the hash aggregation value returned by the server, and determining whether the homomorphic hash tag and the hash aggregation value are the same so as to judge whether a file to which the data block subjected to data verification belongs is correctly held.

Images