RU2771236C1 - Method for integrity control of multidimensional data arrays - Google Patents

Abstract

FIELD: data arrays monitoring.SUBSTANCE: invention relates to a method for monitoring the integrity of multidimensional data arrays. In the method for performing integrity control, data blocks Mi (i = 1, 2, …, n) are represented as fixed-length subblocks Mi,1, Mi,2, …, Mi,n, from which the reference hash codes Hi hash -functions h(Mi), the values of which are subsequently compared with the values of the hash codesof the hash functioncalculated from the checked data blocksin this case, a multidimensional data array of dimension k is represented as a 3-dimensional data array M[k, k, k], consisting of k3 data blocks Mi,j,r (r = j = r = 0, 1, …, k-1 ), which for integrity control will be placed in an array of dimensions k + 1, while filling from 0 to k-1 of its blocks, to which the hash function h is applied to detect signs of integrity violation, while the calculated hash codes Hi, j, r (i, j, r = 0, …, k) will be placed in 3k2 free blocks of the array and will be reference values, the values of which are compared with the values of the hash codesof the hash functioncalculated from the checked data blocksEFFECT: ensuring data integrity control.1 cl, 11 dwg, 3 tbl

Description

The field of technology to which the invention belongs

The present invention relates to information technology and can be used to control the integrity of data in multidimensional storage systems based on the application of cryptographic hash functions to protected data blocks under restrictions on the allowable resource costs.

State of the art

a) Description of analogues

Known methods of data integrity control through the use of cryptographic methods: key and keyless hashing, electronic signature means (Patent for invention RUS No. 26207030, 07.12.2015; Patent for invention RUS No. 2669144, 28.11.2017; Patent for invention RUS No. 2680033, 22.05 .2017; Patent for invention RUS No. 2680350, 02.05.2017; Patent for invention RUS No. 2680739, 11.28.2017; Patent for invention RUS No. 2686024, 04.25.2018; Knut, D.E. The art of computer programming. Volume 3. Dichenko, S. Two-dimensional control and assurance of data integrity in information systems based on residue number system codes and cryptographic hash functions / S. Dichenko, O. Finko // Integrating Research Agendas and Devising Joint Challenges International Multidisciplinary Symposium ICT Research in Russian Federation and Europe, 2018. P. 139-146 Dichenko, S. A. A hybrid cryptocode method for monitoring and restoring data integrity x for secure information-analytical systems / S. Dichenko, O. Finko // Cybersecurity Issues. - 2019. - No. 6 (34). - P. 17-36), which are characterized by three generalized schemes for applying the hash function:

- with the calculation of one common hash code from to data blocks (Fig. 1);

- with the calculation of one hash code from each of the data blocks (Fig. 2);

- with the construction of a fully connected hashing network (Fig. 3).

The disadvantages of these methods are:

- for the hash function application scheme with the calculation of one common hash code from to data blocks:

- does not allow, after data integrity control, to localize a data block with integrity violation;

- the lack of the possibility of increasing the detecting ability of control means in the face of restrictions on the allowable resource costs;

- for the hash function application scheme with the calculation of one hash code from each of the data blocks:

- high redundancy of control information when checking the integrity of data blocks represented by binary vectors of small dimension;

- the lack of the possibility of increasing the detecting ability of control means in the face of restrictions on the allowable resource costs;

- for the hash function application scheme with the construction of a fully connected hashing network:

- high redundancy of control information when checking the integrity of data blocks represented by binary vectors of small dimension;

- in general, this model does not allow, after monitoring the integrity of the data, to localize the data block with integrity violation;

- the lack of the possibility of increasing the detecting ability of the control means in the conditions of restrictions on the allowable resource costs.

b) Description of the closest analogue (prototype)

The closest in technical essence to the claimed invention (prototype) is a method of two-dimensional control and data integrity (figure 4), based on the implementation of data integrity control, presented in the form of a two-dimensional array of data blocks of a fixed length, from which previously by applying a hash function reference hash codes are calculated to the elements of the array rows, the values of which are subsequently compared with the values of the hash codes already calculated from the checked data blocks, when requesting their use (Dichenko S.A., Samoylenko D.V., Finko O.A. Method for two-dimensional control and ensuring data integrity // Patent for invention RUS No. 2696425, 08/02/2019).

The disadvantage of the known method is the lack of the possibility of increasing the detecting ability of the control means in terms of restrictions on the allowable resource costs.

Disclosure of invention

a) The technical result to which the invention is directed

The aim of the present invention is to develop a method for monitoring the integrity of multidimensional data arrays based on the application of cryptographic hash functions to protected data blocks with the possibility of increasing the detective ability of control means under conditions of restrictions on the allowable resource costs.

b) A set of essential features

хэш-функции

вычисляемых уже от проверяемых блоков данных

в представленном же способе многомерный массив данных размерности к представляется в виде 3-мерного массива данных М[k, k, k], состоящего из k³ блоков данных M_i,j,r (i = j = r = 0, 1, …, k-1), которые для контроля целостности будут размещаться в массиве размерности k+1, заполняя при этом от 0 до k-1 его блоков, к которым для обнаружения признаков нарушения целостности применяется хэш-функция h, при этом вычисленные хэш-коды H_i,j,r (i, j, r = 0, …, k) будут размещаться в 3k² свободных блоках массива и являться эталонными, значения которых при запросе на использование данных сравниваются со значениями хэш-кодов

хэш-функции

вычисляемых уже от проверяемых блоков данных

This goal is achieved by the fact that in the known method of two-dimensional control and data integrity, which consists in the fact that for the implementation of integrity control data blocks M _i (i = 1, 2, ..., n) are represented as subblocks of fixed length M _i,1 , M _1,2 , …, M _i,n , from which the reference hash codes H _i of the hash function h(M _i ) are preliminarily calculated, the values of which are subsequently compared with the values of the hash codes

hash functions

computed already from the checked data blocks

in the presented method, a multidimensional data array of dimension k is represented as a 3-dimensional data array M[k, k, k], consisting of k ³ data blocks M _i,j,r (i = j = r = 0, 1, ... , k-1), which for integrity control will be placed in an array of dimensions k + 1, while filling from 0 to k-1 of its blocks, to which the hash function h is applied to detect signs of integrity violation, while the calculated hash codes H _i,j,r (i, j, r = 0, …, k) will be placed in 3k ² free blocks of the array and will be reference values, the values of which are compared with the values of the hash codes when requesting to use the data

hash functions

calculated already from the checked data blocks

A comparative analysis of the claimed solution and the prototype shows that the proposed method differs from the known one in that the goal is achieved by presenting a multidimensional data array of dimension k in the form of a 3-dimensional data array M[k, k, k], consisting of k ³ data blocks M _i,j,r , to detect signs of violation of the integrity of which a hash function is used and 3k ² hash codes H _i,j,r are calculated, which makes it possible to increase the detecting ability of control tools under restrictions on the allowable resource costs.

вычисляемых при запросе на использование данных, подлежащих защите. Новым является то, что многомерный массив данных размерности к представляется в виде 3-мерного массива данных М[k, k, k], состоящего из k³ блоков данных M_i,j,r, которые для контроля целостности будут размещаться в массиве размерности k+1, заполняя при этом от 0 до k-1 его блоков, при этом свободные блоки массива будут предназначаться для эталонных хэш-кодов H_i,j,r. Новым является то, что применение хэш-функции к блокам данных M_i,j,r, расположенным в 3-мерном массиве данных М[k, k, k], позволяет повысить вероятность обнаружения и локализации q-блоков данных с признаками нарушения целостности за счет вычисления и расположения в свободных блоках массива 3k² эталонных хэш-кодов H_i,j,r хэш-функции h(M_i,j,r), значения которых при запросе на использование данных сравниваются со значениями хэш-кодов

хэш-функции

вычисляемых уже от проверяемых блоков данных

The integrity control of k ³ data blocks M _i,j,r will be carried out by calculating 3k ² hash codes H _i,j,r from them, which will allow at time t, under conditions of restrictions on the allowable resource costs, to compare their values with the hash values - codes

calculated when requesting the use of data subject to protection. What is new is that a multidimensional data array of dimension k is represented as a 3-dimensional data array M[k, k, k], consisting of k ³ data blocks M _i,j,r , which, for integrity control, will be placed in an array of dimension k +1, while filling from 0 to k-1 of its blocks, while the free blocks of the array will be intended for the reference hash codes H _i,j,r . What is new is that the application of the hash function to the data blocks M _i,j,r located in the 3-dimensional data array M[k, k, k] makes it possible to increase the probability of detection and localization of q-data blocks with signs of integrity violation for calculation and arrangement in free blocks of the 3k array of ² reference hash codes H _i,j,r of the hash function h(M _i,j,r ), the values of which are compared with the values of the hash codes when requesting to use data

hash functions

computed already from the checked data blocks

c) Causal relationship between features and technical result

Thanks to a new set of essential features, the method implements the possibility of:

- integrity control of a multidimensional data array with low redundancy of control information;

- localization of data blocks with signs of integrity violation;

- increasing the detecting ability of the means of control in conditions of restrictions

to allowable resource costs.

Evidence of compliance of the claimed invention with the conditions of patentability "novelty" and "inventive step"

The analysis of the prior art made it possible to establish that there are no analogues characterized by a set of features identical to all the features of the claimed technical solution, which indicates the compliance of the claimed method with the condition of patentability "novelty".

The results of the search for known solutions in this and related fields of technology in order to identify features that match the distinguishing features of the prototype of the claimed object showed that they do not follow explicitly from the prior art. The prior art also did not reveal the fame of distinctive essential features that cause the same technical result that is achieved in the claimed method. Therefore, the claimed invention meets the condition of patentability "inventive step".

Brief description of the drawings

The claimed method is illustrated by drawings, which show:

fig. 1 is a diagram of the application of a hash function with the calculation of one common hash code from to blocks of data;

fig. 2 is a diagram of the application of the hash function with the calculation of one hash code from each of the data blocks;

fig. 3 is a diagram of the application of the hash function with the construction of a fully connected hash network;

fig. 4 is a diagram explaining the procedure for checking the integrity of data represented as a two-dimensional array of data blocks;

fig. 5 is a diagram of a 3-dimensional cube containing blocks of data M _i,j,r ;

fig. 6 - order of arrangement of k data blocks on the edge of the cube;

fig. 7 - the order of arrangement in the cube of dimension k = 3 data blocks to be protected, and hash codes;

fig. 8 - hashing network for detection and localization of 1-fold error;

fig. 9 - hashing network for detection and localization of 2-fold errors; fig. 10 - hash network for two combinations of data blocks with matching error syndromes;

fig. 11 - dependence of the probability Р _obt.1 on the dimension k.

Implementation of the invention

где индексы ψ₁, …, ψ_р принимают значения от 1 до k _a (а = 1, …, р) соответственно. При этом р-мерный массив данных будет содержать k₁ ×k₂ × … × k_p элементов и обозначаться какA multidimensional data array is represented as a p-dimensional array consisting of elements

where indices ψ ₁ , …, ψ _р take values from 1 to k _a ( а = 1, …, р) respectively. In this case, the p-dimensional data array will contain k ₁ ×k ₂ × … × k _p elements and will be denoted as

) - как точки пространства. Такое пространство будем называть пространством данных.A multidimensional data array M[k ₁ , k ₂ , …, k _p ] is a mathematical set with a certain structure and axiomatic rules, which allows us to consider it similarly to space, and the elements contained in it (data blocks

) - as points in space. Such a space will be called the data space.

) располагаются вдоль абстрактных прямых, параллельных осям координат, на одинаковых расстояниях друг от друга.The data space will be considered a discrete metric space, since it contains points in its structure, represented by array elements isolated from each other in a certain sense. Inside the multidimensional data array M[k ₁ , k ₂ , …, k _p ] all elements (data blocks

) are located along abstract lines parallel to the coordinate axes, at equal distances from each other.

Example 1. A 3-dimensional data array M[k ₁ , k ₂ , k ₃ ] can be represented as a 3-dimensional cube (Fig. 5) containing a coordinate system with axes: x, y, z, along which blocks are plotted data M _i,j,r (i = 0, 1, ..., k ₁ -1; j = 0, 1, ..., k ₂ -1; r = 0, 1, ..., k ₃ -1).

Let's represent a 3-dimensional data array M[k ₁ , k ₂ , k ₃ ] in the following form:

» с индексом (z) показывает порядок представления массива посредством сечений, ориентированных по оси z; стрелки «→» и «↓» с индексами (х) и (у) указывают направления, в которых возрастают соответствующие индексы у элементов массива по осям х и у.where is the arrow

» with index (z) shows the order of the array representation by means of sections oriented along the z axis; the arrows "→" and "↓" with indices (x) and (y) indicate the directions in which the corresponding indices y of the array elements along the x and y axes increase.

If all dimensions of a hypercube containing data blocks have the same values (k ₁ = k ₂ = ... = k _p ), then it will be a regular figure, and its size can be described by one number k, equal to the number of data blocks located on its edge (Fig. 6). Such a hypercube will be called a hypercube of dimension k.

In this case, a 3-dimensional data array М[k, k, k]={M _i,j,r } of dimension k can be represented using orientation sections (z) in the following form:

where i,j,r = 0, …, k-1.

Let's place a 3-dimensional data array (1) of dimension k in an array of dimensions k + 1, represented by a 3-dimensional cube, filling in from 0 to k-1 of its blocks.

With this arrangement, out of (k+1) ³ blocks of a 3-dimensional cube, k ³ blocks are dedicated to storing data blocks to be protected.

The 3-dimensional data array (1) will take the form:

where "0" denotes a writable cube block.

To detect signs of violation of the integrity of multidimensional data arrays (data blocks M _i,j,r (i, j, r = 0, …,k-1)) we apply the hash function h.

Let's place the obtained reference hash codes H _i,j,r = 0, …, k) in the cube blocks free for writing.

The resulting 3-dimensional array containing data blocks and hash codes, using orientation sections (z), can be represented as follows:

Thus, the resulting 3-dimensional array (3) can be represented as a 3-dimensional cube containing (k+1)³ blocks, including: k³ data blocks M_i,j,r (i, j, r = 0, …, k-1) to be protected; 3k² blocks with hash codes H_i,j,r(i, j, r = 0, …, k); 3k+1 free blocks to write.

At the same time, blocks with reference hash codes calculated from them are added along three axes to each block of data to be protected, which are used to detect data with signs of integrity violation.

Under the violation of the integrity of one data block, we mean the occurrence of an error in it, respectively, the violation of the integrity of q data blocks is determined by the occurrence of a q-fold error.

The detection of a data block with signs of integrity violation is performed by comparing the values of the reference hash codes previously calculated from it and the hash codes calculated when requesting its use. In case of a mismatch between the compared hash codes, a conclusion is made about the occurrence of an error and its syndrome is determined.

Under the error syndrome, we mean the binary number obtained by writing the symbol "0" for each performed check for the compliance of the values of the calculated and reference hash code and the symbol "1" if the compared values do not match.

Example 2. To control the integrity of multidimensional data arrays, let's place in a 3-dimensional cube (Fig. 7) data blocks to be protected and their corresponding hash codes.

In this case, the data blocks M _i,j,r to be protected, and the reference hash codes H _i,j,r calculated from them, are interpreted as binary vectors:

where

in this case, each hash code is calculated from two data blocks located with it in one row or one column of the array.

The resulting 3-dimensional array using orientation sections (x) can be represented as follows:

Let's build a hashing network (Fig. 8) to enable detection and localization of a 1-fold error. In this case, each data block M _i,j,r will correspond to a non-repeating set of three hash codes H _i,j,r .

Example 3. In accordance with the constructed hashing network (Fig. 8), the following hash codes correspond to data blocks M ₁₀₀ , M ₀₁₁ :

- for M ₁₀₀ : N ₁₂₀ , N ₁₀₂ , N ₂₀₀ ;

- for M ₀₁₁ : H ₀₂₁ , H ₀₁₂ , H ₂₁₁ ,

moreover, the resulting sets of hash codes for all data blocks will be non-repeating.

Let's build a table of error syndromes that lead to a violation of the integrity of the data block M _i,j,r , in which the place of the error is determined by the presence of the character "1" in the corresponding columns and rows.

Example 4. Syndromes of 1-fold errors, leading to a violation of the integrity of data blocks [M ₁₀₀ ] and [M ₀₁₁ ], are presented in table 1.

The hashing network and the corresponding table of error syndromes for detecting and locating q data blocks with signs of integrity violation are built according to similar rules.

The hash network for 2-fold error detection and localization is shown in FIG. nine.

Example 5. Syndromes of 2-fold errors, leading to a violation of the integrity of data blocks [M ₁₀₀ ] and [M ₁₁₀ ], as well as [M ₀₀₁ ] and [M ₀₁₁ ], are presented in table 2.

The developed method, in comparison with the prototype, with the restrictions imposed on the control tools, allows you to increase the probability of detecting and localizing q-fold errors (allows you to detect and localize 1-, 2-, 3-fold errors, as well as up to ≈ 98.6% of all 4 -fold errors (ignoring collisions)) without increasing the number of calculated hash codes for this.

In particular, at k = 2 in a 3-dimensional array, out of all 70 possible different combinations of four data blocks, up to and 98.6% of all 4-fold errors are detected and localized (without taking into account collisions), except for one (≈ 1.4% ) occurring in one of the following combinations of data blocks:

- the first combination: M ₀₀₁ , M ₀₁₀ , M ₁₀₀ , M ₁₁₁ ;

- the second combination: M ₀₀₀ , M ₀₁₁ , M ₁₀₁ , M ₁₁₀ .

For the combinations under consideration, we will construct a hashing network (Fig. 10), on the basis of which we will compile a table of error syndromes (Table 3), from which it can be seen that for the presented combinations of data blocks to be protected, the error syndromes coincide.

For k = 3, there are 17550 different combinations of four data blocks in a 3-dimensional array. In this case, up to ≈ 99.85% of all 4-fold errors are detected and localized (excluding collisions), with the exception of 27 (≈ 0.15%) that are not detected as a result of matching error syndromes in 27 different pairs of data block combinations.

The dependence of the probability Р _{detect.1 of} detection and localization of 4-fold errors (excluding collisions) on the dimension k as it increases is shown in Fig. eleven.

Claims (1)

A method for monitoring the integrity of multidimensional data arrays, which consists in the fact that for the implementation of integrity control data blocks M _i (i = 1, 2, ..., n) are represented as subblocks of fixed length M _i,1 , M _i,2 , ..., M _i,n , from which the reference hash codes H _i of the hash function h(M _i ) are preliminarily calculated, the values of which are subsequently compared with the values of the hash codes

hash functions

computed already from the checked data blocks

characterized in that a multidimensional data array of dimension k is represented as a 3-dimensional data array M[k, k, k], consisting of k ³ data blocks M _i,j,r (r = j = r = 0, 1, … , k-1), which for integrity control will be placed in an array of dimensions k + 1, while filling from 0 to k-1 of its blocks, to which the hash function h is applied to detect signs of integrity violation, while the calculated hash codes H _i,j,r (i, j, r = 0, …, k) will be placed in 3k ² free blocks of the array and will be reference values, the values of which are compared with the values of the hash codes when requesting to use the data

hash functions

computed already from the checked data blocks

Images