WO2020143318A1 - Data verification method and terminal device - Google Patents

Abstract

The present application is applicable to the technical field of computer applications. Provided are a data verification method, a terminal device and a non-volatile computer-readable storage medium. The method comprises: acquiring a node certificate of a storage node, and verifying whether the node certificate is issued by a preset trusted root certificate; if the node certificate is issued by the trusted root certificate, acquiring a public key of the storage node, and verifying, according to a pre-stored node identifier, whether the public key of the storage node is correct; and if the public key of the storage node is correct, verifying, according to the public key of the storage node, a signature in storage data stored in the storage node, and if the signature passes verification, indicating that the storage data is correct. By means of verifying a node certificate and a signature of a storage node and verifying the correctness of storage data in the storage node, the security of storage data in a node in a peer-to-peer network is improved.

Description

Data verification method and terminal equipment

This application requires the priority of a Chinese patent application filed on January 7, 2019 in the China Patent Office with application number 201910012597.4 and the invention titled "Data Verification Method and Terminal Equipment", the entire contents of which are incorporated by reference in this application.

Technical field

The present application belongs to the field of computer application technology, and particularly relates to a data verification method, terminal device, and computer non-volatile readable storage medium.

Background technique

P2P storage is a kind of network storage based on P2P (Peer-to-Peer, Peer-to-Peer) technology. It organizes many machines in a peer-to-peer way to provide users with a large-capacity data storage service. Network technology on the Internet. It is the product of the combination of computer networks and distributed systems. The core idea is to remove the concept of a central server and build the Internet on the basis of peer-to-peer interconnection to achieve maximum resource sharing. However, in many existing applications, signatures are verified by certificates to achieve identity authentication. However, it may still happen that the certificate and the signature are forged at the same time, resulting in threats to data security.

technical problem

In view of this, embodiments of the present application provide a data verification method, terminal device, and computer non-volatile readable storage medium to solve the situation in the prior art where certificates and signatures may be forged at the same time, resulting in data security The problem is threatened.

Technical solution

The first aspect of the embodiments of the present application provides a data verification method, including:

Obtain the node certificate of the storage node and verify whether the node certificate is issued by a preset trusted root certificate; the storage node is used to store the storage data sent by the data owner terminal, and the storage data includes the signature of the storage node;

If the node certificate is issued by the trusted root certificate, obtain the public key of the storage node, and verify whether the public key of the storage node is correct according to the pre-stored node ID; the node ID is determined by the storage Digital digest generation of the node's public key;

If the public key of the storage node is correct, the signature in the stored data stored by the storage node is verified according to the public key of the storage node, and if the signature verification is passed, the stored data is correct.

A second aspect of an embodiment of the present application provides a terminal device, including a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, and the processor executes the computer The method of the first aspect described above can be realized when the instructions are readable.

A third aspect of the embodiments of the present application provides a terminal device, including various units that implement the method of the first aspect described above.

A fourth aspect of the embodiments of the present application provides a computer nonvolatile readable storage medium. The computer storage medium stores computer readable instructions. The computer readable instructions include program instructions. When the processor executes, the processor is caused to execute the method of the first aspect.

Beneficial effect

The embodiment of the present application verifies whether the node certificate is issued by a preset trusted root certificate by acquiring the node certificate of the storage node; the storage node is used to store the storage data sent by the data owner terminal, and the storage data includes The signature of the storage node; if the node certificate is issued by the trusted root certificate, obtain the public key of the storage node, and verify whether the public key of the storage node is correct according to the pre-stored node ID; the node The identification is generated by a digital digest of the storage node's public key; if the storage node's public key is correct, the signature in the stored data stored by the storage node is verified according to the storage node's public key, if the The signature verification indicates that the stored data is correct. By verifying both the node certificate and signature of the storage node and the correctness of the stored data in the storage node, the security of the stored data of the node in the peer-to-peer network is improved.

BRIEF DESCRIPTION

1 is a flowchart of a data verification method provided in Embodiment 1 of the present application;

2 is a flowchart of a data verification method provided in Embodiment 2 of the present application;

3 is a schematic diagram of a terminal device provided in Embodiment 3 of this application;

4 is a schematic diagram of a terminal device provided in Embodiment 4 of the present application.

Embodiments of the invention

Referring to FIG. 1, FIG. 1 is a flowchart of a data verification method provided in Embodiment 1 of the present application. The execution subject of the data verification method in this embodiment is a terminal. Terminals include but are not limited to mobile terminals such as smart phones, tablet computers, and wearable devices, and may also be desktop computers. The data verification method shown in the figure may include the following steps:

S101: Obtain a node certificate of a storage node, and verify whether the node certificate is issued by a preset trusted root certificate; the storage node is used to store storage data sent by a data owner terminal, and the storage data includes the storage node's signature.

Digital certificate is a series of numbers that mark the identity information of all parties in the communication, and provides a way to verify the identity of the communicating entity on the Internet. Digital certificate is a stamp or seal stamped on the digital ID card by the identity certification agency. In the embodiment, the digital identity of the storage node is obtained to verify whether the node identity of the storage node is authentic. A digital certificate is a file digitally signed by a certificate authority that contains information about the owner of the public key and the public key. The simplest certificate contains a public key, name and digital signature of the certificate authority. Another important feature of digital certificates is that they are only valid for a specific period of time. Especially in the e-commerce system, by obtaining the digital certificate of each storage node can make customers extremely convenient to obtain information of merchants and enterprises when shopping online, but at the same time also increase certain sensitive or valuable data. Risk of abuse. In order to ensure the security and confidentiality of electronic transactions and payments on the Internet, and to prevent fraud in the process of transactions and payments, a trust mechanism must be established online. This requires that both buyers and sellers participating in e-commerce must have legal identities and be validated online without errors.

There are many numbers and English stored in the digital certificate. When the digital certificate is used for identity authentication, it will randomly generate an ID code with a preset number of digits. Each digital certificate can generate a corresponding number that is not the same every time. Ensuring the confidentiality of data transmission is equivalent to generating a complex password. The digital certificate is bound to the true identity of the public key and its holder. It is similar to the resident ID card in real life. The difference is that the digital certificate is no longer a paper certificate, but a section containing the identity of the certificate holder. The information and the electronic data issued by the certification center can be used more conveniently and flexibly in the process of verifying the data accuracy of the storage node.

Specifically, the process of issuing digital certificates for storage nodes is generally to first generate a key pair for each storage node, that is, a public key and a private key, and transmit the public key and part of the node information to the certification center. After verifying the identity, the certification center will perform some necessary steps to ensure that the request is indeed sent by the storage node. Then, the certification center will issue a digital certificate to the storage node, which contains the node information and other information of the storage node. At the same time, the public key information of the certificate is also attached. The storage node can use its own digital certificate to perform various related activities. Digital certificates are issued by independent certificate issuing agencies. Digital certificates are different, and each certificate can provide different levels of credibility. You can obtain your own digital certificate from the certificate issuing agency.

In this embodiment, the way to obtain the node certificate of the node may be to send a certificate request to the storage node. After receiving the certificate request, the storage node sends its own certificate to the data owner terminal. It may also be that the storage node periodically sends its own node certificate to the terminal of the data owner, and the data owner is not required to actively request to obtain the node certificate to reduce the workload of the data owner terminal.

It should be noted that the storage node in this embodiment is used to store the storage data sent by the data owner terminal. The storage data may be due to the limited data storage capability or data processing capability of the data owner terminal, and the needs determined by the data owner terminal For the data stored by the storage node, the data owner terminal sends the data stored in the storage node to the storage node, and specifies that this part of the stored data can only be stored by the corresponding storage node, but the storage node cannot perform any type of storage data Only the data owner terminal or the terminal device with the processing authority can handle the processing. At the same time, the storage data stored by the storage node includes the signature of the storage node, and the signature of the storage node can be used to verify that the storage data is written by the storage node. The signature in this embodiment is generated only by the storage node and cannot be forged by others. This digital string is also an effective proof of the correctness of the stored information.

After obtaining the node certificate of the storage node, we first verify the correctness of the node certificate. The node certificate in this embodiment is through a certificate authority (Certificate Authority, CA). As a trusted third party in e-commerce transactions, the certificate entrusting center bears the responsibility of checking the legality of the public key in the public key system. The CA center issues a digital certificate for each storage node that uses the public key. The role of the digital certificate is to prove that the storage node listed in the certificate has the public key listed in the certificate. The CA organization's digital signature prevents attackers from forging and tampering with certificates. It is responsible for generating, distributing and managing the digital certificates required by all individuals involved in online transactions, so it is the core link of secure electronic transactions. In order to ensure the safety, authenticity, reliability, integrity and non-repudiation of the data stored in the storage node, not only the authenticity of the storage node's identity needs to be verified, but also an authoritative, fair and unique The organization is responsible for issuing and managing e-commerce security certificates that meet the national and international standards for secure electronic transactions to all subjects of e-commerce.

When verifying the node certificate, first obtain the node certificate of the storage node, and determine the issuer ID that issued the node certificate. According to the issuer ID, check whether the issuer ID exists in the preset trusted e-commerce certification authority table ; If the issuer ID exists in the trusted e-commerce certification authority table, it is determined that the node certificate is issued by the trusted root certificate.

S102: If the node certificate is issued by the trusted root certificate, obtain the public key of the storage node, and verify whether the public key of the storage node is correct according to the pre-stored node ID; the node ID is determined by all Generate a digital digest of the storage node's public key.

When the verification determines that the node certificate is issued by the preset trusted root certificate, the public key of the storage node is obtained from the storage node. The method of obtaining the public key may be a method of sending a public key acquisition request to the storage node. Since the public key of each storage node can be public, the public key of the storage node can also be pre-stored in the data owner terminal. When the data owner terminal needs to verify the storage node's public key, it can access its own database Directly obtain the public key of the storage node. Preferably, the data owner terminal can obtain the public key of the storage node in real time, and store the situation where the node modifies its own public key in a manner.

When the verification determines that the node certificate is not issued by the preset trusted root certificate, we can first compare the node certificate with the storage node to detect whether the current node certificate is the certificate of the storage node, and if so, determine the node of the storage node The certificate is wrong. If the current node certificate is not the certificate of the storage node, you can obtain the correct node certificate from the storage node again and verify the node certificate again.

In this embodiment, the data owner terminal stores the node ID of each storage node. The node ID is obtained by performing a summary calculation on the storage node's public key, and is used to verify whether the storage node's public key is correct through the node ID. After the public key of the storage node is obtained, there may also be the possibility that the public key may be tampered when both parties pass the public key on the network. Therefore, we verify the correctness of the obtained public key of the storage node through the node ID . The specific verification method is to first calculate the data summary of the storage node's public key to obtain the public key summary, and then compare the public key summary with the data identification. If the public key summary and the data identification are consistent, the storage node's public key is determined to be correct.

S103: If the public key of the storage node is correct, verify the signature in the stored data stored by the storage node according to the public key of the storage node, and if the signature verification is passed, the stored data is correct.

In practical applications, the digital signature is some data attached to the stored data, and it can also be a cryptographic transformation made to the stored data. This data or transformation allows the data owner of the stored data to verify the integrity of the stored data to protect the data and prevent the risk of storage node falsification. It is a method for signing messages in electronic form. A signed message can be transmitted in a communication network. Both digital signatures based on public key cryptosystems and private key cryptosystems can be obtained, mainly digital signatures based on public key cryptosystems. Including ordinary digital signatures and special digital signatures. Optionally, the common digital signature algorithm has a data encryption standard algorithm (Data Encryption Standard (DES), elliptic curve digital signature algorithm and limited automaton digital signature algorithm, etc. In addition, it can also include blind signature, proxy signature, group signature, non-repudiation signature, fair blind signature, threshold signature, with message The signature of the recovery function is closely related to the specific application environment.

When verifying the stored data according to the storage node's public key, how to verify the correctness of the data to ensure that the data is the original data of the data owner, and has not been tampered with or deleted by the storage node. At this time, the signature will be used. If the public key of the storage node is correct, the signature in the storage data stored by the storage node is verified according to the public key of the storage node, and the correctness of the data is also determined. Before the data owner sends the stored data to the storage node, perform a data summary process on the stored data to obtain a data summary of the stored data. At this time, the original data cannot be obtained by inverting the data summary. Decrypt the signature in the stored data through the public key of the storage node to obtain a data summary of the stored data, and then compare the decrypted data summary with the data summary stored by the data owner to compare the decrypted data summary with the pre-stored data summary. If the abstract is consistent, the consistency proves that the data is the original data and has not been tampered with. This encryption and verification process guarantees data security and tamper resistance.

If the storage node's public key is incorrect, it means that the storage node's public key has been tampered with. The data owner terminal sends a public key request to the storage node again. After obtaining the storage node's public key again, the public key verification and data verification.

In the above solution, by acquiring the node certificate of the storage node, it is verified whether the node certificate is issued by a preset trusted root certificate; the storage node is used to store the storage data sent by the data owner terminal, and the storage data includes storage The signature of the node; if the node certificate is issued by the trusted root certificate, obtain the public key of the storage node, and verify whether the public key of the storage node is correct according to the pre-stored node ID; the node ID Generated from the digital summary of the storage node's public key; if the storage node's public key is correct, verify the signature in the stored data stored by the storage node according to the storage node's public key, if the signature If the verification is passed, the stored data is correct. By verifying both the node certificate and signature of the storage node and the correctness of the stored data in the storage node, the security of the stored data of the node in the peer-to-peer network is improved.

Referring to FIG. 2, FIG. 2 is a flowchart of a data verification method provided in Embodiment 2 of the present application. The execution subject of the data verification method in this embodiment is a terminal. Terminals include but are not limited to mobile terminals such as smart phones, tablet computers, and wearable devices, and may also be desktop computers. The data verification method as shown in the figure may include the following steps:

S201: Obtain the node certificate of the storage node, and verify whether the node certificate is issued by a preset trusted root certificate; the storage node is used to store the storage data sent by the data owner terminal, and the storage data includes the storage node’s signature.

The data owner terminal sends a certificate request to the storage node. After obtaining the node certificate of the storage node, it is verified whether the node certificate is issued by a preset trusted root certificate. The specific way to verify whether the node certificate is issued by the preset trusted root certificate is to first determine the issuer ID that issued the node certificate, and according to the issuer ID, look for the existence in the preset trusted e-commerce certification authority table Issuer ID. If the issuer ID exists in the trusted e-commerce certification authority table, the node certificate is determined to be issued by the trusted root certificate; if the issuer ID does not exist in the trusted e-commerce certification authority table, the node certificate is determined not to be valid A letter-root certificate is issued, and the identity of the storage node is stored in a problem, which requires stricter identity authentication, such as obtaining the processing authority of the storage node, and viewing the historical data processing status of the storage node, according to the historical data processing status and processing authority , Perform corresponding processing on the storage node, for example, restrict its data authority or format.

Further, step S201 may specifically include steps S2011~S2012:

S2011: If the node certificate is issued by the trusted root certificate, send an authorization instruction to store the stored data to the storage node.

In this embodiment, after determining that the node certificate of the current storage node is issued by the trusted root certificate, it can be determined that the node certificate is correct, and at the same time, the storage node is authorized to store the corresponding storage data. The specific authorization method is to send an authorization instruction for storing data to the storage node. The authorization instruction may include data information to be stored, data storage requirements, etc., and may also include terminal authentication information of the data owner, which is not limited herein.

S2012: Receive a write completion notification sent by the storage node; the write completion notification is used to indicate that the storage node has completed the data writing process; the data writing process includes the storage node according to the node After the certificate verifies the authorized content in the authorization instruction, the stored data is written, and the signature of the storage node is attached after the writing is completed; the signature is used to verify whether the stored data is correct.

After receiving the authorization instruction, the storage node may start to store the stored data according to the data information and data storage requirements in the authorization instruction. Further, in order to ensure the security of the data and the orderliness of the storage process, the storage node can verify whether the authorization content in the authorization instruction is correct through its own node certificate after receiving the authorization instruction. After the verification is passed, write the storage data in its own storage space, and attach the signature of the storage node after the writing is completed, to verify whether the stored data is correct by the signature, after the writing is completed, the write completion notification Send to the data owner terminal.

Specifically, when the storage node verifies the authorized content in the authorization instruction, the terminal authentication information stored in the local data owner can be compared with the terminal authentication information of the data owner in the authorized content. If the two are consistent, Then the authorized content in the authorization instruction is verified.

S202: If the node certificate is issued by the trusted root certificate, obtain the public key of the storage node, and verify whether the public key of the storage node is correct according to the pre-stored node identifier.

After verifying that the node certificate is issued by the trusted root certificate, obtain the public key of the storage node. Since there may be cases where the public key may be tampered when both parties pass the public key in the network, in this embodiment, according to the pre-stored node The ID verifies that the storage node's public key is correct.

Further, step S202 may specifically include steps S2021 to S2023:

S2021: If the node certificate is issued by the trusted root certificate, obtain the public key of the storage node.

In practical applications, after verifying that the node certificate is issued by a trusted root certificate, unless the other party hands us the public key, otherwise, if no measures are taken, both parties may be tampered with when passing the public key on the network. We first obtain the public key of the storage node. Since the public key of each storage node can be public, the public key of the storage node can also be stored in advance in the data owner terminal. When the data owner terminal needs the public key of the storage node When verifying, you can obtain the public key of the storage node directly from your own database.

S2022: Calculate the data digest of the public key of the storage node to obtain a public key digest.

In this embodiment, a public key cryptosystem is used, and two secret keys are used, one for encrypting information and the other for decrypting information. There is a certain mathematical relationship between these two keys, so that data encrypted with any one of the two keys can only be decrypted with the other one. Each storage node has two secret keys, which are a public key and a private key. The public key is used to send to the data owner terminal for verification, and the private key is used to encrypt and store data. Due to the mathematical relationship between the two secret keys, any other terminal device that receives the public key can guarantee that the data encrypted with the public key can only be decrypted by the storage node using its own private key. Of course, this guarantee is It is based on the privacy of users' private keys.

In practical applications, we get a summary of the public key by performing a data digest on the storage node's public key. By transforming the public key of a storage node of any length into a fixed-length data string, this certain length of data string is the public key digest. A qualified digest algorithm must meet the following conditions: It is technically impossible to find a message set with the same digest. For a given message digest, it is not technically feasible to reversely calculate the message itself.

The data owner terminal stores the node ID of each storage node. The node ID is obtained by performing a summary calculation on the storage node's public key, and is used to verify whether the storage node's public key is correct through the node ID. After the data owner terminal obtains the public key of the storage node, the digest algorithm calculates the message digest of the public key to obtain the public key digest. By comparing the two message digests, you can clearly determine whether the storage node's public key has been tampered with during transmission. The same result indicates that the data has not been modified, and the different results indicate that the data has been modified or the data has been lost, thereby ensuring the accuracy of the storage node in the transmission process. Optional, commonly used digest algorithms are Message Digest Algorithm (Message Digest Algorithm, MD5), not limited here.

S2023: Compare the public key digest with the data identifier, and if the public key digest is consistent with the data identifier, determine that the public key of the storage node is correct.

After obtaining the public key digest of the storage node, by comparing the public key digest in the data identification with the calculated public key digest and the two message digests, it can be clearly determined that the storage node's public key is in the process of transmission Whether it has been tampered with. The same result indicates that the data has not been modified, and the different results indicate that the data has been modified or the data has been lost, thereby ensuring the accuracy of the storage node in the transmission process.

Optionally, to ensure the correctness of the storage node's public key, a fair third party can be introduced. When a party wants to publish the public key, it submits its own identity information and public key to this third party. The identity is verified, and if there is no problem, the information and public key are packaged into a certificate. And this fair third party is often referred to as a certificate authority. When we need to obtain the public key, we only need to obtain its certificate, and then extract the public key from it.

S203: If the public key of the storage node is correct, verify the signature in the stored data stored by the storage node according to the public key of the storage node, and if the signature verification is passed, the stored data is correct.

In this embodiment, S203 is implemented in the same way as S103 in the embodiment corresponding to FIG. 1. For details, reference may be made to the related description of S101 in the embodiment corresponding to FIG. 1, and details are not described herein again.

S204: If the stored data is incorrect, determine the historical processing records of the stored data and the processing terminal corresponding to each historical processing record.

When it is verified that the stored data is incorrect, there may be various reasons. For example, the storage node may fail, its storage hard disk may be damaged, or the storage node suddenly goes down, etc.; it may also be intercepted or tampered by a malicious terminal during data transmission, so we have no way to guarantee that the stored data is not The correctness is caused by malicious processing by the storage node. So we determine the situation of the storage node and deal with it by situation.

First, obtain the historical processing records of the stored data that occurred incorrectly, which can include historical processing time, processing methods, etc. At the same time, in order to make the processing situation more clear, we can also obtain the user information that performs the processing, etc. The user information can be the user The user account and other information used when logging in to the storage node are not limited here. At the same time, considering that different processing terminals may process the stored data, it is also necessary to determine the processing terminal corresponding to each historical processing record, which can be determined by acquiring the terminal identification of the data processing execution terminal, such as hardware encoding Wait, not limited here.

S205: Acquire the data processing authority of each processing terminal.

After determining the historical processing records of stored data and the processing terminal corresponding to each historical processing record, we obtain the data processing authority of each processing terminal. Among them, the data processing authority may be determined according to the level of data processing, such as primary data processing authority, secondary data processing authority, etc., or it may be a specific method of determining the data processing, for example, only read stored data, or may Modify and delete stored data. By acquiring the data processing authority of each processing terminal, we can use the data processing authority to measure whether the data processing terminal's processing behavior of the stored data is correct.

S206: If the history processing record of the processing terminal corresponds to the data processing authority, it is determined that the history processing record of the processing terminal is in compliance.

If the historical processing record of the processing terminal corresponds to the data processing authority, for example, the historical processing that a processing terminal modifies the stored data, and the data processing authority of the processing terminal includes the ability to modify the stored data, the processing terminal is determined Compliance with the modification records in the historical processing records of stored data.

Further, if the historical processing record of the processing terminal does not correspond to the data processing authority, for example, the processing authority of a processing terminal is only to read the stored data, and the processing terminal in the historical processing record modifies the stored data, it is determined that the Handle the violation of data by the terminal to the storage node. After it is determined that the processing terminal has violated the historical processing record of the stored data, the corresponding processing method of the violating terminal may be adopted, for example, to delete all processing rights of the processing terminal on the stored data and to pull the processing terminal into the blacklist of stored data processing in. Through this data processing violation detection method, it is possible to determine the cause of incorrect storage data that is verified to be incorrect, and punish the corresponding processing terminal when a violation occurs, thereby improving the data security of the data storage system.

In the above solution, by acquiring the node certificate of the storage node, it is verified whether the node certificate is issued by a preset trusted root certificate; the storage node is used to store the storage data sent by the data owner terminal, and the storage data includes storage The signature of the node; if the node certificate is issued by the trusted root certificate, obtain the public key of the storage node, and verify whether the public key of the storage node is correct according to the pre-stored node ID; the node ID Generated from the digital summary of the storage node's public key; if the storage node's public key is correct, verify the signature in the stored data stored by the storage node according to the storage node's public key, if the storage If the data is incorrect, determine the historical processing records of the stored data and the processing terminal corresponding to each historical processing record; obtain the data processing authority of each processing terminal; according to the historical processing records of each processing terminal and The data processing authority determines whether the historical processing records of the processing terminal are in compliance. By verifying the node certificate and signature of the storage node, and verifying the correctness of the storage data in the storage node, and after determining that the storage data is incorrect, the storage node is processed according to the historical processing record and data processing authority of the storage node, It improves the authority of the data owner in data processing and the security of the data stored by the nodes in the distributed network.

Referring to FIG. 3, FIG. 3 is a schematic diagram of a terminal device provided in Embodiment 3 of the present application. Each unit included in the terminal device is used to execute each step in the embodiments corresponding to FIG. 1 to FIG. 2. For details, please refer to the related descriptions in the corresponding embodiments of FIG. 1 to FIG. 2. For ease of explanation, only parts related to this embodiment are shown. The terminal device 300 of this embodiment includes:

The obtaining unit 301 is used to obtain a node certificate of a storage node and verify whether the node certificate is issued by a preset trusted root certificate; the storage node is used to store stored data sent by a data owner terminal, and the stored data Including the signature of the storage node;

The first verification unit 302 is configured to obtain the public key of the storage node and verify whether the public key of the storage node is correct according to the pre-stored node identifier if the node certificate is issued by the trusted root certificate; The node identification is generated from a digital summary of the storage node's public key;

The second verification unit 303 is used to verify the signature in the storage data stored by the storage node according to the public key of the storage node if the public key of the storage node is correct. The stored data is correct.

Further, the terminal device may further include:

An authorization unit, configured to send an authorization instruction to store the stored data to the storage node if the node certificate is issued by the trusted root certificate;

The receiving unit is configured to receive a write completion notification sent by the storage node; the write completion notification is used to indicate that the storage node has completed the data writing process; the data writing process includes the storage node according to After the node certificate verifies the authorization content in the authorization instruction, write the stored data, and attach the signature of the storage node after the writing is completed; the signature is used to verify whether the stored data is correct .

The node identifier is obtained by performing digest processing according to the node public key of the storage node in advance, and stored in the data owner terminal;

Further, the first verification unit 302 may include:

A public key obtaining unit, configured to obtain the public key of the storage node if the node certificate is issued by the trusted root certificate;

A public key digest unit, used to calculate a data digest of the public key of the storage node to obtain a public key digest;

The public key comparison unit is used to compare the public key summary with the data identification, and if the public key summary is consistent with the data identification, it is determined that the public key of the storage node is correct.

Further, the acquiring unit 301 may include:

An identification determining unit, used to obtain a node certificate of a storage node, and determine an identification of an issuing authority that issued the node certificate;

An identification search unit, configured to search for the existence of the issuer ID in a preset trusted e-commerce certification authority table based on the issuer ID;

The certificate determination unit is used to determine that the node certificate is issued by a trusted root certificate if the issuer ID exists in the trusted e-commerce certification authority table.

Further, the terminal device may further include:

A terminal determining unit, configured to determine the historical processing record of the stored data and the processing terminal corresponding to each historical processing record if the stored data is incorrect;

The authority determination unit is used to acquire the data processing authority of each processing terminal;

The record determining unit is configured to determine that the history processing record of the processing terminal is in compliance with the history processing record of the processing terminal corresponding to the data processing authority.

The above solution improves the security of data stored by nodes in a peer-to-peer network by verifying both the node certificate and signature of the storage node and the accuracy of the stored data in the storage node.

4 is a schematic diagram of a terminal device provided in Embodiment 4 of the present application. As shown in FIG. 4, the terminal device 4 of this embodiment includes: a processor 40, a memory 41, and computer-readable instructions 42 stored in the memory 41 and executable on the processor 40. When the processor 40 executes the computer-readable instructions 42, the steps in the above embodiments of each data verification method are implemented, for example, steps 101 to 103 shown in FIG. 1. Alternatively, when the processor 40 executes the computer-readable instructions 42, the functions of each module/unit in the foregoing device embodiments are realized, for example, the functions of the units 301 to 303 shown in FIG. 3.

The terminal device 4 may be a computing device such as a desktop computer, a notebook, a palmtop computer and a cloud server. The terminal device may include, but is not limited to, the processor 40 and the memory 41. Those skilled in the art may understand that FIG. 4 is only an example of the terminal device 4 and does not constitute a limitation on the terminal device 4, and may include more or less components than the illustration, or a combination of certain components or different components. For example, the terminal device may further include an input and output device, a network access device, a bus, and the like.

The processor 40 may be a central processing unit (Central Processing Unit (CPU), can also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application-specific integrated circuits (Application Specific Integrated Circuit (ASIC), ready-made programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The memory 41 may be an internal storage unit of the terminal device 4, such as a hard disk or a memory of the terminal device 4. The memory 41 may also be an external storage device of the terminal device 4, such as a plug-in hard disk equipped on the terminal device 4, a smart memory card (Smart Media Card, SMC), and a secure digital (SD) Cards, flash cards (Flash Card, FC), etc. Further, the memory 41 may also include both an internal storage unit of the terminal device 4 and an external storage device. The memory 41 is used to store the computer-readable instructions and other programs and data required by the terminal device. The memory 41 can also be used to temporarily store data that has been or will be output.

Those skilled in the art can clearly understand that, for convenience and conciseness of description, only the above-mentioned division of each functional unit and module is used as an example for illustration. In practical applications, the above-mentioned functions may be allocated by different functional units, Module completion means that the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit. The above integrated unit may use hardware It can also be implemented in the form of software functional units. In addition, the specific names of the functional units and modules are only for the purpose of distinguishing each other, and are not intended to limit the protection scope of the present application. For the specific working processes of the units and modules in the above system, reference may be made to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

In the above embodiments, the description of each embodiment has its own emphasis. For a part that is not detailed or recorded in an embodiment, you can refer to the related descriptions of other embodiments.

If the integrated module/unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium. Based on this understanding, this application implements all or part of the processes in the methods of the above embodiments, and can also be completed by instructing relevant hardware through computer-readable instructions, which can be stored in a computer non-volatile Readable storage medium.

Those of ordinary skill in the art may understand that all or part of the process in the method of the foregoing embodiments may be completed by instructing relevant hardware through computer-readable instructions, which may be stored in a computer non-volatile In a readable storage medium, when the computer-readable instructions are executed, they may include the processes of the foregoing method embodiments. Wherein, any reference to the memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and/or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous chain (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

The above-mentioned embodiments are only used to illustrate the technical solutions of the present application, not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still implement the foregoing The technical solutions described in the examples are modified, or some of the technical features are equivalently replaced; and these modifications or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present application. Within the scope of protection of this application.

Claims (20)

1. A data verification method, characterized in that it includes:

   Obtain the node certificate of the storage node and verify whether the node certificate is issued by a preset trusted root certificate; the storage node is used to store the storage data sent by the data owner terminal, and the storage data includes the signature of the storage node;

   If the node certificate is issued by the trusted root certificate, obtain the public key of the storage node, and verify whether the public key of the storage node is correct according to the pre-stored node ID; the node ID is determined by the storage Digital digest generation of the node's public key;

   If the public key of the storage node is correct, the signature in the stored data stored by the storage node is verified according to the public key of the storage node, and if the signature verification is passed, the stored data is correct.
2. The data verification method according to claim 1, wherein after acquiring the node certificate of the storage node and verifying whether the node certificate is issued by a preset trusted root certificate, the method further comprises:

   If the node certificate is issued by the trusted root certificate, send an authorization instruction to store the stored data to the storage node;

   Receiving a write completion notification sent by the storage node; the write completion notification is used to indicate that the storage node has completed the data writing process;

   The data writing process includes the storage node writing the storage data after verifying the authorized content in the authorization instruction according to the node certificate, and attaching the signature of the storage node after the writing is completed ; The signature is used to verify that the stored data is correct.
3. The data verification method according to claim 1, characterized in that the node identifier is obtained by performing digest processing on the node public key of the storage node in advance and stored in the data owner terminal;

   If the node certificate is issued by the trusted root certificate, acquiring the public key of the storage node, and verifying whether the public key of the storage node is correct according to the pre-stored node identifier, including:

   If the node certificate is issued by the trusted root certificate, obtain the public key of the storage node;

   Calculating a data digest of the public key of the storage node to obtain a public key digest;

   Compare the public key digest with the data identification, and if the public key digest is consistent with the data identification, determine that the storage node's public key is correct.
4. The data verification method according to claim 1, wherein the acquiring the node certificate of the storage node and verifying whether the node certificate is issued by a preset trusted root certificate includes:

   Obtain the node certificate of the storage node, and determine the identity of the issuing authority that issued the node certificate;

   According to the issuer ID, check whether the issuer ID exists in the preset trusted e-commerce certification authority table;

   If the issuer ID exists in the trusted e-commerce certification authority table, it is determined that the node certificate is issued by a trusted root certificate.
5. The data verification method according to any one of claims 1 to 4, wherein, if the storage node's public key is correct, the storage stored by the storage node is verified according to the storage node's public key The signature in the data. If the signature is correct, it means that the stored data is correct. It also includes:

   If the stored data is incorrect, determine the historical processing records of the stored data and the processing terminal corresponding to each historical processing record;

   Obtain the data processing authority of each processing terminal;

   If the history processing record of the processing terminal corresponds to the data processing authority, it is determined that the history processing record of the processing terminal is in compliance.
6. A terminal device, characterized in that it includes a memory and a processor, and the memory stores computer-readable instructions executable on the processor, wherein the processor executes the computer-readable instructions , The following steps are implemented:

   Obtain the node certificate of the storage node and verify whether the node certificate is issued by a preset trusted root certificate; the storage node is used to store the storage data sent by the data owner terminal, and the storage data includes the signature of the storage node;

   If the node certificate is issued by the trusted root certificate, obtain the public key of the storage node, and verify whether the public key of the storage node is correct according to the pre-stored node ID; the node ID is determined by the storage Digital digest generation of the node's public key;

   If the public key of the storage node is correct, the signature in the stored data stored by the storage node is verified according to the public key of the storage node, and if the signature verification is passed, the stored data is correct.
7. The terminal device according to claim 6, wherein after acquiring the node certificate of the storage node and verifying whether the node certificate is issued by a preset trusted root certificate, the method further includes:

   If the node certificate is issued by the trusted root certificate, send an authorization instruction to store the stored data to the storage node;

   Receiving a write completion notification sent by the storage node; the write completion notification is used to indicate that the storage node has completed the data writing process;

   The data writing process includes the storage node writing the storage data after verifying the authorized content in the authorization instruction according to the node certificate, and attaching the signature of the storage node after the writing is completed ; The signature is used to verify that the stored data is correct.
8. The terminal device according to claim 6, wherein the node identifier is obtained by performing digest processing according to the node public key of the storage node in advance, and stored in the data owner terminal;

   If the node certificate is issued by the trusted root certificate, acquiring the public key of the storage node, and verifying whether the public key of the storage node is correct according to the pre-stored node identifier, including:

   If the node certificate is issued by the trusted root certificate, obtain the public key of the storage node;

   Calculating a data digest of the public key of the storage node to obtain a public key digest;

   Compare the public key digest with the data identification, and if the public key digest is consistent with the data identification, determine that the storage node's public key is correct.
9. The terminal device according to claim 6, wherein the acquiring the node certificate of the storage node and verifying whether the node certificate is issued by a preset trusted root certificate includes:

   Obtain the node certificate of the storage node, and determine the identity of the issuing authority that issued the node certificate;

   According to the issuer ID, check whether the issuer ID exists in the preset trusted e-commerce certification authority table;

   If the issuer ID exists in the trusted e-commerce certification authority table, it is determined that the node certificate is issued by a trusted root certificate.
10. The terminal device according to any one of claims 6-9, wherein, if the public key of the storage node is correct, the stored data stored by the storage node is verified according to the public key of the storage node If the signature is correct, it means that the stored data is correct, and it also includes:

    If the stored data is incorrect, determine the historical processing records of the stored data and the processing terminal corresponding to each historical processing record;

    Obtain the data processing authority of each processing terminal;

    If the history processing record of the processing terminal corresponds to the data processing authority, it is determined that the history processing record of the processing terminal is in compliance.
11. A terminal device is characterized by comprising:

    An obtaining unit, configured to obtain a node certificate of a storage node, and verify whether the node certificate is issued by a preset trusted root certificate; the storage node is used to store stored data sent by a data owner terminal, and the stored data includes The signature of the storage node;

    A first verification unit, used to obtain the public key of the storage node if the node certificate is issued by the trusted root certificate, and verify whether the public key of the storage node is correct according to the pre-stored node identifier; The node identification is generated from a digital summary of the storage node's public key;

    The second verification unit is configured to verify the signature in the storage data stored by the storage node according to the public key of the storage node if the public key of the storage node is correct, and to explain if the signature verification is passed The stored data is correct.
12. The terminal device according to claim 11, further comprising:

    An authorization unit, configured to send an authorization instruction to store the stored data to the storage node if the node certificate is issued by the trusted root certificate;

    The receiving unit is configured to receive a write completion notification sent by the storage node; the write completion notification is used to indicate that the storage node has completed the data writing process; the data writing process includes the storage node according to After the node certificate verifies the authorization content in the authorization instruction, write the stored data, and attach the signature of the storage node after the writing is completed; the signature is used to verify whether the stored data is correct .
13. The terminal device according to claim 11, wherein the node identifier is obtained by performing digest processing according to the node public key of the storage node in advance and stored in the data owner terminal;

    The first verification unit includes:

    A public key obtaining unit, configured to obtain the public key of the storage node if the node certificate is issued by the trusted root certificate;

    A public key digest unit, used to calculate a data digest of the public key of the storage node to obtain a public key digest;

    The public key comparison unit is used to compare the public key summary with the data identification, and if the public key summary is consistent with the data identification, it is determined that the public key of the storage node is correct.
14. The terminal device according to claim 11, wherein the acquiring unit comprises:

    An identification determining unit, used to obtain a node certificate of a storage node, and determine an identification of an issuing authority that issued the node certificate;

    An identification search unit, configured to search for the existence of the issuer ID in a preset trusted e-commerce certification authority table based on the issuer ID;

    The certificate determination unit is used to determine that the node certificate is issued by a trusted root certificate if the issuer ID exists in the trusted e-commerce certification authority table.
15. The terminal device according to any one of claims 11-14, further comprising:

    A terminal determining unit, configured to determine the historical processing record of the stored data and the processing terminal corresponding to each historical processing record if the stored data is incorrect;

    The authority determination unit is used to acquire the data processing authority of each processing terminal;

    The record determining unit is configured to determine that the history processing record of the processing terminal is in compliance with the history processing record of the processing terminal corresponding to the data processing authority.
16. A computer non-volatile readable storage medium, the computer non-volatile readable storage medium stores computer readable instructions, characterized in that, when the computer readable instructions are executed by a processor, the following steps are implemented:

    Obtain the node certificate of the storage node and verify whether the node certificate is issued by a preset trusted root certificate; the storage node is used to store the storage data sent by the data owner terminal, and the storage data includes the signature of the storage node;

    If the node certificate is issued by the trusted root certificate, obtain the public key of the storage node, and verify whether the public key of the storage node is correct according to the pre-stored node ID; the node ID is determined by the storage Digital digest generation of the node's public key;

    If the public key of the storage node is correct, the signature in the stored data stored by the storage node is verified according to the public key of the storage node, and if the signature verification is passed, the stored data is correct.
17. The computer non-volatile storage medium according to claim 16, wherein after acquiring the node certificate of the storage node and verifying whether the node certificate is issued by a preset trusted root certificate, the method further includes:

    If the node certificate is issued by the trusted root certificate, send an authorization instruction to store the stored data to the storage node;

    Receiving a write completion notification sent by the storage node; the write completion notification is used to indicate that the storage node has completed the data writing process;

    The data writing process includes the storage node writing the storage data after verifying the authorized content in the authorization instruction according to the node certificate, and attaching the signature of the storage node after the writing is completed ; The signature is used to verify that the stored data is correct.
18. The computer non-volatile readable storage medium according to claim 16, wherein the node identifier is obtained by performing digest processing according to the node public key of the storage node in advance and stored in the data owner terminal ;

    If the node certificate is issued by the trusted root certificate, acquiring the public key of the storage node, and verifying whether the public key of the storage node is correct according to the pre-stored node identifier, including:

    If the node certificate is issued by the trusted root certificate, obtain the public key of the storage node;

    Calculating a data digest of the public key of the storage node to obtain a public key digest;

    Compare the public key digest with the data identification, and if the public key digest is consistent with the data identification, determine that the storage node's public key is correct.
19. The computer non-volatile readable storage medium of claim 16, wherein the acquiring the node certificate of the storage node and verifying whether the node certificate is issued by a preset trusted root certificate includes:

    Obtain the node certificate of the storage node, and determine the identity of the issuing authority that issued the node certificate;

    According to the issuer ID, check whether the issuer ID exists in the preset trusted e-commerce certification authority table;

    If the issuer ID exists in the trusted e-commerce certification authority table, it is determined that the node certificate is issued by a trusted root certificate.
20. The computer non-volatile storage medium according to any one of claims 16 to 19, wherein if the public key of the storage node is correct, the verification is performed according to the public key of the storage node The signature in the stored data stored by the storage node, if the signature is correct, it indicates that the stored data is correct, and further includes:

    If the stored data is incorrect, determine the historical processing records of the stored data and the processing terminal corresponding to each historical processing record;

    Obtain the data processing authority of each processing terminal;

    If the history processing record of the processing terminal corresponds to the data processing authority, it is determined that the history processing record of the processing terminal is in compliance.