Detailed Description
In order to make those skilled in the art better understand the technical solutions in the embodiments of the present specification, the technical solutions in the embodiments of the present specification will be described in detail below with reference to the drawings in the embodiments of the present specification, and it is obvious that the described embodiments are only a part of the embodiments of the present specification, and not all the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments in the present specification should be within the scope of protection.
First, a block chain type account book in the centralization in the embodiment of the present specification will be described. In a centralized database service provider, a block-chain ledger is generated as follows, as shown in fig. 1, fig. 1 is a schematic flow diagram of generating a block-chain ledger provided in an embodiment of the present disclosure, including:
s101, receiving data records to be stored, and determining hash values of the data records.
The data records to be stored here may be various consumption records of individual users of the client, and also may be business results, intermediate states, operation records, and the like generated by the application server when executing business logic based on instructions of the users. Specific business scenarios may include consumption records, audit logs, supply chains, government regulatory records, medical records, and the like.
S103, when the preset blocking condition is met, determining each data record to be written into the data block, and generating an Nth data block containing the hash value of the data block and the data record.
The preset blocking condition comprises the following steps: when the number of data records to be stored reaches a number threshold, for example, a new data block is generated every time one thousand data records are received, and one thousand data records are written into the block; alternatively, a time interval from the last blocking time reaches a time threshold, e.g., every 5 minutes, a new data block is generated, and the data records received within the 5 minutes are written into the block.
N here refers to a sequence number of the data block, that is, in the embodiment of the present specification, the data block is arranged in a block chain manner, and is arranged in sequence based on the blocking time, so that the data block has a strong timing characteristic. The block height of the data block is monotonically increased based on the sequence of the blocking time. The block height may be a sequence number, and at this time, the block height of the nth data block is N; the block height may also be generated in other ways.
When N =1, the data block at this time is the initial data block. The hash value and the block height of the initial data block are given based on a preset mode. For example, the initial data block does not contain data records, the hash value is any given hash value, and the block height blknum =0; for another example, the trigger condition for generation of the initial data block is consistent with the trigger conditions of other data blocks, but the hash value of the initial data block is determined by hashing all of the contents in the initial data block.
When N >1, since the content and hash value of the previous data block have already been determined, at this time, the hash value of the current data block (nth data block) may be generated based on the hash value of the previous data block (i.e., nth-1 data block), for example, one possible way is to determine the hash value of each data record to be written into the nth data block, generate a mercker tree in the order of arrangement in the blocks, concatenate the root hash value of the mercker tree with the hash value of the previous data block, and generate the hash value of the current block again using the hash algorithm. For example, the hash value of the data block may be generated by concatenating the data records in the order of the data records in the block and hashing the concatenated data records to obtain the hash value of the entire data record, concatenating the hash value of the previous data block and the hash value of the entire data record, and performing a hash operation on the concatenated string.
After the user successfully uploads the data, the hash value of the corresponding data record and the hash value of the located data block can be obtained and stored, and integrity verification can be initiated based on the hash values. The specific verification mode is to recalculate the hash value of the data record and the hash value of the data block in the database, and compare the calculated hash values with those stored locally.
By the above-mentioned manner of generating data blocks, each data block is determined by a hash value, and the hash value of the data block is determined by the content and the sequence of data records in the data block and the hash value of the previous data block. The user can initiate verification based on the hash value of the data block at any time, and modification of any content in the data block (including modification of data record content or sequence in the data block) can cause inconsistency between the hash value of the data block calculated during verification and the hash value generated during data block generation, so that verification failure is caused, and centralized non-tampering is realized.
When the block-chained ledger is verified, generally speaking, a segment of data block is designated for continuous integrity verification, or continuous integrity verification is performed from the initial data block. The verification mode is to obtain the hash value of the previous data block, and recalculate the hash value of the data block according to the data record of the data block and the hash value of the previous data block by adopting the same algorithm as that used for generating the hash value of the data block, and compare the calculated hash value with the previous hash value.
The foregoing part describes a block chain type account book according to an embodiment of the present specification. In practical applications, the database service side is often oriented to various organizations, and the organizations can record data generated between the organizations and third-party users (including other organizations or individuals) in the database service side for storage. As shown in fig. 2, fig. 2 is a schematic diagram of a system architecture according to an embodiment of the present disclosure. In this illustration, one enterprise may be oriented to multiple users, and each user may query or authenticate data to the database service provider through its corresponding enterprise.
For example, the mechanism that the database server side interfaces with is a certain financial product company, and the data record can be a financial record of the individual user at the financial product company; alternatively, the institution that interfaces may be a government department, where the data records are overhead details of the government department for the public projects managed by the department; or the mechanism for the database server to interface is a certain hospital, and the data records are medical records of patients; alternatively, the institution to which the database facilitator interfaces is a third party payment institution, the data records may be payment records of individual users through the institution, and so on.
As described above, although these data records have strong timing characteristics when the account book is written, the data records are usually stored in multiple data blocks in a distributed manner for individual users. For example, medical records for all patients in a hospital are sequentially uploaded in a time-generated order. For a certain user in a hospital, there may be multiple medical histories, and the time interval is large, and if the hospital or the user needs to select the data record of the user from the account book and perform verification, it is very inconvenient to perform verification from the account book according to the hash value of each medical record determined in the previous storage process, or perform traversal verification.
Based on this, the embodiments of the present specification provide a method for verifying data records in a block chain type ledger, which is applied to a centralized database service provider that stores data through the block chain type ledger. Specifically, the location information of the data record is obtained by performing matching based on a pre-created index table, where the index table is pre-generated in the following manner, as shown in fig. 3, fig. 3 is a schematic flow chart of a method for generating an index in a block chain type account book provided in an embodiment of this specification, and the flow specifically includes the following steps:
s301, acquiring a designated identification field in the data record, wherein the designated identification field is used for identifying the service attribute of the data record.
In each mechanism for interfacing with the database server, the service attribute generally exists only in the interfacing mechanism, and the service attribute is based on different service scenes and can comprise a user name, a user identity card number, a driving license number, a mobile phone number, a unique item number and the like.
For example, for a third-party payment mechanism, the data record is a payment record of a user, and the service attribute at this time is a user identifier (including a mobile phone number, an identity card number, a user name, and the like), or a hash value obtained by performing a hash algorithm on the user identifier; for another example, for a government agency, data records are a running stream of expenses for multiple public items, and the business attribute at this time may be a unique number for each item.
The specific location of the specified identification field and the manner of acquisition may be a prior negotiation between the database server and the docking mechanism. For example, when the data record provided by the docking mechanism is a standard structured data record, the specified identification field may be obtained from a specified offset in the data record, or the start position and the end position are identified by specific characters; or, when the data records provided by the docking mechanism are unstructured data, the header containing the service attribute can be directly spliced at the head of each data record when the docking mechanism uploads the unstructured data, and the database server can directly acquire the designated identification field of each data record from the header.
And S303, determining the position information of the data record in the account book, wherein the position information comprises the block height of the data block where the data record is located and the offset in the located data block.
As mentioned above, a block-chained ledger is composed of a plurality of data blocks, and a data block usually contains a plurality of transactions. Therefore, in the embodiments of the present specification, the location information specifically refers to which data block in the ledger a data record is stored on, and at what location in the data block.
In the data blocks provided in the embodiments of the present description, there are various ways to identify different data blocks, including hash values or block heights of the data blocks.
The hash value of the data block is obtained by performing hash calculation according to the hash value of the previous block and the data record of the data block, and can be used for uniquely and definitely identifying one data block. In the block chain type account book, the block height of the first data block is usually 0, and 1 is added for each subsequent data block; alternatively, the blocking time of a data block may be converted to a large sequence of monotonically increasing integer data (typically 12 to 15 bits) as the block height of the data block. Thus, a data block is typically one distinct block high.
For another example, in a determined data block to be written into the database, the ordering of the data record is also fixed, so the sequence number of a data record in the data block is also clear, and when the length of the data record is a fixed unit, the sequence number can also be used to clear the position information of the data record in the data block where the data record is located.
Meanwhile, since a plurality of data records are usually included in one data block, the data records in the data block can be identified by the address offset of each data record in the data block. Obviously, the address offset of each data record is different in the same data block.
Of course, since the specific format of the data block may be customized in the manner provided in the embodiments of this specification (for example, the metadata information and remark information included in the block header of the data block, the form taken by the block header of the data block, and the like), the content of the location information may also be different in different formats, which does not constitute a limitation to this solution.
S305, establishing the corresponding relation between the specified identification field and the position information, and writing an index taking the specified identification field as a main key.
That is, the index is an inverted index. In the index, the primary key is a service attribute contained in the data record. The specific writing mode is that when the main key in the index does not contain the specified identification field, an index record with the specified identification field as the main key is created in the index table.
And when the primary key in the index contains the specified identification field, writing the position information into the index record where the specified identification field is located. Here, the writing is not overwriting, but position information is added to the value of the index record, and is present in the index record in parallel with other position information.
As shown in table 1, table 1 is an exemplary index table provided in the embodiments of the present specification. The Key is a specific Value of the service attribute, each array of the Value part is a piece of position information, the front part of each array is high, the rear part of each array is a serial number of a data record in the data block (when the data record is a hash Value, the length of each data is the same, and the serial number can represent an offset), and a data record can be uniquely determined through the block height and the serial number. It is easily understood that one key may correspond to a plurality of location information in the index table.
TABLE 1
By the scheme, for the data record written into the account book, the service attribute of the data record and the storage position in the account book are determined, the corresponding relation between the service attribute and the storage position is established, and the inverted index with the service attribute as the main key is created.
After the index table is created, data integrity verification may be performed based on the index table. As shown in fig. 4, fig. 4 is a schematic flowchart of a method for verifying a data record in a block-chained ledger in an embodiment of the present specification, where the method includes:
s401, receiving a verification instruction containing a specific value of a service attribute; generally, the authentication request may be sent in the form of instructions. The authentication request may come from the docking authority or from a user serviced by the authority.
And S403, according to the specific value of the user service attribute, matching from a pre-created index table, and determining the position information corresponding to the specific value of the service attribute in the index table.
For example, after table 1 is created, the user inputs an authentication command, verify (0X 123456, & v, FULL), that is, the location information (2, 08), (2, 10), (300, 89) and (300, 999) of the data record corresponding to the specific value "0X123456" of the service attribute can be matched from the index table.
S405, carrying out integrity verification on the data record and/or the data block corresponding to the position information.
The database server can obtain the data records corresponding to the position information (2,08), (2,10), (300,89), (300,999) from the index and perform integrity verification on the two data blocks with the block heights of 2 and 300.
The verification method for the data record is to obtain the data record, determine the hash of the record and the hash values of other data records in the data block where the data record is located, form a tacle tree, and verify whether the root hash of the tacle tree can be regenerated. And the verification mode of the data block is to recalculate the hash value of the data block according to the hash value of the previous data block and the data record of the data block, and verify whether the hash value is consistent with the hash value obtained by the previous calculation.
The result returned during the verification is a "yes" or "no" metadata, and the database server can also add the signature of the server to the verification result. It can be seen that, through the index provided in the embodiment of the present specification, in the process of performing certification in the block chain type account book, the database basic service side is unaware of specific business contents, so that decoupling of data storage and business contents is realized, different business mechanisms can be simultaneously docked, and the adaptability is wider.
According to the scheme provided by the embodiment of the specification, based on the pre-created inverted index which takes the service attribute as the main key and takes the position information as the value, the corresponding position information can be directly matched from the index based on the service attribute contained in the verification instruction, and then the data record and the data block related to the service attribute can be obtained based on the position information, and then the data record and the data block related to the service attribute can be subjected to jumping integrity verification during verification, so that the method is more flexible and has higher efficiency.
Further, a block high parameter for specifying the data block interval may be further included in the verification, for example, a user inputs a verification instruction, verify (0X 123456, & v, 100), to Verify whether the data record of the specified user 0X123456 before the block high 100 is complete. Thus, the data records corresponding to the position information (2, 08) and (2, 10) are obtained and integrity verification is carried out.
And, a segment of data block can be determined by two data block heights, for example, a user inputs a verification instruction, verify (0X 123456, & v,200, 1000), which is used to Verify the data record of the designated user 0X123456 between the block height 200 and the block height 1000 in the account book, and it can be seen that the block height 300 falls into the interval [200,1000], so the position information corresponding to the block height 300 is the target position information, and the data record corresponding to the target position information (300, 89), (300, 999) is obtained and verified.
In one embodiment, the block height of the data block may be large integer data (typically monotonically increasing 12-to 15-bit integer data) obtained by symmetric encryption based on the blocking timestamp of the data block, e.g., a 13-bit large integer. Since the large integer is obtained based on time symmetric encryption, when the blocking time of the data block is needed, the blocking time can be obtained by the same symmetric decryption.
For example, for the blocking time "20xx-01-19 03".
In this specification, the block height is monotonically increased based on the blocking time, so that even if large integer data is employed, the order between them still reflects the order between the data blocks from small to large. For example, if the blocking time of the next data block is "20 xx-01-19" 16.235125 ", it can be converted into another larger large integer" 1547838848125 "by using a preset symmetric encryption algorithm.
In this way, when the user inputs the block height parameter (the database server may provide a time-to-large integer conversion mode so that the user obtains the block height parameter corresponding to the time) to determine the data block interval, the corresponding time period needing to be verified is actually determined, that is, the user may perform verification based on the specified time period, for example, the user may verify the integrity of data records generated by the user within one month or one day based on the self ID (i.e., service attribute) and the current time, or verify the data records generated between certain specified time periods without performing traversal verification from the data block, thereby improving the efficiency.
When some statistics are carried out on the data records, the statistics can be carried out only by directly according to the index table. For example, the docking mechanism may count the number of data records of each user, or the user may know the number of data records of the user and the docking mechanism, and then directly count the Value number after each Key Value in the index table.
In an embodiment, when a database server side acquires a specified identification field in a data record, an acquisition mode can be synchronously created, that is, when the data record is received, a service attribute is directly analyzed to obtain, and when a data block is written into an account book, an index is synchronously created. Another way is that, after the data block is written into the ledger, the index does not need to be created immediately, but when the database has spare resources, the index is created asynchronously for each data record in the data block newly written into the ledger, and in the asynchronous creation way, the database server is facilitated to save resources.
In the index table, since one service attribute may correspond to a plurality of location information (i.e., correspond to a plurality of data records), when the location information is written into the index, the location information may also be sequentially arranged according to the sequence of the data records in the account book, which is beneficial to the query and verification of the user on the data records. The sequence of the data records in the ledger can be embodied by the timestamp (i.e., the blocking timestamp of the data block and) in which the data records are written in the ledger, and for the data records in the same data block, the sequence can be embodied by the sequence in the data block.
Correspondingly, an embodiment of the present specification further provides a device for verifying data records in a block chain type account book, which is applied to a centralized database service provider that stores data in the block chain type account book, as shown in fig. 5, fig. 5 is a schematic structural diagram of the device for verifying data records in a block chain type account book provided in the embodiment of the present specification, and includes:
an instruction receiving module 501, configured to receive a verification instruction including a specific value of a service attribute;
a location information obtaining module 503, configured to perform matching from a pre-created index table according to the specific value of the user service attribute, and determine location information corresponding to the specific value of the service attribute in the index table;
a verification module 505, configured to perform integrity verification on the data record and/or the data block corresponding to the location information;
the apparatus further includes an index creating module 507 for creating an index in advance, where the index creating module includes:
a specified identification field acquisition sub-module 5071, configured to acquire a specified identification field in a data record, where the specified identification field is used to identify a service attribute of the data record;
a position information determination sub-module 5073, configured to determine position information of the data record in the ledger, where the position information includes a block height of a data block where the data record is located, and an offset in the located data block;
the writing sub-module 5075 is used for establishing the corresponding relation between the specified identification field and the position information and writing an index taking the specified identification field as a main key;
in the block chain type account book, except for the initial data block, each data block comprises at least one data record, each data block comprises a hash value of a previous data block and a hash value of a data block determined by the data record contained in the data block, and the block height of the data block is monotonically increased based on the sequence of blocking time.
Further, the specified identification field obtaining sub-module 5071 obtains the specified identification field in the data record when receiving the data record sent by the user; or determining data records contained in the data blocks in the account book, and acquiring the designated identification fields of any data record contained in the data blocks.
Further, the writing sub-module 5075, when the primary key in the index does not include the specified identification field, creates an index record with the specified identification field as the primary key in the index table; and when the primary key in the index contains the specified identification field, writing the position information into the index record where the specified identification field is located.
Further, the write submodule 5075 determines a timestamp of the data record; and sequentially writing the position information of the data record into the value of the index record in the same index record according to the sequence of the time stamps.
Further, the apparatus further includes a data block generating module 509, which receives data records to be stored, and determines hash values of the data records, where the data records include designated identification fields; when a preset blocking condition is reached, determining each data record to be written into the data block, and generating an nth data block containing the hash value of the data block and the data record, specifically comprising:
when N =1, the hash value and the block height of the initial data block are given based on a preset mode;
and when N is greater than 1, determining the hash value of the Nth data block according to the hash values of the data records to be written in the data block and the (N-1) th data block, and generating the Nth data block comprising the hash value of the Nth data block and the data records, wherein the block height of the data block is monotonically increased based on the sequence of the blocking time.
Further, the preset blocking condition includes: the number of data records to be stored reaches a number threshold; alternatively, the time interval from the last chunking time reaches a time threshold.
Further, the instruction receiving module 501 receives a verification instruction including a block height parameter for specifying a verification interval; correspondingly, the verification module 505 determines target location information of which the block height falls in the verification interval in the location information corresponding to the specific value of the service attribute, and performs integrity verification on the data record and/or the data block corresponding to the target location information.
Embodiments of the present specification also provide a computer device, which at least includes a memory, a processor, and a computer program stored in the memory and executable on the processor, where the processor implements the method for verifying data records in a blockchain ledger shown in fig. 4 when executing the program.
Fig. 6 is a schematic diagram illustrating a more specific hardware structure of a computing device according to an embodiment of the present disclosure, where the computing device may include: a processor 1010, a memory 1020, an input/output interface 1030, a communication interface 1040, and a bus 1050. Wherein the processor 1010, memory 1020, input/output interface 1030, and communication interface 1040 are communicatively coupled to each other within the device via bus 1050.
The processor 1010 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an Application Specific Integrated Circuit (ASIC), or one or more Integrated circuits, and is configured to execute related programs to implement the technical solutions provided in the embodiments of the present disclosure.
The Memory 1020 may be implemented in the form of a ROM (Read Only Memory), a RAM (Random Access Memory), a static storage device, a dynamic storage device, or the like. The memory 1020 may store an operating system and other application programs, and when the technical solutions provided by the embodiments of the present specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and called by the processor 1010 for execution.
The input/output interface 1030 is used for connecting an input/output module to input and output information. The i/o module may be configured as a component in a device (not shown) or may be external to the device to provide a corresponding function. The input devices may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output devices may include a display, a speaker, a vibrator, an indicator light, etc.
The communication interface 1040 is used for connecting a communication module (not shown in the drawings) to implement communication interaction between the present apparatus and other apparatuses. The communication module can realize communication in a wired mode (such as USB, network cable and the like) and also can realize communication in a wireless mode (such as mobile network, WIFI, bluetooth and the like).
Bus 1050 includes a path that transfers information between various components of the device, such as processor 1010, memory 1020, input/output interface 1030, and communication interface 1040.
It should be noted that although the above-mentioned device only shows the processor 1010, the memory 1020, the input/output interface 1030, the communication interface 1040 and the bus 1050, in a specific implementation, the device may also include other components necessary for normal operation. In addition, those skilled in the art will appreciate that the above-described apparatus may also include only the components necessary to implement the embodiments of the present disclosure, and need not include all of the components shown in the figures.
The present specification further provides a computer-readable storage medium, on which a computer program is stored, where the computer program, when executed by a processor, implements the method for verifying data records in a block chain ledger shown in fig. 4.
Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.
From the above description of the embodiments, it is clear to those skilled in the art that the embodiments of the present disclosure can be implemented by software plus necessary general hardware platform. Based on such understanding, the technical solutions of the embodiments of the present specification or portions thereof contributing to the prior art may be embodied in the form of a software product, which may be stored in a storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, or the like, and includes several instructions for enabling a computer device (which may be a personal computer, a server, or a network device) to execute the methods described in the embodiments or some portions of the embodiments of the present specification.
The systems, methods, modules or units described in the above embodiments may be implemented by a computer chip or an entity, or by a product with certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, laptop, cellular telephone, camera phone, smart phone, personal digital assistant, media player, navigation device, email messaging device, game console, tablet computer, wearable device, or a combination of any of these devices.
The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, as for the method embodiment, since it is substantially similar to the method embodiment, it is relatively simple to describe, and reference may be made to the partial description of the method embodiment for relevant points. The above-described method embodiments are merely illustrative, wherein the modules described as separate components may or may not be physically separate, and the functions of the modules may be implemented in one or more software and/or hardware when implementing the embodiments of the present specification. And part or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of the embodiment. One of ordinary skill in the art can understand and implement without inventive effort.
The foregoing is only a specific embodiment of the embodiments of the present disclosure, and it should be noted that, for those skilled in the art, a plurality of modifications and decorations can be made without departing from the principle of the embodiments of the present disclosure, and these modifications and decorations should also be regarded as the protection scope of the embodiments of the present disclosure.