WO2024148464A1 - 数据存储方法及相关设备 - Google Patents

数据存储方法及相关设备 Download PDF

Info

Publication number
WO2024148464A1
WO2024148464A1 PCT/CN2023/071325 CN2023071325W WO2024148464A1 WO 2024148464 A1 WO2024148464 A1 WO 2024148464A1 CN 2023071325 W CN2023071325 W CN 2023071325W WO 2024148464 A1 WO2024148464 A1 WO 2024148464A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
node
nodes
value
network
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2023/071325
Other languages
English (en)
French (fr)
Inventor
李波
邓水光
张翼
秦臻
程冠杰
严学强
赵明宇
习燕
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP23915246.5A priority Critical patent/EP4625882A4/en
Priority to PCT/CN2023/071325 priority patent/WO2024148464A1/zh
Priority to CN202380081361.0A priority patent/CN120345210A/zh
Publication of WO2024148464A1 publication Critical patent/WO2024148464A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1097—Protocols in which an application is distributed across nodes in the network for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/085—Secret sharing or secret splitting, e.g. threshold schemes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/34—Encoding or coding, e.g. Huffman coding or error correction
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/18—Information format or content conversion, e.g. adaptation by the network of the transmitted or received information for the purpose of wireless delivery to users or terminals

Definitions

  • the present application relates to the field of communication technology, and in particular to a data storage method and related equipment.
  • Distributed storage networks store data in multiple independent devices (or storage nodes).
  • Distributed network storage networks adopt a scalable system structure and use multiple devices to share the storage load. It not only improves the reliability, availability and access efficiency of the system, but also makes it easy to expand.
  • how to ensure the integrity and confidentiality of data stored in distributed storage networks is a problem that needs to be solved.
  • the present application provides a data storage method and related equipment, which can effectively ensure the integrity and confidentiality of data.
  • the present application provides a data storage method, which is applied to a first node, where the first node is a node with data storage requirements.
  • the data storage method includes the following steps: the first node encrypts the first data to obtain encrypted data; the first node sends a data storage request to the second node.
  • the second node is any node in the distributed storage network.
  • the data storage request includes the encrypted data.
  • the first node receives feedback information.
  • the feedback information is used to indicate that P third nodes have stored P shards, and the above P shards are obtained by splitting the encrypted data. At least M of the P shards are used to restore the encrypted data.
  • the P third nodes are nodes in the distributed storage network. P and M are positive integers greater than one, and M is less than P.
  • the first node first encrypts the first data to obtain encrypted data, which can effectively ensure the confidentiality of the data.
  • the second node then splits the encrypted data into P shards; the P shards are then stored by P third nodes, that is, each third node stores one shard.
  • the encrypted data can be restored based on at least M of the P shards. Therefore, even if individual nodes among the P third nodes are attacked, the encrypted data can still be restored based on at least M of the P shards, effectively ensuring the integrity of the stored data.
  • the data storage method further includes the following steps: the first node sends P subkeys to P third nodes.
  • the P subkeys are obtained by splitting a first key used to encrypt the first data, wherein at least M of the P subkeys are used to recover the first key.
  • the first node when P third nodes have stored P shards, the first node sends P subkeys to the P third nodes, and each third node stores one subkey.
  • the subkey stored by an individual node among the P third nodes is lost, the encrypted data cannot be decrypted using a single subkey. Therefore, using the solution of the present application, the security of the first key can be effectively guaranteed, and the confidentiality of the stored data can be further guaranteed.
  • the data storage request further includes a data name of the first data, where the data name corresponds to a data digest of the encrypted data.
  • the data storage request sent by the first node to the second node may also include the data name of the first data, and the data name corresponds to the data summary of the encrypted data, so that the second node can obtain the data summary of the encrypted data according to the data name of the first data.
  • the second node can verify the correctness of the encrypted data it receives according to the data summary of the encrypted data, that is, determine whether the encrypted data has been tampered with, and ensure the correctness of the stored data.
  • the data storage method further includes the following steps: the first node sends a data registration request to the first network, where the data registration request includes a data name of the first data and a data summary of the encrypted data.
  • the first node sends a data registration request to the first network, and the first network can respond to the data registration request and store the data carried in the request, that is, the first network stores the corresponding relationship between the data name of the first data and the data summary of the encrypted data.
  • the second node can obtain the corresponding data summary of the encrypted data from the first network according to the data name of the first data.
  • the data registration request further includes first indication information, the first indication information is used to determine P, and the first indication information corresponds to the data name.
  • the first network can also store the correspondence between the data name of the first data and the first indication information, so that the second node can obtain the corresponding first indication information according to the data name of the first data, and then determine P according to the first indication information, and then split the encrypted data according to P.
  • the data storage method further includes the following steps: the first node receives second indication information.
  • the second indication information is used to indicate that P third nodes have stored P subkeys.
  • the first node sends third indication information to the first network, the third indication information is used to indicate that the first data storage is completed, and the third indication information corresponds to the data name.
  • the third indication information is sent to the first network, so that the first network can update the storage status of the first data according to the third indication information, and the data requester can learn from the first network that the first data has been stored and is in a requestable state.
  • the present application further provides a data storage method, which is applied to a second node, which is any node in a distributed storage network.
  • the data storage method includes the following steps: the second node receives a data storage request sent by the first node.
  • the data storage request includes encrypted data, which is obtained by encrypting the first data by the first node.
  • the second node splits the encrypted data into P shards. Among them, at least M shards of the P shards are used to restore the encrypted data, P and M are positive integers greater than one, and M is less than P.
  • the second node determines P third nodes in the distributed storage network. The second node sends the P shards to the P third nodes respectively.
  • the second node splits the encrypted data into P shards; and then P third nodes store the P shards, that is, one third node stores one shard.
  • the encrypted data can be restored based on at least M shards among the P shards. Therefore, even if some of the P third nodes are attacked, the encrypted data can still be restored based on at least M shards among the P shards, effectively ensuring the integrity of the stored data.
  • the second node determines P third nodes in the distributed storage network, including: the second node determines the P third nodes according to the first value.
  • the first value includes any of the following: a data summary of encrypted data, a first preset value, a first data summary, or a value stored on a distributed ledger technology DLT network, and the first data summary is a data summary of data stored on the DLT network.
  • the first value may also be a summary of other data or other values, and the other data or other values may be known to each node in the distributed storage network.
  • P third nodes for storing data in the distributed storage network can be determined according to the first value, where P is a positive integer greater than one, and the method for determining P third nodes is very convenient and effective.
  • the identity ID of the i-th third node among the P third nodes is a hash value of the second value.
  • the second value is the sum of the ID of the i-1 second node and a second preset value, or the second value is the sum of the ID of the i-1 second node and a preset function value, and the preset function value is related to i.
  • the ID of the first third node among the P third nodes is the hash value of the first value.
  • the data storage request further includes a data name of the first data
  • the data storage method further includes the following steps: the second node obtains a data summary of the encrypted data corresponding to the data name according to the data name. The second node verifies the correctness of the encrypted data according to the data summary.
  • the data storage request sent by the first node to the second node may also include the data name of the first data, and the data name corresponds to the data summary of the encrypted data, so that the second node can obtain the data summary of the encrypted data according to the data name of the first data.
  • the second node can verify the correctness of the encrypted data it receives according to the data summary of the encrypted data, that is, determine whether the encrypted data has been tampered with, and ensure the correctness of the stored data.
  • the data storage method further includes the following steps: the second node obtains first indication information corresponding to the data name according to the data name.
  • the first indication information is used to determine P.
  • the second node can obtain the corresponding first indication information according to the data name of the first data, and then determine P according to the first indication information, and then split the encrypted data according to P.
  • the second node obtains a data summary of encrypted data corresponding to the data name according to the data name, including: the second node sends a summary request to the first network, the summary request includes the data name.
  • the second node receives the data summary of the encrypted data corresponding to the data name sent by the first network.
  • the second node may send a digest request to the first network to request to obtain the data digest of the encrypted data corresponding to the data name of the first data.
  • the second node obtains first indication information corresponding to the data name according to the data name, including: the second node obtains the first indication information corresponding to the data name from the first network according to the data name.
  • the second node may request the first network to obtain the first indication information corresponding to the data name of the first data.
  • the first network may respond to the above summary request and send the data summary of the encrypted data and the first indication information to the second node.
  • the second node may also initiate another request to the first network to obtain the first indication information.
  • the present application also provides a data storage method, which is applied to a data storage system.
  • the system includes a first node, a second node and a third node, and the first node is a node with data storage requirements.
  • the above-mentioned data storage method includes the following steps: the first node encrypts the first data to obtain encrypted data.
  • the first node sends a data storage request to the second node.
  • the data storage request includes the above-mentioned encrypted data
  • the second node is any node in the distributed storage network.
  • the second node splits the encrypted data into P shards. Among them, at least M shards of the P shards are used to restore the encrypted data.
  • the second node determines P third nodes in the distributed network and sends the P shards to the P third nodes respectively.
  • P and M are positive integers greater than one, and M is less than P.
  • the P third nodes are nodes in the distributed storage network. Each of the P third nodes stores one shard of the P shards.
  • the first node first encrypts the first data to obtain encrypted data, which can effectively ensure the confidentiality of the data.
  • the second node then splits the encrypted data into P shards; and then P third nodes store the P shards, that is, one third node stores one shard.
  • the encrypted data can be restored based on at least M of the P shards. Therefore, even if individual nodes among the P third nodes are attacked, the encrypted data can still be restored based on at least M of the P shards, effectively ensuring the integrity of the stored data.
  • the data storage method further includes the following steps: the first node receives feedback information.
  • the feedback information is used to indicate that P third nodes have stored P shards.
  • the first node sends P subkeys to the P third nodes.
  • the P subkeys are obtained by splitting a first key used to encrypt the first data, wherein at least M of the P subkeys are used to recover the first key.
  • Each of the P third nodes stores one of the P subkeys.
  • the first node after receiving the feedback information, the first node sends P subkeys to P third nodes, so that one third node stores one subkey.
  • the subkey stored in an individual node among the P third nodes is lost, the encrypted data cannot be decrypted using a single subkey. Therefore, using the solution of the present application, the security of the first key can be effectively guaranteed, and the confidentiality of the stored data can be further guaranteed.
  • the data storage request further includes a data name of the first data
  • the data storage method further includes the following steps: the second node obtains a data summary of the encrypted data corresponding to the data name according to the data name. The second node verifies the correctness of the encrypted data according to the data summary.
  • the second node can verify the correctness of the encrypted data it receives based on the data summary of the encrypted data, that is, determine whether the encrypted data has been tampered with, thereby ensuring the correctness of the stored data.
  • the above-mentioned data storage method also includes the following steps: the second node obtains first indication information corresponding to the data name according to the data name, and the first indication information is used to determine P.
  • the second node can obtain the corresponding first indication information according to the data name of the first data, and then determine P according to the first indication information, and then split the encrypted data according to P.
  • the data storage system further includes a first network
  • the second node obtains a data summary of the encrypted data corresponding to the data name according to the data name, including: the second node sends a summary request to the first network.
  • the summary request includes the data name.
  • the second node receives the data summary of the encrypted data corresponding to the data name sent by the first network.
  • the second node can obtain the data summary of the corresponding encrypted data from the first network according to the data name of the first data.
  • the second node receives first indication information corresponding to the data name sent by the first network in response to the summary request.
  • the first network can respond to the above summary request and send the data summary of the encrypted data and the first indication information to the second node together.
  • the data storage method further includes the following steps: the first node sends a data registration request to the first network, where the data registration request includes a data name of the first data and a data summary of the encrypted data.
  • the first node sends a data registration request to the first network, and the first network can respond to the data registration request and store the data carried in the request.
  • the data registration request also includes first indication information for determining P.
  • the first network may also store the correspondence between the data name of the first data and the first indication information.
  • the second node determines P third nodes in the distributed storage network, including: the second node determines the P second nodes according to a first value.
  • the first value includes any one of the following: a data summary of encrypted data, a first preset value, a first data summary, or a value stored on a distributed ledger technology DLT network, and the first data summary is a data summary of data stored on the DLT network.
  • P third nodes for storing data in the distributed storage network can be determined according to the first value, where P is a positive integer greater than one, and the method for determining P third nodes is very convenient and effective.
  • the identity ID of the i-th third node among the P third nodes is a hash value of the second value.
  • the second value is the sum of the ID of the i-1th third node and the second preset value, or the second value is the sum of the ID of the i-1th third node and a preset function value, and the preset function value is related to i.
  • the ID of the first third node among the P third nodes is the hash value of the first value.
  • the present application also provides a data storage method, which is applied to a distributed storage network.
  • the above-mentioned data storage method includes the following steps: the second node receives a data storage request sent by the first node.
  • the second node is any node in the distributed storage network
  • the first node is a node with data storage requirements
  • the data storage request includes encrypted data, which is obtained by the first node encrypting the first data.
  • the second node splits the encrypted data into P fragments, wherein at least M fragments of the P fragments are used to restore the encrypted data.
  • the second node determines P third nodes in the distributed network, and sends the P fragments to the P third nodes respectively, where P and M are positive integers greater than one, and M is less than P.
  • the P third nodes are nodes in the distributed storage network. Each of the P third nodes stores one fragment of the P fragments.
  • the second node splits the encrypted data into P shards; and then P third nodes store the P shards, that is, one third node stores one shard.
  • the encrypted data can be restored based on at least M shards among the P shards. Therefore, even if some of the P third nodes are attacked, the encrypted data can still be restored based on at least M shards among the P shards, effectively ensuring the integrity of the stored data.
  • the data storage method further includes the following steps: each of the P third nodes receives one of the P subkeys, and one third node stores one subkey.
  • the P subkeys are obtained by splitting the first key used to encrypt the first data, wherein at least M of the P subkeys are used to restore the first key.
  • the P subkeys are sent by the first node after receiving feedback information, and the feedback information is used to indicate that the P third nodes have stored P fragments.
  • the second node determines P third nodes in the distributed storage network, including: the second node determines the P third nodes according to the first value.
  • the first value includes any of the following: a data summary of encrypted data, a first preset value, a first data summary, or a value stored on a distributed ledger technology DLT network, and the first data summary is a data summary of data stored on the DLT network.
  • the first value may also be a summary of other data or other values, and the other data or other values may be known to each node in the distributed storage network.
  • the identity ID of the i-th third node among the P third nodes is a hash value of the second value.
  • the second value is the sum of the ID of the i-1 second node and a second preset value, or the second value is the sum of the ID of the i-1 second node and a preset function value, and the preset function value is related to i.
  • the ID of the first third node among the P third nodes is the hash value of the first value.
  • the data storage request further includes a data name of the first data
  • the data storage method further includes the following steps: the second node obtains a data summary of the encrypted data corresponding to the data name according to the data name. The second node verifies the correctness of the encrypted data according to the data summary.
  • the data storage method further includes the following steps: the second node obtains first indication information corresponding to the data name according to the data name.
  • the first indication information is used to determine P.
  • the second node obtains a data summary of encrypted data corresponding to the data name according to the data name, including: the second node sends a summary request to the first network.
  • the summary request includes the data name.
  • the second node receives the data summary of the encrypted data corresponding to the data name sent by the first network in response to the summary request.
  • the second node obtains first indication information corresponding to the data name according to the data name, including: the second node obtains the first indication information corresponding to the data name from the first network according to the data name.
  • the present application also provides a node determination method, which can be applied to a node determination device or a chip in a node determination device.
  • the node determination method comprises the following steps: splitting the first task into P subtasks, where P is a positive integer greater than one. Determining the P nodes in the distributed storage network according to the first value.
  • the first value comprises any one of the following: a summary corresponding to the data to be processed by the first task, a first preset value, a first data summary, or a value stored on a distributed ledger technology DLT network, wherein the first data summary is a data summary of the data stored on the DLT network.
  • P nodes in the distributed storage network for executing P subtasks can be determined according to the first value, where P is a positive integer greater than one, and the method for determining P nodes is very convenient and effective.
  • the first task may include a storage task or a computing task.
  • the identity ID of the i-th node among the P nodes is a hash value of a second value
  • the second value is the sum of the ID of the i-1-th node and a second preset value
  • the second value is the sum of the ID of the i-1-th node and a preset function value
  • the preset function value is related to i.
  • the ID of the first node among the P nodes is a hash value of the first value.
  • the node determination method further includes: sending the P subtasks to the P nodes respectively, so that one node executes one subtask.
  • the present application further provides a first node.
  • the first node includes an encryption module, a sending module and a receiving module. Among them:
  • the encryption module is used to encrypt the first data to obtain encrypted data.
  • the sending module is used to send a data storage request to the second node.
  • the second node is any node in the distributed storage network, and the data storage request includes encrypted data.
  • a receiving module is used to receive feedback information.
  • the feedback information is used to indicate that P third nodes have stored P shards, where the P shards are obtained by splitting the encrypted data. At least M of the P shards are used to restore the encrypted data.
  • the P third nodes are nodes in a distributed storage network, P and M are positive integers greater than one, and M is less than P.
  • the present application further provides a second node, which is any node in a distributed storage network.
  • the second node includes a receiving module, a splitting module, a determining module, and a sending module, wherein:
  • the receiving module is used to receive a data storage request sent by the first node.
  • the data storage request includes encrypted data, and the encrypted data is obtained by the first node encrypting the first data.
  • the splitting module is used to split the encrypted data into P fragments, wherein at least M fragments of the P fragments are used to recover the encrypted data, P and M are positive integers greater than one, and M is less than P.
  • the determination module is used to determine P third nodes in the distributed storage network.
  • the sending module is used to send the P slices to P third nodes respectively.
  • the present application further provides a data storage system, the system comprising a first node, a second node and a third node.
  • the first node is used to encrypt the first data to obtain encrypted data, and send a data storage request to the second node.
  • the data storage request includes the encrypted data
  • the second node is any node in the distributed storage network.
  • the second node is used to split the encrypted data into P shards. At least M shards of the P shards are used to recover the encrypted data. P and M are positive integers greater than one, and M is less than P. P third nodes in the distributed storage network are determined, and the P shards are sent to the P third nodes respectively.
  • the third node is used to store one of the P shards.
  • the present application further provides a node determination device, the node determination device comprising a splitting module and a determination module, wherein:
  • the splitting module is used to split the first task into P subtasks, where P is a positive integer.
  • the determination module is configured to determine P nodes in the distributed storage network according to a first value.
  • the first value includes any one of the following: a summary corresponding to the data to be processed by the first task, a first preset value, a first data summary, or a value stored on a distributed ledger technology DLT network, wherein the first data summary is a data summary of the data stored on the DLT network.
  • the identity ID of the i-th node among the P nodes is a hash value of the second value
  • the second value is the sum of the ID of the i-1-th node and a preset value
  • the second value is the sum of the ID of the i-1-th node and a preset function value
  • the preset function value is related to i.
  • the ID of the first node among the P nodes is the hash value of the first value.
  • the present application also provides a communication device, comprising one or more processors and one or more memories; wherein the one or more memories are coupled to the one or more processors, and the one or more memories are used to store computer program codes, and the computer program codes include computer instructions, and when the one or more processors execute the computer instructions, the communication device executes a method as described in any one of the first aspect, the second aspect, the third aspect, the fourth aspect or the fifth aspect.
  • the present application also provides a computer-readable storage medium, which stores instructions.
  • the instructions When the instructions are executed by a processor, the method described in any one of the first aspect, the second aspect, the third aspect, the fourth aspect or the fifth aspect is implemented.
  • the present application also provides a computer program product, comprising a computer program, which, when executed on a processor, implements the method described in any one of the first, second, third, fourth or fifth aspects.
  • the present application provides a chip system, which is applied to a communication device, and the chip system includes one or more processors, and the processor is used to call computer instructions so that the communication device executes any method as described in the first aspect, the second aspect, the third aspect, the fourth aspect or the fifth aspect.
  • FIG1 is a schematic diagram of the structure of a data storage system provided in an embodiment of the present application.
  • FIG2 is a flow chart of a data storage method provided by an embodiment of the present application.
  • FIG3A is an interactive flow chart of a data storage method provided in an embodiment of the present application.
  • FIG3B is a schematic diagram of an erasure code provided in an embodiment of the present application.
  • FIG3C is a schematic diagram of an erasure code under a fault condition provided by an embodiment of the present application.
  • FIG3D is a schematic diagram of the operation of erasure codes in a fault situation provided by an embodiment of the present application.
  • FIG3E is a schematic diagram of erasure code recovery data provided by an embodiment of the present application.
  • FIG4 is a schematic diagram of a flow chart of a node determination method provided in an embodiment of the present application.
  • FIG5 is a schematic diagram of the structure of a first node provided in an embodiment of the present application.
  • FIG6 is a schematic diagram of the structure of a second node provided in an embodiment of the present application.
  • FIG7 is a schematic diagram of the structure of a node determination device provided in an embodiment of the present application.
  • FIG8 is a schematic diagram of the structure of a communication device provided in an embodiment of the present application.
  • first and second are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of the indicated technical features.
  • a feature defined as “first” or “second” may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "plurality” means two or more.
  • the distributed storage network is a data storage network composed of a plurality of distributed storage nodes (referred to as nodes).
  • nodes a distributed hash table (DHT) network is one type of distributed storage network, wherein the storage nodes of the network may be base stations and/or core network elements.
  • the storage nodes of the distributed storage network may also be edge servers.
  • DHT distributed hash table
  • Distributed network storage network adopts a scalable system structure and uses multiple devices to share the storage load. It not only improves the system's reliability, availability and access efficiency, but also makes it easy to expand.
  • the distributed ledger technology (DLT) network is a decentralized data management architecture. There are several nodes in the entire network, and each node copies and saves an identical ledger. When the data on the ledger changes, all nodes update independently and use a consensus algorithm to determine the correct copy of the ledger. After reaching a consensus, all nodes synchronize according to the correct copy of the ledger. At the same time, the DLT network also uses encryption algorithms and digital signatures to improve the security of the system. DLT networks can be classified by the data structure used, such as blockchain and directed acyclic graphs. Or they can be classified by the consensus algorithm used, such as Proof of Work (PoW) and Proof of Stake (PoS). Exemplarily, the nodes in the DLT network can be base stations and/or core network elements.
  • PoW Proof of Work
  • PoS Proof of Stake
  • FEC forward error correction
  • the original data can be restored based on any M fragments.
  • Information dispersion algorithms include Reed-Solomon (RS) erasure code algorithm or Locally Repairable Codes (LRC) algorithm.
  • RS Reed-Solomon
  • LRC Locally Repairable Codes
  • the LRC algorithm is a local parity coding method. Its core idea is to divide the parity block into global parity block and local reconstruction parity block, and perform group calculations during fault recovery.
  • the threshold key sharing algorithm processes the original key to obtain P subkeys, and the original key can be solved using a combination of greater than or equal to M subkeys.
  • an embodiment of the present application provides a data storage method, which can effectively ensure the integrity and confidentiality of stored data.
  • the method of the embodiment of the present application can be applied to a data storage system.
  • FIG 1 is a schematic diagram of the structure of the data storage system provided by the embodiment of the present application.
  • the data storage system includes a first node 101 and a distributed storage network 102.
  • the data storage system also includes a first network 103.
  • the distributed storage network 102 includes several nodes with wired and/or wireless communication connections.
  • the distributed storage network 102 includes a second node 104 and P third nodes 105.
  • the second node 104 is any one of the nodes in the distributed storage network 102, that is, the second node 104 can be one of the P third nodes 105.
  • the nodes in the distributed storage network 102 take base stations as an example, such as the second node 104 and the third node 105.
  • the node in the distributed storage network 102 may also be a core network element 106.
  • the core network element 106 includes at least one of the following: an access and mobility management function (AMF) element, a session management function (SMF) element, a user plane function (UPF) element, a mobility management entity (MME) element, a serving gateway (SGW) or a packet data network gateway (PDN gateway, PGW).
  • AMF access and mobility management function
  • SMF session management function
  • UPF user plane function
  • MME mobility management entity
  • SGW serving gateway
  • PGW packet data network gateway
  • PDN gateway Packet Data Network gateway
  • the first node 101 is a node with data storage requirements.
  • the specific process of the first node 101 storing data in the distributed storage network 102 can refer to the specific description of FIG. 2 and will not be repeated here.
  • FIG2 is a flow chart of a data storage method provided in an embodiment of the present application.
  • the data storage method comprises the following steps:
  • a first node encrypts first data to obtain encrypted data.
  • the first node is a node with data storage requirements.
  • the first node encrypts the first data using the first key to obtain encrypted data.
  • the first key may be an asymmetric key or a symmetric key.
  • the first node may obtain the first key from other devices.
  • the first node may randomly generate a symmetric key and then use the symmetric key to encrypt the first data.
  • the first node may include a terminal device or an access network device.
  • the terminal device or the access network device is not limited to a terminal device or an access network device in a future communication network system such as a long term evolution (LTE) system, a long term evolution-advanced (LTE-A) system, an enhanced long term evolution (eLTE) system, a fifth generation (5G) mobile communication system, a new radio (NR) system, a sixth generation (6G) mobile communication system, etc.
  • LTE long term evolution
  • LTE-A long term evolution-advanced
  • eLTE enhanced long term evolution
  • 5G fifth generation
  • NR new radio
  • 6G sixth generation
  • Terminal equipment is referred to as terminal, also known as user equipment (UE), which can include various handheld devices with wireless communication functions, vehicle-mounted devices, wearable devices, computing devices or other processing devices connected to wireless modems, as well as various forms of terminals, mobile stations (MS), terminals, soft terminals, access terminals, subscriber units, terminal equipment stations, mobile stations, mobile stations (MS), remote stations, remote terminals, mobile devices, terminal equipment agents, terminal equipment devices, etc. For example, water meters, electric meters, sensors, etc.
  • UE user equipment
  • Access network equipment may have any of the following replacement terms: wireless access network, access network (AN), where the access network equipment may be a base station, a further evolved node B (gNB), an evolved node B (eNB), a transmission reception point (TRP), a centralized unit (CU) node, a distributed unit (DU) node, a transmission point (TP), a receiving point (RP), etc., without limitation.
  • the CU node may also be divided into a CU-control plane (CP) and a CU-user plane (UP), etc.
  • the access network equipment may also be an antenna unit (RU), etc.
  • the access network equipment may also be an open radio access network (ORAN) architecture, etc.
  • ORAN open radio access network
  • CU may also be referred to as open (O)-CU
  • DU may also be referred to as O-DU
  • CU-CP may also be referred to as O-CU-CP
  • CU-UP may also be referred to as O-CU-UP
  • RU may also be referred to as O-RU.
  • the access network device receives the first data from the terminal.
  • the terminal may send a data storage request to the access network device, the data storage request including the first data, so that the terminal receives the data storage request and can obtain the first data.
  • the first node sends a data storage request to the second node, wherein the second node is any node in the distributed storage network, and the data storage request includes encrypted data.
  • FIG3A is an interactive flow chart of a data storage method provided in an embodiment of the present application.
  • the second node receives a data storage request sent by the first node.
  • the second node splits or processes the encrypted data to obtain P shards. Among them, at least M shards of the P shards are used to restore the encrypted data.
  • the second node determines P third nodes in the distributed storage network.
  • the second node sends the P shards to the P third nodes respectively, and accordingly, each third node stores one shard.
  • P and M are positive integers greater than one, and M is less than P.
  • the encrypted data can be recovered based on at least M fragments.
  • the erasure code has two parameters M and N, denoted as RS (M, N), where M is the number of source data blocks and N is the number of check blocks.
  • M source data blocks form a vector D, which is multiplied by a generator matrix B to obtain a data vector, which consists of M data blocks and N check blocks. If a data block is lost, the lost data block can be restored through a series of calculations.
  • RS (M, N) can tolerate the loss of up to N blocks (including data blocks and check blocks).
  • FIG. 3B is a schematic diagram of an erasure code provided in an embodiment of the present application.
  • B is called a distribution matrix.
  • any M row vectors of the matrix B are independent of each other, that is, the MM matrix composed of these M row vectors is reversible.
  • Perform matrix-vector multiplication B*D to obtain a data vector composed of N check blocks C1 ⁇ CN and M source data blocks D1 ⁇ DM .
  • Figure 3C is a schematic diagram of the erasure code under a failure condition provided in an embodiment of the present application.
  • the row vectors corresponding to the remaining data blocks are picked out from the matrix B to form a new matrix B'.
  • the result of multiplying B' by the vector D is exactly the data vector composed of non-faulty data blocks.
  • FIG3D is a schematic diagram of the operation of the erasure code under a failure condition provided in an embodiment of the present application.
  • the encrypted data can be recovered based on data of at least M fragments.
  • Other methods such as the LRC algorithm, are not particularly limited.
  • the second node After the second node determines the P third nodes, it can obtain network identification information of the P third nodes, such as the identity document (ID) of the third node or the IP address of the third node.
  • ID identity document
  • IP address IP address
  • the second node can send P shards to the corresponding third nodes based on the network identification information of the third node.
  • the P shards are ten shards S1, S2, S3, S4, S5, S6, S7, S8, S9 and S10
  • the P third nodes are ten third nodes J1, J2, J3, J4, J5, J6, J7, J8, J9 and J10.
  • the second node sends shard S1 to the third node J1, sends shard S2 to the third node J2, and sends shard S3 to the third node J3, and so on.
  • the second node can send P shards and network identification information of P third nodes to any one of the P third nodes, such as the third node J6.
  • the third node J6 After the third node J6 obtains any one of the P shards, it sends the remaining (P-1) shards to any one of the (P-1) third nodes; repeat the previous step until all shards are sent.
  • the first node receives feedback information.
  • the feedback information is used to indicate that P third nodes have stored P shards, where the P shards are obtained by splitting or processing the encrypted data by the second node.
  • the P third nodes are nodes in the distributed storage network.
  • P and M are positive integers greater than one, and M is less than P.
  • the feedback information is composed of P sub-feedback information, and the sub-feedback information is used to indicate that the third node has stored a shard.
  • Each of the P third nodes sends its own sub-feedback information to the first node, so that the first node knows that the P third nodes have stored P shards.
  • the third node can also send its own network identification information.
  • each of the P third nodes sends its own sub-feedback information to the second node.
  • each of the P third nodes sends its own sub-feedback information to the second node.
  • the second node After the second node receives the sub-feedback information of each of the P third nodes, the second node sends a feedback information to the first node, and the one feedback information is used to indicate that the P third nodes have stored P shards.
  • the second node sends the network identification information of the P third nodes to the first node.
  • the second node transmits the network identification information of the P third nodes to the first node, so that the first node can send information to the P third nodes according to the network identification information of the P third nodes.
  • the first node first encrypts the first data to obtain encrypted data, which can effectively ensure the confidentiality of the data.
  • the second node then splits the encrypted data into P fragments; and the P third nodes store the P fragments, that is, each third node stores one fragment.
  • the encrypted data can be restored based on at least M fragments of the P fragments. Therefore, even if individual nodes of the P third nodes are attacked, the encrypted data can still be restored based on at least M fragments of the P fragments, effectively ensuring the integrity of the stored data.
  • the data storage method further includes the second node calculating a data summary of each shard, i.e., a shard summary.
  • the second node sends a shard summary corresponding to the shard to each third node, so that the third node can verify the correctness of the received shard based on the shard summary and confirm whether it has not been tampered with.
  • the second node can send P shard summaries to each third node together, so that the third node can find its own corresponding shard summary, and then verify the correctness of the received shard based on the shard summary.
  • the third node calculates a shard summary based on the received shard, and then compares the shard summary with the above-mentioned corresponding shard summary to verify the correctness of the received shard.
  • the above-mentioned second node determines P third nodes in the distributed storage network, including:
  • the second node determines P third nodes according to the first value.
  • the first value includes any of the following: a data summary of encrypted data, a first preset value, a first data summary or a value stored on a DLT network, and the first data summary is a data summary of data stored on a DLT network.
  • the first preset value may be a constant, such as 1, 2, 3, etc.
  • the first preset value may also be an operation value of any X items among the data summary of encrypted data, a preset constant, the first data summary and a value stored on a DLT network, and the above operation may be an addition operation, a subtraction operation or other mathematical operation, without special limitation.
  • X is greater than or equal to two.
  • the above first value may also be a summary of other data or other values, and the other data or other values may be known to each node in the distributed storage network.
  • P third nodes for storing data in a distributed storage network can be determined based on the first value, where P is a positive integer greater than one.
  • the P third nodes can be discovered using a small amount of data, and the method for determining the P third nodes is very convenient and effective.
  • the ID of the i-th third node among the P third nodes is a hash value of the second value.
  • the second value is the sum of the ID of the i-1 second node and a second preset value, or the second value is the sum of the ID of the i-1 second node and a preset function value, and the preset function value is related to i.
  • the ID of the first third node among the P third nodes is the hash value of the first value.
  • the second preset value may be any constant, such as 1, 2, 3, etc.
  • the preset function value may be a function value corresponding to any preset function related to i, and the preset function may be a logarithmic function, an exponential function, a linear function, etc.
  • the preset function is log i, or the preset function is 2i+6, or the preset function is 2 i .
  • the first value is the data digest HF of the encrypted data
  • the second preset value is 1.
  • P is 10
  • the IDs of the P third nodes are respectively:
  • the data storage request further includes a data name of the first data, and the data name corresponds to a data summary of the encrypted data.
  • the second node can obtain the data name of the first data from the data storage request, and the data name corresponds to the data summary of the encrypted data.
  • the second node can obtain the data summary of the encrypted data corresponding to the data name (i.e., the data summary used for verification) based on the data name of the first data.
  • the second node can verify the correctness of the encrypted data it has received based on the data summary of the encrypted data, that is, determine whether the encrypted data has been tampered with, and ensure the correctness of the stored data.
  • the second node can calculate the data summary of the received encrypted data, and then compare the calculated data summary with the data summary used for verification. When the latter two are the same, it can be confirmed that the encrypted data has not been tampered with.
  • the data storage method further includes the following steps:
  • the first node sends a data registration request to the first network, where the data registration request includes a data name of the first data and a data summary of the encrypted data.
  • the first node sends a data registration request to the first network, and the first network can respond to the data registration request, store the data carried in the request, and complete the data registration; that is, the first network stores the corresponding relationship between the data name of the first data and the data summary of the encrypted data.
  • the second node can obtain the corresponding data summary of the encrypted data from the first network according to the data name of the first data.
  • the first node calculates a data digest of the encrypted data.
  • the first network mentioned above can be a DLT network or other storage network, which is not particularly limited here.
  • the second node obtains the data digest of the encrypted data corresponding to the data name according to the data name, including:
  • the second node sends a summary request to the first network, wherein the summary request includes a data name.
  • the second node receives a data summary of the encrypted data corresponding to the data name sent by the first network.
  • the data registration request further includes first indication information, where the first indication information is used to determine P, and the first indication information corresponds to the data name.
  • the first network can also store the correspondence between the data name of the first data and the first indication information, so that the second node can obtain the corresponding first indication information according to the data name of the first data, and then determine P according to the first indication information, and then split the encrypted data according to P.
  • the second node may request the first network to obtain the first indication information corresponding to the data name of the first data.
  • the first network may respond to the above summary request and send the data summary of the encrypted data and the first indication information to the second node.
  • the second node may also initiate another request to the first network to obtain the first indication information.
  • the data storage method further includes the following steps:
  • the first node sends P subkeys to P third nodes.
  • the P subkeys are obtained by splitting a first key used to encrypt the first data, wherein at least M subkeys of the P subkeys are used to restore the first key.
  • the first node splits the first key to obtain P subkeys, and sends the P subkeys to P third nodes.
  • the first node processes the first key using a threshold key sharing algorithm to obtain P subkeys, assuming that the threshold value of the threshold key sharing algorithm is M, the first key can be recovered based on subkeys greater than or equal to M.
  • each of the P third nodes stores one of the P sub-keys.
  • splitting the key means randomly generating coefficient values from a 1 to a M-1 .
  • M-1 degree polynomial function curve randomly select P different points ⁇ (x 1 ,y 1 ), (x 2 ,y 2 ),...,(x P ,y P ) ⁇ , and assign these points to P third nodes.
  • Each coordinate obtained by the third node is a secret share, and a secret share is a subkey.
  • Recovering the key means aggregating the key fragments by M third nodes and substituting the M coordinate points into the original function to determine a unique curve. Based on the curve, the value of ⁇ a 0 ,a 1 ,a 2 ,...a M-1 ⁇ can be calculated, where a 0 is the first key.
  • the first node may send P subkeys to P third nodes respectively based on the network identification information of the P third nodes.
  • the P subkeys are Z1, Z2, Z3, Z4, Z5, Z6, Z7, Z8, Z9 and Z10 respectively.
  • the second node sends subkey Z1 to the third node J1, sends subkey Z2 to the third node J2, sends subkey Z3 to the third node J3, and so on.
  • the first node may first send P subkeys to the second node, and then the second node may send the P subkeys to P third nodes.
  • the method by which the second node sends P subkeys to P third nodes may be the same as the method by which the second node sends P fragments, which will not be elaborated here.
  • the first node when P third nodes have stored P shards, the first node sends P subkeys to the P third nodes, and one third node stores one subkey.
  • the subkey stored by an individual node among the P third nodes is lost, the encrypted data cannot be decrypted using a single subkey. Therefore, the solution of the embodiment of the present application can effectively ensure the security of the first key and further ensure the confidentiality of the stored data.
  • the data storage method further includes the following steps:
  • the first node receives second indication information, where the second indication information is used to indicate that P third nodes have stored P subkeys.
  • the first node sends third indication information to the first network, where the third indication information is used to indicate that storage of the first data is complete, and the third indication information corresponds to the data name.
  • the first node after the first node receives the second indication information, it sends the third indication information to the first network, so that the first network can update the storage status of the first data according to the third indication information, and the data requester can learn from the first network that the first data has been stored and is in a requestable state.
  • the access network device when the first node is an access network device, after receiving the second indication information, the access network device feeds back the storage result of the first data to the terminal that sends the data storage request.
  • the second indication information is composed of P sub-indication information, and the sub-indication information is used to indicate that the third node has stored a subkey.
  • the sub-indication information is used to indicate that the third node has stored a subkey.
  • Each of the P third nodes sends its own sub-indication information to the first node, so that the first node knows that the P third nodes have stored P subkeys.
  • each of the P third nodes sends its own sub-indication information to the second node.
  • the second node After the second node receives the sub-indication information from each of the P third nodes, the second node sends a second indication information to the first node.
  • the second indication information is used to indicate that the P third nodes have stored P sub-keys.
  • the embodiment of the present application also provides a node determination method, which can be applied to a node determination device or a chip in a node determination device.
  • the node determination device can be any node in a distributed storage network.
  • FIG 4 is a flow chart of a node determination method provided in an embodiment of the present application.
  • the node determination method comprises the following steps:
  • the first task may include a storage task or a computing task, the storage task is used to store data, and the computing task is used to process data.
  • splitting the storage task into P subtasks can be understood as splitting the data to be stored into P shards, such as using an information dispersion algorithm to split the data, and the algorithm for splitting the data is not particularly limited.
  • splitting the computing task into P sub-computing tasks For another example, splitting the computing task into P sub-computing tasks. Similarly, the algorithm for splitting the computing task is not particularly limited.
  • the first value includes any one of the following: a summary corresponding to the data to be processed by the first task, a first preset value, a first data summary, or a value stored on a distributed ledger technology DLT network, and the first data summary is a data summary of the data stored on the DLT network.
  • the specific description of the first value here can refer to the description of the first value in the above data storage method, and will not be repeated here.
  • P nodes in the distributed storage network for executing P subtasks can be determined based on the first value, and the method for determining the P nodes is very convenient and effective.
  • the ID of the i-th node among the P nodes is the hash value of the second value
  • the second value is the sum of the ID of the i-1-th node and the second preset value
  • the second value is the sum of the ID of the i-1-th node and a preset function value
  • the preset function value is related to i.
  • the ID of the first node among the P nodes is the hash value of the first value.
  • the node determination method further includes:
  • the node determines that the device sends P shards to P nodes respectively, so that each node stores one shard.
  • the node determines that the device sends P sub-computing tasks to P nodes respectively, so that each node processes one sub-computing task.
  • the method for the node to determine that the device sends P shards or P sub-computing tasks can refer to the description of the second node sending P shards, which will not be repeated.
  • FIG5 is a schematic diagram of the structure of a first node provided in an embodiment of the present application.
  • the first node 500 includes an encryption module 501, a sending module 502 and a receiving module 503. Among them:
  • the encryption module 501 is used to encrypt the first data to obtain encrypted data.
  • the sending module 502 is configured to send a data storage request to a second node.
  • the second node is any node in the distributed storage network, and the data storage request includes encrypted data.
  • the receiving module 503 is used to receive feedback information.
  • the feedback information is used to indicate that the P third nodes have stored P shards, and the P shards are obtained by splitting the encrypted data. Among them, at least M shards of the P shards are used to restore the encrypted data.
  • the P third nodes are nodes in the distributed storage network, P and M are positive integers greater than one, and M is less than P.
  • the encryption module 501 may be implemented by a processor
  • the sending module 502 may be implemented by a transmitter
  • the receiving module 503 may be implemented by a receiver.
  • the sending module 502 and the receiving module 503 may also be combined into a transceiver.
  • the sending module 502 is further configured to send P subkeys to P third nodes.
  • the P subkeys are obtained by splitting the first key used to encrypt the first data, wherein at least M of the P subkeys are used to restore the first key.
  • the data storage request further includes a data name of the first data, where the data name corresponds to a data digest of the encrypted data.
  • the sending module 502 is further configured to send a data registration request to the first network, where the data registration request includes a data name of the first data and a data summary of the encrypted data.
  • the data registration request further includes first indication information, where the first indication information is used to determine P, and the first indication information corresponds to the data name.
  • the receiving module 503 is further configured to receive second indication information.
  • the second indication information is used to indicate that the P third nodes have stored the P subkeys.
  • the first node sends third indication information to the first network, the third indication information is used to indicate that the storage of the first data is complete, and the third indication information corresponds to the data name.
  • first node For a detailed description of the first node, please refer to the description of the first node in the above data storage method, which will not be repeated here.
  • the embodiment of the present application also provides a second node, which is any node in the distributed storage network.
  • FIG. 6 is a schematic diagram of the structure of a second node provided in an embodiment of the present application.
  • the second node 600 includes a receiving module 601, a splitting module 602, a determining module 603 and a sending module 604, wherein
  • the receiving module 601 is configured to receive a data storage request sent by a first node.
  • the data storage request includes encrypted data, and the encrypted data is obtained by the first node encrypting the first data.
  • the splitting module 602 is used to split the encrypted data into P fragments, wherein at least M fragments of the P fragments are used to restore the encrypted data, P and M are positive integers greater than one, and M is less than P.
  • the determination module 603 is used to determine P third nodes in the distributed storage network.
  • the sending module 604 is used to send the P slices to P third nodes respectively.
  • the receiving module 601 may be implemented by a receiver
  • the splitting module 602 and the determining module 603 may be implemented by a processor
  • the sending module 604 may be implemented by a transmitter.
  • the sending module 604 and the receiving module 601 may also be combined into a transceiver.
  • the determination module 603 is specifically configured to:
  • the P third nodes are determined according to the first value.
  • the first value includes any one of the following: a data summary of the encrypted data, a first preset value, a first data summary, or a value stored on a distributed ledger technology DLT network, and the first data summary is a data summary of the data stored on the DLT network.
  • the identity ID of the i-th third node among the P third nodes is a hash value of the second value.
  • the second value is the sum of the ID of the i-1 second node and a second preset value, or the second value is the sum of the ID of the i-1 second node and a preset function value, and the preset function value is related to i.
  • the ID of the first third node among the P third nodes is the hash value of the first value.
  • the data storage request further includes a data name of the first data
  • the second node further includes:
  • the acquisition module is used to obtain the data summary of the encrypted data corresponding to the data name according to the data name.
  • the verification module is used to verify the correctness of the encrypted data based on the data digest.
  • the acquisition module is further configured to acquire first indication information corresponding to the data name according to the data name.
  • the first indication information is used to determine P.
  • the acquisition module in acquiring the data summary of the encrypted data corresponding to the data name according to the data name, is specifically used to:
  • a summary request is sent to the first network, wherein the summary request includes a data name.
  • a data digest of encrypted data corresponding to the data name sent by the first network in response to the digest request is received.
  • the acquisition module in acquiring the first indication information corresponding to the data name according to the data name, is specifically configured to:
  • the present application also provides a data storage system.
  • the system includes a first node, a second node, and a third node.
  • the first node is used to encrypt the first data to obtain encrypted data, and send a data storage request to the second node.
  • the data storage request includes the encrypted data
  • the second node is any node in the distributed storage network.
  • the second node is used to split the encrypted data into P fragments. At least M fragments of the P fragments are used to recover the encrypted data. P and M are positive integers greater than one, and M is less than P. P third nodes in the distributed network are determined, and the P fragments are sent to the P third nodes respectively.
  • the third node is used to store one of the P shards.
  • the embodiment of the present application further provides a distributed storage network, the distributed storage network includes a second node and a third node, with reference to FIG3A , wherein:
  • the second node is used to receive a data storage request sent by the first node.
  • the second node is any node in the distributed storage network
  • the first node is a node with data storage requirements
  • the data storage request includes encrypted data, which is obtained by encrypting the first data by the first node.
  • the second node is further used to split the encrypted data into P fragments, wherein at least M fragments of the P fragments are used to restore the encrypted data.
  • the second node is further used to determine P third nodes in the distributed network, and send the P shards to the P third nodes respectively, where P and M are positive integers greater than one, and M is less than P.
  • the P third nodes are nodes in the distributed storage network.
  • Each of the P third nodes is used to store one shard among the P shards.
  • the embodiment of the present application further provides a node determination device, refer to Figure 7, which is a schematic diagram of the structure of the node determination device provided by the embodiment of the present application.
  • the node determination device 700 includes a splitting module 701 and a determination module 702, wherein:
  • the splitting module 701 is used to split the first task into P subtasks, where P is a positive integer greater than one.
  • the determination module 702 is configured to determine P nodes in the distributed storage network according to a first value.
  • the first value includes any one of the following: a summary corresponding to the data to be processed by the first task, a first preset value, a first data summary, or a value stored on a distributed ledger technology DLT network, wherein the first data summary is a data summary of the data stored on the DLT network.
  • the identity ID of the i-th node among the P nodes is the hash value of the second value
  • the second value is the sum of the ID of the i-1-th node and a preset value
  • the second value is the sum of the ID of the i-1-th node and a preset function value
  • the preset function value is related to i.
  • the ID of the first node among the P nodes is the hash value of the first value.
  • the node determination device 700 further includes:
  • the sending module is used to send P subtasks to P nodes respectively. Each node executes one subtask.
  • node determination device For a detailed description of the node determination device, please refer to the relevant description of the above-mentioned node determination method, which will not be repeated here.
  • the embodiment of the present application also provides a communication device, refer to Figure 8, which is a schematic diagram of the structure of the communication device provided in the embodiment of the present application.
  • the communication device 800 includes a memory 801, a processor 802, a communication interface 804 and a bus 803. Among them, the memory 801, the processor 802, and the communication interface 804 are connected to each other through the bus 803. Among them, the memory 801 can be one or more, and the processor 802 can be one or more.
  • the communication device 800 may be a chip or a chip system.
  • the memory 801 may be a read-only memory (ROM), a static storage device, a dynamic storage device or a random access memory (RAM).
  • the memory 801 may store a program. When the program stored in the memory 801 is executed by the processor 802, the processor 802 is used to execute the various steps of the method described in any of the above embodiments.
  • Processor 802 can adopt a general-purpose central processing unit (CPU), a microprocessor, an application specific integrated circuit (ASIC), a graphics processing unit (GPU) or one or more integrated circuits to execute relevant programs to implement the method described in any of the above embodiments.
  • CPU central processing unit
  • ASIC application specific integrated circuit
  • GPU graphics processing unit
  • the processor 802 may also be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the method described in any embodiment of the present application may be completed by an integrated logic circuit of hardware or software instructions in the processor 802.
  • the above-mentioned processor 802 may also be a general-purpose processor, a digital signal processor (Digital Signal Processing, DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.
  • DSP Digital Signal Processing
  • ASIC application-specific integrated circuit
  • FPGA field programmable gate array
  • the disclosed methods, steps and logic block diagrams in the embodiments of the present application may be implemented or executed.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.
  • the steps of the method described in any embodiment of the present application may be directly embodied as being executed by a hardware decoding processor, or may be executed by a combination of hardware and software modules in a decoding processor.
  • the software module may be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc.
  • the storage medium is located in the memory 801, and the processor 802 reads the information in the memory 801 and completes the method described in any of the above embodiments in combination with its hardware.
  • the communication interface 804 uses a transceiver such as, but not limited to, a transceiver to implement communication between the communication device 800 and other devices or a communication network.
  • a transceiver such as, but not limited to, a transceiver to implement communication between the communication device 800 and other devices or a communication network.
  • the communication device 800 can obtain first data through the communication interface 804.
  • the bus 803 may include a path for transmitting information between various components of the communication device 800 (eg, the memory 801 , the processor 802 , and the communication interface 804 ).
  • the communication device 800 shown in FIG8 only shows a memory, a processor, and a communication interface, in the specific implementation process, those skilled in the art should understand that the communication device 800 also includes other devices necessary for normal operation. At the same time, according to specific needs, those skilled in the art should understand that the communication device 800 may also include hardware devices for implementing other additional functions. In addition, those skilled in the art should understand that the communication device 800 may also only include the devices necessary for implementing the embodiments of the present application, and does not necessarily include all the devices shown in FIG8.
  • An embodiment of the present application provides a chip system, which is applied to a communication device.
  • the chip system includes one or more processors, and the processor is used to call computer instructions so that the communication device executes a method as described in any of the above embodiments.
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only schematic.
  • the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.
  • Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the computer program product includes one or more computer instructions.
  • the computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.
  • the computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integration.
  • the available medium can be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk), etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Bioethics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Storage Device Security (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

一种数据存储方法及相关设备，该方法包括：第一节点先对第一数据进行加密得到加密数据，可以有效保障数据的机密性；第二节点再将加密数据拆分成P个分片；再由P个第三节点存储上述P个分片，即一个第三节点存储一个分片；其中，基于P个分片中的至少M个分片可以恢复得到加密数据，因此，即使P个第三节点中的个别节点被攻击，仍然可以基于P个分片中的至少M个分片恢复得到加密数据，有效保障存储的数据的完整性。

Description

数据存储方法及相关设备 技术领域
本申请涉及通信技术领域，尤其涉及一种数据存储方法及相关设备。
背景技术
随着通讯技术、物联网技术以及边缘计算技术的迅速发展，越来越多的设备拥有了数据收集和数据处理的能力。分布式存储网络是将数据分散存储在多台独立的设备(或存储节点)上。分布式网络存储网络采用可扩展的系统结构，利用多台设备分担存储负荷，它不但提高了系统的可靠性、可用性和存取效率，还易于扩展。然而，如何保障分布式存储网络存储的数据的完整性和机密性是需要解决的问题。
发明内容
本申请提供了一种数据存储方法及相关设备，可以有效保证数据的完整性和机密性。
第一方面，本申请提供了一种数据存储方法。该方法应用于第一节点，第一节点为具有数据存储需求的节点。
该数据存储方法包括以下步骤：第一节点对第一数据进行加密得到加密数据；第一节点向第二节点发送数据存储请求。其中，第二节点为分布式存储网络中的任意一个节点。而数据存储请求包括加密数据。第一节点接收反馈信息。该反馈信息用于指示P个第三节点已存储P个分片，上述P个分片是对加密数据进行拆分得到的。其中，P个分片中的至少M个分片用于恢复得到加密数据。P个第三节点为分布式存储网络中的节点。P、M为大于一的正整数，M小于P。
本方案中，第一节点先对第一数据进行加密得到加密数据，可以有效保障数据的机密性。第二节点再将加密数据拆分成P个分片；再由P个第三节点存储上述P个分片，即每个第三节点存储一个分片。其中，基于P个分片中的至少M个分片可以恢复得到加密数据，因此，即使P个第三节点中的个别节点被攻击，仍然可以基于P个分片中的至少M个分片恢复得到加密数据，有效保障存储的数据的完整性。
结合第一方面的一种可能的实施方式中，上述数据存储方法还包括以下步骤：第一节点向P个第三节点发送P个子密钥。P个子密钥是对用于加密第一数据的第一密钥进行拆分得到的，其中，P个子密钥中的至少M个子密钥用于恢复得到第一密钥。
从而，本申请中，P个第三节点已存储P个分片时，第一节点向P个第三节点发送P个子密钥，每个第三节点存储一个子密钥。当P个第三节点中的个别节点存储的子密钥丢失时，利用单个子密钥无法对加密数据进行解密，因此，利用本申请的方案，可以有效保障第一密钥的安全性，进一步保障存储数据的机密性。
结合第一方面的一种可能的实施方式中，数据存储请求还包括第一数据的数据名称，数据名称与加密数据的数据摘要对应。
从而，本申请中，第一节点向第二节点发送的数据存储请求中还可以包括第一数据的数据名称，该数据名称与加密数据的数据摘要对应，这样，第二节点根据第一数据的数据名称可以获得加密数据的数据摘要。第二节点根据加密数据的数据摘要可以对其接收到的加密数据的正确性进行验证，即判断加密数据是否被篡改过，保障存储的数据的正确性。
结合第一方面的一种可能的实施方式中，上述数据存储方法还包括以下步骤：第一节点向第一网络发送数据注册请求，数据注册请求包括第一数据的数据名称和加密数据的数据摘要。
从而，本申请中，第一节点向第一网络发送数据注册请求，第一网络可以响应该数据注册请求，将该请求中携带的数据存储下来，即第一网络将第一数据的数据名称和加密数据的数据摘要的对应关系存储下来。这样，第二节点可以根据第一数据的数据名称从第一网络获得对应的加密数据的数据摘要。
结合第一方面的一种可能的实施方式中，上述数据注册请求还包括第一指示信息，第一指示信息用于确定P，第一指示信息和数据名称对应。
从而，本申请中，第一网络还可以存储第一数据的数据名称和第一指示信息的对应关系，这样，第二节点根据第一数据的数据名称可以得到对应的第一指示信息，进而可以根据第一指示信息确定P，再根据P对加密数据进行拆分。
结合第一方面的一种可能的实施方式中，上述数据存储方法还包括以下步骤：第一节点接收第二指示信息。该第二指示信息用于指示P个第三节点已存储P个子密钥。第一节点向第一网络发送第三指示信息，第三指示信息用于指示第一数据存储完成，第三指示信息与数据名称对应。
从而，本申请中，在第一节点接收到第二指示信息之后，向第一网络发送第三指示信息，以使第一网络根据第三指示信息可以更新第一数据的存储状态，数据请求方可以从第一网络获知第一数据已完成存储且为可请求状态。
第二方面，本申请还提供一种数据存储方法。该方法应用于第二节点，第二节点为分布式存储网络中的任意一个节点。
具体地，数据存储方法包括以下步骤：第二节点接收第一节点发送的数据存储请求。该数据存储请求包括加密数据，加密数据是第一节点对第一数据进行加密得到的。第二节点将加密数据拆分成P个分片。其中，P个分片中的至少M个分片用于恢复得到加密数据，P、M为大于一的正整数，M小于P。第二节点确定分布式存储网络中的P个第三节点。第二节点将P个分片分别发送给P个第三节点。
本方案中，第二节点将加密数据拆分成P个分片；再由P个第三节点存储上述P个分片，即一个第三节点存储一个分片。其中，基于P个分片中的至少M个分片可以恢复得到加密数据，因此，即使P个第三节点中的个别节点被攻击，仍然可以基于P个分片中的至少M个分片恢复得到加密数据，有效保障存储的数据的完整性。
结合第二方面的一种可能的实施方式中，上述第二节点确定分布式存储网络中的P个第三节点，包括：第二节点根据第一值确定P个第三节点。第一值包括以下任一项：加密数据的数据摘要、第一预设数值、第一数据摘要或分布式账本技术DLT网络上存储的数值，第一数据摘要为DLT网络上存储的数据的数据摘要。上述第一值还可以是其他数据的摘要或其他数值，其他数据或其他数值为分布式存储网络中各个节点能够获知的即可。
从而，本申请中，根据第一值可以确定分布式存储网络中用于存储数据的P个第三节点，P为大于一的正整数，确定P个第三节点的方法十分便捷有效。
结合第二方面的一种可能的实施方式中，上述P个第三节点中第i个第三节点的身份标识ID为第二值的哈希运算值。该第二值为第i-1个第二节点的ID与第二预设数值之间的和，或者，该第二值为第i-1个第二节点的ID与预设函数值之间的和，预设函数值与i相关。P个第三节点中第一个第三节点的ID为上述第一值的哈希运算值。
结合第二方面的一种可能的实施方式中，上述数据存储请求还包括第一数据的数据名称，上述数据存储方法还包括以下步骤：第二节点根据数据名称获取数据名称对应的加密数据的数据摘要。第二节点根据数据摘要验证加密数据的正确性。
从而，本申请中，第一节点向第二节点发送的数据存储请求中还可以包括第一数据的数据名称，该数据名称与加密数据的数据摘要对应，这样，第二节点根据第一数据的数据名称可以获得加密数据的数据摘要。第二节点根据加密数据的数据摘要可以对其接收到的加密数据的正确性进行验证，即判断加密数据是否被篡改过，保障存储的数据的正确性。
结合第二方面的一种可能的实施方式中，上述数据存储方法还包括以下步骤：第二节点根据数据名称获取数据名称对应的第一指示信息。该第一指示信息用于确定P。
从而，本申请中，第二节点根据第一数据的数据名称可以得到对应的第一指示信息，进而可以根据第一指示信息确定P，再根据P对加密数据进行拆分。
结合第二方面的一种可能的实施方式中，第二节点根据数据名称获取数据名称对应的加密数据的数据摘要，包括：第二节点向第一网络发送摘要请求，该摘要请求包括数据名称。第二节点接收第一网络发送的数据名称对应的加密数据的数据摘要。
从而，本申请中，第二节点可以向第一网络发送摘要请求，以请求获得第一数据的数据名称对应的加密数据的数据摘要。
结合第二方面的一种可能的实施方式中，第二节点根据数据名称获取数据名称对应的第一指示信息，包括：第二节点根据数据名称从第一网络获取数据名称对应的第一指示信息。
从而，本申请中，第二节点可以向第一网络请求获得第一数据的数据名称对应的第一指示信息。示例性地，第一网络可以响应上述摘要请求，将加密数据的数据摘要和第一指示信息一同发给第二节点。又示例性地，第二节点也可以另外向第一网络发起一个请求，以获得第一指示信息。
第三方面，本申请还提供一种数据存储方法，该方法应用于数据存储系统。该系统包括第一节点，第二节点和第三节点，第一节点为具有数据存储需求的节点。
具体地，上述数据存储方法包括以下步骤：第一节点对第一数据进行加密得到加密数据。第一节点向第二节点发送数据存储请求。数据存储请求包括上述加密数据，第二节点为分布式存储网络中的任意一个节点。第二节点将加密数据拆分成P个分片。其中，P个分片中的至少M个分片用于恢复得到加密数据。第二节点确定分布式网络中的P个第三节点，并将P个分片分别发送给P个第三节点。P、M为大于一的正整数，M小于P。P个第三节点为分布式存储网络中的节点。P个第三节点中每个第三节点存储P个分片中的一个分片。
本方案中，第一节点先对第一数据进行加密得到加密数据，可以有效保障数据的机密性。第二节点再将加密数据拆分成P个分片；再由P个第三节点存储上述P个分片，即一个第三节点存储一个分片。其中，基于P个分片中的至少M个分片可以恢复得到加密数据，因此，即使P个第三节点中的个别节点被攻击，仍然可以基于P个分片中的至少M个分片恢复得到加密数据，有效保障存储的数据的完整性。
结合第三方面的一种可能的实施方式中，上述数据存储方法还包括以下步骤：第一节点接收反馈信息。该反馈信息用于指示P个第三节点已存储P个分片。第一节点向P个第三节点发送P个子密钥。P个子密钥是对用于加密第一数据的第一密钥进行拆分得到的，其中，P个子密钥中的至少M个子密钥用于恢复得到第一密钥。P个第三节点中每个第三节点存储P个子密钥中的一个子密钥。
从而，本申请中，第一节点接收到反馈信息之后，向P个第三节点发送P个子密钥，以 使一个第三节点存储一个子密钥。当P个第三节点中的个别节点存储的子密钥丢失时，利用单个子密钥无法对加密数据进行解密，因此，利用本申请的方案，可以有效保障第一密钥的安全性，进一步保障存储数据的机密性。
结合第三方面的一种可能的实施方式中，上述数据存储请求还包括第一数据的数据名称，上述数据存储方法还包括以下步骤：第二节点根据数据名称获取数据名称对应的加密数据的数据摘要。第二节点根据数据摘要验证加密数据的正确性。
从而，本申请中，第二节点根据加密数据的数据摘要可以对其接收到的加密数据的正确性进行验证，即判断加密数据是否被篡改过，保障存储的数据的正确性。
结合第三方面的一种可能的实施方式中，上述数据存储方法还包括以下步骤：第二节点根据数据名称获取数据名称对应的第一指示信息，第一指示信息用于确定P。
从而，本申请中，第二节点根据第一数据的数据名称可以得到对应的第一指示信息，进而可以根据第一指示信息确定P，再根据P对加密数据进行拆分。
结合第三方面的一种可能的实施方式中，上述数据存储系统还包括第一网络，第二节点根据数据名称获取数据名称对应的加密数据的数据摘要，包括：第二节点向第一网络发送摘要请求。摘要请求包括数据名称。第二节点接收第一网络发送的数据名称对应的加密数据的数据摘要。
从而，本申请中，第二节点可以根据第一数据的数据名称从第一网络获得对应的加密数据的数据摘要。
结合第三方面的一种可能的实施方式中，第二节点接收第一网络响应摘要请求而发送的数据名称对应的第一指示信息。
从而，本申请中，第一网络可以响应上述摘要请求，将加密数据的数据摘要和第一指示信息一同发给第二节点。
结合第三方面的一种可能的实施方式中，上述数据存储方法还包括以下步骤：第一节点向第一网络发送数据注册请求，数据注册请求包括第一数据的数据名称和加密数据的数据摘要。
从而，本申请中，第一节点向第一网络发送数据注册请求，第一网络可以响应该数据注册请求，将该请求中携带的数据存储下来。
结合第三方面的一种可能的实施方式中，数据注册请求还包括用于确定P的第一指示信息。
从而，本申请中，第一网络还可以存储第一数据的数据名称和第一指示信息的对应关系。
结合第三方面的一种可能的实施方式中，第二节点确定分布式存储网络中的P个第三节点，包括：第二节点根据第一值确定P个第二节点。第一值包括以下任一项：加密数据的数据摘要、第一预设数值、第一数据摘要或分布式账本技术DLT网络上存储的数值，第一数据摘要为DLT网络上存储的数据的数据摘要。
从而，本申请中，根据第一值可以确定分布式存储网络中用于存储数据的P个第三节点，P为大于一的正整数，确定P个第三节点的方法十分便捷有效。
结合第三方面的一种可能的实施方式中，P个第三节点中第i个第三节点的身份标识ID为第二值的哈希运算值。该第二值为第i-1个第三节点的ID与第二预设数值之间的和，或者，第二值为第i-1个第三节点的ID与预设函数值之间的和，预设函数值与i相关。P个第三节点中第一个第三节点的ID为第一值的哈希运算值。
第四方面，本申请还提供一种数据存储方法，该方法应用于分布式存储网络。
具体地，上述数据存储方法包括以下步骤：第二节点接收第一节点发送的数据存储请求。第二节点为分布式存储网络中的任意一个节点，第一节点为具有数据存储需求的节点，数据存储请求包括加密数据，该加密数据是第一节点对第一数据进行加密得到的。第二节点将加密数据拆分成P个分片，其中，P个分片中的至少M个分片用于恢复得到加密数据。第二节点确定分布式网络中的P个第三节点，并将P个分片分别发送给P个第三节点，P、M为大于一的正整数，M小于P。P个第三节点为分布式存储网络中的节点。P个第三节点中每个第三节点存储P个分片中的一个分片。
本方案中，第二节点将加密数据拆分成P个分片；再由P个第三节点存储上述P个分片，即一个第三节点存储一个分片。其中，基于P个分片中的至少M个分片可以恢复得到加密数据，因此，即使P个第三节点中的个别节点被攻击，仍然可以基于P个分片中的至少M个分片恢复得到加密数据，有效保障存储的数据的完整性。
结合第四方面的一种可能的实施方式中，上述数据存储方法还包括以下步骤：P个第三节点中每个第三节点接收P个子密钥中的一个，一个第三节点存储一个子密钥。P个子密钥是对用于加密第一数据的第一密钥进行拆分得到的，其中，P个子密钥中的至少M个子密钥用于恢复得到第一密钥。P个子密钥是第一节点接收到反馈信息后发出的，该反馈信息用于指示P个第三节点已存储P个分片。
结合第四方面的一种可能的实施方式中，上述第二节点确定分布式存储网络中的P个第三节点，包括：第二节点根据第一值确定P个第三节点。第一值包括以下任一项：加密数据的数据摘要、第一预设数值、第一数据摘要或分布式账本技术DLT网络上存储的数值，第一数据摘要为DLT网络上存储的数据的数据摘要。上述第一值还可以是其他数据的摘要或其他数值，其他数据或其他数值为分布式存储网络中各个节点能够获知的即可。
结合第四方面的一种可能的实施方式中，上述P个第三节点中第i个第三节点的身份标识ID为第二值的哈希运算值。该第二值为第i-1个第二节点的ID与第二预设数值之间的和，或者，该第二值为第i-1个第二节点的ID与预设函数值之间的和，预设函数值与i相关。P个第三节点中第一个第三节点的ID为上述第一值的哈希运算值。
结合第四方面的一种可能的实施方式中，上述数据存储请求还包括第一数据的数据名称，上述数据存储方法还包括以下步骤：第二节点根据数据名称获取数据名称对应的加密数据的数据摘要。第二节点根据数据摘要验证加密数据的正确性。
结合第四方面的一种可能的实施方式中，上述数据存储方法还包括以下步骤：第二节点根据数据名称获取数据名称对应的第一指示信息。该第一指示信息用于确定P。
结合第四方面的一种可能的实施方式中，第二节点根据数据名称获取数据名称对应的加密数据的数据摘要，包括：第二节点向第一网络发送摘要请求。该摘要请求包括数据名称。第二节点接收第一网络响应摘要请求而发送的数据名称对应的加密数据的数据摘要。
结合第四方面的一种可能的实施方式中，第二节点根据数据名称获取数据名称对应的第一指示信息，包括：第二节点根据数据名称从第一网络获取数据名称对应的第一指示信息。
第五方面，本申请还提供一种节点确定方法，该方法可应用于节点确定设备或节点确定设备中的芯片。
具体地，上述节点确定方法包括以下步骤：将第一任务拆分成P个子任务，P为大于一的正整数。根据第一值确定分布式存储网络中的P个节点。第一值包括以下任一项：第一任务要处理的数据对应的摘要、第一预设数值、第一数据摘要或分布式账本技术DLT网络上存储的数值，第一数据摘要为DLT网络上存储的数据的数据摘要。
本方案中，根据第一值可以确定分布式存储网络中用于执行P个子任务的P个节点，P为大于一的正整数，确定P个节点的方法十分便捷有效。上述第一任务可以包括存储任务或计算任务。
结合第五方面的一种可能的实施方式中，上述P个节点中第i个节点的身份标识ID为第二值的哈希运算值，第二值为第i-1个节点的ID与第二预设数值之间的和，或者，第二值为第i-1个节点的ID与预设函数值之间的和，预设函数值与i相关。P个节点中第一个节点的ID为第一值的哈希运算值。
结合第五方面的一种可能的实施方式中，上述节点确定方法还包括：将P个子任务分别发送给P个节点，以使一个节点执行一个子任务。
第六方面，本申请还提供一种第一节点。第一节点包括加密模块、发送模块和接收模块。其中：
加密模块，用于对第一数据进行加密得到加密数据。
发送模块，用于向第二节点发送数据存储请求。第二节点为分布式存储网络中的任意一个节点，数据存储请求包括加密数据。
接收模块，用于接收反馈信息。该反馈信息用于指示P个第三节点已存储P个分片，P个分片是对加密数据进行拆分得到的。其中，P个分片中的至少M个分片用于恢复得到加密数据。P个第三节点为分布式存储网络中的节点，P、M为大于一的正整数，M小于P。
第七方面，本申请还提供一种第二节点，第二节点为分布式存储网络中的任意一个节点。第二节点包括接收模块、拆分模块、确定模块和发送模块，其中：
接收模块，用于接收第一节点发送的数据存储请求。数据存储请求包括加密数据，加密数据是第一节点对第一数据进行加密得到的。
拆分模块，用于将加密数据拆分成P个分片。其中，P个分片中的至少M个分片用于恢复得到加密数据，P、M为大于一的正整数，M小于P。
确定模块，用于确定分布式存储网络中的P个第三节点。
发送模块，用于将P个分片分别发送给P个第三节点。
第八方面，本申请还提供一种数据存储系统，该系统包括第一节点，第二节点和第三节点。其中：
第一节点，用于对第一数据进行加密得到加密数据；并向第二节点发送数据存储请求。数据存储请求包括加密数据，第二节点为分布式存储网络中的任意一个节点。
第二节点，用于将加密数据拆分成P个分片。其中，P个分片中的至少M个分片用于恢复得到加密数据。P、M为大于一的正整数，M小于P。确定分布式存储网络中的P个第三节点，并将P个分片分别发送给P个第三节点。
第三节点，用于存储P个分片中的一个分片。
第九方面，本申请还提供一种节点确定设备，节点确定设备包括拆分模块和确定模块，其中：
拆分模块，用于将第一任务拆分成P个子任务，P为正整数。
确定模块，用于根据第一值确定分布式存储网络中的P个节点。第一值包括以下任一项：第一任务要处理的数据对应的摘要、第一预设数值、第一数据摘要或分布式账本技术DLT网络上存储的数值，第一数据摘要为DLT网络上存储的数据的数据摘要。
结合第九方面的一个可能的实施方式中，P个节点中第i个节点的身份标识ID为第二值的哈希运算值，第二值为第i-1个节点的ID与预设数值之间的和，或者，第二值为第i-1个 节点的ID与预设函数值之间的和，预设函数值与i相关。P个节点中第一个节点的ID为第一值的哈希运算值。
第十方面，本申请还提供一种通信装置，所述通信装置包括一个或多个处理器和一个或多个存储器；其中，所述一个或多个存储器与所述一个或多个处理器耦合，所述一个或多个存储器用于存储计算机程序代码，所述计算机程序代码包括计算机指令，当所述一个或多个处理器执行所述计算机指令时，使得所述通信装置执行如第一方面、第二方面、第三方面、第四方面或第五方面中任一项所述的方法。
第十一方面，本申请还提供一种计算机可读存储介质，所述计算机可读存储介质存储有指令，当所述指令被处理器执行时，实现第一方面、第二方面、第三方面、第四方面或第五方面中任一项所述的方法。
第十二方面，本申请还提供一种计算机程序产品，包括计算机程序，当所述计算机程序在处理器上运行时，实现第一方面、第二方面、第三方面、第四方面或第五方面中任一项所述的方法。
第十三方面，本申请提供了一种芯片系统，所述芯片系统应用于通信装置，所述芯片系统包括一个或多个处理器，所述处理器用于调用计算机指令以使得所述通信装置执行如第一方面、第二方面、第三方面、第四方面或第五方面中任一项所述的方法。
附图说明
图1是本申请实施例提供的数据存储系统的结构示意图；
图2是本申请实施例提供的数据存储方法的流程图；
图3A是本申请实施例提供的数据存储方法的交互流程图；
图3B是本申请实施例提供的纠删码的示意图；
图3C是本申请实施例提供的故障情况下的纠删码示意图；
图3D是本申请实施例提供的故障情况下的纠删码的运算示意图；
图3E是本申请实施例提供的纠删码恢复数据示意图；
图4是本申请实施例提供的节点确定方法的流程示意图；
图5是本申请实施例提供的第一节点的结构示意图；
图6是本申请实施例提供的第二节点的结构示意图；
图7是本申请实施例提供的节点确定设备的结构示意图；
图8是本申请实施例提供的通信装置的结构示意图。
具体实施方式
本申请以下实施例中所使用的术语只是为了描述特定实施例的目的，而并非旨在作为对本申请的限制。如在本申请的说明书和所附权利要求书中所使用的那样，单数表达形式“一个”、“一种”、“所述”、“上述”、“该”和“这一”旨在也包括复数表达形式，除非其上下文中明确地有相反指示。还应当理解，本申请中使用的术语“和/或”是指并包含一个或多个所列出项目的任何或所有可能组合。
以下，术语“第一”、“第二”仅用于描述目的，而不能理解为暗示或暗示相对重要性或者隐含指明所指示的技术特征的数量。由此，限定有“第一”、“第二”的特征可以明示或者隐含地包括一个或者更多个该特征，在本申请实施例的描述中，除非另有说明，“多个”的含义是两个或两个以上。
由于本申请实施例涉及方法，为了便于理解，下面先对本申请实施例涉及的相关术语及 概念进行介绍。
(1)、分布式存储网络
本申请实施例中，分布式存储网络是由若干个分布式存储节点(简称节点)组成的数据存储网络。示例性地，分布式哈希表(Distributed Hash Table，DHT)网络是分布式存储网络中的一种，其中，该网络的存储节点可以为基站和/或核心网网元。又示例性地，分布式存储网络的存储节点还可以是边缘服务器。
分布式网络存储网络采用可扩展的系统结构，利用多台设备分担存储负荷，它不但提高了系统的可靠性、可用性和存取效率，还易于扩展。
(2)、分布式账本技术(Distribution Leger Technology，DLT)网络
分布式账本技术(DLT)网络是一种去中心化的数据管理架构。整个网络中存在若干个节点，每个节点都复制并保存一份相同的账本。当账本上的数据发生改变时，所有节点独立更新，并通过共识算法来决定正确的账本副本，达成共识后所有节点根据正确的副本账本进行同步。同时，DLT网络也使用加密算法和数字签名等技术来提高系统的安全性。DLT网络可以按使用的数据结构分类，如区块链、有向无环图。或按使用的共识算法分类，如工作量证明(Proof of Work，PoW)，权益证明(Proof of Stake，PoS)。示例性地，DLT网络中的节点可以为基站和/或核心网网元。
(3)、信息分散算法
在编码理论里，有一种前向纠错(FEC)编码方式，也称为纠删码。这种技术可以将原始数据中丢失的k字节数据从n个含编码字节的信息中进行恢复。
而信息分散算法是将原始数据使用纠删码技术处理后得到P个分片，其中，P＝M+N，M小于或等于N。根据任意M个分片都可以恢复得到原始数据。信息分散算法包括里德-所罗门(Reed-solomon，RS)纠删码算法或局部修复码(Locally Repairable Codes，LRC)算法。LRC算法是一种局部校验编码方法，其核心思想为：将校验块(parity block)分为全局校验块(global parity)、局部校验块(local reconstruction parity)，故障恢复时分组计算。
(4)、门限密钥共享算法
门限密钥共享算法是将原始密钥通过处理得到P个子密钥，利用大于或等于M个子密钥的组合就可以求解出原始密钥。
下面结合上述术语，对本申请实施例中涉及的方法进行介绍。
现有技术中，如何保障分布式存储网络存储的数据的完整性和机密性是需要解决的问题。由此，本申请实施例提供一种数据存储方法，利用该方法可以有效保证存储的数据的完整性和机密性。
本申请实施例的方法可以应用于数据存储系统，参考图1，图1是本申请实施例提供的数据存储系统的结构示意图。该数据存储系统包括第一节点101和分布式存储网络102。可选地，数据存储系统还包括第一网络103。第一节点101、分布式存储网络102和第一网络103之间具有有线和/或无线通信连接。具体地，分布式存储网络102包括具有有线和/或无线通信连接的若干节点。分布式存储网络102包括第二节点104和P个第三节点105。第二节点104为分布式存储网络102中的任意一个节点，即第二节点104可为P个第三节点105中的一个。示例性地，图1中，分布式存储网络102中的节点以基站为例，如第二节点104和第三节点105。又示例性地，分布式存储网络102中的节点还可以为核心网网元106，示例性地，核心网网元106包括以下至少一项：接入和移动性管理功能(access and mobility  management function，AMF)网元、会话管理功能(session management function，SMF)网元、用户面功能(user plane function，UPF)网元、移动性管理实体(mobility management entity，MME)网元、服务网关(serving gateway，SGW)或包数据网络网关(PDN gateway，PGW)。其中，PDN的全称为Packet Data Network。
其中，第一节点101为具有数据存储需求的节点，第一节点101将数据存储到分布式存储网络102中的具体过程，可以参考图2的具体描述，在此不做赘述。
下面首先介绍本申请实施例提供的示例性数据存储方法。
图2是本申请实施例提供的数据存储方法的流程图。数据存储方法包括以下步骤：
201、第一节点对第一数据进行加密得到加密数据。
具体地，第一节点是具有数据存储需求的节点。可选的，第一节点利用第一密钥对第一数据进行加密，以得到加密数据。其中，第一密钥可以为非对称密钥或对称密钥。示例性地，第一节点可以从其他设备获得第一密钥。又示例性地，第一节点可以随机生成一个对称密钥，再利用该对称密钥对第一数据进行加密。
第一节点可以包括终端设备或接入网设备。其中，终端设备或接入网设备不限于长期演进技术(long term evolution，LTE)系统，长期演进高级技术(long term evolution-advanced，LTE-A)系统，增强的长期演进技术(enhanced long term evolution-advanced，eLTE)系统，第五代(the 5th Generation，5G)移动通信系统新空口(New Radio，NR)系统，第六代(the6th Generation，6G)移动通信系统等未来的通信网络系统中的终端设备或接入网设备。
终端设备简称终端，也称为用户设备(user equipment，UE)，其可以包括各种具有无线通信功能的手持设备、车载设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备，以及各种形式的终端，移动台(mobile station，MS)，终端(terminal)，软终端，接入终端，终端设备单元(subscriber unit)，终端设备站，移动站，移动台(mobile station，MS)，远方站，远程终端，移动设备，终端设备代理，终端设备装置等等。例如，水表、电表、传感器等。
接入网设备可以有以下任意一种替换词：无线接入网络，接入网(access network，AN)，其中接入网设备可以是基站、继续演进的节点B(gNB)、演进型节点B(evolved node B，eNB)、传输接收点(transmission reception point，TRP)、集中单元(centralized unit，CU)节点、分布单元(distributed unit，DU)节点、发送点(transmission point，TP)、接收点(receiving point，RP)等，对此不做限定。在接入网设备的一些部署下中，CU节点还可以划分为CU-控制面(control plane，CP)和CU-用户面(user plane，UP)等。在接入网设备的另一些部署中，接入网设备还可以是天线单元(radio unit，RU)等。在接入网设备的又一些部署中，接入网设备还可以是开放的无线接入网(open radio access network，ORAN)架构等。示例性地，在ORAN系统中，CU还可以称为开放(open，O)-CU，DU还可以称为O-DU，CU-CP还可以称为O-CU-CP，CU-UP还可以称为O-CU-UP，RU还可以称为O-RU。
当第一节点为接入网设备时，接入网设备从终端接收第一数据。示例性地，终端可以向接入网设备发送一个数据存储请求，该数据存储请求包括第一数据，这样，终端接收到数据存储请求，可以得到第一数据。
202、第一节点向第二节点发送数据存储请求。其中，第二节点为分布式存储网络中的任意一个节点。而数据存储请求包括加密数据。
相应地，参考图3A，图3A是本申请实施例提供的数据存储方法的交互流程图。第二节 点接收第一节点发送的数据存储请求。第二节点将加密数据拆分或处理得到P个分片。其中，P个分片中的至少M个分片用于恢复得到加密数据。第二节点确定分布式存储网络中的P个第三节点。第二节点将P个分片分别发送给P个第三节点，相应的，每个第三节点存储一个分片。
其中，P、M为大于一的正整数，M小于P。
示例性地，当第二节点采用信息分散算法对加密数据进行拆分以得到P个分片时，基于至少M个分片可以恢复得到加密数据。
示例性地，信息分散算法使用RS纠删码技术对加密数据进行处理后得到P(P＝M+N)个分片。纠删码有两个参数M和N，记为RS(M，N)，M为源数据块的个数，N为校验块的个数。M个源数据块组成一个向量D被乘上一个生成矩阵B从而得到一个数据向量，该数据向量由M个数据块和N个校验块构成。如果一个数据块丢失，可以通过一系列计算来恢复出丢失的数据块。RS(M，N)最多可容忍N个块(包括数据块和校验块)丢失。
以冗余级别M+N为5+3(即M为5，N为3)的纠删码为例说明。参考图3B，图3B是本申请实施例提供的纠删码的示意图。将M个源数据块D 1～D M按列排成向量D，再构造一个(M+N)M矩阵B，B称为分布矩阵。其中，矩阵B的任意M个行向量都是相互独立的，即这M个行向量组成的MM矩阵为可逆的。执行矩阵向量乘B*D，得到N个校验块C 1～C N和M个源数据块D 1～D M组成的数据向量。
假设将上述数据向量中每个数据块存储在一个硬盘中，当(M+N)个硬盘中的N个硬盘发生了故障，即图3B中的数据块D 1、D 4、C 2丢失，需要从剩下的M个数据块中恢复出来源数据块D 1～D M。参考图3C，图3C是本申请实施例提供的故障情况下的纠删码示意图。从矩阵B中将剩余数据块对应的行向量挑出来，组成新矩阵B’，B’乘以向量D的结果恰好是未故障的数据块所组成的数据向量。因为B的任意M行组成的矩阵都可逆，所以矩阵B’存在逆矩阵，记为B ’-1。参考图3D，图3D是本申请实施例提供的故障情况下的纠删码的运算示意图。在图3C中的等式的左右两边同时左乘矩阵B ’-1，其中，由于B ’-1*B’＝E，而单位矩阵E乘任何矩阵都等于该矩阵；因此，由图3D可以得到图3E，图3E是本申请实施例提供的纠删码恢复数据示意图。也即根据逆矩阵B ’-1和未故障的数据块所组成的数据向量可以得到M个源数据块D 1～D M，完成数据恢复。
又示例性地，第二节点采用其他方法对加密数据进行拆分以得到P个分片时，可以基于至少M个分片的数据恢复得到加密数据。其他方法例如LRC算法，对此不做特别限定。
第二节点确定了P个第三节点之后，可以得到P个第三节点的网络标识信息，网络标识信息例如第三节点的身份标识(identity document，ID)或第三节点的IP地址等。
示例性地，第二节点根据第三节点的网络标识信息可以将P个分片发送给对应的第三节点，例如P个分片为S1、S2、S3、S4、S5、S6、S7、S8、S9和S10这十个分片，P个第三节点为J1、J2、J3、J4、J5、J6、J7、J8、J9和J10这十个第三节点，第二节点将分片S1发送给第三节点J1，将分片S2发送给第三节点J2，将分片S3发送给第三节点J3，依此类推。
又示例性地，第二节点可以将P个分片和P个第三节点的网络标识信息发送给P个第三节点中的任一个第三节点，如第三节点J6，第三节点J6获取P个分片中的任意一个分片之后，将剩余(P-1)个分片发送给(P-1)个第三节点中的任一个；重复执行上一步骤直到分片发送完毕。
203、第一节点接收反馈信息。该反馈信息用于指示P个第三节点已存储P个分片，上述P个分片是第二节点对加密数据进行拆分或处理得到的。P个第三节点为分布式存储网络中的 节点。而P、M为大于一的正整数，M小于P。
示例性地，反馈信息由P个子反馈信息组成，子反馈信息用于指示第三节点已存储一个分片。P个第三节点中每个第三节点分别向第一节点发送各自的子反馈信息，以使第一节点知晓P个第三节点已存储P个分片。可选地，第三节点在发送子反馈信息时，还可以将自身的网络标识信息一并进行发送。又可选地，P个第三节点中每个第三节点分别将各自的子反馈信息发送给第二节点。
又示例性地，P个第三节点中每个第三节点分别向第二节点发送各自的子反馈信息，第二节点接收到P个第三节点中每个第三节点的子反馈信息后，第二节点再向第一节点发送一个反馈信息，该一个反馈信息用于指示P个第三节点已存储P个分片。
在一个可能的实施例中，第二节点将P个第三节点的网络标识信息发送给第一节点。示例性地，第二节点在接收到P个子反馈信息之后，将P个第三节点的网络标识信息传输给第一节点，这样，第一节点根据P个第三节点的网络标识信息可以向P个第三节点发送信息。
本实施例中，第一节点先对第一数据进行加密得到加密数据，可以有效保障数据的机密性。第二节点再将加密数据拆分成P个分片；再由P个第三节点存储上述P个分片，即每个第三节点存储一个分片。其中，基于P个分片中的至少M个分片可以恢复得到加密数据，因此，即使P个第三节点中的个别节点被攻击，仍然可以基于P个分片中的至少M个分片恢复得到加密数据，有效保障存储的数据的完整性。
另外，现有技术中，对数据进行备份需要对整个数据进行备份，而本申请中，每个节点只需要存储一个分片，即可以实现备份，可以有效节省备份开销。而且，本申请实施例的方案为分布式存储方案，可以节省通讯开销。
在一种可能的实施方式中，数据存储方法还包括第二节点计算每个分片的数据摘要，即分片摘要。可选地，第二节点向每个第三节点发送分片对应的分片摘要，以使第三节点可以根据分片摘要验证接收到的分片的正确性，确认其是否未被篡改。又可选地，第二节点可以将P个分片摘要一并发送给每个第三节点，以使第三节点找到自身对应的分片摘要，再根据该分片摘要验证接收到的分片的正确性。具体地，第三节点根据接收到的分片计算得到一个分片摘要，再根据该分片摘要和上述自身对应的分片摘要进行对比，以验证接收到的分片的正确性。在一种可能的实施方式中，上述第二节点确定分布式存储网络中的P个第三节点，包括：
第二节点根据第一值确定P个第三节点。
其中，第一值包括以下任一项：加密数据的数据摘要、第一预设数值、第一数据摘要或DLT网络上存储的数值，第一数据摘要为DLT网络上存储的数据的数据摘要。示例性地，第一预设数值可以是常数，例如为1、2、3等数值。又示例性地，第一预设数值也可以是加密数据的数据摘要、预设的常数、第一数据摘要和DLT网络上存储的数值中任意X项的运算值，上述运算可以是加法运算、减法运算或其他数学运算，不做特别限定。X大于或等于二。上述第一值还可以是其他数据的摘要或其他数值，其他数据或其他数值为分布式存储网络中各个节点能够获知的即可。
从而，本申请实施例中，根据第一值可以确定分布式存储网络中用于存储数据的P个第三节点，P为大于一的正整数，通过少量的数据就能发现P个第三节点，确定P个第三节点的方法十分便捷有效。
在一种可能的实施方式中，上述P个第三节点中第i个第三节点的ID为第二值的哈希(hash)运算值。该第二值为第i-1个第二节点的ID与第二预设数值之间的和，或者，该第 二值为第i-1个第二节点的ID与预设函数值之间的和，预设函数值与i相关。P个第三节点中第一个第三节点的ID为上述第一值的哈希运算值。
上述第二预设数值可以为任意常数，例如1、2、3等。而预设函数值可以是任意与i相关的预设函数的对应的函数值，上述预设函数可以是对数函数、指数函数、线性函数等，例如预设函数为log i，或者，预设函数为2i+6，或者，预设函数为2 i。
以第一值为加密数据的数据摘要HF，而第二预设数值为1为例。假设P为10，则P个第三节点的ID分别为：
J1＝hash(HF),
J2＝hash(J1+1),
……,
J10＝hash(J9+1)。
在一种可能的实施方式中，上述数据存储请求还包括第一数据的数据名称，数据名称与加密数据的数据摘要对应。
从而，本申请实施例中，第二节点从数据存储请求中可以获得第一数据的数据名称，该数据名称与加密数据的数据摘要对应，这样，第二节点根据第一数据的数据名称可以获得数据名称对应的加密数据的数据摘要(即用于验证的数据摘要)。第二节点根据加密数据的数据摘要可以对其接收到的加密数据的正确性进行验证，即判断加密数据是否被篡改过，保障存储的数据的正确性。具体地，第二节点可以计算接收到的加密数据的数据摘要，再根据计算得到的数据摘要和用于验证的数据摘要进行对比，当前后两者相同时，可以确认加密数据并未被篡改。
在一种可能的实施方式中，参考图3A，上述数据存储方法还包括以下步骤：
第一节点向第一网络发送数据注册请求，数据注册请求包括第一数据的数据名称和加密数据的数据摘要。
从而，本申请实施例中，第一节点向第一网络发送数据注册请求，第一网络可以响应该数据注册请求，将该请求中携带的数据存储下来，完成数据注册；即第一网络将第一数据的数据名称和加密数据的数据摘要的对应关系存储下来。这样，第二节点可以根据第一数据的数据名称从第一网络获得对应的加密数据的数据摘要。
相应地，在步骤201中，第一节点计算加密数据的数据摘要。
上述第一网络可以为DLT网络或其他存储网络，在此不做特别限定。
在一种可能的实施方式中，参考图3A，上述第二节点根据数据名称获取数据名称对应的加密数据的数据摘要，包括：
第二节点向第一网络发送摘要请求。该摘要请求包括数据名称。
第二节点接收第一网络发送的数据名称对应的加密数据的数据摘要。
在一种可能的实施方式中，上述数据注册请求还包括第一指示信息，第一指示信息用于确定P，第一指示信息和数据名称对应。
从而，本申请实施例中，第一网络还可以存储第一数据的数据名称和第一指示信息的对应关系，这样，第二节点根据第一数据的数据名称可以得到对应的第一指示信息，进而可以根据第一指示信息确定P，再根据P对加密数据进行拆分。
本申请实施例中，第二节点可以向第一网络请求获得第一数据的数据名称对应的第一指示信息。示例性地，第一网络可以响应上述摘要请求，将加密数据的数据摘要和第一指示信息一同发给第二节点。又示例性地，第二节点也可以另外向第一网络发起一个请求，以获得 第一指示信息。
在一种可能的实施方式中，参考图3A，上述数据存储方法还包括以下步骤：
第一节点向P个第三节点发送P个子密钥。P个子密钥是对用于加密第一数据的第一密钥进行拆分得到的，其中，P个子密钥中的至少M个子密钥用于恢复得到第一密钥。
具体地，第一节点接收到反馈信息后，对第一密钥进行拆分得到P个子密钥，向P个第三节点发送P个子密钥。示例性地，当第一节点利用门限密钥共享算法处理第一密钥以得到P个子密钥时，假设门限密钥共享算法的门限值为M，则基于大于或等于M个的子密钥可以恢复得到第一密钥。
相应地，P个第三节点中每个第三节点存储P个子密钥中的一个。
示例性地，利用门限密钥共享算法处理第一密钥时，包括分割(split)密钥和恢复(recover)密钥两个过程。其中，门限密钥共享算法是使用一个M-1次多项式函数来隐藏第一密钥，M-1次多项式函数为a(x)＝a 0+a 1x+a 2x 2+…+a a-1x M-1，其中，将第一密钥编码为常数a 0。
具体地，分割密钥是指随机生成a 1到a M-1这几个系数值。在这条M-1次多项式函数曲线上，任意取P个不同的点{(x 1,y 1)，(x 2,y 2),...,(x P,y P)}，将这些点分配给P个第三节点，每个第三节点拿到的一个坐标都是一个密钥分片(secret share)，密钥分片即子密钥。
恢复密钥(recover)是指将M个第三节点把密钥分片聚合在一起，将M个坐标点代入原函数中，可以确定一条唯一的曲线，根据该曲线可以计算出{a 0,a 1,a 2，……a M-1}的值，其中的a 0即是第一密钥。
在一个实例中，第一节点可以根据P个第三节点的网络标识信息分别向P个第三节点发送P个子密钥，例如，P个子密钥分别为Z1、Z2、Z3、Z4、Z5、Z6、Z7、Z8、Z9和Z10，第二节点将子密钥Z1发送给第三节点J1，将子密钥Z2发送给第三节点J2，将子密钥Z3发送给第三节点J3，依此类推。
在另一个实例中，第一节点可以先将P个子密钥发送给第二节点，再由第二节点将P个子密钥发送给P个第三节点，第二节点发送P个子密钥给P个第三节点的方法可以与第二节点发送P个分片的方法相同，在此不做赘述。
从而，本申请实施例中，在P个第三节点已存储P个分片时，第一节点向P个第三节点发送P个子密钥，一个第三节点存储一个子密钥。当P个第三节点中的个别节点存储的子密钥丢失时，利用单个子密钥无法对加密数据进行解密，因此，利用本申请实施例的方案，可以有效保障第一密钥的安全性，进一步保障存储数据的机密性。
在一种可能的实施方式中，参考图3A，上述数据存储方法还包括以下步骤：
第一节点接收第二指示信息。该第二指示信息用于指示P个第三节点已存储P个子密钥。
第一节点向第一网络发送第三指示信息，第三指示信息用于指示第一数据存储完成，第三指示信息与数据名称对应。
从而，本申请实施例中，在第一节点接收到第二指示信息之后，向第一网络发送第三指示信息，以使第一网络根据第三指示信息可以更新第一数据的存储状态，数据请求方可以从第一网络获知第一数据已完成存储且为可请求状态。
示例性地，当第一节点为接入网设备时，接入网设备在接收到第二指示信息之后，向发送数据存储请求的终端反馈第一数据的存储结果。
在一个实例中，第二指示信息由P个子指示信息组成，子指示信息用于指示第三节点已存储一个子密钥。P个第三节点中每个第三节点分别向第一节点发送各自的子指示信息，以使第一节点知晓P个第三节点已存储P个子密钥。
在另一个实例中，P个第三节点中每个第三节点分别向第二节点发送各自的子指示信息，第二节点接收到P个第三节点中每个第三节点的子指示信息后，第二节点再向第一节点发送一个第二指示信息，该一个第二指示信息用于指示P个第三节点已存储P个子密钥。
本申请实施例还提供一种节点确定方法，该方法可应用于节点确定设备或节点确定设备中的芯片。示例性地，节点确定设备可以为分布式存储网络中的任意一个节点。
参考图4，图4是本申请实施例提供的节点确定方法的流程示意图。上述节点确定方法包括以下步骤：
401、将第一任务拆分成P个子任务。
具体地，P为大于一的正整数。第一任务可以包括存储任务或计算任务，存储任务用于存储数据，计算任务用于对数据进行处理。
对第一任务进行拆分的方法可以有很多，例如，对存储任务进行拆分得到P个子任务可以理解为对要存储的数据进行拆分得到P个分片，如利用信息分散算法等算法对数据进行拆分，对拆分数据的算法不做特别限定。又例如，对计算任务进行拆分得到P个子计算任务。同样地，对拆分计算任务的算法不做特别限定。
402、根据第一值确定分布式存储网络中的P个节点。
其中，第一值包括以下任一项：第一任务要处理的数据对应的摘要、第一预设数值、第一数据摘要或分布式账本技术DLT网络上存储的数值，第一数据摘要为DLT网络上存储的数据的数据摘要。此处关于第一值的具体描述可以参考上述数据存储方法中对第一值的描述，不再赘述。
本申请实施例中，根据第一值可以确定分布式存储网络中用于执行P个子任务的P个节点，确定P个节点的方法十分便捷有效。
在一种可能的实施方式中，上述P个节点中第i个节点的ID为第二值的哈希运算值，第二值为第i-1个节点的ID与第二预设数值之间的和，或者，第二值为第i-1个节点的ID与预设函数值之间的和，预设函数值与i相关。P个节点中第一个节点的ID为第一值的哈希运算值。
在一种可能的实施方式中，参考图4，上述节点确定方法还包括：
403、将P个子任务分别发送给P个节点。
具体地，第一任务为存储任务时，节点确定设备将P个分片分别发送给P个节点，以使每个节点存储一个分片。而第一任务为计算任务时，节点确定设备将P个子计算任务分别发送给P个节点，以使每个节点处理一个子计算任务。具体地，节点确定设备发送P个分片或P个子计算任务的方法可以参考上述第二节点发送P个分片的描述，不再赘述。
下面对本申请实施例提供的装置进行说明。
参考图5，图5是本申请实施例提供的第一节点的结构示意图。第一节点500包括加密模块501、发送模块502和接收模块503。其中：
加密模块501，用于对第一数据进行加密得到加密数据。
发送模块502，用于向第二节点发送数据存储请求。第二节点为分布式存储网络中的任意一个节点，数据存储请求包括加密数据。
接收模块503，用于接收反馈信息。该反馈信息用于指示P个第三节点已存储P个分片，P个分片是对加密数据进行拆分得到的。其中，P个分片中的至少M个分片用于恢复得到加 密数据。P个第三节点为分布式存储网络中的节点，P、M为大于一的正整数，M小于P。
示例性地，加密模块501可以由处理器来实现，发送模块502可以通过发送器来实现，而接收模块503可以通过接收器来实现。可选地，发送模块502和接收模块503也可以合设为收发器。
在一个可能的实施例中，发送模块502还用于向P个第三节点发送P个子密钥。P个子密钥是对用于加密第一数据的第一密钥进行拆分得到的，其中，P个子密钥中的至少M个子密钥用于恢复得到第一密钥。
在一种可能的实施方式中，数据存储请求还包括第一数据的数据名称，数据名称与加密数据的数据摘要对应。
在一种可能的实施方式中，发送模块502还用于向第一网络发送数据注册请求，数据注册请求包括第一数据的数据名称和加密数据的数据摘要。
在一种可能的实施方式中，上述数据注册请求还包括第一指示信息，第一指示信息用于确定P，第一指示信息和数据名称对应。
在一种可能的实施方式中，接收模块503还用于接收第二指示信息。该第二指示信息用于指示P个第三节点已存储P个子密钥。第一节点向第一网络发送用于第三指示信息，第三指示信息用于指示第一数据存储完成，第三指示信息与数据名称对应。
关于第一节点的具体描述可以参考上述数据存储方法中第一节点侧的描述，在此不做赘述。
本申请实施例还提供一种第二节点，第二节点为分布式存储网络中的任意一个节点。
参考图6，图6是本申请实施例提供的第二节点的结构示意图。第二节点600包括接收模块601、拆分模块602、确定模块603和发送模块604，其中
接收模块601，用于接收第一节点发送的数据存储请求。数据存储请求包括加密数据，加密数据是第一节点对第一数据进行加密得到的。
拆分模块602，用于将加密数据拆分成P个分片。其中，P个分片中的至少M个分片用于恢复得到加密数据，P、M为大于一的正整数，M小于P。
确定模块603，用于确定分布式存储网络中的P个第三节点。
发送模块604，用于将P个分片分别发送给P个第三节点。
示例性地，接收模块601可以通过接收器来实现，拆分模块602和确定模块603可以由处理器来实现，而发送模块604可以通过发送器来实现。可选地，发送模块604和接收模块601也可以合设为收发器。
在一种可能的实施方式中，确定模块603具体用于：
根据第一值确定P个第三节点。第一值包括以下任一项：加密数据的数据摘要、第一预设数值、第一数据摘要或分布式账本技术DLT网络上存储的数值，第一数据摘要为DLT网络上存储的数据的数据摘要。
在一种可能的实施方式中，上述P个第三节点中第i个第三节点的身份标识ID为第二值的哈希运算值。该第二值为第i-1个第二节点的ID与第二预设数值之间的和，或者，该第二值为第i-1个第二节点的ID与预设函数值之间的和，预设函数值与i相关。P个第三节点中第一个第三节点的ID为上述第一值的哈希运算值。
在一种可能的实施方式中，上述数据存储请求还包括第一数据的数据名称，第二节点还包括：
获取模块，用于根据数据名称获取数据名称对应的加密数据的数据摘要。
验证模块，用于根据数据摘要验证加密数据的正确性。
在一种可能的实施方式中，获取模块，还用于根据数据名称获取数据名称对应的第一指示信息。该第一指示信息用于确定P。
在一种可能的实施方式中，获取模块在根据数据名称获取数据名称对应的加密数据的数据摘要方面，具体用于：
向第一网络发送摘要请求。该摘要请求包括数据名称。
接收第一网络响应摘要请求而发送的数据名称对应的加密数据的数据摘要。
在一种可能的实施方式中，获取模块在根据数据名称获取数据名称对应的第一指示信息方面，具体用于：
根据数据名称从第一网络获取数据名称对应的第一指示信息。
关于第二节点的具体描述可以参考上述数据存储方法中第二节点侧的描述，在此不做赘述。
本申请实施例还提供一种数据存储系统，参考图3A，该系统包括第一节点，第二节点和第三节点。其中：
第一节点，用于对第一数据进行加密得到加密数据；并向第二节点发送数据存储请求。数据存储请求包括加密数据，第二节点为分布式存储网络中的任意一个节点。
第二节点，用于将加密数据拆分成P个分片。其中，P个分片中的至少M个分片用于恢复得到加密数据。P、M为大于一的正整数，M小于P。确定分布式网络中的P个第三节点，并将P个分片分别发送给P个第三节点。
第三节点，用于存储P个分片中的一个分片。
关于数据存储系统的具体描述，可以参考上述数据存储方法中关于第一节点、第二节点和第三节点的相关描述，在此不做赘述。
本申请实施例还提供一种分布式存储网络，分布式存储网络包括第二节点和第三节点，参考图3A，其中：
第二节点，用于接收第一节点发送的数据存储请求。第二节点为分布式存储网络中的任意一个节点，第一节点为具有数据存储需求的节点，数据存储请求包括加密数据，该加密数据是第一节点对第一数据进行加密得到的。
第二节点，还用于将加密数据拆分成P个分片，其中，P个分片中的至少M个分片用于恢复得到加密数据。
第二节点，还用于确定分布式网络中的P个第三节点，并将P个分片分别发送给P个第三节点，P、M为大于一的正整数，M小于P。P个第三节点为分布式存储网络中的节点。
P个第三节点中每个第三节点用于存储P个分片中的一个分片。
关于分布式存储网络的具体描述，可以参考上述数据存储方法中关于第二节点和第三节点的相关描述，在此不做赘述。
本申请实施例还提供一种节点确定设备，参考图7，图7是本申请实施例提供的节点确定设备的结构示意图。节点确定设备700包括拆分模块701和确定模块702，其中：
拆分模块701，用于将第一任务拆分成P个子任务，P为大于一的正整数。
确定模块702，用于根据第一值确定分布式存储网络中的P个节点。第一值包括以下任一项：第一任务要处理的数据对应的摘要、第一预设数值、第一数据摘要或分布式账本技术DLT网络上存储的数值，第一数据摘要为DLT网络上存储的数据的数据摘要。
在一个可能的实施例中，P个节点中第i个节点的身份标识ID为第二值的哈希运算值， 第二值为第i-1个节点的ID与预设数值之间的和，或者，第二值为第i-1个节点的ID与预设函数值之间的和，预设函数值与i相关。P个节点中第一个节点的ID为第一值的哈希运算值。
在一个可能的实施例中，节点确定设备700还包括：
发送模块，用于将P个子任务分别发送给P个节点。每个节点执行一个子任务。
关于节点确定设备的具体描述，可以参考上述节点确定方法的相关描述，在此不做赘述。
本申请实施例还提供一种通信装置，参考图8，图8是本申请实施例提供的通信装置的结构示意图。通信装置800包括存储器801、处理器802、通信接口804以及总线803。其中，存储器801、处理器802、通信接口804通过总线803实现彼此之间的通信连接。其中，存储器801可以为一个或多个，处理器802可以为一个或多个。
示例性地，通信装置800可以为芯片或芯片系统。
存储器801可以是只读存储器(Read Only Memory，ROM)，静态存储设备，动态存储设备或者随机存取存储器(Random Access Memory，RAM)。存储器801可以存储程序，当存储器801中存储的程序被处理器802执行时，处理器802用于执行上述任意实施例所述的方法的各个步骤。
处理器802可以采用通用的中央处理器(Central Processing Unit，CPU)，微处理器，应用专用集成电路(Application Specific Integrated Circuit，ASIC)，图形处理器(graphics processing unit，GPU)或者一个或多个集成电路，用于执行相关程序，以实现上述任一实施例所述的方法。
处理器802还可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，本申请任一实施例所述的方法的各个步骤可以通过处理器802中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器802还可以是通用处理器、数字信号处理器(Digital Signal Processing，DSP)、专用集成电路(ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请任一实施例所述的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器801，处理器802读取存储器801中的信息，结合其硬件完成上述任一实施例所述的方法。
通信接口804使用例如但不限于收发器一类的收发装置，来实现通信装置800与其他设备或通信网络之间的通信。例如，通信装置800可以通过通信接口804获取第一数据等。
总线803可包括在通信装置800各个部件(例如，存储器801、处理器802、通信接口804)之间传送信息的通路。
应注意，尽管图8所示的通信装置800仅仅示出了存储器、处理器、通信接口，但是在具体实现过程中，本领域的技术人员应当理解，通信装置800还包括实现正常运行所必须的其他器件。同时，根据具体需要，本领域的技术人员应当理解，通信装置800还可包括实现其他附加功能的硬件器件。此外，本领域的技术人员应当理解，通信装置800也可仅仅包括实现本申请实施例所必须的器件，而不必包括图8中所示的全部器件。
本申请实施例提供了一种芯片系统，所述芯片系统应用于通信装置，所述芯片系统包括一个或多个处理器，所述处理器用于调用计算机指令以使得所述通信装置执行如上述任一实 施例所述的方法。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线)或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如DVD)、或者半导体介质(例如固态硬盘)等。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (32)

  1. 一种数据存储方法，其特征在于，所述方法包括以下步骤：
    第一节点对第一数据进行加密得到加密数据；
    所述第一节点向第二节点发送数据存储请求，所述第二节点为分布式存储网络中的任意一个节点，所述数据存储请求包括所述加密数据；
    所述第一节点接收反馈信息，所述反馈信息用于指示P个第三节点已存储P个分片，所述P个分片是对所述加密数据进行拆分得到的，其中，所述P个分片中的至少M个分片用于恢复得到所述加密数据；所述P个第三节点为所述分布式存储网络中的节点，所述P、所述M为大于一的正整数，所述M小于所述P。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括以下步骤：
    所述第一节点向所述P个第三节点发送P个子密钥，所述P个子密钥是对用于加密所述第一数据的第一密钥进行拆分得到的，其中，所述P个子密钥中的至少M个子密钥用于恢复得到所述第一密钥。
  3. 根据权利要求1或2所述的方法，其特征在于，所述数据存储请求还包括所述第一数据的数据名称，所述数据名称与所述加密数据的数据摘要对应。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括以下步骤：
    所述第一节点向第一网络发送数据注册请求，所述数据注册请求包括所述第一数据的数据名称和所述加密数据的数据摘要。
  5. 根据权利要求4所述的方法，其特征在于，所述数据注册请求还包括第一指示信息，所述第一指示信息用于确定所述P，所述第一指示信息和所述数据名称对应。
  6. 根据权利要求4或5所述的方法，其特征在于，所述方法还包括以下步骤：
    所述第一节点接收第二指示信息，所述第二指示信息用于指示所述P个第三节点已存储所述P个子密钥；
    所述第一节点向所述第一网络发送第三指示信息，所述第三指示信息用于指示所述第一数据存储完成，所述第三指示信息与所述数据名称对应。
  7. 一种数据存储方法，其特征在于，所述方法包括以下步骤：
    第二节点接收第一节点发送的数据存储请求，所述第二节点为分布式存储网络中的任意一个节点，所述数据存储请求包括加密数据，所述加密数据是所述第一节点对第一数据进行加密得到的；
    所述第二节点将所述加密数据拆分成P个分片，其中，所述P个分片中的至少M个分片用于恢复得到所述加密数据，所述P、所述M为大于一的正整数，所述M小于所述P；
    所述第二节点确定所述分布式存储网络中的P个第三节点；
    所述第二节点将所述P个分片分别发送给所述P个第三节点。
  8. 根据权利要求7所述的方法，其特征在于，所述第二节点确定所述分布式存储网络中的P个第三节点，包括：
    所述第二节点根据第一值确定所述P个第三节点，所述第一值包括以下任一项：所述加密数据的数据摘要、第一预设数值、第一数据摘要或分布式账本技术DLT网络上存储的数值，所述第一数据摘要为所述DLT网络上存储的数据的数据摘要。
  9. 根据权利要求8所述的方法，其特征在于，所述P个第三节点中第i个第三节点的身份标识ID为第二值的哈希运算值，所述第二值为第i-1个第二节点的ID与第二预设数值之间的和，或者，所述第二值为所述第i-1个第二节点的ID与预设函数值之间的和，所述预设函数值与所述i相关；所述P个第三节点中第一个第三节点的ID为所述第一值的哈希运算值。
  10. 根据权利要求7至9任一项所述的方法，其特征在于，所述数据存储请求还包括所述第一数据的数据名称，所述方法还包括以下步骤：
    所述第二节点根据所述数据名称获取所述数据名称对应的所述加密数据的数据摘要；
    所述第二节点根据所述数据摘要验证所述加密数据的正确性。
  11. 根据权利要求10所述的方法，其特征在于，所述方法还包括以下步骤：
    所述第二节点根据所述数据名称获取所述数据名称对应的第一指示信息，所述第一指示信息用于确定所述P。
  12. 根据权利要求10或11所述的方法，其特征在于，所述第二节点根据所述数据名称获取所述数据名称对应的所述加密数据的数据摘要，包括：
    所述第二节点向第一网络发送摘要请求，所述摘要请求包括所述数据名称；
    所述第二节点接收所述第一网络发送的所述数据名称对应的加密数据的数据摘要。
  13. 根据权利要求12所述的方法，其特征在于，所述第二节点根据所述数据名称获取所述数据名称对应的第一指示信息，包括：
    所述第二节点根据所述数据名称从所述第一网络获取所述数据名称对应的第一指示信息。
  14. 一种数据存储方法，其特征在于，所述方法应用于数据存储系统，所述系统包括第一节点，第二节点和第三节点；所述方法包括以下步骤：
    所述第一节点对第一数据进行加密得到加密数据；并向第二节点发送数据存储请求，所述数据存储请求包括所述加密数据，所述第二节点为分布式存储网络中的任意一个节点；
    所述第二节点将所述加密数据拆分成P个分片，其中，所述P个分片中的至少M个分片用于恢复得到所述加密数据；确定所述分布式网络中的P个第三节点，并将所述P个分片分别发送给所述P个第三节点，所述P、所述M为大于一的正整数，所述M小于所述P；所述P个第三节点为所述分布式存储网络中的节点；
    所述P个第三节点中每个第三节点存储所述P个分片中的一个分片。
  15. 根据权利要求14所述的方法，其特征在于，所述方法还包括以下步骤：
    所述第一节点接收反馈信息，所述反馈信息用于指示所述P个第三节点已存储P个分片；
    所述第一节点向所述P个第三节点发送P个子密钥，所述P个子密钥是对用于加密所述第一数据的第一密钥进行拆分得到的，其中，所述P个子密钥中的至少M个子密钥用于恢复得到所述第一密钥；
    所述P个第三节点中每个第三节点存储所述P个子密钥中的一个子密钥。
  16. 根据权利要求14或15所述的方法，其特征在于，所述数据存储请求还包括所述第一数据的数据名称，所述方法还包括以下步骤：
    所述第二节点根据所述数据名称获取所述数据名称对应的所述加密数据的数据摘要；
    所述第二节点根据所述数据摘要验证所述加密数据的正确性。
  17. 根据权利要求16所述的方法，其特征在于，所述方法还包括以下步骤：
    所述第二节点根据所述数据名称获取所述数据名称对应的第一指示信息，所述第一指示信息用于确定所述P。
  18. 根据权利要求17所述的方法，其特征在于，所述数据存储系统还包括第一网络，所述第二节点根据所述数据名称获取所述数据名称对应的所述加密数据的数据摘要，包括：
    所述第二节点向所述第一网络发送摘要请求，所述摘要请求包括所述数据名称；
    所述第二节点接收所述第一网络发送的所述数据名称对应的加密数据的数据摘要。
  19. 根据权利要求18所述的方法，其特征在于，所述第二节点接收所述第一网络响应所述摘要请求而发送的所述数据名称对应的第一指示信息。
  20. 根据权利要求18或19所述的方法，其特征在于，所述方法还包括以下步骤：
    所述第一节点向所述第一网络发送数据注册请求，所述数据注册请求包括所述第一数据的数据名称和所述加密数据的数据摘要。
  21. 根据权利要求20所述的方法，其特征在于，所述数据注册请求还包括用于确定所述P的第一指示信息。
  22. 根据权利要求14至21任一项所述的方法，其特征在于，所述第二节点确定所述分布式存储网络中的P个第三节点，包括：
    所述第二节点根据第一值确定所述P个第二节点，所述第一值包括以下任一项：所述加密数据的数据摘要、第一预设数值、第一数据摘要或分布式账本技术DLT网络上存储的数值，所述第一数据摘要为所述DLT网络上存储的数据的数据摘要。
  23. 根据权利要求22所述的方法，其特征在于，所述P个第三节点中第i个第三节点的身份标识ID为第二值的哈希运算值，所述第二值为第i-1个第三节点的ID与第二预设数值之间的和，或者，所述第二值为所述第i-1个第三节点的ID与预设函数值之间的和，所述预设函数值与所述i相关；所述P个第三节点中第一个第三节点的ID为所述第一值的哈希运算值。
  24. 一种节点确定方法，其特征在于，所述方法包括以下步骤：
    将第一任务拆分成P个子任务，所述P为大于一的正整数；
    根据第一值确定分布式存储网络中的P个节点，所述第一值包括以下任一项：所述第一任务要处理的数据对应的摘要、第一预设数值、第一数据摘要或分布式账本技术DLT网络上存储的数值，所述第一数据摘要为所述DLT网络上存储的数据的数据摘要。
  25. 根据权利要求24所述的方法，其特征在于，所述P个节点中第i个节点的身份标识ID为第二值的哈希运算值，所述第二值为第i-1个节点的ID与第二预设数值之间的和，或者，所述第二值为所述第i-1个节点的ID与预设函数值之间的和，所述预设函数值与所述i相关；所述P个节点中第一个节点的ID为所述第一值的哈希运算值。
  26. 一种第一节点，其特征在于，包括：
    加密模块，用于对第一数据进行加密得到加密数据；
    发送模块，用于向第二节点发送数据存储请求，所述第二节点为分布式存储网络中的任意一个节点，所述数据存储请求包括所述加密数据；
    接收模块，用于接收反馈信息，所述反馈信息用于指示P个第三节点已存储P个分片，所述P个分片是对所述加密数据进行拆分得到的，其中，所述P个分片中的至少M个分片用于恢复得到所述加密数据；所述P个第三节点为所述分布式存储网络中的节点，所述P、所述M为大于一的正整数，所述M小于所述P。
  27. 一种第二节点，其特征在于，所述第二节点为分布式存储网络中的任意一个节点，所述第二节点包括：
    接收模块，用于接收第一节点发送的数据存储请求，所述数据存储请求包括加密数据，所述加密数据是所述第一节点对第一数据进行加密得到的；
    拆分模块，用于将所述加密数据拆分成P个分片，其中，所述P个分片中的至少M个分片用于恢复得到所述加密数据，所述P、所述M为大于一的正整数，所述M小于所述P；
    确定模块，用于确定所述分布式存储网络中的P个第三节点；
    发送模块，用于将所述P个分片分别发送给所述P个第三节点。
  28. 一种数据存储系统，其特征在于，所述系统包括第一节点，第二节点和第三节点；
    所述第一节点，用于对第一数据进行加密得到加密数据；并向第二节点发送数据存储请求，所述数据存储请求包括所述加密数据，所述第二节点为分布式存储网络中的任意一个节点；
    所述第二节点，用于将所述加密数据拆分成P个分片，其中，所述P个分片中的至少M个分片用于恢复得到所述加密数据，所述P、所述M为大于一的正整数，所述M小于所述P；确定所述分布式存储网络中的P个第三节点，并将所述P个分片分别发送给所述P个第三节点；
    所述第三节点，用于存储所述P个分片中的一个分片。
  29. 一种节点确定设备，其特征在于，所述设备包括：
    拆分模块，用于将第一任务拆分成P个子任务，所述P为大于一的正整数；
    确定模块，用于根据第一值确定分布式存储网络中的P个节点，所述第一值包括以下任 一项：所述第一任务要处理的数据对应的摘要、第一预设数值、第一数据摘要或分布式账本技术DLT网络上存储的数值，所述第一数据摘要为所述DLT网络上存储的数据的数据摘要。
  30. 一种通信装置，其特征在于，所述通信装置包括一个或多个处理器和一个或多个存储器；其中，所述一个或多个存储器与所述一个或多个处理器耦合，所述一个或多个存储器用于存储计算机程序代码，所述计算机程序代码包括计算机指令，当所述一个或多个处理器执行所述计算机指令时，使得所述通信装置执行如权利要求1至25任一项所述的方法。
  31. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有指令，当所述指令被处理器执行时，实现权利要求1至25任一项所述的方法。
  32. 一种计算机程序产品，其特征在于，包括计算机程序，当所述计算机程序在处理器上运行时，实现权利要求1至25任一项所述的方法。
PCT/CN2023/071325 2023-01-09 2023-01-09 数据存储方法及相关设备 Ceased WO2024148464A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP23915246.5A EP4625882A4 (en) 2023-01-09 2023-01-09 DATA STORAGE METHOD AND ASSOCIATED DEVICE
PCT/CN2023/071325 WO2024148464A1 (zh) 2023-01-09 2023-01-09 数据存储方法及相关设备
CN202380081361.0A CN120345210A (zh) 2023-01-09 2023-01-09 数据存储方法及相关设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2023/071325 WO2024148464A1 (zh) 2023-01-09 2023-01-09 数据存储方法及相关设备

Publications (1)

Publication Number Publication Date
WO2024148464A1 true WO2024148464A1 (zh) 2024-07-18

Family

ID=91897578

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/071325 Ceased WO2024148464A1 (zh) 2023-01-09 2023-01-09 数据存储方法及相关设备

Country Status (3)

Country Link
EP (1) EP4625882A4 (zh)
CN (1) CN120345210A (zh)
WO (1) WO2024148464A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109831487A (zh) * 2019-01-08 2019-05-31 平安科技（深圳）有限公司 分片文件验证方法及终端设备
CN109885256A (zh) * 2019-01-23 2019-06-14 平安科技（深圳）有限公司 一种基于数据分片的数据存储方法、设备及介质
US20210111889A1 (en) * 2019-10-11 2021-04-15 Atakama LLC Relay network for encryption system
WO2021209966A1 (en) * 2020-04-17 2021-10-21 Uvue Ltd Distributed computer system and method of operation thereof
US20220038273A1 (en) * 2020-07-28 2022-02-03 Samsung Sds Co., Ltd. Distributed data management method based on a blockchain network and apparatus therefor
WO2022083871A1 (en) * 2020-10-22 2022-04-28 Qpq Ltd A system and method for self-adaptive and autonomous sharding of distributed ledger technology platforms

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8621580B2 (en) * 2010-05-19 2013-12-31 Cleversafe, Inc. Retrieving access information in a dispersed storage network
CN113347266A (zh) * 2021-06-21 2021-09-03 上海计算机软件技术开发中心 一种基于区块链的权限控制系统、方法以及ipfs

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109831487A (zh) * 2019-01-08 2019-05-31 平安科技（深圳）有限公司 分片文件验证方法及终端设备
CN109885256A (zh) * 2019-01-23 2019-06-14 平安科技（深圳）有限公司 一种基于数据分片的数据存储方法、设备及介质
US20210111889A1 (en) * 2019-10-11 2021-04-15 Atakama LLC Relay network for encryption system
WO2021209966A1 (en) * 2020-04-17 2021-10-21 Uvue Ltd Distributed computer system and method of operation thereof
US20220038273A1 (en) * 2020-07-28 2022-02-03 Samsung Sds Co., Ltd. Distributed data management method based on a blockchain network and apparatus therefor
WO2022083871A1 (en) * 2020-10-22 2022-04-28 Qpq Ltd A system and method for self-adaptive and autonomous sharding of distributed ledger technology platforms

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4625882A4 *

Also Published As

Publication number Publication date
CN120345210A (zh) 2025-07-18
EP4625882A1 (en) 2025-10-01
EP4625882A4 (en) 2025-12-31

Similar Documents

Publication Publication Date Title
US11316676B2 (en) Quantum-proof multiparty key exchange system, quantum-proof multiparty terminal device, quantum-proof multiparty key exchange method, program, and recording medium
US10372357B2 (en) Securely recovering stored data in a dispersed storage network
US11496290B2 (en) Blockchain network and finalization method therefor
KR102775668B1 (ko) 신경망 동기화에 기반한 비밀키 생성 방법 및 장치
US8977847B1 (en) Distributed challenge-response authentication
CN111786787B (zh) 基于可验证秘密共享的量子密钥分发后处理方法及其系统
Tyagi et al. When is a function securely computable?
US12580769B2 (en) Round optimal oblivious transfers from isogenies
CN115134086A (zh) 异步网络的动态委员会秘密分享更新方法及装置
US20240419537A1 (en) Data processing method based on blockchain network and related product
CN107666491A (zh) 基于对称加密的空地一体化网络的数据传输方法
US11329808B2 (en) Secure computation device, secure computation authentication system, secure computation method, and program
KR20260038899A (ko) 포스트 양자 임계 서명
US20060282677A1 (en) Security for network coding file distribution
CN113746623B (zh) 一种门限密钥验证方法及相关设备
US20180089020A1 (en) Managing rebuilding performance in a dispersed storage network
KR20240036392A (ko) Shamir 비밀 공유 및 HMAC 인증에 기초하는 중앙 집중식 임계 키 생성 프로토콜
CN111200560A (zh) 微服务注册方法、装置、设备及存储介质
WO2024148464A1 (zh) 数据存储方法及相关设备
An et al. Polar code-based secure transmission with higher message rate combining channel entropy and computational entropy
US20180018232A1 (en) Encryption of slice partials
CN114553505B (zh) 多方协同生成随机数的方法、装置、存储介质和计算设备
TWI776416B (zh) 分層確定性錢包的門檻式簽章系統及其方法
Tsaloli et al. WiP: Verifiable, secure and energy-efficient private data aggregation in wireless sensor networks
CN115643013B (zh) 密钥的分片方法、装置、存储介质及电子装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23915246

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 202380081361.0

Country of ref document: CN

WWE Wipo information: entry into national phase

Ref document number: 2023915246

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2023915246

Country of ref document: EP

Effective date: 20250626

WWP Wipo information: published in national office

Ref document number: 202380081361.0

Country of ref document: CN

NENP Non-entry into the national phase

Ref country code: DE

WWP Wipo information: published in national office

Ref document number: 2023915246

Country of ref document: EP