CN117200992A - System and method for identifying false of data stream transmission - Google Patents

Abstract

The invention discloses a system and method for data stream transmission and forgery authentication, including a client and a server. The client includes a request sending module for sending data stream requests; a data forwarding module for forwarding digital signatures; and a data reading module. , used to determine whether to read the data stream based on the signature verification result; the server includes a file storage module, used to obtain the data stream to be transmitted based on the data stream request; the XMSS hardware module includes a key acquisition unit, a digital signature unit and a digital Signature verification unit; file sending module, used to send digital signatures and their corresponding data streams, as well as signature verification results to the client. The invention temporarily generates public keys and private keys based on the data stream to be transmitted, and the public keys and private keys are only transmitted within the server, ensuring the security of the transmission and greatly improving the reliability of the data stream transmission authentication process. .

Description

A system and method for detecting forgery in data stream transmission

Technical field

The invention relates to a system and method for detecting forgery in data stream transmission, belonging to the technical field of data transmission.

Background technique

Data transmission is to transmit data from data source to data terminal according to a certain process. Its main function is to realize data transmission and exchange between points. How to ensure efficient and safe transmission of data information is an important issue. For example, public-key encryption algorithms that are currently widely used in the computer and Internet fields are based on three computational problems: integer decomposition problems, discrete logarithm problems, and elliptic curve problems, such as DH, ECDH, RSA, ECDSA, etc. However, these difficult problems can be solved efficiently by using sufficiently powerful quantum computers and specific quantum algorithms, such as Shor and Grove algorithms.

Therefore, with the rapid development of quantum computers. All existing encryption methods for digital identity verification, digital signatures and even network security certificates will be cracked by the computing power of quantum computers. In 2021, IBM launched the first quantum processor "Eagle" with more than 100 qubits, and recently launched the company's largest quantum computer processor "Osprey" with 433 qubits. When a quantum computer reaches 1024 qubits, it will be able to crack all existing network encryption. By then, all web security certificates, all digital offices, and signatures for online secure file transmissions can be forged, which may lead to a huge Internet security crisis. It will be difficult for people to identify which web pages are truly safe and which files have not been altered. Everyday life, business contracts and even military secrets will face severe tests.

XMSS, the extended Merkle Signature Scheme (eXtendedMerkle Signature Scheme), as a hash-based high-efficiency, high-security post-quantum encryption technology, was approved by the Internet Engineering Task Force as early as 2018. , IETF) and was recommended by NIST as a stateful post-quantum signature scheme in 2020. However, most of the existing XMSS implementation solutions remain at the code level, with low availability, high cost, and insufficient performance to use XMSS technology. It cannot be conveniently used by the public and therefore difficult to popularize.

In addition, the existing XMSS algorithm needs to perform tens of millions of hash operations, and general general-purpose processors are inefficient and difficult to quickly calculate the key, so they cannot meet the requirements of high-speed networks.

Papers for the "Higher Education Society Cup" National Undergraduate Mathematical Modeling Competition were once submitted in the MD5 (Message-DigestAlgorithm 5) code. However, the MD5 message digest algorithm in this technology does not have anti-quantum properties, resulting in the use of this algorithm in the future. It is not secure enough and can be easily cracked. In addition, the client's submission lacks a good hardware acceleration structure design, so it is easy to cause too many people in the queue and long waiting time when submitting. In addition, the client requires the user to click to generate the MD5 code and upload it after submission, which also exposes the signature verification operation to the user, making the operation cumbersome.

The information disclosed in this Background section is merely intended to increase understanding of the general background of the invention and should not be taken as an admission or in any way implying that the information constitutes prior art that is already known to a person of ordinary skill in the art.

Contents of the invention

The purpose of the present invention is to overcome the deficiencies in the prior art and provide a system and method for data stream transmission forgery authentication. The present invention temporarily generates a public key and a private key based on the data stream to be transmitted, and both the public key and the private key are only Transmitting within the server ensures the security of the transmission and greatly improves the reliability of the data stream transmission authentication process.

In order to achieve the above objects, the present invention is achieved by adopting the following technical solutions:

In a first aspect, the present invention discloses a data stream transmission forgery authentication system, including a client and a server,

The clients include:

Request sending module, used to send data stream requests to the server;

A data forwarding module, configured to receive the digital signature and its corresponding data stream sent by the server, and forward the digital signature to the server;

The data reading module is used to receive and determine whether to read the data stream in the data forwarding module based on the signature verification results sent by the server;

The servers include:

The file storage module is used to obtain the data stream to be transmitted according to the client's data stream request;

The XMSS hardware module includes a key acquisition unit, a digital signature unit and a digital signature verification unit; wherein the key acquisition unit generates the corresponding public key and private key according to the data stream to be transmitted; the digital signature The unit uses the private key to sign the data stream to be transmitted to obtain a digital signature; the digital signature verification unit uses the public key to verify the digital signature forwarded by the client to obtain the signature verification result;

The file sending module is used to send the digital signature and its corresponding data stream, as well as the signature verification result to the client.

Further, in the request sending module of the client, the data stream request includes a new data stream transmission request and a historical data stream playback request.

Further, the digital signature unit includes:

The SHA256 subunit is used to perform fixed bit width processing on the data stream to be transmitted to obtain a fixed bit width data stream;

The first WOTS subunit is used to perform a single digital signature operation based on the fixed-width data stream and the private key to obtain the first WOTS-pk data;

The first L-TREE subunit is used to compress the first WOTS-pk data into first leaf node data;

The MERKLE subunit is used to compress the first leaf node data into root node data; obtain the digital signature of XMSS based on the root node data.

Further, the digital signature verification unit includes:

The MSGchecksum subunit is used to verify the integrity of the digital signature forwarded by the client. After passing the verification, it is combined with the digest to obtain a fixed-width string;

The second WOTS subunit is used to perform a WOTS chain operation on the fixed-width character string to obtain the second WOTS-pk data;

The second L-TREE subunit is used to perform depth-first calculation on the second WOTS-pk data to obtain the L-TREE hash value;

The Authpath subunit is used to compress the L-TREE hash value, and use the public key to verify the correctness of the compressed L-TREE hash value to obtain the signature verification result.

Further, the determination of whether to read the data stream in the data forwarding module includes:

In response to the signature verification result being passed, the data reading module reads the data stream in the data forwarding module;

In response to the signature verification result being failed, the data forwarding module receives the server to resend the new digital signature and its corresponding data stream, forwards the new digital signature to the server for signature verification, and discards the previously stored signature verification. The result is a failed digital signature and its corresponding data stream.

Further, the file storage module and the file sending module are respectively connected to the XMSS hardware module through serial port communication.

In a second aspect, the present invention discloses a method for authenticating data stream transmission, which is suitable for the client of the system for authenticating data stream transmission described in the first aspect, and includes the following steps:

The client-based request sending module sends data stream requests to the server;

The client-based data forwarding module receives the digital signature and its corresponding data stream sent by the server, and forwards the digital signature to the server;

The client-based data reading module receives and determines whether to read the data stream in the data forwarding module based on the signature verification results sent by the server.

In a third aspect, the present invention discloses a method for authenticating data stream transmission, which is suitable for the server of the system for authenticating data stream transmission described in the first aspect, and includes the following steps:

The server-based file storage module obtains the data stream to be transmitted according to the client's data stream request;

The key acquisition unit of the server-based XMSS hardware module generates the corresponding public key and private key according to the data stream to be transmitted;

The digital signature unit based on the server's XMSS hardware module uses the private key to sign the data stream to be transmitted to obtain a digital signature;

The server-based file sending module sends the digital signature and its corresponding data stream,

The digital signature verification unit based on the server's XMSS hardware module uses the public key to verify the digital signature forwarded by the client, and the verification result is sent to the client;

The server-based file sending module sends the signature verification result to the client.

Compared with the prior art, the beneficial effects achieved by the present invention are:

The data stream transmission forgery authentication system of the present invention temporarily generates public keys and private keys based on the data stream to be transmitted, and the public keys and private keys are only transmitted within the server, ensuring the security of the transmission and greatly improving the data efficiency. Reliability during stream transmission forgery detection.

Description of the drawings

Figure 1 is a schematic diagram of a data stream transmission forgery authentication system;

Figure 2 is a schematic diagram of the digital signature unit;

Figure 3 is a schematic diagram of the digital signature verification unit.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings. The following examples are only used to more clearly illustrate the technical solutions of the present invention, but cannot be used to limit the scope of the present invention.

Example 1

This embodiment 1 provides a data stream transmission forgery authentication system, including a client and a server.

Clients include:

Request sending module, used to send data stream requests to the server;

The data forwarding module is used to receive the digital signature and its corresponding data stream sent by the server, and forward the digital signature to the server;

The data reading module is used to receive and determine whether to read the data stream in the data forwarding module based on the signature verification results sent by the server;

Servers include:

The file storage module is used to obtain the data stream to be transmitted according to the client's data stream request;

The XMSS hardware module includes a key acquisition unit, a digital signature unit and a digital signature verification unit; among them, the key acquisition unit generates the corresponding public key and private key according to the data stream to be transmitted; the digital signature unit uses the private key to treat The transmitted data stream is signed to obtain a digital signature and its corresponding data stream; the digital signature verification unit uses the public key to verify the digital signature forwarded by the client and obtains the signature verification result;

The file sending module is used to send digital signatures and their corresponding data streams, as well as signature verification results to the client.

The technical concept of the present invention is to temporarily generate a public key and a private key based on the data stream to be transmitted, and both the public key and the private key are only transmitted within the server, ensuring the security of the transmission and greatly improving the data stream transmission authentication. Reliability in the process.

Specific steps are as follows:

Step 1: Based on the client's request sending module, send the data flow request to the server. Among them, data stream requests include new data stream transmission requests and historical data stream playback requests.

The specific business scenarios are as follows:

Business scenario 1: The client sends a new data stream transmission request and requests some files that need to be protected against forgery.

When applied to this business scenario one, the receiver sends a new data stream transmission request to the server side to trigger related processing on the server side.

Business scenario 2: The client sends a historical data stream playback request, requesting the server to play back the previously accepted and stored data stream for viewing and verification.

When applied to business scenario 2, the receiver sends a historical data stream playback request to the server side to trigger related processing on the server side.

Step 2: Based on the server's file storage module, obtain the data stream to be transmitted according to the client's data stream request;

Similar to step 1, there are two corresponding business scenarios.

Business scenario 1. In response to a new data stream transmission request sent by the client, request some files that need to be protected against forgery.

When applied to this business scenario one, the server receives the new data stream transmission request sent by the client and obtains the corresponding new data stream to be transmitted.

Business scenario 2: In response to the historical data stream playback request sent by the client, the server is requested to play back the previously accepted and stored data stream for viewing and verification.

When applied to the second business scenario, the server receives the historical data stream playback request sent by the client and obtains the corresponding historical data stream to be transmitted.

Step 3: The key acquisition unit of the server-based XMSS hardware module generates the corresponding public key and private key according to the data stream to be transmitted. Among them, the private key is sent to the digital signature unit, and the public key is sent to the digital signature verification unit.

When applied to business scenario 1, the data stream to be transmitted is a new data stream, and the corresponding key pairs such as public key and private key are generated based on the new data stream.

When applied to business scenario 2, the data stream to be transmitted is a historical data stream. It may happen that the historical data stream previously sent and stored on the server side has been played back multiple times, resulting in multiple key pairs. It should be noted that this step generates a new corresponding key pair such as public key and private key based on the historical data stream, instead of using the old key pair.

Step 4: Based on the digital signature unit of the server's XMSS hardware module, use the private key to sign the data stream to be transmitted to obtain a digital signature.

When applied to business scenario 1, use the private key to sign the new data stream to be transmitted to obtain a digital signature.

When applied to business scenario 2, use the private key to sign the historical data stream to be transmitted to obtain a digital signature.

Specifically, the digital signature unit includes:

The SHA256 subunit is used to perform fixed bit width processing on the data stream to be transmitted to obtain a fixed bit width data stream. For example: a fixed 256-bit output data stream is obtained based on a variable input length for a data stream.

The first WOTS subunit is used to perform a single digital signature operation based on the fixed-width data stream and the private key to obtain the first WOTS-pk data. It should be noted that the first WOTS subunit will be called repeatedly during the key generation and signing process. The higher the reuse rate, the more efficient the design, and the better the overall performance will be. Adopting multi-core multiplexing can greatly improve the computing speed.

The first L-TREE subunit is used to compress the first WOTS-pk data into the first leaf node data. Based on the cost consideration of hardware modules, the first L-TREE subunit adopts the depth-first method. Calculating the h-th layer node of the binary tree only requires h storage space, which is far less than the 2 ^h storage resources in the standardized solution.

The MERKLE subunit is used to compress the first leaf node data into root node data; based on the root node data, the digital signature of XMSS is obtained.

In addition, the present invention can also use the BDS algorithm to accelerate the signature process during the digital signature process. For example, the BDS can be hardware-based and configured inside the hardware module to reduce the amount of data in bus communication, thereby further accelerating the XMSS digital signature. calculate.

Step 5: The server-based file sending module sends the digital signature and its corresponding data stream to the client.

Step 6: The client-based data forwarding module receives the digital signature and its corresponding data stream sent by the server, and forwards the digital signature to the server.

It should be noted that the data stream is simply received here and the data stream is not read.

Step 7: The digital signature verification unit of the server-based XMSS hardware module uses the public key to verify the digital signature forwarded by the client and obtains the signature verification result.

The digital signature verification unit includes:

The MSGchecksum subunit is used to verify the integrity of the digital signature forwarded by the client. After passing the verification, it is combined with the digest to obtain a fixed-width string. For example: verify the integrity of the digitally signed message forwarded by the client and output the checksum digest combined into a 268-bit string.

The second WOTS subunit is used to perform WOTS chain operations on fixed-width strings to obtain the second WOTS-pk data;

The second L-TREE subunit is used to perform depth-first calculation on the second WOTS-pk data to obtain the L-TREE hash value. In the same way, based on the cost consideration of hardware modules, the second L-TREE subunit adopts the depth-first method. Calculating the h-th layer node of the binary tree only requires h storage space, which is far less than the 2 ^h storage space in the standardized solution. resource.

The Authpath subunit is used to compress the L-TREE hash value, and use the public key to verify the correctness of the compressed L-TREE hash value to obtain the signature verification result. Specifically, it is used for Authath verification in the XMSS signature scheme. The f_t function is continuously called to compress the received L-TREE hash value. Finally, the received public key is used to verify the correctness of the signature.

Step 8: Server-based file sending module sends signature verification results to the client.

It should be noted that the file storage module and the file sending module are respectively connected to the XMSS hardware module through serial port communication.

Step 9: The client-based data reading module receives and determines whether to read the data stream in the data forwarding module based on the signature verification result sent by the server;

Among them, determining whether to read the data stream in the data forwarding module includes:

In response to the signature verification result being passed, the data reading module reads the data stream in the data forwarding module. If the signature verification passes, it means that the data has not been tampered with and the client can read it correctly.

In response to the signature verification result being failed, the data forwarding module receives the server to resend the new digital signature and its corresponding data stream, forwards the new digital signature to the server for signature verification, and discards the previously stored signature verification result that is failed. The digital signature and its corresponding data stream.

Among them, if the signature verification fails three times in a row, it means that the attacker may eavesdrop on the receiver's port, and the server will switch the client port to prevent the attack from continuing.

It should be noted that the information records of the exchange will be saved on both the server and the client, ensuring that the information sent is by the sender himself and not forged/tampered with. This is to prevent the sender from not recognizing that the document was sent by him in the future.

To sum up, the digital signature designed by the present invention is used by the server side to verify the digital signature later in order to ensure the integrity of the transmission data stream. Through the processing of steps 1-9, the client system of the recipient system and the server side Both parties learn the digital signature to ensure that the server side can later verify whether the data has been tampered with by verifying the digital signature received by the recipient.

The digital signature is temporarily generated during the digital signature process and is only used once. A new digital signature can be regenerated the next time you sign, which improves security.

This application first uses the private key to digitally sign the transmitted data stream; secondly, the public and private key pairs used to encrypt the media stream are generated and then transmitted within the hardware module. Since the process is transmitted within the hardware module , Therefore, the security of the key pair transmission is guaranteed, and the security during the data stream transmission process is further improved; at the same time, the public key is used to perform digital signature verification on the data stream, and the key pair is temporarily generated based on the data stream. , and is only used once, a new key pair will be regenerated the next time it is generated. To sum up, since the sensitive parameters involved in the entire key pair transmission process are transmitted within the module, the reliability of the data stream transmission authentication process is greatly improved.

Example 2

Embodiment 2 provides a method for authenticating data stream transmission, which is suitable for the client of the system for authenticating data stream transmission in Embodiment 1. It is characterized by including the following steps:

The client-based request sending module sends data stream requests to the server;

The client-based data forwarding module receives the digital signature and its corresponding data stream sent by the server, and forwards the digital signature to the server;

The client-based data reading module receives and determines whether to read the data stream in the data forwarding module based on the signature verification results sent by the server.

Example 3

Embodiment 3 provides a data stream transmission forgery authentication method, which is suitable for the server of the data stream transmission forgery authentication system of Embodiment 1. It is characterized by including the following steps:

The server-based file storage module obtains the data stream to be transmitted according to the client's data stream request;

The key acquisition unit of the server-based XMSS hardware module generates the corresponding public key and private key according to the data stream to be transmitted;

The digital signature unit based on the server's XMSS hardware module uses the private key to sign the data stream to be transmitted, and the digital signature and its corresponding data stream are obtained and sent to the client;

Server-based file sending module, sending digital signatures and their corresponding data streams,

The digital signature verification unit based on the server's XMSS hardware module uses the public key to verify the digital signature forwarded by the client, and the verification result is sent to the client;

Server-based file sending module sends signature verification results to the client.

Those skilled in the art will understand that embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions executed by the processor of the computer or other programmable data processing device produce a use A device for realizing the functions specified in one process or multiple processes of the flowchart and/or one block or multiple blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions The device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device. Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.

The above are only the preferred embodiments of the present invention. It should be pointed out that those of ordinary skill in the art can make several improvements and modifications without departing from the principles of the present invention. These improvements and modifications can also be made. should be regarded as the protection scope of the present invention.

Claims (8)

1. A data stream transmission forgery authentication system, characterized by including a client and a server, The clients include: Request sending module, used to send data stream requests to the server; A data forwarding module, configured to receive the digital signature and its corresponding data stream sent by the server, and forward the digital signature to the server; The data reading module is used to receive and determine whether to read the data stream in the data forwarding module based on the signature verification results sent by the server; The servers include: The file storage module is used to obtain the data stream to be transmitted according to the client's data stream request; The XMSS hardware module includes a key acquisition unit, a digital signature unit and a digital signature verification unit; wherein the key acquisition unit generates the corresponding public key and private key according to the data stream to be transmitted; the digital signature The unit uses the private key to sign the data stream to be transmitted to obtain a digital signature; the digital signature verification unit uses the public key to verify the digital signature forwarded by the client to obtain the signature verification result; The file sending module is used to send the digital signature and its corresponding data stream, as well as the signature verification results to the client. 2. The system for authenticating data stream transmission according to claim 1, characterized in that, in the request sending module of the client, the data stream request includes a new data stream transmission request and a historical data stream playback request. 3. The data stream transmission forgery authentication system according to claim 1, characterized in that the digital signature unit includes: The SHA256 subunit is used to perform fixed bit width processing on the data stream to be transmitted to obtain a fixed bit width data stream; The first WOTS subunit is used to perform a single digital signature operation based on the fixed-width data stream and the private key to obtain the first WOTS-pk data; The first L-TREE subunit is used to compress the first WOTS-pk data into first leaf node data; The MERKLE subunit is used to compress the first leaf node data into root node data; obtain the digital signature of XMSS based on the root node data. 4. The system for authenticating data stream transmission according to claim 1, characterized in that the digital signature verification unit includes: The MSGchecksum subunit is used to verify the integrity of the digital signature forwarded by the client. After passing the verification, it is combined with the digest to obtain a fixed-width string; The second WOTS subunit is used to perform a WOTS chain operation on the fixed-width character string to obtain the second WOTS-pk data; The second L-TREE subunit is used to perform depth-first calculation on the second WOTS-pk data to obtain the L-TREE hash value; The Authpath subunit is used to compress the L-TREE hash value, and use the public key to verify the correctness of the compressed L-TREE hash value to obtain the signature verification result. 5. The system for authenticating data stream transmission according to claim 1, wherein the step of determining whether to read the data stream in the data forwarding module includes: In response to the signature verification result being passed, the data reading module reads the data stream in the data forwarding module; In response to the signature verification result being failed, the data forwarding module receives the server to resend the new digital signature and its corresponding data stream, forwards the new digital signature to the server for signature verification, and discards the previously stored signature verification. The result is a failed digital signature and its corresponding data stream. 6. The data stream transmission and counterfeiting authentication system according to claim 1, characterized in that the file storage module and the file sending module are respectively connected to the XMSS hardware module through serial communication. 7. A method for authenticating data stream transmission, suitable for the client of the system for authenticating data stream transmission as described in any one of 1-6, characterized in that it includes the following steps: The client-based request sending module sends data stream requests to the server; The client-based data forwarding module receives the digital signature and its corresponding data stream sent by the server, and forwards the digital signature to the server; The client-based data reading module receives and determines whether to read the data stream in the data forwarding module based on the signature verification results sent by the server. 8. A method for authenticating data stream transmission, suitable for the server of the system for authenticating data stream transmission as described in any one of 1-6, characterized in that it includes the following steps: The server-based file storage module obtains the data stream to be transmitted according to the client's data stream request; The key acquisition unit of the server-based XMSS hardware module generates the corresponding public key and private key according to the data stream to be transmitted; The digital signature unit based on the server's XMSS hardware module uses the private key to sign the data stream to be transmitted to obtain a digital signature; The server-based file sending module sends the digital signature and its corresponding data stream, The digital signature verification unit based on the server's XMSS hardware module uses the public key to verify the digital signature forwarded by the client, and the verification result is sent to the client; The server-based file sending module sends the signature verification result to the client.