WO2018166333A1 - 一种内容验证方法及设备 - Google Patents

一种内容验证方法及设备 Download PDF

Info

Publication number
WO2018166333A1
WO2018166333A1 PCT/CN2018/076980 CN2018076980W WO2018166333A1 WO 2018166333 A1 WO2018166333 A1 WO 2018166333A1 CN 2018076980 W CN2018076980 W CN 2018076980W WO 2018166333 A1 WO2018166333 A1 WO 2018166333A1
Authority
WO
WIPO (PCT)
Prior art keywords
content
data packet
network device
hash value
encryption information
Prior art date
Application number
PCT/CN2018/076980
Other languages
English (en)
French (fr)
Inventor
汪漪
林栋�
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2018166333A1 publication Critical patent/WO2018166333A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the embodiments of the present invention relate to the field of communications technologies, and in particular, to a content verification method and device.
  • IP Internet Protocol
  • the initial goal of the Internet is to pursue the interconnection of networks to achieve the sharing of hardware resources. Since the initial communication requirements occur between two physical devices, in order to determine the specific location of the device, the Internet uses IP addresses to identify different devices to support data communication between devices.
  • the demand for hardware sharing is gradually decreasing, and information sharing has gradually become the main goal.
  • the main body of the web application has been converted into text information, images and videos, and the content service has become the main body of the network service.
  • the current IP network architecture still retrieves and transmits information content based on device addresses, which is inefficient in adapting to changes in upper-layer applications.
  • CCN Content-Centric Networking
  • NDN Named Data Networking
  • the NDN router needs to verify the forwarded or stored content to prevent the contaminated data from spreading in the network.
  • the NDN router uses the asymmetric encryption method to verify.
  • the verification method can detect whether the content is polluted, the verification speed in the asymmetric encryption mode is too slow to meet the high-speed network.
  • the embodiment of the invention provides a content verification method and device for speeding up content verification.
  • a content verification method is provided, which may be performed by a first network device, where the first network device includes, but is not limited to, a router, a switch, a network management, or a network card.
  • the method further involves a second network device, including but not limited to a content providing device, a router, a switch, a network management, or a network card.
  • the method includes: the first network device receives a first data packet sent by the second network device, where the first data packet carries the first content.
  • the first network device verifies the first symmetric encryption information according to the first Whether the first content carried by a data packet is legal. If the first content is legal, the first network device processes the first data packet according to the transmission path of the first data packet.
  • the first network device may use the symmetric encryption method to verify the content in the trusted domain where the first network device is located, and the security is guaranteed because the symmetric encryption mode is adopted in the trusted domain.
  • the verification speed of the symmetric encryption method is much faster than that of the asymmetric encryption mode. Therefore, the technical solution provided by the embodiment of the present invention can effectively speed up the content verification, improve the efficiency, and can also meet the requirements of the high-speed network environment.
  • the first network device includes: the first network device uses the first A symmetric key decodes the first symmetric encrypted information to obtain a first hash value, and the first network device hashes the first content to obtain a second hash value. The first network device compares the first hash value and the second hash value to determine whether the two are the same, wherein if the first hash value is the same as the second hash value, determining that the first content is legal, otherwise determining the first The content is not legal.
  • the first symmetric encryption information is obtained by encrypting a hash value of the first content by using a first symmetric key.
  • a method for content verification by symmetric encryption is provided. Verification by symmetric encryption is simple, and the verification speed is greatly improved. Compared with the method of verifying by asymmetric encryption, the efficiency of content verification can be greatly improved.
  • the method further includes: if the first data packet does not carry the first symmetric encryption information, or the first symmetric encryption information is not used in the first network device If the first content is verified in the trusted domain, the first network device verifies whether the first content is legal according to the digital signature carried in the first data packet. If the first content is legal, the first network device processes the first data packet according to the transmission path of the first data packet.
  • the first network device if the first network device cannot verify the first content by using the symmetric encryption mode, the first network device continues to use the asymmetric encryption method to verify, so as to ensure the smooth progress of the content verification process. That is, the network device in the embodiment of the present invention is flexible, and the verification mode can be flexibly selected according to actual conditions.
  • the first network device according to the digital signature carried by the first data packet, whether the first content is legal, including: The network device decodes the digital signature by using the public key provided by the content providing device of the first content to obtain a third hash value, and the first network device performs a hash operation on the first content to obtain a second hash value. . The first network device compares the second hash value and the third hash value to determine whether the two are the same. If the second hash value is the same as the third hash value, determining that the first content is legal, otherwise determining that the first content is not legitimate. The digital signature is obtained by the content providing device encrypting the hash value of the first content by using a private key.
  • a method for content verification by asymmetric encryption is provided, and the network device can flexibly select different verification methods.
  • the method further includes: the first network device encrypts the second hash value by using the first symmetric key And obtaining the second symmetric encryption information, the first network device adding the second symmetric encryption information to the first data packet, to obtain the second data packet. Then, if the first content is legal, the first network device processes the first data packet according to the transmission path of the first data packet, including: if the first content is legal, the first network device is configured according to the transmission path of the first data packet The first data packet is processed.
  • the symmetric encryption information corresponding to the trusted domain may be carried in the data packet, that is, the content of the data packet is used by using the symmetric key of the trusted domain.
  • the information after the hash value is encrypted.
  • the first network device adds the second symmetric encryption information to the first data packet, and transmits the second data packet, where the second data packet carries The second symmetric encryption information.
  • the other network device in the trusted domain where the first network device is located can directly perform verification according to the second symmetric encryption information, and does not need to regenerate the symmetric encryption information, which simplifies the operation of the subsequent network device.
  • the first network device encrypts the second hash value by using the first symmetric key to obtain the second After the information is symmetrically encrypted, the method further includes: the first network device sending the second symmetric encryption information to the content providing device.
  • the second symmetric encryption information may be sent to the content providing device, and after receiving the second symmetric encryption information, the content providing device may store the second symmetric encrypted information to the first content. In the attachment data. In this way, if the content providing device sends the first content again, the second symmetric encryption information may be added to the data packet carrying the first content, and the second symmetric encryption information corresponds to the trusted domain.
  • the device can directly use the symmetric encryption method to verify the validity of the first content, reduce the number of times of verification using the asymmetric encryption method, and improve the verification efficiency.
  • a content verification method is provided, which may be performed by a first network device, where the first network device includes, but is not limited to, a router, a switch, a network management, or a network card.
  • the method further involves a second network device, including but not limited to a content providing device, a router, a switch, a network management, or a network card.
  • the method includes: the first network device receives a first data packet sent by the second network device, where the first data packet carries the first content. If the first data packet does not carry the symmetric encryption information, the first network device encrypts the hash value of the first content by using the first symmetric key to obtain the first symmetric encryption information.
  • the first network device adds the first symmetric encryption information to the first data packet to obtain a second data packet.
  • the first network device processes the second data packet according to the transmission path of the first data packet.
  • the first symmetric key is used to symmetrically encrypt the content in the trusted domain where the first network device is located.
  • the first network device If the first network device cannot verify the first content by using a symmetric encryption manner, the first network device generates symmetric encryption information, so that other network devices in the trusted domain where the first network device is located receive the second data packet. After that, the first symmetric encryption information can be directly verified, and the symmetric encryption information does not need to be regenerated, which simplifies the operation of subsequent network devices. Moreover, since the symmetric encryption mode is adopted in the trusted domain, the security is guaranteed, and the verification speed of the symmetric encryption mode is much faster than the asymmetric encryption mode. Therefore, the technical solution provided by the embodiment of the present invention can be effectively accelerated. The speed of content verification, improve efficiency, and adapt to the needs of high-speed network environments.
  • the method further includes: the first network device is configured according to The digital signature carried by the first data packet verifies whether the first content is legal. Then, the first network device encrypts the hash value of the first content by using the first symmetric key, including: if the first content is legal, the first network device uses the first symmetric key to hash the first content. Encrypt.
  • the first network device needs to verify the validity of the first content before generating the first symmetric encryption information. If the first content is not legal, the first network device does not need to generate the first symmetric encrypted information. At this time, since the first network device cannot verify the first content by using the symmetric encryption method, the first network device uses the asymmetric encryption method to verify, so as to ensure the smooth progress of the content verification process. It can be seen that the network device in the embodiment of the present invention is flexible, and the verification mode can be flexibly selected according to actual conditions.
  • the first network device is to verify whether the first content is legal, including: The network device decodes the digital signature by using the public key provided by the content providing device of the first content to obtain a second hash value, and the first network device performs a hash operation on the first content to obtain a first hash value. . The first network device compares the first hash value with the second hash value to determine whether the two are the same. If the first hash value is the same as the second hash value, determining that the first content is legal, otherwise determining that the first content is not legitimate. The digital signature is obtained by the content providing device encrypting the hash value of the first content by using a private key.
  • a method for content verification by asymmetric encryption is provided, and the network device can flexibly select different verification methods.
  • the first network device After the first symmetric encryption information is obtained, the first network device sends the first symmetric encryption information to the content providing device of the first content.
  • the first symmetric encryption information may be sent to the content providing device, and after receiving the first symmetric encryption information, the content providing device may store the first symmetric encrypted information to the first content. In the attachment data. In this way, if the content providing device sends the first content again, the first symmetric encryption information may be added to the data packet carrying the first content, and the first symmetric encryption information corresponds to the trusted domain.
  • the device can directly use the symmetric encryption method to verify the validity of the first content, reduce the number of times of verification using the asymmetric encryption method, and improve the verification efficiency.
  • a network device comprising a receiver and a processor.
  • the receiver is configured to receive a first data packet sent by the second network device, where the first data packet carries the first content.
  • the processor is configured to: if the first data packet carries the first symmetric encryption information, and the first symmetric encryption information is used to verify the first content in the trusted domain where the network device is located, verify the first data according to the first symmetric encryption information Whether the first content carried in the package is legal. If the first content is legal, the first data packet is processed according to the transmission path of the first data packet.
  • the processor is configured to verify, according to the first symmetric encryption information, whether the first content carried by the first data packet is legal, including: using the first symmetric key pair
  • the first symmetric encrypted information is decoded to obtain a first hash value, and the first content is hashed to obtain a second hash value. Comparing the first hash value and the second hash value to determine whether the two are the same. If the first hash value is the same as the second hash value, determining that the first content is legal, otherwise determining that the first content is invalid.
  • the first symmetric encryption information is obtained by encrypting a hash value of the first content by using a first symmetric key.
  • the processor is further configured to: if the first data packet does not carry the first symmetric encryption information, or the first symmetric encryption information is not used in the network device The first content is verified in the trusted domain, and the first content is verified according to the digital signature carried in the first data packet. If the first content is legal, the first data packet is processed according to the transmission path of the first data packet.
  • the processor is configured to verify, according to the digital signature carried by the first data packet, whether the first content is legal, including: adopting the first
  • the public key provided by the content providing device of the content decodes the digital signature to obtain a third hash value, and hashes the first content to obtain a second hash value. Comparing the second hash value and the third hash value to determine whether the two are the same. If the second hash value is the same as the third hash value, determining that the first content is legal, otherwise determining that the first content is invalid.
  • the digital signature is obtained by the content providing device encrypting the hash value of the first content by using a private key.
  • the processor is further configured to: encrypt the second hash value by using the first symmetric key to obtain the first Two symmetrically encrypted information.
  • the second symmetric encryption information is added to the first data packet to obtain a second data packet.
  • the processor is configured to process, according to the transmission path of the first data packet, the first data packet, if the first content is legal, if the first content is legal, the first data packet is used according to the transmission path of the first data packet. Process it.
  • the network device further includes: a transmitter, configured to: use, by the processor, the first symmetric key pair After the hash value is encrypted to obtain the second symmetric encryption information, the second symmetric encryption information is sent to the content providing device.
  • a network device comprising a receiver and a processor.
  • the receiver is configured to receive the first data packet sent by the second network device, where the first data packet carries the first content.
  • the processor is configured to: if the first data packet does not carry the symmetric encryption information, encrypt the hash value of the first content by using the first symmetric key to obtain the first symmetric encryption information, and add the first symmetric encryption information to the first data packet. In the middle, get the second data packet.
  • the first symmetric key is used to symmetrically encrypt the content in the trusted domain where the network device is located.
  • the second data packet is processed according to the transmission path of the first data packet.
  • the processor is further configured to: before the hash value of the first content is encrypted by using the first symmetric key, according to the first data packet The digital signature carried carries out whether the first content is legal. Then, the processor encrypts the hash value of the first content by using the first symmetric key, including: if the first content is legal, encrypting the hash value of the first content by using the first symmetric key.
  • the processor is configured to verify, according to the digital signature carried by the first data packet, whether the first content is legal, including: adopting the first The public key provided by the content providing device of the content decodes the digital signature to obtain a second hash value, and hashes the first content to obtain a first hash value. Comparing the first hash value and the second hash value to determine whether the two are the same. If the first hash value is the same as the second hash value, determining that the first content is legal, otherwise determining that the first content is invalid.
  • the digital signature is obtained by the content providing device encrypting the hash value of the first content by using a private key.
  • the network device further includes a transmitter And the method is: after the processor encrypts the hash value of the first content by using the first symmetric key to obtain the first symmetric encryption information, and sends the first symmetric encryption information to the content providing device of the first content.
  • a network device comprising a functional unit for performing the method provided by the first aspect or any of the possible implementations of the first aspect.
  • a network device comprising a functional unit for performing the method provided by the second aspect or any of the possible implementations of the second aspect.
  • a computer storage medium for storing computer software instructions for use in the network device, including any of the possible implementations for performing the first aspect or the first aspect, which are designed for a network device program.
  • a computer storage medium for storing computer software instructions for use in the network device, including any of the possible implementations for performing the second aspect or the second aspect, which are designed for a network device program.
  • the content can be verified by using a symmetric encryption method.
  • the verification speed of the symmetric encryption method is much faster than the asymmetric encryption mode. Therefore, the technical solution provided by the embodiment of the present invention can effectively speed up the content verification and improve the speed. Efficiency can also adapt to the needs of high-speed network environments.
  • 1A is a schematic structural diagram of an Interest packet in a CCN/NDN network
  • 1B is a schematic structural diagram of a Data packet in a CCN/NDN network
  • FIG. 2 is a schematic diagram of a forwarding mechanism of an Interest packet and a Data packet in an NDN network
  • 3 is a flow chart of content verification by an NDN router in an NDN network
  • FIG. 4 is a flowchart of a content verification method according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a first network device according to an embodiment of the present invention.
  • CCN/NDN networks can also be used in a variety of content center networks.
  • a network device capable of forwarding data packets.
  • the network device can also generate data packets.
  • the network device may include a router, a switch, a network management system, or a network card.
  • the router is taken as an example in the description.
  • CCN/NDN data packets are roughly divided into two categories: Interest packet and Data packet.
  • the Interest packet is a request packet format in the CCN/NDN network.
  • the Data packet is in the CCN/NDN network.
  • a content package format packet format is a packet format in the CCN/NDN network.
  • the structure of the Interest packet can be referred to FIG. 1A.
  • the structure of the Interest packet can be referred to FIG. 1A.
  • the request content name is used to carry the name of the content requested by the Interest package
  • the selection rule set is used to indicate the preference of the requested content, or used for publisher filtering, or to indicate the scope of the request, etc.
  • the session serial number is used. The serial number that carries this session.
  • the structure of the Data packet can be referred to FIG. 1B.
  • the Data package includes fields such as the requested content name, digital signature, publisher information, and content data.
  • the requested content name is used to carry the name of the content data carried by the data packet
  • the digital signature is that the publisher of the content data performs hash calculation on the content data, and then encrypts the result of the hash calculation by using the private key.
  • Obtained for verifying content data such as a name of a publisher including the content data, a public key for decrypting the digital signature, an address of the content data, and an expiration date of the content data
  • At least one of the content data is the requested content.
  • “content” and “data” are used interchangeably herein, and in view of this, the content data carried by the data package is also referred to herein as “content” or “data”.
  • CCN/NDN provides three logical structures to maintain state information.
  • the three logical structures are Content Store (CS) and Pending Interest Table (PIT). ), and Forwarding Information Base (FIB). These three logical structures can be stored in the router.
  • CS Content Store
  • PIT Pending Interest Table
  • FIB Forwarding Information Base
  • the CS is used to store some commonly used content that is recently forwarded by the router.
  • it is generally stored in the format of ⁇ name, data pointer>.
  • the "name” is the name of the externally published content of the requested content, and the "data pointer” points to the physical memory location where the content is actually stored.
  • the CS table can also be understood as a content index table on the router.
  • the PIT stores the status information of the Interest packet that has been forwarded by the router but has not received the response, and is stored in a format similar to ⁇ name prefix, port list, and other attributes> in the PIT.
  • the "name prefix” is the route prefix after the content name is aggregated, and the "port list” records the receiving port of the Interest packet requesting the same content.
  • the FIB is similar to the routing forwarding table in the IP network. It records the list of ports that the Interest packet can be forwarded and stores it in the format of ⁇ name prefix, port list>.
  • the name prefix is the aggregated route prefix, and the port list indicates which ports can be forwarded to obtain the content corresponding to the specified name.
  • Trusted domain means that in a set, each network device authenticates with each other, thereby realizing the sharing of symmetric keys.
  • a trusted domain is an autonomous system (AS).
  • each network device in a trusted domain can share a symmetric key, that is, each network device in a trusted domain can use the same symmetric key to encrypt the content.
  • the content encrypted by the symmetric key can be decrypted by the other network device after the receiving of the symmetric key to verify whether the content is legal.
  • symmetric encryption can be used in the trusted domain to verify the legitimacy of the content, eliminating the need for asymmetric encryption and speeding up content verification.
  • the network devices in a trusted domain can share the symmetric key in advance by means of interworking messages.
  • the symmetric keys used may be the same or different, and the embodiments of the present invention are not limited.
  • system and “network” in the embodiments of the present invention may be used interchangeably.
  • Multiple means two or more, and in view of this, "a plurality” may also be understood as “at least two” in the embodiment of the present invention.
  • the character "/” unless otherwise specified, generally indicates that the contextual object is an "or" relationship.
  • the NDN router implements different forwarding mechanisms for the Interest packet and the Data packet. For details, refer to Figure 2.
  • the NDN router When the NDN router receives the Interest packet, it first searches in the CS according to the name of the content requested in the Interest packet. If the content corresponding to the name is retrieved in the CS, the content is directly returned to the Send Interest. The user equipment of the package. If the content does not exist in the cache, that is, the content corresponding to the name is not retrieved in the CS, the corresponding PIT entry is searched in the PIT table. If the corresponding PIT entry is found, the Interest for requesting the same content is specified. The packet has been forwarded, but the data packet has not been received yet. Then the NDN router adds the port number of the Interest packet to the corresponding PIT entry, and discards the Interest packet and does not forward it.
  • the name needs to be added to the PIT table, and the port number of the received Interest packet is recorded, and the route search is performed in the FIB. If there are multiple ports that can be forwarded in the FIB table, you need to select one or multiple routes for forwarding according to the multipath feature of the NDN network. If there is no routing information corresponding to the name in the FIB, the Interest packet is discarded, or the request packet is returned.
  • the NDN router When the NDN router receives the data packet, it searches the PIT table for the corresponding PIT entry according to the name carried in the data packet, obtains the forwarding port list, and then sends the data packet according to the port in the forwarding port list, and caches the data packet in the CS. Carrying content. If the corresponding PIT entry is not found in the PIT table, or the data packet in the PIT entry that records the same content has been forwarded, the NDN router discards the data packet.
  • the NDN router After receiving the data packet, the NDN router needs to verify the forwarded and/or stored content, and then forwards and/or stores the content after the verification is passed, so as to prevent the contaminated content from being in the network. diffusion.
  • the basic process of content verification by the NDN router is shown in Figure 3:
  • the NDN router receives the data packet corresponding to the Interest packet sent by the content provider.
  • the user equipment may first send an Interest packet for requesting the content D' to the content provider, and after receiving the Interest packet, the content provider sends the data packet to the NDN router.
  • the NDN router parses the data packet to obtain information such as “content” and “digital signature” carried by the data packet.
  • the content is D'
  • the digital signature is represented by Kpri (Hash (D).
  • the digital signature is that the provider of the content D' first hashes the content D' to obtain the hash value of the content D', and then uses The private key encrypts the hash value of the content D'.
  • the hash calculation here may be a hash hash calculation.
  • the NDN router performs hash hash calculation on the content D'.
  • an algorithm such as MD5 or CRC32 may be used to obtain a hash value of the content D', which is represented as Hash (D').
  • the NDN router decodes the digital signature using the public key provided by the provider of the content D' to obtain a hash value of the original content D', which is represented as Kpub (Kpri(Hash(D))).
  • the NDN router compares Hash(D') with Kpub(Kpri(Hash(D))) to determine whether the two are the same. If the two are the same, the NDN router determines that the received content D' is correct, and can forward and cache the content D', for example, to the user equipment. Otherwise, if the NDN router determines that the received content D' is incorrect, the content D' is discarded.
  • the NDN router verifies the content by using an asymmetric encryption method. Although this type of verification can detect whether the content is contaminated, the verification speed in the asymmetric encryption mode is too slow to meet the requirements of the high-speed network environment.
  • the first network device may use the symmetric encryption manner to verify the content in the trusted domain where the first network device is located, because the symmetric encryption mode is adopted in the trusted domain, so the security is performed.
  • the authentication speed of the symmetric encryption method is much faster than that of the asymmetric encryption mode. Therefore, the technical solution provided by the embodiment of the present invention can effectively speed up the content verification, improve the efficiency, and can adapt to the requirements of the high-speed network environment.
  • an embodiment of the present invention provides a content verification method.
  • the provider of the content, the router 1 and the router 2 belong to a trusted domain, and the trusted domain is, for example, AS1, and the router 3 and the user equipment belong to a trusted domain, and the trusted domain is, for example, AS2. . That is to say, the provider of the content, the router 1 and the router 2 can share the same symmetric key, and the router 3 and the user equipment can share the same symmetric key.
  • the provider of the content is referred to as a content providing device, and one content providing device may provide a plurality of contents. The process of this method is described below.
  • the content providing device sends a data packet to the router 1, where the data packet carries the first content, and the router 1 receives the data packet.
  • the user equipment first sends an Interest packet to the content providing device for requesting the first content, the first content stored in the content providing device being represented by D'. Then, after the content providing device receives the Interest packet, the content providing device sends the data packet carrying the content D' to the user device.
  • the transmission path between the content providing device and the user equipment is the content providing device-router 1 - router 2 - router 3 - user equipment, and therefore the content providing device transmits the data packet carrying the content D' to the router 1.
  • the router 1 can serve as a first network device, and the content providing device can serve as a second network device.
  • the data packet can also be referred to as a first data packet. In FIG. 4, the packet is referred to as packet 1.
  • a digital signature may be carried, where the digital signature device performs hash calculation on the content D' (for example, hash hash calculation) to obtain the content D'.
  • the ciphertext obtained by encrypting the hash value of the content D' using the private key, for example, the digital signature is represented as Kpri (Hash(D)).
  • the router 1 determines that the first data packet does not carry symmetric encryption information, and the router 1 uses the first symmetric key to symmetrically encrypt the hash value of the content D′, and the symmetrically encrypted information is called the first symmetric. Encrypt information.
  • the router 1 After the router 1 receives the first data packet, if it is determined that the first data packet does not carry the symmetric encryption information, the router 1 performs a hash hash calculation on the content D′ carried by the first data packet to obtain a hash value of the content D′. And encrypting the hash value of the content D' by using the first symmetric key to obtain the first symmetric encrypted information.
  • the first symmetric key is the trusted domain where the router 1 is located, that is, the symmetric key shared by the AS1.
  • the devices in the AS1 can symmetrically encrypt the content by using the first symmetric key.
  • the content providing device is When the first data packet is sent to the router 1, the first symmetric encryption information may be directly added to the first data packet, that is, the content providing device performs hash hash calculation on the content D' to obtain a hash value of the content D', and then Encrypting the hash value of the content D' using the first symmetric key to obtain the first symmetric encrypted information, and adding the first symmetric encrypted information to the first data packet, in which case the router 1 determines A packet carries symmetrically encrypted information.
  • the content providing device may also add the content D' and the digital signature to the first data packet and send it to the router 1.
  • the first data packet received by the router 1 does not carry the symmetric encryption information, and S42 takes this as an example.
  • the symmetric keys used by different trusted domains may be different, or even the same, symmetric keys of other trusted domains may not be known to each other for different trusted domains, and the data packets are from the content.
  • the user equipment may pass through one or more trusted domains.
  • each trusted domain may be carried in the data packet.
  • Symmetrically encrypted information that is, information obtained by encrypting the hash value of the content in the packet using the symmetric key of the trusted domain.
  • the first data packet is directly sent from the content providing device to the router 1, and in other scenarios, after the first data packet is sent from the content providing device, it may also pass through other network devices before reaching the router. 1.
  • the content providing device belongs to another trusted domain, and the passed network device also belongs to other trusted domains. If this is the case, the first data packet carries symmetric encrypted information, but the first data packet carries The symmetric encrypted information may not be the information used to authenticate the content D' in the trusted domain where the router 1 is located. In the embodiment of the present invention, even if the data packet carries symmetric encryption information, the processing mode and determination of the router 1 are performed as long as the symmetric encryption information for verifying the content D′ in the trusted domain where the router 1 is located is not carried. The processing method in which the first data packet does not carry symmetric encrypted information is the same.
  • the content providing device and the router 1 belong to one trusted domain, and the content providing device does not generate the first symmetric encrypted information, so the router in S42 1
  • the received first data packet does not carry any symmetric encrypted information.
  • the router 1 before the router 1 symmetrically encrypts the hash value of the content D' using the first symmetric key, the router 1 first verifies whether the content D' is legitimate. Because the first data packet does not carry symmetric encryption information at this time, the router 1 can verify the validity of the content D' by using an asymmetric encryption method. For example, the router 1 can verify whether the content D' is based on the digital signature carried by the first data packet. legitimate. If router 1 verifies that content D' is legitimate, router 1 symmetrically encrypts the hash value of content D' using the first symmetric key.
  • the router 1 verifies whether the content D′ is legal according to the digital signature carried by the first data packet, and can be implemented by: the router 1 uses the public key provided by the content providing device to decode the digital signature carried by the first data packet. The result of the decoding is referred to as a second hash value. And, the router 1 performs a hash hash calculation on the first content, and the obtained result is referred to as a first hash value. Then, the router 1 compares the first hash value and the second hash value to determine whether the two are the same. If the first hash value is the same as the second hash value, the router 1 determines that the first content is legal, otherwise it determines The first content is not legal.
  • the router 1 may symmetrically encrypt the hash value of the content D' using the first symmetric key, and if it is determined that the content D' is illegal, indicating that the content D' has been contaminated, the router 1 The first packet can be discarded to ensure network security.
  • the router 1 may also re-request to obtain the content D', for example, the router 1 generates an Interest packet for requesting the content D', and sends the Interest packet to other upstream network devices, or Send to other user devices to request content D'. As to which devices are sent to request the content D', the router 1 knows in advance.
  • the router 1 adds the first symmetric encryption information to the first data packet.
  • the first data packet to which the first symmetric encryption information is added is referred to herein as a second data packet.
  • the second data packet is referred to as data packet 2 in FIG.
  • the router 1 processes the second data packet according to the transmission path of the first data packet.
  • the router 1 may buffer the content D', and may also send the second data packet to the next hop device on the transmission path of the first data packet, that is, the router 2, and the router 2 receives the second data packet.
  • S44 in FIG. 4 is an example in which the router 1 transmits the second data packet to the router 2.
  • the router 1 may also send the first symmetric encryption information to the content providing device, for example, the router 1 may generate an Interest packet, and add the first symmetric encryption information to the Interest packet and send the content to the content providing device. Then, after receiving the Interest packet carrying the first symmetric encryption information, the content providing device may store the first symmetric encrypted information in the accessory data of the content D′, so that if the content providing device sends the content D′ next time, The first symmetric encryption information may be added to the data packet carrying the content D′, and the device in the trusted domain corresponding to the first symmetric encryption information may directly verify the validity of the content D′ by using a symmetric encryption method. Sexuality reduces the number of verifications using asymmetric encryption and improves verification efficiency.
  • the router 2 verifies the validity of the content D' carried by the second data packet according to the first symmetric encryption information carried by the second data packet.
  • the first data packet, the second data packet, the first network device, the second network device, and the like are just names, which are relative concepts.
  • the router 2 can also serve as the first network device, and the router 1 serves as the first network device.
  • the second data packet can also be considered as the first data packet. But to avoid confusion, the second packet is still referred to as the second packet.
  • the router 2 After receiving the second data packet, the router 2 determines that the second data packet carries the symmetric encryption information, that is, the first symmetric encryption information, and then the router 2 determines whether the first symmetric encryption information is the trusted domain corresponding to the router 2
  • the symmetric encryption information the following describes several ways to determine.
  • the device can add the identifier of the trusted domain where the device resides.
  • the identifier of AS1 is a
  • the identifier of AS2 is b
  • the router 1 adds the identifier a of the AS1 to the first symmetric encryption information.
  • the router 2 determines that the symmetric encryption information carried by the second data packet carries the symmetric encryption information carrying the identifier a. It can be known that the symmetric encrypted information carrying the identifier a is the symmetric encrypted information of the trusted domain where the router 2 is located.
  • This method is relatively simple, and the device can quickly determine whether the symmetric encryption information is symmetric encryption information corresponding to the trusted domain where the device is located.
  • the device After the device receives the data packet, if the data packet carries the symmetric encryption information, the device decrypts the symmetric encryption information carried by the data packet by using the symmetric key of the trusted domain where the device is located, and the device calculates the data carried by the data packet.
  • the hash value of the content If the hash value obtained by the decryption is consistent with the hash value of the content carried by the device, the symmetric encryption information is symmetric encryption information corresponding to the trusted domain where the device is located, and is equivalent to one. And verified the legitimacy of the content.
  • the device cannot determine whether the symmetric encrypted information is not the symmetric encrypted information corresponding to the trusted domain where the device is located. Or the content is illegal. Therefore, the device can continue to decode the digital signature carried by the data packet by using the public key provided by the content providing device, and compare the decoded hash value with the content carried by the device and calculated by the device. Whether the hash value is consistent, if the hash value obtained by the decoding is consistent with the hash value of the content carried by the device, the symmetric encrypted information is not the symmetric encrypted information corresponding to the trusted domain where the device is located. In fact, it is equivalent to confirming that the content is legal, and if the hash value obtained by the decoding is inconsistent with the hash value of the content carried by the data packet calculated by the device, it indicates that the content is illegal.
  • a mode and B mode are only examples.
  • the manner in which the router 2 determines whether the first symmetric encryption information is the symmetric encryption information corresponding to the trusted domain where the router 2 is located is not limited to the above two types.
  • the router 2 determines that the first symmetric encryption information is symmetric encryption information corresponding to the trusted domain where the router 2 is located, the router 2 verifies whether the content D' carried by the second data packet is legal according to the first symmetric encryption information. Specifically, the router 2 verifies whether the content D′ carried by the second data packet is legal according to the first symmetric encryption information, and is implemented by: the router 2 uses the first symmetric key to decode the first symmetric encrypted information, and the router 2 Perform a hash hash operation on the content D'. The router 2 compares the hash value obtained by the decoding with the hash value obtained by the hash hash operation to determine whether the two are the same. If the hash value obtained by the decoding is the same as the hash value obtained by the hash hash operation, the router 2 It is determined that the first content is legal, otherwise the router 2 determines that the first content is illegal.
  • S45 is an example in which the second data packet carries the first symmetric encryption information. If the second data packet does not carry the first symmetric encryption information, or the second data packet carries the symmetric encryption information, but carries the symmetric encryption information.
  • the symmetric encryption information corresponding to the trusted domain where the router 2 is located, that is, the symmetric encryption information carried is not used to verify the validity of the content D' in the AS1, and the router 2 can continue to verify the validity of the content D' by using asymmetric encryption.
  • the verification process of the asymmetric encryption method refer to the related introduction in S42.
  • the router 2 processes the second data packet according to the transmission path of the second data packet.
  • router 2 can discard content D'.
  • the router 2 can also re-request to obtain the content D'. For example, the router 2 generates an Interest packet for requesting the content D', and sends the Interest packet to other upstream network devices, or to other user devices. Request to get the content D'. As to which devices are sent to request the content D', the router 2 knows in advance.
  • the router 2 determines that the content D' is legitimate, the router 2 processes the second data packet according to the transmission path of the second data packet.
  • the router 2 may buffer the content D', and may also send the second data packet to the next hop device on the transmission path of the second data packet, that is, the router 3, and the router 3 receives the second data packet.
  • S46 in FIG. 4 is an example in which the router 2 transmits the second data packet to the router 3.
  • the router 2 may also send the first symmetric encryption information to the content providing device, for example, the router 2 may generate an Interest packet, and add the first symmetric encryption information to the Interest packet and send the content to the content providing device. Then, after receiving the Interest packet carrying the first symmetric encryption information, the content providing device may store the first symmetric encrypted information in the accessory data of the content D′, so that if the content providing device sends the content D′ next time, The first symmetric encryption information may be added to the data packet carrying the content D′, and the device in the trusted domain corresponding to the first symmetric encryption information may directly verify the validity of the content D′ by using a symmetric encryption method. Sexuality reduces the number of verifications using asymmetric encryption and improves verification efficiency.
  • the router 2 may not need to send, or if it is the first symmetric encrypted information generated by the content providing device itself, the router 2 does not need to send, Choose different treatment methods according to the actual situation.
  • the router 3 determines that the symmetric encryption information carried in the second data packet does not include the symmetric encryption information corresponding to the trusted domain where the router 3 is located, and the router 3 uses the second symmetric key to perform the hash value of the content D′. Symmetric encryption, the information obtained by symmetric encryption is called second symmetric encryption information.
  • the router 3 After receiving the second data packet, the router 3 determines that the second data packet carries the symmetric encryption information, and the router 3 can determine whether the symmetric encryption information carried by the second data packet is included in the A mode or the B mode. Symmetrically encrypted information verifying the validity of the content D' in AS2.
  • the first symmetric encryption information carried by the second data packet is symmetric encryption information for verifying the validity of the content D' in the AS1, that is, the second data packet is not carried in the AS2.
  • Symmetrically encrypted information verifying the legitimacy of the content D' so the router 3 can generate symmetric encrypted information for verifying the content D' in AS2, in order to authenticate with the first symmetrically encrypted content D' in AS1
  • the symmetric encrypted information used to verify the content D' in AS2 is referred to as second symmetric encrypted information.
  • the router 3 performs a hash hash calculation on the content D′ carried by the second data packet to obtain a hash value of the content D′, and then encrypts the hash value of the content D′ by using the second symmetric key to obtain a hash value.
  • the first symmetric key is the trusted domain where the router 1 is located, that is, the symmetric key shared by the AS1.
  • the devices in the AS1 can symmetrically encrypt the content by using the first symmetric key.
  • the content D' carried by the second data packet is verified by using an asymmetric encryption method.
  • an asymmetric encryption method For the verification process of the asymmetric encryption method, refer to the related introduction in S42.
  • the router 3 adds the second symmetric encryption information to the second data packet.
  • the second data packet to which the second symmetric encryption information is added is referred to herein as a third data packet.
  • This third data packet is represented as data packet 3 in FIG.
  • the router 3 processes the third data packet according to the transmission path of the second data packet.
  • the router 3 may buffer the content D′, and may also send the third data packet to the next hop device on the transmission path of the second data packet, that is, the user equipment, and the user equipment receives the third data packet.
  • S49 in FIG. 4 is an example in which the router 3 sends the third data packet to the user equipment.
  • the router 3 may also send the second symmetric encryption information to the content providing device, for example, the router 3 may generate an Interest packet, and add the second symmetric encryption information to the Interest packet and send the content to the content providing device.
  • the second symmetric encrypted information may be stored in the attached data of the content D′, so that if the content providing device sends the content D′ next time, The second symmetric encryption information may be added to the data packet carrying the content D′, and the device in the trusted domain corresponding to the second symmetric encryption information may directly verify the content of the content D′ by using a symmetric encryption method.
  • Sexuality reduces the number of verifications using asymmetric encryption and improves verification efficiency.
  • the user equipment and the router 3 belong to the same trusted domain, the user equipment can verify the validity of the content D' by using a symmetric encryption method after receiving the third data packet, that is, verifying the content D' by using the second symmetric key shared in AS2. For the legality, refer to the related introduction in S45 for the verification process under symmetric encryption. If the user equipment and the router 3 belong to different trusted domains, the user equipment continues to use the asymmetric encryption method to verify the validity of the content D' after receiving the third data packet, and the verification process in the asymmetric encryption mode may be Refer to the related introduction in S42.
  • the user equipment is the device that requests the content D', and after the user equipment receives the third data packet, the content D' is transmitted. If the user equipment determines that the content D' is legal, the user equipment may cache the content D', and may perform other processing on the content D', which is not limited in the embodiment of the present invention. If the user equipment determines that the content D' is not legal, the user equipment may discard the content D'. In addition, the user equipment may also re-request the content D', for example, the user equipment regenerates the Interest packet for requesting the content D', and The Interest packet is sent to the content providing device to re-request the content D'.
  • the asymmetric encryption and decryption process is converted into a symmetric encryption and decryption process by using the trusted domain between the network devices.
  • a trusted domain only the network device that receives the data packet for the first time can perform asymmetric decryption verification. Subsequent network devices only need symmetric decryption verification. If it is implemented by software, it can achieve about 2 to 3 orders of magnitude acceleration. If it is implemented by hardware, the speedup ratio is higher. The problem that the traditional method of implementing identity authentication via asymmetric encryption is too inefficient is solved.
  • the network device performs the symmetric encryption of the hashed hash value of the content to mark the content in the trusted domain of the network device, thereby facilitating subsequent network devices in the same trusted domain to speed up verification by verifying the validity of the identifier. The speed at which the content is verified.
  • the different trusted domains can be added to their unique identifiers, so that the technical solutions provided by the embodiments of the present invention can be applied to the network environment of multiple trusted domains.
  • Table 1 is a comparison between the content verification method in the prior art, that is, the NDN original verification method, and the content verification method provided by the embodiment of the present invention. It can be seen that the embodiment of the present invention greatly saves the use of the encryption and decryption process. time. The experimental results show that the efficiency of content verification can be improved by about 18 times by using the solution provided by the embodiment of the present invention.
  • an embodiment of the present invention provides a network device, where the network device includes a receiver 501 and a processor 502.
  • the processor 502 may include a central processing unit (CPU) or an application specific integrated circuit (ASIC), and may include one or more integrated circuits for controlling program execution, and may include using a field programmable gate array.
  • a hardware circuit developed by a Field Programmable Gate Array (FPGA) may include a baseband chip.
  • the network device may further include a memory 503, which is shown together in FIG. 5, because the memory 503 is not a mandatory device, and is therefore shown in the form of a dashed box in FIG. Make a distinction.
  • the number of memories 503 can be one or more.
  • the memory 503 may include a Read Only Memory (ROM), a Random Access Memory (RAM), and a disk storage, and the like.
  • the memory 503 can be used to store program code required by the processor 502 to perform tasks, and can also be used to store data.
  • the receiver 501 is configured to receive a first data packet sent by the second network device, where the first data packet carries the first content.
  • the processor 502 is configured to: if the first data packet carries the first symmetric encryption information, and the first symmetric encryption information is used to verify the first content in the trusted domain where the network device is located, verify the first symmetric encryption information according to the first symmetric encryption information. Whether the first content carried by a data packet is legal. And, if the first content is legal, processing the first data packet according to the transmission path of the first data packet.
  • the processor 502 may be implemented by: decoding the first symmetric encrypted information by using the first symmetric key, Obtaining a first hash value, and hashing the first content to obtain a second hash value. The first hash value and the second hash value are compared to determine whether the two are the same. Wherein, if the first hash value is the same as the second hash value, it is determined that the first content is legal, otherwise the first content is determined to be illegal.
  • the first symmetric encrypted information is obtained by encrypting a hash value of the first content using a first symmetric key.
  • the processor 502 is further configured to: if the first data packet does not carry the first symmetric encryption information, or the first symmetric encryption information is not used to verify the first content in a trusted domain where the network device is located, Verification of whether the first content is legal according to the digital signature carried by the first data packet. If the first content is legal, the first data packet is processed according to the transmission path of the first data packet.
  • the processor 502 may be implemented by: decoding the digital signature by using the public key provided by the content providing device of the first content. Obtaining a third hash value, and hashing the first content to obtain a second hash value. The second hash value and the third hash value are compared to determine whether the two are the same. Wherein, if the second hash value is the same as the third hash value, it is determined that the first content is legal, otherwise the first content is determined to be illegal.
  • the digital signature is obtained by the content providing device encrypting the hash value of the first content by the private key.
  • the processor 502 is further configured to: encrypt the second hash value by using the first symmetric key to obtain the second symmetric encryption information, and add the second symmetric encryption information to the first data packet, Get the second packet. Then, the processor 502 is configured to: when the first content is legal, process the first data packet according to the transmission path of the first data packet, including: if the first content is legal, according to the transmission path of the first data packet, the first The packet is processed.
  • the network device further includes a transmitter 504, which is shown together in FIG. 5, because the transmitter 504 is not a mandatory device, and therefore is drawn in the form of a dashed box in FIG. Select the device to distinguish.
  • the transmitter 504 may belong to a radio frequency system for performing network communication with an external device, for example, may communicate with an external device through a network such as an Ethernet, a radio access network, or a wireless local area network.
  • the transmitter is configured to: after the processor 502 encrypts the second hash value by using the first symmetric key to obtain the second symmetric encryption information, and send the second symmetric encryption information to the content providing device.
  • the receiver 501, the memory 503, and the transmitter 504 may be connected to the processor 502 through the bus 500 (as shown in FIG. 5), or may be connected to the processor 502 through a dedicated connection line.
  • the code corresponding to the method shown above is solidified into the chip, thereby enabling the chip to perform the method shown in the previous embodiment while it is running.
  • How to design and program the processor 502 is a technique well known to those skilled in the art, and details are not described herein.
  • the network device can be used to perform the method provided by the embodiment shown in FIG. 4 above, such as the first network device as described above. Therefore, for the functions and the like implemented by the functional units in the network device, reference may be made to the description of the previous method section, and details are not described herein.
  • an embodiment of the present invention provides a network device, where the network device includes a receiver 601 and a processor 602.
  • the processor 602 may include a CPU or an ASIC, may include one or more integrated circuits for controlling program execution, may include hardware circuits developed using an FPGA, and may include a baseband chip.
  • the network device may further include a memory 603, which is shown together in FIG. 6, because the memory 603 is not a mandatory device, and thus is drawn in the form of a dashed box in FIG. Make a distinction.
  • the number of memories 603 may be one or more.
  • the memory 603 may include a ROM, a RAM, and a disk storage, and the like.
  • the memory 603 can be used to store program code required by the processor 602 to perform tasks, and can also be used to store data.
  • the receiver 601 is configured to receive a first data packet sent by the second network device, where the first data packet carries the first content. If the first data packet does not carry the symmetric encryption information, the hash value of the first content is encrypted by using the first symmetric key to obtain the first symmetric encryption information, and the first symmetric encryption information is added to the first data packet to obtain The second data packet. The first symmetric key is used to symmetrically encrypt the content in the trusted domain where the network device is located.
  • the processor 602 is configured to process the second data packet according to the transmission path of the first data packet.
  • the processor 602 is further configured to verify, according to the digital signature carried by the first data packet, whether the first content is legal before encrypting the hash value of the first content by using the first symmetric key. Then, the processor 602 encrypts the hash value of the first content by using the first symmetric key, including: if the first content is legal, encrypting the hash value of the first content by using the first symmetric key.
  • the processor 602 is configured to verify, according to the digital signature carried by the first data packet, whether the first content is legal, including: decoding the digital signature by using a public key provided by the content providing device of the first content, to obtain a second hash value, and hashing the first content to obtain a first hash value. Comparing the first hash value and the second hash value to determine whether the two are the same. If the first hash value is the same as the second hash value, determining that the first content is legal, otherwise determining that the first content is invalid.
  • the digital signature is obtained by the content providing device encrypting the hash value of the first content by using a private key.
  • the network device further includes a transmitter 604, which is shown together in FIG. 6, because the transmitter 604 is not a mandatory device, and therefore is drawn in the form of a dashed box in FIG. Select the device to distinguish.
  • the transmitter 604 may belong to a radio frequency system for performing network communication with an external device, for example, may communicate with an external device through a network such as an Ethernet, a radio access network, or a wireless local area network.
  • the transmitter is configured to: after the processor 602 encrypts the hash value of the first content by using the first symmetric key, to obtain the first symmetric encrypted information, and send the first symmetric encrypted information to the content providing device of the first content. .
  • the receiver 601, the memory 603, and the transmitter 604 may be connected to the processor 602 via the bus 600 (as shown in FIG. 6 as an example), or may be connected to the processor 602 through a dedicated connection line.
  • the code corresponding to the method shown above is solidified into the chip, thereby enabling the chip to perform the method shown in the previous embodiment while it is running.
  • How to design and program the processor 602 is a technique well known to those skilled in the art, and details are not described herein.
  • the network device can be used to perform the method provided by the embodiment shown in FIG. 4 above, such as the first network device as described above. Therefore, for the functions and the like implemented by the functional units in the network device, reference may be made to the description of the previous method section, and details are not described herein.
  • an embodiment of the present invention provides a network device, which may include a receiving unit 701, a verification unit 702, and a processing unit 703.
  • the receiving unit 701 is configured to receive a first data packet sent by the second network device, where the first data packet carries the first content.
  • the verification unit 702 is configured to: if the first data packet carries the first symmetric encryption information, and the first symmetric encryption information is used to verify the first content in the trusted domain where the network device is located, verifying according to the first symmetric encryption information Whether the first content carried by a data packet is legal.
  • the processing unit 703 is configured to process the first data packet according to the transmission path of the first data packet if the first content is legal.
  • the verification unit 702 is configured to verify, according to the first symmetric encryption information, whether the first content carried by the first data packet is legal, including: decoding the first symmetric encryption information by using the first symmetric key to obtain the first a hash value, and hashing the first content to obtain a second hash value. Comparing the first hash value and the second hash value to determine whether the two are the same. If the first hash value is the same as the second hash value, determining that the first content is legal, otherwise determining that the first content is invalid.
  • the first symmetric encryption information is obtained by encrypting a hash value of the first content by using a first symmetric key.
  • the verification unit 702 is further configured to: if the first data packet does not carry the first symmetric encryption information, or the first symmetric encryption information is not used to verify the first content in the trusted domain where the network device is located, And verifying whether the first content is legal according to the digital signature carried by the first data packet.
  • the processing unit 703 is further configured to: if the first content is legal, process the first data packet according to the transmission path of the first data packet.
  • the verification unit 702 is configured to verify, according to the digital signature carried by the first data packet, whether the first content is legal, including: decoding the digital signature by using the public key provided by the content providing device of the first content, to obtain And a third hash value, and hashing the first content to obtain a second hash value. Comparing the second hash value and the third hash value to determine whether the two are the same, wherein if the second hash value is the same as the third hash value, determining the first content is normal, otherwise determining that the first content is invalid.
  • the digital signature is obtained by the content providing device encrypting the hash value of the first content by using a private key.
  • the network device further includes an encryption unit 704 and an adding unit 705, both of which are shown together in FIG.
  • the encryption unit 704 and the adding unit 705 are all optional functional units, in order to distinguish from the mandatory functional units, the encryption unit 704 and the adding unit 705 are drawn in the form of a broken line in FIG.
  • the encryption unit 704 is configured to encrypt the second hash value by using the first symmetric key to obtain second symmetric encryption information.
  • the adding unit 705 is configured to add the second symmetric encryption information to the first data packet to obtain the second data packet.
  • the processing unit 703 is configured to process, according to the transmission path of the first data packet, the first data packet, if the first content is legal, if the first content is legal, according to the transmission path of the first data packet, the first The packet is processed.
  • the network device further includes a transmitting unit 706, both of which are shown together in FIG.
  • the transmitting unit 706 is an optional functional unit, in order to distinguish from the mandatory functional unit, the transmitting unit 706 is drawn in the form of a broken line in FIG.
  • the sending unit 706 is configured to: after the encryption unit 704 encrypts the second hash value by using the first symmetric key to obtain the second symmetric encryption information, and send the second symmetric encryption information to the content providing device.
  • the physical device corresponding to the receiving unit 701 may be the receiver 501 in FIG. 5, and the physical device corresponding to the verification unit 702, the processing unit 703, the encryption unit 704, and the adding unit 705 may be the processor in FIG. 502.
  • the physical device corresponding to the sending unit 706 may be the transmitter 504 in FIG. 5.
  • the network device can be used to perform the method provided by the embodiment shown in FIG. 4 above, such as the first network device as described above. Therefore, for the functions and the like implemented by the functional units in the network device, reference may be made to the description of the previous method section, and details are not described herein.
  • an embodiment of the present invention provides a network device, which may include a receiving unit 801, an encryption unit 802, an adding unit 803, and a processing unit 804.
  • the receiving unit 801 is configured to receive the first data packet sent by the second network device, where the first data packet carries the first content.
  • the encryption unit 802 is configured to: if the first data packet does not carry the symmetric encryption information, encrypt the hash value of the first content by using the first symmetric key to obtain the first symmetric encryption information.
  • the adding unit 803 is configured to add the first symmetric encryption information to the first data packet to obtain the second data packet.
  • the processing unit 804 is configured to process the second data packet according to the transmission path of the first data packet.
  • the first symmetric key is used to symmetrically encrypt the content in the trusted domain where the network device is located.
  • the network device further includes a verification unit 805, both of which are shown together in FIG.
  • the verification unit 805 is an optional functional unit, in order to distinguish from the mandatory functional unit, the verification unit 805 is drawn in the form of a broken line in FIG.
  • the verification unit 805 is configured to verify, according to the digital signature carried by the first data packet, whether the first content is legal before the encryption unit 802 encrypts the hash value of the first content by using the first symmetric key. Then, the encryption unit is configured to encrypt the hash value of the first content by using the first symmetric key, including: if the first content is legal, encrypting the hash value of the first content by using the first symmetric key.
  • the verification unit 805 is configured to verify, according to the digital signature carried by the first data packet, whether the first content is legal, including: decoding the digital signature by using the public key provided by the content providing device of the first content, to obtain a second hash value, and hashing the first content to obtain a first hash value. Comparing the first hash value and the second hash value to determine whether the two are the same. If the first hash value is the same as the second hash value, determining that the first content is legal, otherwise determining that the first content is invalid.
  • the digital signature is obtained by the content providing device encrypting the hash value of the first content by using a private key.
  • the network device further includes a transmitting unit 806, both of which are shown together in FIG.
  • the transmitting unit 806 is an optional functional unit, in order to distinguish from the mandatory functional unit, the transmitting unit 806 is drawn in the form of a broken line in FIG.
  • the sending unit 806 is configured to: after the encryption unit 802 encrypts the hash value of the first content by using the first symmetric key, after obtaining the first symmetric encryption information, sending the first symmetric encrypted information to the content providing of the first content. device.
  • the physical device corresponding to the receiving unit 801 may be the receiver 601 in FIG. 6.
  • the physical device corresponding to the encryption unit 802, the adding unit 803, the processing unit 804, and the verification unit 805 may be the processor in FIG. 602.
  • the physical device corresponding to the sending unit 806 may be the transmitter 604 in FIG. 6.
  • the network device can be used to perform the method provided by the embodiment shown in FIG. 4 above, such as the first network device as described above. Therefore, for the functions and the like implemented by the functional units in the network device, reference may be made to the description of the previous method section, and details are not described herein.
  • the first network device may use the symmetric encryption method to verify the content in the trusted domain where the first network device is located, and the security is guaranteed because the symmetric encryption mode is adopted in the trusted domain.
  • the verification speed of the symmetric encryption method is much faster than that of the asymmetric encryption mode. Therefore, the technical solution provided by the embodiment of the present invention can effectively speed up the content verification, improve the efficiency, and can also meet the requirements of the high-speed network environment.
  • the embodiment of the present invention further provides a computer storage medium, wherein the computer storage medium can store a program, and the program execution includes all the executions of the first network device described in the method embodiment shown in FIG. 4 as before. step.
  • embodiments of the invention may be provided as a method, system, or computer program product.
  • embodiments of the invention may be in the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware.
  • embodiments of the invention may take the form of a computer program product embodied on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • Embodiments of the invention are described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG.
  • These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种内容验证方法及设备，用以加快内容验证的速度。该方法包括：第一网络设备接收第二网络设备发送的第一数据包，所述第一数据包携带第一内容；若所述第一数据包携带了第一对称加密信息，且所述第一对称加密信息用于在所述第一网络设备所在的可信域中验证所述第一内容，则所述第一网络设备根据所述第一对称加密信息验证所述第一数据包携带的第一内容是否合法；若所述第一内容合法，则所述第一网络设备根据所述第一数据包的传输路径对所述第一数据包进行处理。

Description

一种内容验证方法及设备
本申请要求在2017年3月15日提交中国专利局、申请号为201710152738.3、申请名称为“一种内容验证方法及设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明实施例涉及通信技术领域，尤其涉及一种内容验证方法及设备。
背景技术
以网际协议(Internet Protocol，IP)包交换为核心技术的互联网机制已被广泛应用了超过20年，这是因为IP协议自身的简单性降低了网络互联成本、增强了网络适应性。但从技术发展的角度反思，互联网最初的目标是为了追求网络的互联以实现硬件资源的共享。由于最开始的通信需求发生在两台实体设备间，为了确定设备的具体位置，互联网使用IP地址来标识不同的设备以支持设备间的数据通信。然而，随着技术的进步和信息化的普及，硬件共享的需求在逐步下降，信息共享已逐渐成为主要目标。目前，网络应用的主体已经转为文字信息、图像和视频等内容，内容服务已经成为网络服务的主体。对于用户来说，关注的不再是内容存储在哪里(Where)，而更多的是关注内容本身(What)，以及内容检索与传输的速度、质量和安全性。目前的IP网络架构仍然根据设备地址进行信息内容的检索和传送，这样做在适应上层应用的变化方面显得低效。
为了从根本上解决IP技术原有的缺陷，国际学术界和工业界过去已经开展了许多以内容为中心的研究项目，代表性的研究有内容中心网络(Content-Centric Networking，CCN)/内容中心网络(Named Data Networking，NDN)项目。CCN/NDN是通过在网络设备中缓存内容来提高网络的传输效率，从而降低网络成本、提高网络利用率。
其中，在NDN网络中，NDN路由器需要对转发或存储的内容进行验证，以防止被污染的数据在网络中扩散。而目前NDN路由器在对内容进行验证时，都是采用非对称加密方式来验证，通过这种验证方式虽然能够检测内容是否被污染，但非对称加密方式下的验证速度过慢，无法满足高速网络环境的需求。
发明内容
本发明实施例提供一种内容验证方法及设备，用于加快内容验证的速度。
第一方面，提供一种内容验证方法，该方法可由第一网络设备执行，其中，第一网络设备包括但不限于路由器、交换机、网管、或网卡等设备。另外，该方法还涉及第二网络设备，第二网络设备包括但不限于内容提供设备、路由器、交换机、网管、或网卡等设备。该方法包括：第一网络设备接收第二网络设备发送的第一数据包，第一数据包携带第一内容。若第一数据包携带了第一对称加密信息，且第一对称加密信息用于在第一网络设备所在的可信域中验证第一内容，则第一网络设备根据第一对称加密信息验证第一数据包携带的第一内容是否合法。若第一内容合法，则第一网络设备根据第一数据包的传输路径对第一数据包进行处理。
本发明实施例中，第一网络设备在第一网络设备所在的可信域中可采用对称加密的方式对内容进行验证，由于是在可信域中采用对称加密方式，因此安全性有所保障，而对称 加密方式的验证速度远快于非对称加密方式，因此通过采用本发明实施例提供的技术方案能够有效加快内容验证的速度，提高效率，也能够适应高速网络环境的需求。
结合第一方面，在第一方面的第一种可能的实施方式中，第一网络设备根据第一对称加密信息验证第一数据包携带的第一内容是否合法，包括：第一网络设备使用第一对称密钥对第一对称加密信息进行解码，得到第一散列值，及，第一网络设备对第一内容进行哈希运算，得到第二散列值。第一网络设备比较第一散列值及第二散列值，确定二者是否相同，其中，若第一散列值与第二散列值相同，则确定第一内容合法，否则确定第一内容不合法。其中，第一对称加密信息是使用第一对称密钥对第一内容的散列值进行加密得到的。
提供了通过对称加密方式进行内容验证的方法。通过对称加密进行验证，方式简单，验证速度会有较大幅度的提高，相对于通过非对称加密进行验证的方式来说能够极大地提高内容验证的效率。
结合第一方面，在第一方面的第二种可能的实施方式中，该方法还包括：若第一数据包未携带第一对称加密信息，或第一对称加密信息不用于在第一网络设备所在的可信域中验证第一内容，则第一网络设备根据第一数据包携带的数字签名验证第一内容是否合法。若第一内容合法，则第一网络设备根据第一数据包的传输路径对第一数据包进行处理。
也就是说，如果第一网络设备无法使用对称加密方式对第一内容进行验证，那么第一网络设备就继续采用非对称加密方式来验证，以保证内容验证过程的顺利进行。即，本发明实施例中的网络设备较为灵活，可根据实际情况灵活选择验证方式。
结合第一方面的第二种可能的实施方式，在第一方面的第三种可能的实施方式中，第一网络设备根据第一数据包携带的数字签名验证第一内容是否合法，包括：第一网络设备采用第一内容的内容提供设备所提供的公钥对数字签名进行解码，得到第三散列值，及，第一网络设备对第一内容进行哈希运算，得到第二散列值。第一网络设备比较第二散列值及第三散列值，确定二者是否相同，若第二散列值与第三散列值相同，则确定第一内容合法，否则确定第一内容不合法。其中，数字签名是内容提供设备通过私钥对第一内容的散列值加密得到的。
提供了通过非对称加密方式进行内容验证的方法，网络设备可灵活选择不同的验证方法。
结合第一方面的第三种可能的实施方式，在第一方面的第四种可能的实施方式中，该方法还包括：第一网络设备使用第一对称密钥对第二散列值进行加密，得到第二对称加密信息，第一网络设备将第二对称加密信息添加到第一数据包中，得到第二数据包。那么，若第一内容合法，则第一网络设备根据第一数据包的传输路径对第一数据包进行处理，包括：若第一内容合法，则第一网络设备根据第一数据包的传输路径对第一数据包进行处理。
本发明实施例中，每经过一个可信域，在该数据包中就可以带上该可信域对应的对称加密信息，即，使用该可信域的对称密钥对数据包中的内容的散列值加密后的信息。那么，如果是第一网络设备生成的第二对称加密信息，第一网络设备就将第二对称加密信息添加到第一数据包中，并传输第二数据包，则第二数据包里就携带了第二对称加密信息。处于第一网络设备所在的可信域中的其他网络设备接收第二数据包后就可以直接根据第二对称加密信息进行验证，无需再重新生成对称加密信息，简化了后续的网络设备的操作。
结合第一方面的第四种可能的实施方式，在第一方面的第五种可能的实施方式中，在第一网络设备使用第一对称密钥对第二散列值进行加密，得到第二对称加密信息后，还包 括：第一网络设备将第二对称加密信息发送给内容提供设备。
第一网络设备生成第二对称加密信息后，可将第二对称加密信息发给内容提供设备，则内容提供设备在接收第二对称加密信息后，可以将第二对称加密信息存储到第一内容的附件数据中。这样，若内容提供设备下次再发送第一内容时，可将第二对称加密信息添加到携带第一内容的数据包中一并发送，则第二对称加密信息所对应的可信域中的设备就可以直接使用对称加密方式来验证第一内容的合法性，减少了使用非对称加密方式验证的次数，提高验证效率。
第二方面，提供一种内容验证方法，该方法可由第一网络设备执行，其中，第一网络设备包括但不限于路由器、交换机、网管、或网卡等设备。另外，该方法还涉及第二网络设备，第二网络设备包括但不限于内容提供设备、路由器、交换机、网管、或网卡等设备。该方法包括：第一网络设备接收第二网络设备发送的第一数据包，第一数据包携带第一内容。若第一数据包未携带对称加密信息，则第一网络设备使用第一对称密钥对第一内容的散列值进行加密，得到第一对称加密信息。第一网络设备将第一对称加密信息添加到第一数据包中，得到第二数据包。第一网络设备根据第一数据包的传输路径对第二数据包进行处理。其中，第一对称密钥用于在第一网络设备所在的可信域中对内容进行对称加密。
如果第一网络设备无法使用对称加密方式对第一内容进行验证，那么第一网络设备就生成对称加密信息，以使得处于第一网络设备所在的可信域中的其他网络设备接收第二数据包后就可以直接根据第一对称加密信息进行验证，无需再重新生成对称加密信息，简化了后续的网络设备的操作。而且，由于是在可信域中采用对称加密方式，因此安全性有所保障，而对称加密方式的验证速度远快于非对称加密方式，因此通过采用本发明实施例提供的技术方案能够有效加快内容验证的速度，提高效率，也能够适应高速网络环境的需求。
结合第二方面，在第二方面的第一种可能的实现方式中，在第一网络设备使用第一对称密钥对第一内容的散列值进行加密之前，还包括：第一网络设备根据第一数据包携带的数字签名验证第一内容是否合法。那么，第一网络设备使用第一对称密钥对第一内容的散列值进行加密，包括：若第一内容合法，则第一网络设备使用第一对称密钥对第一内容的散列值进行加密。
也就是说，第一网络设备在生成第一对称加密信息之前，先要验证第一内容的合法性，若第一内容不合法，则第一网络设备也就无需生成第一对称加密信息了。此时，由于第一网络设备无法使用对称加密方式对第一内容进行验证，则第一网络设备就采用非对称加密方式来验证，以保证内容验证过程的顺利进行。可见，本发明实施例中的网络设备较为灵活，可根据实际情况灵活选择验证方式。
结合第二方面的第一种可能的实现方式，在第二方面的第二种可能的实现方式中，第一网络设备根据第一数据包携带的数字签名验证第一内容是否合法，包括：第一网络设备采用第一内容的内容提供设备所提供的公钥对数字签名进行解码，得到第二散列值，及，第一网络设备对第一内容进行哈希运算，得到第一散列值。第一网络设备比较第一散列值及第二散列值，确定二者是否相同，若第一散列值与第二散列值相同，则确定第一内容合法，否则确定第一内容不合法。其中，数字签名是内容提供设备通过私钥对第一内容的散列值加密得到的。
提供了通过非对称加密方式进行内容验证的方法，网络设备可灵活选择不同的验证方法。
结合第二方面或第二方面的第一种可能的实现方式或第二方面的第二种可能的实现方式，在第二方面的第三种可能的实现方式中，在第一网络设备使用第一对称密钥对第一内容的散列值进行加密，得到第一对称加密信息之后，还包括：第一网络设备将第一对称加密信息发送给第一内容的内容提供设备。
第一网络设备生成第一对称加密信息后，可将第一对称加密信息发给内容提供设备，则内容提供设备在接收第一对称加密信息后，可以将第一对称加密信息存储到第一内容的附件数据中。这样，若内容提供设备下次再发送第一内容时，可将第一对称加密信息添加到携带第一内容的数据包中一并发送，则第一对称加密信息所对应的可信域中的设备就可以直接使用对称加密方式来验证第一内容的合法性，减少了使用非对称加密方式验证的次数，提高验证效率。
第三方面，提供一种网络设备，该网络设备包括接收器和处理器。其中，接收器用于接收第二网络设备发送的第一数据包，第一数据包携带第一内容。处理器用于若第一数据包携带了第一对称加密信息，且第一对称加密信息用于在该网络设备所在的可信域中验证第一内容，则根据第一对称加密信息验证第一数据包携带的第一内容是否合法。若第一内容合法，则根据第一数据包的传输路径对第一数据包进行处理。
结合第三方面，在第三方面的第一种可能的实现方式中，处理器用于根据第一对称加密信息验证第一数据包携带的第一内容是否合法，包括：使用第一对称密钥对第一对称加密信息进行解码，得到第一散列值，及，对第一内容进行哈希运算，得到第二散列值。比较第一散列值及第二散列值，确定二者是否相同，若第一散列值与第二散列值相同，则确定第一内容合法，否则确定第一内容不合法。其中，第一对称加密信息是使用第一对称密钥对第一内容的散列值进行加密得到的。
结合第三方面，在第三方面的第二种可能的实现方式中，处理器还用于：若第一数据包未携带第一对称加密信息，或第一对称加密信息不用于在该网络设备所在的可信域中验证第一内容，则根据第一数据包携带的数字签名验证第一内容是否合法。若第一内容合法，则根据第一数据包的传输路径对第一数据包进行处理。
结合第三方面的第二种可能的实现方式，在第三方面的第三种可能的实现方式中，处理器用于根据第一数据包携带的数字签名验证第一内容是否合法，包括：采用第一内容的内容提供设备所提供的公钥对数字签名进行解码，得到第三散列值，及，对第一内容进行哈希运算，得到第二散列值。比较第二散列值及第三散列值，确定二者是否相同，若第二散列值与第三散列值相同，则确定第一内容合法，否则确定第一内容不合法。其中，数字签名是内容提供设备通过私钥对第一内容的散列值加密得到的。
结合第三方面的第三种可能的实现方式，在第三方面的第四种可能的实现方式中，处理器还用于：使用第一对称密钥对第二散列值进行加密，得到第二对称加密信息。将第二对称加密信息添加到第一数据包中，得到第二数据包。那么，处理器用于若第一内容合法，则根据第一数据包的传输路径对第一数据包进行处理，包括：若第一内容合法，则根据第一数据包的传输路径对第一数据包进行处理。
结合第三方面的第四种可能的实现方式，在第三方面的第五种可能的实现方式中，该网络设备还包括发送器，用于：在处理器使用第一对称密钥对第二散列值进行加密，得到第二对称加密信息后，将第二对称加密信息发送给内容提供设备。
第四方面，提供一种网络设备，该网络设备包括接收器和处理器。其中，接收器用于 接收第二网络设备发送的第一数据包，第一数据包携带第一内容。处理器用于若第一数据包未携带对称加密信息，使用第一对称密钥对第一内容的散列值进行加密，得到第一对称加密信息，将第一对称加密信息添加到第一数据包中，得到第二数据包。其中，第一对称密钥用于在该网络设备所在的可信域中对内容进行对称加密。根据第一数据包的传输路径对第二数据包进行处理。
结合第四方面，在第四方面的第一种可能的实现方式中，处理器还用于：在所使用第一对称密钥对第一内容的散列值进行加密之前，根据第一数据包携带的数字签名验证第一内容是否合法。那么，处理器使用第一对称密钥对第一内容的散列值进行加密，包括：若第一内容合法，则使用第一对称密钥对第一内容的散列值进行加密。
结合第四方面的第一种可能的实现方式，在第四方面的第二种可能的实现方式中，处理器用于根据第一数据包携带的数字签名验证第一内容是否合法，包括：采用第一内容的内容提供设备所提供的公钥对数字签名进行解码，得到第二散列值，及，对第一内容进行哈希运算，得到第一散列值。比较第一散列值及第二散列值，确定二者是否相同，若第一散列值与第二散列值相同，则确定第一内容合法，否则确定第一内容不合法。其中，数字签名是内容提供设备通过私钥对第一内容的散列值加密得到的。
结合第四方面或第四方面的第一种可能的实现方式或第四方面的第二种可能的实现方式，在第四方面的第三种可能的实现方式中，该网络设备还包括发送器，用于：在处理器使用第一对称密钥对第一内容的散列值进行加密，得到第一对称加密信息之后，将第一对称加密信息发送给第一内容的内容提供设备。
第五方面，提供一种网络设备，该网络设备包括用于执行第一方面或第一方面的任一种可能的实现方式所提供的方法的功能单元。
第六方面，提供一种网络设备，该网络设备包括用于执行第二方面或第二方面的任一种可能的实现方式所提供的方法的功能单元。
第七方面，提供一种计算机存储介质，用于储存为上述网络设备所用的计算机软件指令，其包含用于执行第一方面或第一方面的任一种可能的实现方式为网络设备所设计的程序。
第八方面，提供一种计算机存储介质，用于储存为上述网络设备所用的计算机软件指令，其包含用于执行第二方面或第二方面的任一种可能的实现方式为网络设备所设计的程序。
本发明实施例中，可采用对称加密方式对内容进行验证，对称加密方式的验证速度远快于非对称加密方式，因此通过采用本发明实施例提供的技术方案能够有效加快内容验证的速度，提高效率，也能够适应高速网络环境的需求。
附图说明
图1A为CCN/NDN网络中的Interest包的结构示意图；
图1B为CCN/NDN网络中的Data包的结构示意图；
图2为NDN网络中对Interest包和Data包的转发机制的示意图；
图3为NDN网络中NDN路由器进行内容验证的流程图；
图4为本发明实施例提供的内容验证方法的一种流程图；
图5-图8为本发明实施例提供的第一网络设备的几种结构示意图。
具体实施方式
为了使本发明实施例的目的、技术方案和优点更加清楚，下面将结合附图对本发明实施例作进一步地详细描述。
本文中描述的技术不仅限于CCN/NDN网络，还可用于多种内容中心网络。
以下，对本发明实施例中的部分用语进行解释说明，以便于本领域技术人员理解。
(1)网络设备，能够转发数据包，在某些实施方式中，网络设备也可以生成数据包。网络设备可包括路由器、交换机、网管、或网卡等设备，本文在描述时以路由器为例。
(2)CCN/NDN的数据包大致分为两类：兴趣(Interest)包和数据(Data)包，Interest包是CCN/NDN网络中的一种请求包格式，Data包是CCN/NDN网络中的一种内容包格式包格式。
其中，Interest包的结构可参考图1A。可以看到，在Interest包中包括请求内容名、选择规则集、以及会话序列号等字段。其中，请求内容名用于承载一个Interest包所请求的内容的名称，选择规则集用于指示请求内容的偏好，或用于进行发布者过滤，或用于指示请求的范围等，会话序列号用于承载本次会话的序列号。
Data包的结构可参考图1B。Data包中包括被请求内容名、数字签名、发布者信息、以及内容数据等字段。其中，被请求内容名用于承载该Data包所携带的内容数据的名称，数字签名是该内容数据的发布者对该内容数据进行哈希计算后再采用私钥对哈希计算的结果进行加密得到的，用于对内容数据进行验证，发布者信息例如包括该内容数据的发布者的名称、用于对数字签名进行解密的公钥、该内容数据的地址、以及该内容数据的有效期中的至少一种，内容数据即为所请求的内容。其中，“内容”和“数据”在本文中可被互换使用，鉴于此，本文中也将Data包承载的内容数据称为“内容”或“数据”。
(3)CCN/NDN为了提供更好的服务，提供了三种逻辑结构来维护状态信息，这三种逻辑结构分别为内容存储池(Content Store，CS)、请求状态表(Pending Interest Table，PIT)、以及转发表(Forwarding Information Base，FIB)。这三种逻辑结构可以存储在路由器中。
其中，CS用于存储近期被路由器转发的某些常用的内容，在CS中，一般采用<名字，数据指针>的格式存储。“名字”为所请求的内容的对外发布的名字，“数据指针”指向实际存储该内容的物理内存位置。CS这张表也可以理解为路由器上的内容索引表。
PIT中存储已经被路由器转发，但还没有收到响应的有特殊需求的Interest包的状态信息，在PIT中，以类似于<名字前缀，端口列表，其他属性>的格式存储。其中，“名字前缀”是内容的名字聚合后的路由前缀，“端口列表”记录请求相同内容的Interest包的接收端口。
FIB与IP网络中的路由转发表类似，记录Interest包可被转发的端口列表，以<名字前缀，端口列表>的格式存储。其中，“名字前缀”是聚合后的路由前缀，“端口列表”表示可以经由哪些端口转发，以获取指定名字对应的内容。
(4)可信域，是指在一个集合中，各个网络设备互相通过身份认证，从而实现对称秘钥的共享。例如一种可信域为自治系统(AS)。
本发明实施例中，一个可信域中的各个网络设备可以共享一个对称密钥，也就是说，一个可信域中的各个网络设备可以使用同一个对称密钥对内容进行加密，而对于已使用该对称密钥加密的内容，其他的网络设备接收之后可以采用该对称密钥对加密后的内容进行解密，以验证该内容是否合法。通过这种方式，在可信域内都可以采用对称加密方式来验 证内容的合法性，无需再使用非对称加密方式，加快了内容验证的速度。其中，一个可信域中的各个网络设备事先可以通过互通消息的方式来共享对称密钥。
对于不同的可信域，所使用的对称密钥可以相同，也可以不相同，本发明实施例不作限制。
(5)本发明实施例中的术语“系统”和“网络”可被互换使用。“多个”是指两个或两个以上，鉴于此，本发明实施例中也可以将“多个”理解为“至少两个”。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，字符“/”，如无特殊说明，一般表示前后关联对象是一种“或”的关系。另外，需要理解的是，在本发明实施例的描述中，“第一”、“第二”等词汇，仅用于区分描述的目的，而不能理解为指示或暗示相对重要性，也不能理解为指示或暗示顺序。
首先介绍本发明实施例的技术背景。
目前在NDN网络中，NDN路由器对Interest包和Data包实行不同的转发机制，下面进行介绍，请参见图2。
当NDN路由器收到Interest包时，首先依据Interest包中所请求的内容的名字作为关键字在CS中进行检索，如果在CS中检索到对应该名字的内容，那么就直接返回该内容给发送Interest包的用户设备。如果缓存中不存在该内容，即在CS中未检索到对应该名字的内容，则在PIT表中查找对应的PIT表项，如果找到对应的PIT表项，说明用于请求相同的内容的Interest包已经被转发过，但还没有收到Data包，那么NDN路由器就在对应的PIT表项中添加收到该Interest包的端口号，并丢弃该Interest包，不再转发。而如果在PIT表中没有找到对应的PIT表项，则需要将该名字添加到PIT表中，并记录接收到该Interest包的端口号，并在FIB中进行路由查找。如果FIB表中可以转发的端口有多个，则需要根据NDN网络的多路径特性来选取一路或多路进行转发。如果FIB中没有对应名字的路由信息，则丢弃该Interest包，或返回请求包。
当NDN路由器收到Data包时，根据Data包携带的名字在PIT表中搜索相应的PIT表项，获取转发端口列表，然后根据转发端口列表中的端口发送Data包，并在CS中缓存Data包携带的内容。如果在PIT表中没有搜寻到对应的PIT表项，或者PIT表项中记录同样内容的Data包已经转发过，那么NDN路由器就丢弃该Data包。
其中，在NDN网络中，NDN路由器收到Data包后，需要对转发和/或存储的内容进行验证，在验证通过后才会转发和/或存储该内容，以防止被污染的内容在网络中扩散。NDN路由器进行内容验证的基本过程如图3所示：
S31、NDN路由器接收内容提供方发送的与Interest包对应的Data包。
其中，用户设备可先向内容提供方发送用于请求内容D’的Interest包，内容提供方接收该Interest包后，就向NDN路由器发送给Data包。
S32、当NDN路由器收到内容提供方发送的与Interest包对应的Data包时，NDN路由器对Data包进行解析，获取Data包携带的“内容”和“数字签名”等信息。该内容即为D’，数字签名以Kpri(Hash(D)表示。其中，数字签名是该内容D’的提供方先对内容D’进行哈希计算得到内容D’的散列值，再使用私钥对该内容D’的散列值加密得到的。这里的哈希计算可以是哈希散列计算。
S33、NDN路由器对内容D’进行哈希散列计算，例如可采用MD5或CRC32等算法， 得到内容D’的散列值，表示为Hash(D’)。
S34、NDN路由器使用内容D’的提供方所提供的公钥对数字签名进行解码，获得原始的内容D’的散列值，将其表示为Kpub(Kpri(Hash(D)))。
S35、NDN路由器将Hash(D’)与Kpub(Kpri(Hash(D)))进行比较，确定二者是否相同。如果两者相同，则NDN路由器确定接收的内容D’无误，则可以转发并缓存内容D’，例如转发给用户设备，否则，NDN路由器确定接收的内容D’有误，则丢弃内容D’。
根据图3可知，目前NDN路由器在对内容进行验证时，都是采用非对称加密方式来验证。通过这种验证方式虽然能够检测内容是否被污染，但非对称加密方式下的验证速度过慢，无法满足高速网络环境的需求。
鉴于此，本发明实施例中，第一网络设备在第一网络设备所在的可信域中可采用对称加密的方式对内容进行验证，由于是在可信域中采用对称加密方式，因此安全性有所保障，而对称加密方式的验证速度远快于非对称加密方式，因此通过采用本发明实施例提供的技术方案能够有效加快内容验证的速度，提高效率，也能够适应高速网络环境的需求。
下面结合附图介绍本发明实施例提供的技术方案。
请参见图4，本发明一实施例提供一种内容验证方法。其中在图4中，内容的提供方、路由器1和路由器2属于一个可信域，将该可信域例如为AS1，路由器3和用户设备属于一个可信域，将该可信域例如为AS2。也就是说，内容的提供方、路由器1和路由器2可以共享同一个对称密钥，路由器3和用户设备可以共享同一个对称密钥。下文中将内容的提供方称为内容提供设备，一个内容提供设备可以提供多个内容。该方法的过程描述如下。
S41、内容提供设备向路由器1发送数据包，该数据包携带第一内容，则路由器1接收该数据包。
用户设备首先向内容提供设备发送Interest包，该Interest包用于请求第一内容，该存储在内容提供设备中的第一内容用D’来表示。那么内容提供设备接收该Interest包后，内容提供设备就向用户设备发送携带内容D’的数据包。例如内容提供设备到用户设备之间的传输路径为内容提供设备-路由器1-路由器2-路由器3-用户设备，因此内容提供设备将携带内容D’的数据包发送给路由器1。
其中，路由器1可以作为第一网络设备，该内容提供设备可以作为第二网络设备，该数据包也可称为第一数据包。在图4中，将该数据包称为数据包1。
在第一数据包中，除了携带内容D’之外，还可携带数字签名，该数字签名是内容提供设备对内容D’进行哈希计算(例如哈希散列计算)得到内容D’的散列值，再使用私钥对内容D’的散列值进行加密后得到的密文，例如将数字签名表示为Kpri(Hash(D))。
S42、路由器1确定第一数据包里未携带对称加密信息，那么路由器1就使用第一对称密钥对内容D’的散列值进行对称加密，将对称加密后得到的信息称为第一对称加密信息。
路由器1接收第一数据包后，若确定第一数据包里未携带对称加密信息，则路由器1对第一数据包携带的内容D’进行哈希散列计算，得到内容D’的散列值，再使用第一对称密钥对内容D’的散列值进行加密，得到第一对称加密信息。第一对称密钥是路由器1所在的可信域，即AS1中共享的对称密钥，AS1里的设备都可以使用第一对称密钥对内容进行对称加密。
以从内容提供设备到用户设备之间的传输路径为内容提供设备-路由器1-路由器2-路由器3-用户设备为例，内容提供设备与路由器1同属于一个可信域，那么内容提供设备在 向路由器1发送第一数据包时，可以直接在第一数据包里添加第一对称加密信息，即内容提供设备对内容D’进行哈希散列计算，得到内容D’的散列值，再使用第一对称密钥对内容D’的散列值进行加密，得到第一对称加密信息，并将第一对称加密信息添加到第一数据包中，在这种情况下，路由器1会确定第一数据包里携带了对称加密信息。或者，内容提供设备也可以只将内容D’和数字签名添加到第一数据包中发送给路由器1，那么路由器1接收的第一数据包就未携带对称加密信息，S42以此为例。
另外，因为不同的可信域所使用的对称密钥可能不同，或者即使相同，对于不同的可信域来说彼此之间可能也不知晓其他可信域的对称密钥，而数据包从内容提供设备传输到请求内容的用户设备的过程中可能会经过一个或多个可信域，本发明实施例中，每经过一个可信域，在该数据包中就可以带上该可信域对应的对称加密信息，即，使用该可信域的对称密钥对数据包中的内容的散列值加密后的信息。在图4中，第一数据包从内容提供设备直接发给了路由器1，而在其他场景中，第一数据包从内容提供设备发出之后，可能还经过了其他的网络设备，之后才到达路由器1，即内容提供设备属于其他的可信域，经过的网络设备也属于其他的可信域，如果是这种情况，那么第一数据包里就会携带对称加密信息，但第一数据包携带的对称加密信息可能就不是路由器1所在的可信域里用于对内容D’进行验证的信息。本发明实施例中，即使数据包里携带了对称加密信息，但只要携带的不是路由器1所在的可信域中用于对内容D’进行验证的对称加密信息，则路由器1的处理方式与确定第一数据包未携带对称加密信息的处理方式是一样的。
当然，因为图4里第一数据包是从内容提供设备直接发送给路由器1，内容提供设备和路由器1同属于一个可信域，且内容提供设备未生成第一对称加密信息，因此S42中路由器1接收的第一数据包不携带任何的对称加密信息。
在一种实施方式中，在路由器1使用第一对称密钥对内容D’的散列值进行对称加密之前，路由器1先要验证内容D’是否合法。因为此时第一数据包里未携带对称加密信息，因此路由器1可使用非对称加密方式验证内容D’的合法性，例如，路由器1可根据第一数据包携带的数字签名验证内容D’是否合法。如果路由器1验证确定内容D’合法，则路由器1就使用第一对称密钥对内容D’的散列值进行对称加密。
具体的，路由器1根据第一数据包携带的数字签名验证内容D’是否合法，可通过以下方式实现：路由器1采用内容提供设备所提供的公钥对第一数据包携带的数字签名进行解码，将解码得到的结果称为第二散列值。以及，路由器1对第一内容进行哈希散列计算，将得到的结果称为第一散列值。然后，路由器1比较第一散列值及第二散列值，确定二者是否相同，如果第一散列值与第二散列值相同，那么路由器1就确定第一内容合法，否则就确定第一内容不合法。如果确定内容D’合法，则路由器1可使用第一对称密钥对内容D’的散列值进行对称加密，而如果确定内容D’不合法，则表明内容D’已被污染，则路由器1可以丢弃第一数据包，以保障网络安全。另外，如果确定内容D’不合法，路由器1还可以重新请求获得内容D’，例如路由器1生成用于请求获得内容D’的Interest包，并将该Interest包发送给上游的其他网络设备，或发送给其他的用户设备，以请求获得内容D’。至于究竟发送给哪些设备来请求内容D’，是路由器1事先知晓的。
S43、路由器1将第一对称加密信息添加到第一数据包中。本文中将添加了第一对称加密信息的第一数据包称为第二数据包。其中，在图4中将该第二数据包称为数据包2。
S44、路由器1根据第一数据包的传输路径对第二数据包进行处理。
在本发明实施例中，路由器1可以缓存内容D’，还可以将第二数据包发送给第一数据包的传输路径上的下一跳设备，即路由器2，则路由器2接收第二数据包。图4中的S44是以路由器1将第二数据包发送给路由器2为例。
在一种实施方式中，路由器1还可以将第一对称加密信息发送给内容提供设备，例如路由器1可生成Interest包，并将第一对称加密信息添加到该Interest包中发送给内容提供设备。那么内容提供设备在接收携带了第一对称加密信息的Interest包后，可以将第一对称加密信息存储到内容D’的附件数据中，这样，若内容提供设备下次再发送内容D’时，可将第一对称加密信息添加到携带内容D’的数据包中一并发送，则第一对称加密信息所对应的可信域中的设备就可以直接使用对称加密方式来验证内容D’的合法性，减少了使用非对称加密方式验证的次数，提高验证效率。
S45、路由器2根据第二数据包携带的第一对称加密信息验证第二数据包携带的内容D’的合法性。
实际上，第一数据包、第二数据包、第一网络设备、第二网络设备等只是称谓，是相对概念，例如此时路由器2也可作为第一网络设备，路由器1作为第一网络设备，第二数据包也可认为是第一数据包。但为了避免混淆，依然将第二数据包称为第二数据包。
其中，路由器2接收第二数据包后，确定第二数据包里携带了对称加密信息，即第一对称加密信息，那么路由器2先确定第一对称加密信息是否是路由器2所在的可信域对应的对称加密信息，下面介绍几种确定方式。
A、设备在对内容进行对称加密后，可以在生成的对称加密信息中添加设备所在的可信域的标识，例如AS1的标识为a，AS2的标识为b，等等，每个可信域都唯一对应各自的标识。那么路由器1也就在第一对称加密信息中添加了AS1的标识a，则路由器2接收第二数据包后，只要确定第二数据包携带的对称加密信息中有携带了标识a的对称加密信息，就可以知道该携带了标识a的对称加密信息为路由器2所在的可信域的对称加密信息。
这种方式较为简单，设备可以很快确定对称加密信息是否是该设备所在的可信域对应的对称加密信息。
B、设备接收数据包后，若数据包携带了对称加密信息，则设备使用该设备所在的可信域的对称密钥对数据包携带的对称加密信息进行解密，且设备计算该数据包携带的内容的散列值。如果解密得到的散列值与设备计算得到的该数据包携带的内容的散列值一致，那么就表明该对称加密信息是该设备所在的可信域对应的对称加密信息，且相当于也一并验证了内容的合法性。而如果解密得到的散列值与设备计算得到的该数据包携带的内容的散列值不一致，则设备并不能确定究竟是该对称加密信息不是该设备所在的可信域对应的对称加密信息，还是内容不合法，因此，设备可以继续使用内容提供设备所提供的公钥对该数据包携带的数字签名进行解码，并比较解码得到的散列值与设备计算得到的该数据包携带的内容的散列值是否一致，如果解码得到的散列值与设备计算得到的该数据包携带的内容的散列值一致，则表明该对称加密信息不是该设备所在的可信域对应的对称加密信息，实际上也就相当于确认了该内容合法，而如果解码得到的散列值与设备计算得到的该数据包携带的内容的散列值不一致，则表明内容不合法。
当然上面的A方式和B方式只是举例，本发明实施例中，路由器2确定第一对称加密信息是否是路由器2所在的可信域对应的对称加密信息的方式不限于以上两种。
如果路由器2确定第一对称加密信息是路由器2所在的可信域对应的对称加密信息， 那么路由器2就根据第一对称加密信息验证第二数据包携带的内容D’是否合法。具体的，路由器2根据第一对称加密信息验证第二数据包携带的内容D’是否合法，可通过以下方式实现：路由器2使用第一对称密钥对第一对称加密信息进行解码，及，路由器2对内容D’进行哈希散列运算。路由器2比较解码得到的散列值与哈希散列运算得到的散列值，确定二者是否相同，如果解码得到的散列值与哈希散列运算得到的散列值相同，则路由器2确定第一内容合法，否则路由器2确定第一内容不合法。
其中，S45是以第二数据包携带了第一对称加密信息为例，如果第二数据包未携带第一对称加密信息，或者第二数据包虽然携带了对称加密信息，但携带的对称加密信息不是路由器2所在的可信域对应的对称加密信息，即携带的对称加密信息不用于在AS1中验证内容D’的合法性，那么路由器2可继续采用非对称加密方式验证内容D’的合法性，关于非对称加密方式的验证过程可参考S42中的相关介绍。
S46、如果内容D’合法，则路由器2根据第二数据包的传输路径对第二数据包进行处理。
如果路由器2确定内容D’不合法，则路由器2可以丢弃内容D’。另外，路由器2还可以重新请求获得内容D’，例如路由器2生成用于请求获得内容D’的Interest包，并将该Interest包发送给上游的其他网络设备，或发送给其他的用户设备，以请求获得内容D’。至于究竟发送给哪些设备来请求内容D’，是路由器2事先知晓的。
如果路由器2确定内容D’合法，则路由器2就根据第二数据包的传输路径对第二数据包进行处理。在本发明实施例中，路由器2可以缓存内容D’，还可以将第二数据包发送给第二数据包的传输路径上的下一跳设备，即路由器3，则路由器3接收第二数据包。图4中的S46是以路由器2将第二数据包发送给路由器3为例。
在一种实施方式中，路由器2还可以将第一对称加密信息发送给内容提供设备，例如路由器2可生成Interest包，并将第一对称加密信息添加到该Interest包中发送给内容提供设备。那么内容提供设备在接收携带了第一对称加密信息的Interest包后，可以将第一对称加密信息存储到内容D’的附件数据中，这样，若内容提供设备下次再发送内容D’时，可将第一对称加密信息添加到携带内容D’的数据包中一并发送，则第一对称加密信息所对应的可信域中的设备就可以直接使用对称加密方式来验证内容D’的合法性，减少了使用非对称加密方式验证的次数，提高验证效率。
当然，如果路由器1已经将第一对称加密信息发送给内容提供设备了，则路由器2就可以无需发送，或者如果是内容提供设备自己生成的第一对称加密信息，则路由器2也无需发送，可根据实际情况选择不同的处理方式。
S47、路由器3确定第二数据包里携带的对称加密信息中不包括路由器3所在的可信域对应的对称加密信息，那么路由器3就使用第二对称密钥对内容D’的散列值进行对称加密，将对称加密后得到的信息称为第二对称加密信息。
路由器3接收第二数据包后，确定第二数据包里携带了对称加密信息，则路由器3可采用如前介绍的A方式或B方式确定第二数据包携带的对称加密信息中是否包括用于在AS2中验证内容D’的合法性的对称加密信息。本发明实施例中，第二数据包携带的第一对称加密信息是用于在AS1里验证内容D’的合法性的对称加密信息，也就是说第二数据包里未携带用于在AS2里验证内容D’的合法性的对称加密信息，因此路由器3可以生成用于在AS2里对内容D’进行验证的对称加密信息，为了与在AS1里对内容D’进行验证的第 一对称加密信息相区别，本文中将用于在AS2里对内容D’进行验证的对称加密信息称为第二对称加密信息。具体的，路由器3对第二数据包携带的内容D’进行哈希散列计算，得到内容D’的散列值，再使用第二对称密钥对内容D’的散列值进行加密，得到第二对称加密信息。第一对称密钥是路由器1所在的可信域，即AS1中共享的对称密钥，AS1里的设备都可以使用第一对称密钥对内容进行对称加密。
另外，在路由器3生成第二对称加密信息之前，要采用非对称加密方式对第二数据包携带的内容D’进行验证，，关于非对称加密方式的验证过程可参考S42中的相关介绍。
S48、路由器3将第二对称加密信息添加到第二数据包中。本文中将添加了第二对称加密信息的第二数据包称为第三数据包。在图4中将该第三数据包表示为数据包3。
S49、路由器3根据第二数据包的传输路径对第三数据包进行处理。
在本发明实施例中，路由器3可以缓存内容D’，还可以将第三数据包发送给第二数据包的传输路径上的下一跳设备，即用户设备，则用户设备接收第三数据包。图4中的S49是以路由器3将第三数据包发送给用户设备为例。
在一种实施方式中，路由器3还可以将第二对称加密信息发送给内容提供设备，例如路由器3可生成Interest包，并将第二对称加密信息添加到该Interest包中发送给内容提供设备。那么内容提供设备在接收携带了第二对称加密信息的Interest包后，可以将第二对称加密信息存储到内容D’的附件数据中，这样，若内容提供设备下次再发送内容D’时，可将第二对称加密信息添加到携带内容D’的数据包中一并发送，则第二对称加密信息所对应的可信域中的设备就可以直接使用对称加密方式来验证内容D’的合法性，减少了使用非对称加密方式验证的次数，提高验证效率。
如果用户设备与路由器3同属于一个可信域，则用户设备接收第三数据包后可采用对称加密方式验证内容D’的合法性，即使用AS2中共享的第二对称密钥验证内容D’的合法性，关于对称加密方式下的验证过程可参考S45中的相关介绍。而如果用户设备与路由器3属于不同的可信域，那么用户设备接收第三数据包后，还会继续采用非对称加密方式验证内容D’的合法性，关于非对称加密方式下的验证过程可参考S42中的相关介绍。
其中，用户设备就是请求该内容D’的设备，则用户设备接收第三数据包后，内容D’就传输完毕。如果用户设备确定内容D’合法，则用户设备可以缓存内容D’，还可以对内容D’进行其他一些处理，本发明实施例不作限制。而如果用户设备确定内容D’不合法，则用户设备可以丢弃内容D’，另外，用户设备还可以重新请求获得内容D’，例如用户设备重新生成用于请求内容D’的Interest包，并将该Interest包发送给内容提供设备，以重新请求内容D’。
在本发明实施例中，利用网络设备间的可信域，将非对称的加解密过程转变为对称加解密的过程。在一个可信域中，仅需要第一次收到数据包的网络设备进行非对称解密验证即可，后续的网络设备都只需要对称解密验证。若通过软件方式实现，则约能实现2～3个数量级的加速，若通过硬件方式实现则加速比更高。解决了传统的经由非对称加密实现身份认证的方法效率太低的问题。另外，网络设备通过对内容的哈希散列值进行对称加密来对内容进行网络设备所处可信域的标记，从而帮助后续的同一可信域内的网络设备通过验证标识的有效性来加快对内容的验证速度。不同的可信域可添加其特有的标识，使得本发明实施例提供的技术方案能够适用于多可信域的网络环境。
请参见表1，为纯软件实现条件下的初步的实验效果。
表1
Figure PCTCN2018076980-appb-000001
表1是将现有技术中的内容验证方法，即NDN原始验证方法，与本发明实施例提供的内容验证方法进行比较，可以看到，本发明实施例极大地节约了加解密过程所使用的时间。该实验结果表明，采用本发明实施例提供的方案，内容验证的效率可以提高18倍左右。
下面结合附图介绍本发明实施例所提供的设备。
请参见图5，基于同一发明构思，本发明一实施例提供一种网络设备，该网络设备包括包括接收器501和处理器502。
其中，处理器502可以包括中央处理器(CPU)或特定应用集成电路(Application Specific Integrated Circuit，ASIC)，可以包括一个或多个用于控制程序执行的集成电路，可以包括使用现场可编程门阵列(Field Programmable Gate Array，FPGA)开发的硬件电路，可以包括基带芯片。
可能的实施方式中，该网络设备还可以包括存储器503，均在图5中一并示出，因为存储器503不是必选器件，因此在图5中画为虚线框的形式，以与必选器件进行区分。存储器503的数量可以是一个或多个。存储器503可以包括只读存储器(Read Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)和磁盘存储器，等等。存储器503可以用于存储处理器502执行任务所需的程序代码，还可以用于存储数据。
其中，接收器501用于接收第二网络设备发送的第一数据包，第一数据包携带第一内容。处理器502用于若第一数据包携带了第一对称加密信息，且第一对称加密信息用于在该网络设备所在的可信域中验证第一内容，则根据第一对称加密信息验证第一数据包携带的第一内容是否合法。以及，若第一内容合法，则根据第一数据包的传输路径对第一数据包进行处理。
在可能的实施方式中，处理器502根据第一对称加密信息验证第一数据包携带的第一内容是否合法，可通过以下方式实现：使用第一对称密钥对第一对称加密信息进行解码，得到第一散列值，及，对第一内容进行哈希运算，得到第二散列值。比较第一散列值及第二散列值，确定二者是否相同。其中，若第一散列值与第二散列值相同，则确定第一内容合法，否则确定第一内容不合法。第一对称加密信息是使用第一对称密钥对第一内容的散列值进行加密得到的。
在可能的实施方式中，处理器502还用于：若第一数据包未携带第一对称加密信息，或第一对称加密信息不用于在网络设备所在的可信域中验证第一内容，则根据第一数据包携带的数字签名验证第一内容是否合法。若第一内容合法，则根据第一数据包的传输路径对第一数据包进行处理。
在可能的实施方式中，处理器502根据第一数据包携带的数字签名验证第一内容是否合法，可通过以下方式实现：采用第一内容的内容提供设备所提供的公钥对数字签名进行 解码，得到第三散列值，及，对第一内容进行哈希运算，得到第二散列值。比较第二散列值及第三散列值，确定二者是否相同。其中，若第二散列值与第三散列值相同，则确定第一内容合法，否则确定第一内容不合法。数字签名是内容提供设备通过私钥对第一内容的散列值加密得到的。
在可能的实施方式中，处理器502还用于：使用第一对称密钥对第二散列值进行加密，得到第二对称加密信息，将第二对称加密信息添加到第一数据包中，得到第二数据包。那么，处理器502用于若第一内容合法，则根据第一数据包的传输路径对第一数据包进行处理，包括：若第一内容合法，则根据第一数据包的传输路径对第一数据包进行处理。
在可能的实施方式中，该网络设备还包括发送器504，均在图5中一并示出，因为发送器504不是必选器件，因此在图5中画为虚线框的形式，以与必选器件进行区分。发送器504可以属于射频系统，用于与外部设备进行网络通信，例如可以通过以太网、无线接入网、无线局域网等网络与外部设备进行通信。
其中，发送器用于：在处理器502使用第一对称密钥对第二散列值进行加密，得到第二对称加密信息后，将第二对称加密信息发送给内容提供设备。
其中，接收器501、存储器503和发送器504可以通过总线500与处理器502相连接(图5以此为例)，或者也可以通过专门的连接线与处理器502连接。
通过对处理器502进行设计编程，将前述所示的方法所对应的代码固化到芯片内，从而使芯片在运行时能够执行前述实施例中的所示的方法。如何对处理器502进行设计编程为本领域技术人员所公知的技术，这里不再赘述。
该网络设备可以用于执行上述图4所示的实施例所提供的方法，例如是如前所述的第一网络设备。因此，对于该网络设备中的各功能单元所实现的功能等，可参考如前方法部分的描述，不多赘述。
请参见图6，基于同一发明构思，本发明一实施例提供一种网络设备，该网络设备包括包括接收器601和处理器602。
其中，处理器602可以包括CPU或ASIC，可以包括一个或多个用于控制程序执行的集成电路，可以包括使用FPGA开发的硬件电路，可以包括基带芯片。
可能的实施方式中，该网络设备还可以包括存储器603，均在图6中一并示出，因为存储器603不是必选器件，因此在图6中画为虚线框的形式，以与必选器件进行区分。存储器603的数量可以是一个或多个。存储器603可以包括ROM、RAM和磁盘存储器，等等。存储器603可以用于存储处理器602执行任务所需的程序代码，还可以用于存储数据。
其中，接收器601用于接收第二网络设备发送的第一数据包，第一数据包携带第一内容。若第一数据包未携带对称加密信息，使用第一对称密钥对第一内容的散列值进行加密，得到第一对称加密信息，将第一对称加密信息添加到第一数据包中，得到第二数据包。其中，第一对称密钥用于在该网络设备所在的可信域中对内容进行对称加密。处理器602用于根据第一数据包的传输路径对第二数据包进行处理。
在可能的实施方式中，处理器602还用于在使用第一对称密钥对第一内容的散列值进行加密之前，根据第一数据包携带的数字签名验证第一内容是否合法。那么，处理器602使用第一对称密钥对第一内容的散列值进行加密，包括：若第一内容合法，则使用第一对称密钥对第一内容的散列值进行加密。
在可能的实施方式中，处理器602用于根据第一数据包携带的数字签名验证第一内容 是否合法，包括：采用第一内容的内容提供设备所提供的公钥对数字签名进行解码，得到第二散列值，及，对第一内容进行哈希运算，得到第一散列值。比较第一散列值及第二散列值，确定二者是否相同，其中，若第一散列值与第二散列值相同，则确定第一内容合法，否则确定第一内容不合法。其中，数字签名是内容提供设备通过私钥对第一内容的散列值加密得到的。
在可能的实施方式中，该网络设备还包括发送器604，均在图6中一并示出，因为发送器604不是必选器件，因此在图6中画为虚线框的形式，以与必选器件进行区分。发送器604可以属于射频系统，用于与外部设备进行网络通信，例如可以通过以太网、无线接入网、无线局域网等网络与外部设备进行通信。
其中，发送器用于：在处理器602使用第一对称密钥对第一内容的散列值进行加密，得到第一对称加密信息之后，将第一对称加密信息发送给第一内容的内容提供设备。
其中，接收器601、存储器603和发送器604可以通过总线600与处理器602相连接(图6以此为例)，或者也可以通过专门的连接线与处理器602连接。
通过对处理器602进行设计编程，将前述所示的方法所对应的代码固化到芯片内，从而使芯片在运行时能够执行前述实施例中的所示的方法。如何对处理器602进行设计编程为本领域技术人员所公知的技术，这里不再赘述。
该网络设备可以用于执行上述图4所示的实施例所提供的方法，例如是如前所述的第一网络设备。因此，对于该网络设备中的各功能单元所实现的功能等，可参考如前方法部分的描述，不多赘述。
请参见图7，基于同一发明构思，本发明一实施例提供一种网络设备，该网络设备可以包括接收单元701、验证单元702和处理单元703。
其中，接收单元701用于接收第二网络设备发送的第一数据包，第一数据包携带第一内容。验证单元702用于若第一数据包携带了第一对称加密信息，且第一对称加密信息用于在该网络设备所在的可信域中验证第一内容，则根据第一对称加密信息验证第一数据包携带的第一内容是否合法。处理单元703用于若第一内容合法，则根据第一数据包的传输路径对第一数据包进行处理。
在可能的实施方式中，验证单元702用于根据第一对称加密信息验证第一数据包携带的第一内容是否合法，包括：使用第一对称密钥对第一对称加密信息进行解码，得到第一散列值，及，对第一内容进行哈希运算，得到第二散列值。比较第一散列值及第二散列值，确定二者是否相同，其中，若第一散列值与第二散列值相同，则确定第一内容合法，否则确定第一内容不合法。其中，第一对称加密信息是使用第一对称密钥对第一内容的散列值进行加密得到的。
在可能的实施方式中，验证单元702还用于：若第一数据包未携带第一对称加密信息，或第一对称加密信息不用于在该网络设备所在的可信域中验证第一内容，则根据第一数据包携带的数字签名验证第一内容是否合法。处理单元703还用于：若第一内容合法，则根据第一数据包的传输路径对第一数据包进行处理。
在可能的实施方式中，验证单元702用于根据第一数据包携带的数字签名验证第一内容是否合法，包括：采用第一内容的内容提供设备所提供的公钥对数字签名进行解码，得到第三散列值，及，对第一内容进行哈希运算，得到第二散列值。比较第二散列值及第三散列值，确定二者是否相同，其中，若第二散列值与第三散列值相同，则确定第一内容合 法，否则确定第一内容不合法。其中，数字签名是内容提供设备通过私钥对第一内容的散列值加密得到的。
在可能的实施方式中，该网络设备还包括加密单元704和添加单元705，均在图7中一并示出。其中，因为加密单元704和添加单元705都是可选的功能单元，为了与必选的功能单元相区分，在图7中将加密单元704和添加单元705画为虚线形式。
其中，加密单元704用于使用第一对称密钥对第二散列值进行加密，得到第二对称加密信息。添加单元705用于将第二对称加密信息添加到第一数据包中，得到第二数据包。那么，处理单元703用于若第一内容合法，则根据第一数据包的传输路径对第一数据包进行处理，包括：若第一内容合法，则根据第一数据包的传输路径对第一数据包进行处理。
在可能的实施方式中，该网络设备还包括发送单元706，均在图7中一并示出。其中，因为发送单元706是可选的功能单元，为了与必选的功能单元相区分，在图7中将发送单元706画为虚线形式。
其中，发送单元706用于：在加密单元704使用第一对称密钥对第二散列值进行加密，得到第二对称加密信息后，将第二对称加密信息发送给内容提供设备。
在实际应用中，接收单元701对应的实体设备可以是图5中的接收器501，验证单元702、处理单元703、加密单元704、及添加单元705对应的实体设备可以是图5中的处理器502，发送单元706对应的实体设备可以是图5中的发送器504。
该网络设备可以用于执行上述图4所示的实施例所提供的方法，例如是如前所述的第一网络设备。因此，对于该网络设备中的各功能单元所实现的功能等，可参考如前方法部分的描述，不多赘述。
请参见图8，基于同一发明构思，本发明一实施例提供一种网络设备，该网络设备可以包括接收单元801、加密单元802、添加单元803和处理单元804。
其中，接收单元801用于接收第二网络设备发送的第一数据包，第一数据包携带第一内容。加密单元802用于若第一数据包未携带对称加密信息，使用第一对称密钥对第一内容的散列值进行加密，得到第一对称加密信息。添加单元803用于将第一对称加密信息添加到第一数据包中，得到第二数据包。处理单元804用于根据第一数据包的传输路径对第二数据包进行处理。其中，第一对称密钥用于在该网络设备所在的可信域中对内容进行对称加密。
在可能的实施方式中，该网络设备还包括验证单元805，均在图8中一并示出。其中，因为验证单元805是可选的功能单元，为了与必选的功能单元相区分，在图8中将验证单元805画为虚线形式。
其中，验证单元805用于在加密单元802使用第一对称密钥对第一内容的散列值进行加密之前，根据第一数据包携带的数字签名验证第一内容是否合法。那么，加密单元用于使用第一对称密钥对第一内容的散列值进行加密，包括：若第一内容合法，则使用第一对称密钥对第一内容的散列值进行加密。
在可能的实施方式中，验证单元805用于根据第一数据包携带的数字签名验证第一内容是否合法，包括：采用第一内容的内容提供设备所提供的公钥对数字签名进行解码，得到第二散列值，及，对第一内容进行哈希运算，得到第一散列值。比较第一散列值及第二散列值，确定二者是否相同，其中，若第一散列值与第二散列值相同，则确定第一内容合法，否则确定第一内容不合法。其中，数字签名是内容提供设备通过私钥对第一内容的散 列值加密得到的。
在可能的实施方式中，该网络设备还包括发送单元806，均在图8中一并示出。其中，因为发送单元806是可选的功能单元，为了与必选的功能单元相区分，在图8中将发送单元806画为虚线形式。
其中，发送单元806用于在加密单元802使用第一对称密钥对第一内容的散列值进行加密，得到第一对称加密信息之后，将第一对称加密信息发送给第一内容的内容提供设备。
在实际应用中，接收单元801对应的实体设备可以是图6中的接收器601，加密单元802、添加单元803、处理单元804、及验证单元805对应的实体设备可以是图6中的处理器602，发送单元806对应的实体设备可以是图6中的发送器604。
该网络设备可以用于执行上述图4所示的实施例所提供的方法，例如是如前所述的第一网络设备。因此，对于该网络设备中的各功能单元所实现的功能等，可参考如前方法部分的描述，不多赘述。
本发明实施例中，第一网络设备在第一网络设备所在的可信域中可采用对称加密的方式对内容进行验证，由于是在可信域中采用对称加密方式，因此安全性有所保障，而对称加密方式的验证速度远快于非对称加密方式，因此通过采用本发明实施例提供的技术方案能够有效加快内容验证的速度，提高效率，也能够适应高速网络环境的需求。
本发明实施例还提供一种计算机存储介质，其中，该计算机存储介质可存储有程序，该程序执行时包括如前的图4所示的方法实施例中记载的第一网络设备所执行的全部步骤。
本领域内的技术人员应明白，本发明实施例可提供为方法、系统、或计算机程序产品。因此，本发明实施例可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明实施例可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明实施例是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本发明实施例进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本发明实施例的这些修改和变型属于本申请权利要求及其等同技 术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (20)

  1. 一种内容验证方法，其特征在于，包括：
    第一网络设备接收第二网络设备发送的第一数据包，所述第一数据包携带第一内容；
    若所述第一数据包携带了第一对称加密信息，且所述第一对称加密信息用于在所述第一网络设备所在的可信域中验证所述第一内容，则所述第一网络设备根据所述第一对称加密信息验证所述第一数据包携带的第一内容是否合法；
    若所述第一内容合法，则所述第一网络设备根据所述第一数据包的传输路径对所述第一数据包进行处理。
  2. 如权利要求1所述的方法，其特征在于，所述第一网络设备根据所述第一对称加密信息验证所述第一数据包携带的第一内容是否合法，包括：
    所述第一网络设备使用第一对称密钥对所述第一对称加密信息进行解码，得到第一散列值，及，所述第一网络设备对所述第一内容进行哈希运算，得到第二散列值；其中，所述第一对称加密信息是使用所述第一对称密钥对所述第一内容的散列值进行加密得到的；
    所述第一网络设备比较所述第一散列值及所述第二散列值，确定二者是否相同；其中，若所述第一散列值与所述第二散列值相同，则确定所述第一内容合法，否则确定所述第一内容不合法。
  3. 如权利要求1所述的方法，其特征在于，所述方法还包括：
    若所述第一数据包未携带所述第一对称加密信息，或所述第一对称加密信息不用于在所述第一网络设备所在的可信域中验证所述第一内容，则所述第一网络设备根据所述第一数据包携带的数字签名验证所述第一内容是否合法；
    若所述第一内容合法，则所述第一网络设备根据所述第一数据包的传输路径对所述第一数据包进行处理。
  4. 如权利要求3所述的方法，其特征在于，所述第一网络设备根据所述第一数据包携带的数字签名验证所述第一内容是否合法，包括：
    所述第一网络设备采用所述第一内容的内容提供设备所提供的公钥对所述数字签名进行解码，得到第三散列值，及，所述第一网络设备对所述第一内容进行哈希运算，得到第二散列值；其中，所述数字签名是所述内容提供设备通过私钥对所述第一内容的散列值加密得到的；
    所述第一网络设备比较所述第二散列值及所述第三散列值，确定二者是否相同；其中，若所述第二散列值与所述第三散列值相同，则确定所述第一内容合法，否则确定所述第一内容不合法。
  5. 如权利要求4所述的方法，其特征在于，
    所述方法还包括：
    所述第一网络设备使用第一对称密钥对所述第二散列值进行加密，得到第二对称加密信息；
    所述第一网络设备将所述第二对称加密信息添加到所述第一数据包中，得到第二数据包；
    若所述第一内容合法，则所述第一网络设备根据所述第一数据包的传输路径对所述第一数据包进行处理，包括：
    若所述第一内容合法，则所述第一网络设备根据所述第一数据包的传输路径对所述第一数据包进行处理。
  6. 如权利要求5所述的方法，其特征在于，在所述第一网络设备使用第一对称密钥对所述第二散列值进行加密，得到第二对称加密信息后，还包括：
    所述第一网络设备将所述第二对称加密信息发送给所述内容提供设备。
  7. 一种内容验证方法，其特征在于，包括：
    第一网络设备接收第二网络设备发送的第一数据包，所述第一数据包携带第一内容；
    若所述第一数据包未携带对称加密信息，则所述第一网络设备使用第一对称密钥对所述第一内容的散列值进行加密，得到第一对称加密信息；所述第一对称密钥用于在所述第一网络设备所在的可信域中对内容进行对称加密；
    所述第一网络设备将所述第一对称加密信息添加到所述第一数据包中，得到第二数据包；
    所述第一网络设备根据所述第一数据包的传输路径对所述第二数据包进行处理。
  8. 如权利要求7所述的方法，其特征在于，
    在所述第一网络设备使用第一对称密钥对所述第一内容的散列值进行加密之前，还包括：
    所述第一网络设备根据所述第一数据包携带的数字签名验证所述第一内容是否合法；
    所述第一网络设备使用第一对称密钥对所述第一内容的散列值进行加密，包括：
    若所述第一内容合法，则所述第一网络设备使用所述第一对称密钥对所述第一内容的散列值进行加密。
  9. 如权利要求8所述的方法，其特征在于，所述第一网络设备根据所述第一数据包携带的数字签名验证所述第一内容是否合法，包括：
    所述第一网络设备采用所述第一内容的内容提供设备所提供的公钥对所述数字签名进行解码，得到第二散列值，及，所述第一网络设备对所述第一内容进行哈希运算，得到第一散列值；其中，所述数字签名是所述内容提供设备通过私钥对所述第一内容的散列值加密得到的；
    所述第一网络设备比较所述第一散列值及所述第二散列值，确定二者是否相同；其中，若所述第一散列值与所述第二散列值相同，则确定所述第一内容合法，否则确定所述第一内容不合法。
  10. 如权利要求7-9任一所述的方法，其特征在于，在所述第一网络设备使用第一对称密钥对所述第一内容的散列值进行加密，得到第一对称加密信息之后，还包括：
    所述第一网络设备将所述第一对称加密信息发送给所述第一内容的内容提供设备。
  11. 一种网络设备，其特征在于，包括：
    接收单元，用于接收第二网络设备发送的第一数据包，所述第一数据包携带第一内容；
    验证单元，用于若所述第一数据包携带了第一对称加密信息，且所述第一对称加密信息用于在所述网络设备所在的可信域中验证所述第一内容，则根据所述第一对称加密信息验证所述第一数据包携带的第一内容是否合法；
    处理单元，用于若所述第一内容合法，则根据所述第一数据包的传输路径对所述第一数据包进行处理。
  12. 如权利要求11所述的网络设备，其特征在于，所述验证单元用于根据所述第一对 称加密信息验证所述第一数据包携带的第一内容是否合法，包括：
    使用第一对称密钥对所述第一对称加密信息进行解码，得到第一散列值，及，对所述第一内容进行哈希运算，得到第二散列值；其中，所述第一对称加密信息是使用所述第一对称密钥对所述第一内容的散列值进行加密得到的；
    比较所述第一散列值及所述第二散列值，确定二者是否相同；其中，若所述第一散列值与所述第二散列值相同，则确定所述第一内容合法，否则确定所述第一内容不合法。
  13. 如权利要求11所述的网络设备，其特征在于，
    所述验证单元还用于：若所述第一数据包未携带所述第一对称加密信息，或所述第一对称加密信息不用于在所述网络设备所在的可信域中验证所述第一内容，则根据所述第一数据包携带的数字签名验证所述第一内容是否合法；
    所述处理单元还用于：若所述第一内容合法，则根据所述第一数据包的传输路径对所述第一数据包进行处理。
  14. 如权利要求13所述的网络设备，其特征在于，所述验证单元用于根据所述第一数据包携带的数字签名验证所述第一内容是否合法，包括：
    采用所述第一内容的内容提供设备所提供的公钥对所述数字签名进行解码，得到第三散列值，及，对所述第一内容进行哈希运算，得到第二散列值；其中，所述数字签名是所述内容提供设备通过私钥对所述第一内容的散列值加密得到的；
    比较所述第二散列值及所述第三散列值，确定二者是否相同；其中，若所述第二散列值与所述第三散列值相同，则确定所述第一内容合法，否则确定所述第一内容不合法。
  15. 如权利要求14所述的网络设备，其特征在于，所述网络设备还包括加密单元和添加单元；
    所述加密单元用于：使用第一对称密钥对所述第二散列值进行加密，得到第二对称加密信息；
    所述添加单元用于：将所述第二对称加密信息添加到所述第一数据包中，得到第二数据包；
    所述处理单元用于若所述第一内容合法，则根据所述第一数据包的传输路径对所述第一数据包进行处理，包括：若所述第一内容合法，则根据所述第一数据包的传输路径对所述第一数据包进行处理。
  16. 如权利要求15所述的网络设备，其特征在于，所述网络设备还包括发送单元，用于：
    在所述加密单元使用第一对称密钥对所述第二散列值进行加密，得到第二对称加密信息后，将所述第二对称加密信息发送给所述内容提供设备。
  17. 一种网络设备，其特征在于，包括：
    接收单元，用于接收第二网络设备发送的第一数据包，所述第一数据包携带第一内容；
    加密单元，用于若所述第一数据包未携带对称加密信息，使用第一对称密钥对所述第一内容的散列值进行加密，得到第一对称加密信息；所述第一对称密钥用于在所述网络设备所在的可信域中对内容进行对称加密；
    添加单元，用于将所述第一对称加密信息添加到所述第一数据包中，得到第二数据包；
    处理单元，用于根据所述第一数据包的传输路径对所述第二数据包进行处理。
  18. 如权利要求17所述的网络设备，其特征在于，所述网络设备还包括验证单元；
    所述验证单元用于：在所述加密单元使用第一对称密钥对所述第一内容的散列值进行加密之前，根据所述第一数据包携带的数字签名验证所述第一内容是否合法；
    所述加密单元用于使用第一对称密钥对所述第一内容的散列值进行加密，包括：若所述第一内容合法，则使用所述第一对称密钥对所述第一内容的散列值进行加密。
  19. 如权利要求18所述的网络设备，其特征在于，所述验证单元用于根据所述第一数据包携带的数字签名验证所述第一内容是否合法，包括：
    采用所述第一内容的内容提供设备所提供的公钥对所述数字签名进行解码，得到第二散列值，及，对所述第一内容进行哈希运算，得到第一散列值；其中，所述数字签名是所述内容提供设备通过私钥对所述第一内容的散列值加密得到的；
    比较所述第一散列值及所述第二散列值，确定二者是否相同；其中，若所述第一散列值与所述第二散列值相同，则确定所述第一内容合法，否则确定所述第一内容不合法。
  20. 如权利要求17-19任一所述的网络设备，其特征在于，所述网络设备还包括发送单元，用于：
    在所述加密单元使用第一对称密钥对所述第一内容的散列值进行加密，得到第一对称加密信息之后，将所述第一对称加密信息发送给所述第一内容的内容提供设备。
PCT/CN2018/076980 2017-03-15 2018-02-22 一种内容验证方法及设备 WO2018166333A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710152738.3A CN108632197B (zh) 2017-03-15 2017-03-15 一种内容验证方法及设备
CN201710152738.3 2017-03-15

Publications (1)

Publication Number Publication Date
WO2018166333A1 true WO2018166333A1 (zh) 2018-09-20

Family

ID=63521695

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/076980 WO2018166333A1 (zh) 2017-03-15 2018-02-22 一种内容验证方法及设备

Country Status (2)

Country Link
CN (1) CN108632197B (zh)
WO (1) WO2018166333A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109635574A (zh) * 2018-11-14 2019-04-16 李炜哲 一种云存储系统中的文件加解密方法、系统及存储介质
CN111385278B (zh) * 2018-12-29 2021-11-30 西安华为技术有限公司 一种报文转发方法及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103095710A (zh) * 2013-01-17 2013-05-08 北京交通大学 以内容为中心的网络中基于身份的广播加密传输方法
CN104065760A (zh) * 2013-11-25 2014-09-24 中国科学院计算机网络信息中心 基于dns及其扩展协议的ccn可信寻址方法及系统
CN104935626A (zh) * 2014-03-19 2015-09-23 帕洛阿尔托研究中心公司 用于有效、安全分发数字内容的系统和方法
CN106257882A (zh) * 2015-12-28 2016-12-28 重庆邮电大学 命名数据网络中基于身份与加密的访问控制方法
WO2017009730A1 (en) * 2015-07-10 2017-01-19 Telefonaktiebolaget Lm Ericsson (Publ) Ccn name chaining

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP5036406B2 (ja) * 2007-05-30 2012-09-26 エイチジーエスティーネザーランドビーブイ コンテンツデータ管理システム及び方法
CN102714595B (zh) * 2009-11-25 2015-04-01 株式会社东芝 签名数据服务器以及用户终端
CN102413103B (zh) * 2010-09-20 2014-07-30 华为技术有限公司 一种消息验证方法、系统及设备
TW201447804A (zh) * 2013-06-11 2014-12-16 Real Time Winning System Inc 即時投注開獎中獎系統及其方法
CN104022865A (zh) * 2014-04-29 2014-09-03 云南电网公司 一种网络数据加密传输方法
US9276922B2 (en) * 2014-05-21 2016-03-01 Palo Alto Research Center Incorporated Border property validation for named data networks
CN104320257B (zh) * 2014-10-22 2015-10-28 李名选 电子档案验证方法及装置
CN105763331A (zh) * 2014-12-19 2016-07-13 北大方正集团有限公司 一种数据加密方法和数据解密方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103095710A (zh) * 2013-01-17 2013-05-08 北京交通大学 以内容为中心的网络中基于身份的广播加密传输方法
CN104065760A (zh) * 2013-11-25 2014-09-24 中国科学院计算机网络信息中心 基于dns及其扩展协议的ccn可信寻址方法及系统
CN104935626A (zh) * 2014-03-19 2015-09-23 帕洛阿尔托研究中心公司 用于有效、安全分发数字内容的系统和方法
WO2017009730A1 (en) * 2015-07-10 2017-01-19 Telefonaktiebolaget Lm Ericsson (Publ) Ccn name chaining
CN106257882A (zh) * 2015-12-28 2016-12-28 重庆邮电大学 命名数据网络中基于身份与加密的访问控制方法

Also Published As

Publication number Publication date
CN108632197A (zh) 2018-10-09
CN108632197B (zh) 2021-03-05

Similar Documents

Publication Publication Date Title
US10129230B2 (en) System for key exchange in a content centric network
US11050724B2 (en) IaaS-aided access control for information centric networking with Internet-of-Things
CN105847228B (zh) 用于信息中心网络的访问控制框架
US8532115B2 (en) Negotiated secure fast table lookups for protocols with bidirectional identifiers
US10263965B2 (en) Encrypted CCNx
US20200084222A1 (en) Data Packet Security with Expiring Time-Based Hash Message Authentication Codes (HMACs)
JP5948001B2 (ja) 所要のノード経路と暗号署名とを用いたセキュアなパケット送信のためのポリシー
US9276922B2 (en) Border property validation for named data networks
US10681018B2 (en) Transparent encryption in a content centric network
US10104050B2 (en) Authenticated group context in transitive IP network domains
KR20150141362A (ko) 네트워크 노드 및 네트워크 노드의 동작 방법
US10320760B2 (en) Method and system for mutating and caching content in a content centric network
US20180006823A1 (en) Multi-hop secure content routing based on cryptographic partial blind signatures and embedded terms
US20160105279A1 (en) Data distributing over network to user devices
JP2015149717A (ja) 分散した作成部についてのコンテンツベースの伝送セキュリティ
CN116633582A (zh) 安全通信方法、装置、电子设备及存储介质
WO2018166333A1 (zh) 一种内容验证方法及设备
Kurihara et al. A consumer-driven access control approach to censorship circumvention in content-centric networking
JP6549518B2 (ja) コンテンツ配信ネットワークの代理装置、転送装置、クライアント装置及びプログラム
CN118473686A (zh) 基于区块链的跨域数据获取方法及系统
KR20190006899A (ko) 정보 중심 네트워킹에서 저작권 콘텐츠 배포 장치 및 방법
WO2018019368A1 (en) Devices and methods for caching enciphered content in computer networks

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18768542

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18768542

Country of ref document: EP

Kind code of ref document: A1