Method and apparatus for authentication of data streams with adaptively controlled losses

Abstract

Methods, components, and systems for efficient authentication, either through a digital signature or message authentication codes, and verification of a digital stream sent from a source to a receiver via zero or more intermediaries, such that the source or intermediary (or both) can remove certain portions of the data stream without inhibiting the ability of the ultimate receiver to verify the authenticity and integrity of the data received. According to the invention, a source may sign an entire data stream once, but may permit either itself or an intermediary to efficiently remove certain portions of the stream before transmitting the stream to the ultimate recipient, without having to re-sign the entire stream. Applications may include the signing of media streams which often need to be further processed to accommodate the resource requirements of a particular environment. Another application allows an intermediary to choose an advertisement to include in a given slot.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS [0001] This application claims the benefit of Provisional Application No. 60 / 495,787, filed Aug. 15, 2003. The present application incorporates the disclosure of this provisional application by reference.BACKGROUND OF THE INVENTION [0002] 1. Field of the Invention [0003] The present invention relates to data stream authentication, and more specifically to authentication schemes with adaptively controlled packet loss. [0004] 2. Description of the Related Art [0005] In many cases, it is desirable to append authentication information to a stream of data to assure a recipient that the data came from a specific source and was not modified en-route. For example, if the data is being provided to an application, then it would be important for the application that the data has not been corrupted either maliciously or by accident. [0006] In cryptography, there are two traditional mechanisms for permitting such authentication: [0007] 1. Message Authentic...

AI Technical Summary

Benefits of technology

[0033] According to one aspect of this invention, Linear Scheme for Subsequence Authentication, the intermediary or source can remove arbitrary blocks (irrespective of their location) while still permitting the receiver to authenticate information. The scheme involves computing a two-layer hash chain and providing the recipient with various values in this chain. The scheme is online for the receiver in the sense that the receiver does not have to incur any delay in verifying the authentication information. In an optimization and generalization to this scheme, one second layer-hash is computed for every bundle of r first-layer hashes. When r=1, the scheme is the original linear scheme for subsequence authentication. In an improvement to this scheme, several first-layer hashes are aggregated before performing the second-layer hash. Consequently, fewer second-layer hashes need to be performed.

[0038] The present invention permits a situation in which an intermediary may adaptively and intelligently decide which blocks are to be dropped. The schemes of the present invention readily adapt to any model for dropping blocks. Moreover, the intermediary is not required to know of any cryptographic keying material. Furthermore, if the source provides the intermediary with various hash values, then the intermediary can avoid having to do any cryptographic related computation. Instead, it just has to forward the blocks it desired together with the hash information for those blocks that are dropped.

Problems solved by technology

The key is split in such a way that it is not possible to derive the private portion from the public portion.

Of course, the signature owner can always claim that the secret signing key was stolen by some adversary.

Because of their nature, traditional authentication schemes do not tolerate any transformations to the data made by the source or by an intermediate.

If the entire stream has been digitally signed or authenticated in conventional ways, then by removing the enhancement layers, the original tag or signature becomes invalid.

First, in the case of using digital signatures, a fairly expensive computation must be performed for each packet.

Second, in both the digital signature and MAC case, authentication information must be appended to each packet, which may not be feasible in consideration of efforts to remove portions of the stream stem to meet bandwidth constraints. levels.

Thus, this approach does not deal with the controlled loss authentication problem, and is not bandwidth efficient.

However, the above Homomorphic Signature Scheme takes precautions, via a GGM tree, to protect the confidentiality of censored data and requires all uncensored message blocks, all co-nodes, and all keying information in order to permit verification, and thus is not efficient.

Images