Hmac-sha256 security authentication method

Abstract

The application provides an HMAC-SHA256 security authentication method, which comprises the following steps: sending messages in groups in sequence, and processing at most 64 groups of messages simultaneously in each round; each group of messages corresponds to a group of keys, and the first XOR calculation of HMAC is performed on the corresponding keys; the keys after the first XOR calculation are combined with the corresponding each group of messages respectively as a group of thread data, and each group of threads is numbered; all threads are sequentially scheduled by the SHA256 authentication algorithm for the first round; the multiplexing is performed on the group of keys corresponding to each group of thread numbers in the first round scheduling result; the second XOR calculation of HMAC is performed on the multiplexed keys; the keys after the second XOR calculation are combined with the corresponding each group of thread results in the first round scheduling result respectively as a group of thread data, and each group of threads is numbered; all threads are sequentially scheduled by the SHA256 authentication algorithm for the second round, and the MAC value is obtained. The application can realize multi-thread parallel execution of data processing, and improve the information processing rate.

Description

Technical Field

[0001] This manual relates to the field of communication technology, and in particular to the HMAC-SHA256 security authentication method. Background Technology

[0002] The SHA256 Secure Hash Algorithm is a widely used cryptographic hash function that produces a 256-bit (32-byte) hash value to ensure the integrity and consistency of transmitted information.

[0003] The HMAC algorithm is a checksum algorithm that checks data for tampering. Before sending data, the HMAC algorithm hashes the data block and the agreed-upon public key to generate a digest, which is appended to the data block to be sent. When the data and digest arrive at their destination, the HMAC algorithm is used to generate another checksum. If the two numbers match, the data has not been altered.

[0004] Combining the HAMC and SHA256 algorithms can further enhance the security of verification. Currently, a common approach is to use a CPU to serially implement HMAC-SHA256 data processing. However, this method is complex, involves many rounds, resulting in a low CPU output rate; furthermore, since a CPU can only execute commands serially, it cannot meet the requirements for speeds exceeding Git / s. Summary of the Invention

[0005] To overcome the problems existing in related technologies, this specification provides the HMAC-SHA256 security authentication method.

[0006] The HMAC-SHA256 security authentication method according to the embodiments of this specification is applied to a programmable logic chip, including:

[0007] Messages are sent in groups sequentially, with a maximum of 64 groups of messages processed simultaneously in each round.

[0008] Each group of messages corresponds to a key, and the corresponding key is subjected to the first XOR calculation of HMAC;

[0009] The key obtained after the first XOR operation is combined with each corresponding message group to form a thread data group, and each thread group is numbered.

[0010] All threads are scheduled in the first round using the SHA256 authentication algorithm in sequence;

[0011] The key corresponding to each group of thread numbers in the first round of scheduling results is reused;

[0012] Perform a second XOR operation on the reused key using HMAC;

[0013] The key after the second XOR operation is combined with the thread results of each group in the corresponding first round of scheduling results to form a group of thread data, and each group of threads is numbered.

[0014] All threads are scheduled in the second round using the SHA256 authentication algorithm to obtain the MAC value.

[0015] Furthermore, the key length corresponding to each group of messages is 512 bits. If it is less than 512 bits, it needs to be padded and then the first HMAC XOR calculation is performed. If it is greater than 512 bits, it needs to be calculated once with SHA256 to get a 256-bit result. Then, the 256-byte result is padded to 512 bytes. After padding, the first HMAC XOR calculation is performed. The key after the first HMAC XOR and the corresponding message form a group of thread data, which is sent as a data packet with a length of 512 bits per tick.

[0016] Furthermore, the range of thread numbers for each group in the first round of scheduling is 0 to 63;

[0017] In the second round of scheduling, the thread number for each group ranges from 64 to 127;

[0018] In each round of scheduling, if a thread's data packet is empty, no data is sent.

[0019] Furthermore, data packets are sent in the same order within the same thread, but data packets between different threads do not need to be sent in the same order.

[0020] Furthermore, in the first round of scheduling, each group of threads corresponds to a register. When sending the data packet of each group of threads, the corresponding programming number, the end marker of the data packet of each group of threads, the corresponding key, and the hash initial value of the SHA256 authentication algorithm for each group of threads are attached and stored in the register of the corresponding thread respectively.

[0021] In the second round of scheduling, each group of threads corresponds to a register. When sending data to each group of threads, the corresponding programming number, the end marker of each group of thread data packets, and the initial hash value are attached and stored in the register of the corresponding thread.

[0022] Furthermore, reusing the key corresponding to the thread number in the first round of scheduling includes reusing the key in the 0th group number register for the 64th group of numbered threads, and so on, until the 127th group of numbered threads reuses the key in the 63rd group number register.

[0023] Furthermore, the key after the second XOR operation is combined with the corresponding thread results from the first round of scheduling to form a set of thread data:

[0024] The key with the reused 0th group number is XORed with HMAC a second time. The XORed key is combined with the hash value of the 0th group in the 64th group number register to form the thread data of the 64th group number. This process continues until the key with the reused 63rd group number is XORed with HMAC a second time. The XORed key is combined with the hash value of the 63rd group in the 127th group number register to form the thread data of the 127th group number.

[0025] Furthermore, in the second round of scheduling, each key obtained needs to be 512 bits in length. If it is less than 512 bits, it needs to be padded, and then the first HMAC XOR calculation is performed. If it is greater than 512 bits, it needs to be SHA256 calculated first to obtain a 256-bit result, and then padded to 512 bits. After padding, the first HMAC XOR calculation is performed. The key after the second XOR is combined with the hash value of each group after the first round of scheduling to form a group of thread data. Each group of threads sends data packets with a length of 512 bits per tick.

[0026] Furthermore, after completing the data packets for the second round of scheduling numbered threads, the corresponding register contents used in the first round of scheduling are deleted.

[0027] Preferably, the programmable logic chip is an FPGA chip.

[0028] The technical solutions provided in the embodiments of this specification may include the following beneficial effects:

[0029] The embodiments in this specification enable multi-threaded parallel execution of data processing, thereby improving information processing speed.

[0030] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this specification. Attached Figure Description

[0031] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this specification and, together with the description, serve to explain the principles of this specification.

[0032] Figure 1 This is a schematic diagram of an embodiment of the method of this application. Detailed Implementation

[0033] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this specification as detailed in the appended claims.

[0034] This application provides an HMAC-SHA256 security authentication method, applied to programmable logic chips, such as... Figure 1 As shown, it includes:

[0035] 101: Send messages in groups sequentially, with a maximum of 64 groups of messages processed simultaneously per round;

[0036] The messages are packetized and sent sequentially in groups. Because a programmable logic chip is used, the programmability allows for parallel processing of multiple groups of message data. This embodiment preferably uses an FPGA chip, which can process up to 64 groups of message data simultaneously per round. However, in practice, each round may have fewer than 64 groups, such as 30 or 40 groups per round.

[0037] 103: Each group of messages corresponds to a key, and the corresponding key is used for the first XOR calculation of HMAC;

[0038] Each message group corresponds to a key. The key needs to be XORed with the first HMAC operation and combined with the corresponding received message group to form a set of thread data, which is used for the first round of scheduling calculation of the subsequent SHA256 algorithm. Here, the length of each key group must be 512 bits. If the length is less than 512 bits, the key needs to be padded, for example, with 0s. This is done by XORing with ipad00110110. If the length is greater than 512 bits, it first needs to undergo one SHA256 calculation to obtain a 256-bit result, which is then padded with 0s before XORing with ipad00110110.

[0039] 105: The key after the first XOR operation is combined with each corresponding message group to form a thread data group, and each thread group is numbered.

[0040] The combined data packets are sent at 512 bits per tick. The thread number for each group in the first round of scheduling can range from 0 to 63; alternatively, it can be other numbers, such as 1 to 64. If a group of messages includes multiple tick messages, they are sent sequentially. The same key is used for messages within the same group.

[0041] 107: All threads sequentially undergo the first round of scheduling using the SHA256 authentication algorithm;

[0042] In the first round of scheduling, each group of threads corresponds to a register, which can be assigned a number for easy retrieval later. When sending the data packet for each thread group, the corresponding programming number, an end marker for the data packet, the corresponding key, and the initial hash value for the SHA256 authentication algorithm for each thread are included and stored in the corresponding thread's register. For example, thread number 0 corresponds to register number 0, thread number 1 corresponds to register number 1, and so on. The initial hash value for the SHA256 authentication algorithm stored in the register is determined by the start marker. The initial hash value in each register is XORed with the data of the corresponding thread number to obtain the result of the first round of scheduling.

[0043] 109: Reuse the set of keys corresponding to each group of thread numbers in the first round of scheduling results;

[0044] Retrieve the key from the register corresponding to each group of threads in the first round of scheduling, for use in the second round of scheduling.

[0045] 111: Perform a second XOR operation on the reused key using HMAC;

[0046] The reused key must still be 512 bits long. If the length is insufficient, it can be padded with zeros. Then, a second XOR operation of HMAC is performed. If the length is greater than 512 bits, a SHA256 operation is performed first to obtain a 256-bit result. This 256-bit result is then padded with zeros before the second XOR operation of HMAC is performed. The key after the second XOR operation is combined with each hash value from the first round of scheduling to form a set of thread data. Each thread sends data packets with a length of 512 bits per tick. This is then XORed with opad01011100.

[0047] 113: The key after the second XOR is combined with the thread results of each group in the corresponding first round of scheduling results to form a group of thread data, and each group of threads is numbered;

[0048] The key obtained by the second XOR operation is combined with the result of the same number from the first round of scheduling to form a set of thread data for use in the second round of scheduling. The range of thread numbers for each set in the second round can be 64 to 127, or other ranges such as 65 to 128, as long as the numbering does not interfere with each other.

[0049] The key method of the first round is reused. For example, the key in the register of the 0th group is reused for the 64th group of numbered threads, and so on, until the key in the register of the 63rd group of numbered threads is reused for the 127th group of numbered threads.

[0050] The key after the second XOR operation is combined with each group of threads in the corresponding first round of scheduling results to form a group of thread data. For example, the key with the reused group number 0 is XORed with the key with the second HMAC operation, and the key after the XOR operation is combined with the hash value of group 0 in the group number register to form the thread data of group number 64. This process continues until the key with the reused group number 63 is XORed with the key with the second HMAC operation, and the key after the XOR operation is combined with the hash value of group 63 in the group number register to form the thread data of group number 127.

[0051] After completing the data packet combination for the thread with the second scheduling number, the contents of the corresponding registers used in the first scheduling round are deleted. This allows registers 0-63 used in the first scheduling round to be used in the next scheduling round.

[0052] 115: All threads sequentially undergo the second round of scheduling using the SHA256 authentication algorithm to obtain the MAC value.

[0053] In the second round of scheduling, each group of threads corresponds to a register. When sending data to each group of threads, the corresponding programming number, the end marker of each group's data packet, and the initial hash value are attached and stored in the corresponding thread's register. Registers can also be numbered for easy lookup, for example, using the same number as the thread. The initial hash value in each group's register is XORed with the data of the corresponding numbered thread to obtain the result of the second round of scheduling.

[0054] This application uses 0 to 127 threads as a cycle, including the two rounds of scheduling mentioned above, as shown in Table 1.

[0055] Table 1

[0056]

[0057]

[0058] If more than 64 packets need to be processed, then according to the method of this application, the packets must undergo two rounds of SHA256 algorithm scheduling. During the first round of scheduling, when a thread has completed its calculation, it directly proceeds to the second round of scheduling corresponding to that thread to accelerate the processing speed. For example, if 100 packets need to be processed, when the processing of the 0th packet's data is complete, the second round of calculation for the 0th packet is not performed immediately; instead, the data for the 64th packet is input. After the 99th packet is input, the second round of data for the 0th packet is input in the next clock cycle. Although other threads in the first round of scheduling may not have completed their first round of scheduling, because the data in the first round of scheduling is independent of each other, there is no need to wait, thus improving the data processing speed.

[0059] In the two rounds of scheduling mentioned above, if the data packets in a certain group of threads are empty, no data will be sent.

[0060] In this application, during the two rounds of scheduling, data packets within the same thread are sent in order, while data packets between different threads do not need to be sent in order. A reordering module can be added after the output data to sort the packets sent by different threads according to their thread numbers, thus ensuring order preservation between threads.

[0061] This application utilizes the parallel data processing capabilities of programmable logic chips to achieve parallel message processing, thereby increasing data processing speed. Furthermore, this application performs two rounds of data scheduling processing in the same mode, achieving a performance improvement of 64 times compared to serial processing. Moreover, by reusing the SHA256 module, the cost of logic resources is significantly reduced.

[0062] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods and computer program products according to embodiments of this disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0063] Furthermore, these computer program instructions can also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in the process. Figure 1 One or more processes and / or boxes Figure 1The function specified in one or more boxes.

[0064] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0065] It should be understood that this specification is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this specification is limited only by the appended claims.

[0066] The above are merely preferred embodiments of this specification and are not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification shall be included within the scope of protection of this specification.

Claims

1. An HMAC-SHA256 security authentication method, applied to programmable logic chips, characterized in that, include: Messages are sent in groups sequentially, with a maximum of 64 groups of messages processed simultaneously in each round. Each group of messages corresponds to a key, and the corresponding key is subjected to the first XOR calculation of HMAC; The key obtained after the first XOR operation is combined with each corresponding message group to form a thread data group, and each thread group is numbered. All threads are scheduled in the first round using the SHA256 authentication algorithm in sequence; The key corresponding to each group of thread numbers in the first round of scheduling results is reused; Perform a second XOR operation on the reused key using HMAC; The key after the second XOR operation is combined with the thread results of each group in the corresponding first round of scheduling results to form a group of thread data, and each group of threads is numbered. All threads are scheduled in the second round using the SHA256 authentication algorithm to obtain the MAC value.

2. The HMAC-SHA256 security authentication method according to claim 1, characterized in that, The key length corresponding to each group of messages is 512 bits. If it is less than 512 bits, it needs to be padded and then the first XOR calculation of HMAC is performed. If it is greater than 512 bits, it needs to be calculated once to get a 256-bit result, and then padded to 512 bits. After padding, the first XOR calculation of HMAC is performed. The key after the first XOR operation of HMAC and the corresponding message form a set of thread data, which is sent as a data packet with a length of 512 bits per tick.

3. The HMAC-SHA256 security authentication method according to claim 2, characterized in that, In the first round of scheduling, the thread number for each group ranges from 0 to 63; In the second round of scheduling, the thread number for each group ranges from 64 to 127; In each round of scheduling, if a thread's data packet is empty, no data is sent.

4. The HMAC-SHA256 security authentication method according to claim 3, characterized in that, Data packets are sent in the same order within the same thread, but data packets between different threads do not need to be sent in the same order.

5. The HMAC-SHA256 security authentication method according to claim 4, characterized in that, In the first round of scheduling, each group of threads corresponds to a register. When sending the data packet of each group of threads, the corresponding programming number, the end marker of the data packet of each group of threads, the corresponding key, and the hash initial value of the SHA256 authentication algorithm for each group of threads are attached and stored in the register of the corresponding thread respectively. In the second round of scheduling, each group of threads corresponds to a register. When sending data to each group of threads, the corresponding programming number, the end marker of each group of thread data packets, and the initial hash value are attached and stored in the register of the corresponding thread.

6. The HMAC-SHA256 security authentication method according to claim 5, characterized in that, Reusing the key corresponding to the thread number in the first round of scheduling includes reusing the key in the 0th group number register for the 64th group number thread, and so on, until the 127th group number thread reuses the key in the 63rd group number register.

7. The HMAC-SHA256 security authentication method according to claim 6, characterized in that, The key after the second XOR operation is combined with each group of threads in the corresponding first round scheduling result to form a thread group: The key with the reused 0th group number is XORed with HMAC a second time. The XORed key is combined with the hash value of the 0th group in the 64th group number register to form the thread data of the 64th group number. This process continues until the key with the reused 63rd group number is XORed with HMAC a second time. The XORed key is combined with the hash value of the 63rd group in the 127th group number register to form the thread data of the 127th group number.

8. The HMAC-SHA256 security authentication method according to claim 7, characterized in that, In the second round of scheduling, each key obtained must be 512 bits in length. If it is less than 512 bits, it needs to be padded. After padding, a second HMAC XOR calculation is performed. If it is greater than 512 bits, a SHA256 calculation is performed first to obtain a 256-bit result, and then padded. After padding, a second HMAC XOR calculation is performed. The key after the second XOR is combined with the hash value of each group after the first round of scheduling to form a group of thread data. Each group of threads sends data packets with a length of 512 bits per tick.

9. The HMAC-SHA256 security authentication method according to claim 7, characterized in that, After completing the data packets for the second round of scheduling of the numbered thread, delete the corresponding register contents used in the first round of scheduling.

10. The HMAC-SHA256 security authentication method according to claim 1, characterized in that, The programmable logic chip mentioned is an FPGA chip.

Images