A method, apparatus, electronic device, and storage medium for signing compressed files.

Abstract

This disclosure provides a method, apparatus, electronic device, and storage medium for signing compressed files, relating to the field of security. The method includes: obtaining bytes from a specific location in a file to form a byte array; calculating a digest of the byte array using a digest algorithm; and encrypting the digest using a private key to generate a signature. Implementing the technical solution of this disclosure can reduce the computational load required to calculate the digest and improve the signing speed.

Description

Technical Field

[0001] This invention relates to the field of security, and more particularly to a method, apparatus, electronic device, and storage medium for signing compressed files. Background Technology

[0002] Digital signatures can be used to verify that a message comes from a specific sender, or to prove that a message has not been tampered with. Simply put, digital signatures are an application of asymmetric encryption algorithms, that is, encrypting a message with a private key and decrypting it with a public key.

[0003] The drawback of existing digital signatures is that they are extremely time-consuming when processing large files: because the entire binary stream of the file needs to be used as input for the digest algorithm, regardless of the digest algorithm used, calculating the digest of a large file will always take a very long time. In the end, both the sender generating the signature and the receiver verifying the message will consume a long time and computing resources. Summary of the Invention

[0004] To address at least one technical problem in the prior art, this disclosure provides a compressed file signing method, apparatus, electronic device, and storage medium.

[0005] According to a first aspect of this disclosure, a method for signing compressed files is provided, comprising:

[0006] Extract bytes from a specific position in a file to form a byte array;

[0007] A digest algorithm is used to compute a digest of the byte array;

[0008] The digest is encrypted using the private key to generate a signature.

[0009] Optionally, the byte array includes a basic byte array and an additional byte array, wherein the basic byte array includes bytes of partially compressed data of the file, and the additional byte array includes bytes of the file's checksum.

[0010] Optionally, the additional byte array may also include bytes representing the uncompressed size of the file.

[0011] Optionally, the byte array includes a basic byte array;

[0012] The process of obtaining bytes at a specific location in the file to form a byte array includes:

[0013] The file is divided into m segments according to a preset partitioning rule;

[0014] Obtain the bytes at the preset positions of each segment to form a basic byte array.

[0015] Optionally, the preset partitioning rule is to divide the file into m segments on average.

[0016] Optionally, the bytes at the preset position of the segment are the first p bytes of the segment, or the bytes at the preset position of the segment are the last p bytes of the segment.

[0017] Optionally, the byte array may include an additional byte array;

[0018] The process of obtaining bytes at a specific location in the file to form a byte array includes:

[0019] Determine the file type of the file;

[0020] Based on the file type, determine the byte position of the checksum in the file;

[0021] Based on the byte position, the bytes of the checksum in the file are obtained to form the additional byte array.

[0022] According to a second aspect of this disclosure, a compressed file signing device is provided, comprising:

[0023] The acquisition module is used to acquire bytes at a specific position in a file to form a byte array;

[0024] A digest calculation module is used to calculate a digest of the byte array using a digest algorithm;

[0025] The signature generation module is used to encrypt the digest using a private key to generate a signature.

[0026] According to a third aspect of this disclosure, an electronic device is provided, comprising:

[0027] Processor; and

[0028] Stored program memory,

[0029] The program includes instructions that, when executed by the processor, cause the processor to perform the method according to any one of the first aspects of this disclosure.

[0030] According to a fourth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions for causing the computer to perform the method according to any one of the first aspects of this disclosure.

[0031] One or more technical solutions provided in the embodiments of this application can obtain bytes at a specific position in a file to form a byte array, and generate a signature of the file based on the digest of the byte array. On the one hand, this can reduce the amount of computation required to calculate the digest and improve the signing speed, and on the other hand, it can also ensure the security of the signature. Attached Figure Description

[0032] The accompanying drawings illustrate exemplary embodiments of the present disclosure and, together with the description thereof, serve to explain the principles of the present disclosure. These drawings are included to provide a further understanding of the present disclosure and are incorporated in and constitute a part of this specification.

[0033] Figure 1 A flowchart of a compressed file signing method according to an exemplary embodiment of the present disclosure is shown;

[0034] Figure 2 A sub-flowchart of a compressed file signing method according to an exemplary embodiment of the present disclosure is shown;

[0035] Figure 3 Another sub-flowchart of the compressed file signing method according to an exemplary embodiment of the present disclosure is shown;

[0036] Figure 4 A schematic block diagram of a file compression device according to an exemplary embodiment of the present disclosure is shown;

[0037] Figure 5 A structural block diagram of an exemplary electronic device that can be used to implement embodiments of the present disclosure is shown. Detailed Implementation

[0038] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0039] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0040] The term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below. It should be noted that the concepts of "first", "second", etc., used in this disclosure are only used to distinguish different devices, modules, or units, and are not intended to limit the order of functions performed by these devices, modules, or units or their interdependencies.

[0041] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0042] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0043] The present disclosure is described below with reference to the accompanying drawings.

[0044] See Figure 1 A method for signing compressed files, comprising:

[0045] S101: Obtain bytes from a specific position in the file to form a byte array.

[0046] In one implementation, the byte array includes a basic byte array and an additional byte array. The basic byte array includes bytes of partially compressed data of the file, and the additional byte array includes bytes of the file's checksum. The combination of compressed data bytes and checksum bytes can improve the accuracy of signature verification. Optionally, the additional byte array may also include bytes representing the uncompressed size of the file.

[0047] S102, use a digest algorithm to calculate a digest of the byte array.

[0048] In this embodiment, "hash algorithm" or "digest algorithm" refers to the same type of algorithm. This type of algorithm can combine inputs of arbitrary length to obtain a pseudo-random output of fixed length. Commonly used algorithms include the SHA (Secure Hash Algorithm) family or the MD (Message Digest) family. The larger the input of such algorithms, the longer the computation time. Accordingly, in this invention, "hash" or "digest" refers to the output result of the algorithm.

[0049] S103, use the private key to encrypt the digest and generate a signature.

[0050] The signature is obtained by encrypting the digest using the private key. This signature can be decrypted using the corresponding public key. The verification is then determined based on the decrypted digest and the digest calculated using the same method applied when generating the signature from the original file.

[0051] The public and private keys mentioned in this embodiment are the corresponding keys in PKI (Public Key Infrastructure). Each private key corresponds to a unique public key, and information encrypted with the private key can only be decrypted with the corresponding public key.

[0052] The compressed file signing method in this embodiment can obtain bytes at specific positions in the file to form a byte array, and generate a file signature based on the digest of the byte array. On the one hand, it can greatly reduce the amount of computation required to calculate the digest, improve the signing speed and the corresponding verification speed, and on the other hand, it can also ensure the security of the signature.

[0053] In one implementation, the byte array includes a basic byte array. See also Figure 2 Step S101 includes:

[0054] S201, divide the file into m segments according to the preset partitioning rules.

[0055] The preset partitioning rules can be set according to actual needs. For compressed files, most existing lossless data compression algorithms, including ZIP and GZIP, are based on the 1977 paper "A Universal Algorithm for Sequential Data Compression," and their core principle is to use a combination of distance and length to replace repeated byte strings. Therefore, if a byte in the file changes, the compression result after that byte may also undergo a transitive change. Using segmentation to obtain the data can quickly detect this transitive change.

[0056] For example, the default partitioning rule is to divide the file into m segments on average.

[0057] For example, the default partitioning rule is to divide the file into m segments with alternating large and small intervals.

[0058] Taking dividing a file into m equal segments as an example, the length of each segment can be obtained by dividing the total file length L by the number of segments m, based on user input or a pre-determined number of segments; and then the data corresponding to each segment can be obtained.

[0059] For example, when the total data length L is not divisible by the number of segments n, the remaining data can be evenly distributed among the first few segments, and then all the data from the remaining segments can be distributed into the last segment. Specifically, take the remainder of the total data length L divided by the number of segments m to obtain the remainder; distribute the remainder evenly among the first few segments. More specifically, divide the remainder by m to obtain the amount of extra data that needs to be added to each segment. Then distribute this extra data evenly among the first few segments. For example, suppose the data length is 100 and the number of segments is 90. The length of each segment is 1. The remainder is 10, and this 10 needs to be evenly distributed among the first few segments. The amount of extra data that needs to be added to each segment is 10 / 90 = 0.1111, rounded down to 0. Therefore, no extra data needs to be added; take 1 data point from each of the first 90-10 = 80 segments, and then distribute the last 10 data points into the last segment. It should be noted that the data here is only for illustrating the principle and does not represent the actual values ​​used.

[0060] For example, when the total data length L is not divisible by the number of segments n, all remaining data can be allocated to the last segment. Specifically, take the remainder when the total data length is modulo the number of segments m. Allocate the remaining data to the last segment. For instance, suppose the data length is 100, the number of segments is 90, and each segment has a length of 1. The remainder is 10, so allocate these 10 data points to the last segment. One data point is taken from each of the first 89 segments, and 10 data points are taken from the last segment. It should be noted that the data here is for illustrative purposes only and does not represent actual numerical values.

[0061] S202, obtain the bytes at the preset positions of each segment to form a basic byte array.

[0062] The preset position can be set according to actual needs.

[0063] For example, the preset position can be the position of the first p bytes of the segment.

[0064] For example, the preset position can be the last p bytes of the segment.

[0065] The value of P can be set according to actual needs; for example, it can be set to a value between 4 and 16, such as 8. When the file is divided into m segments, a basic byte array of length m*p can be obtained.

[0066] In one implementation, the byte array includes an additional byte array. See also Figure 3 S101 includes:

[0067] S301, Determine the file type.

[0068] The file type of a file can be determined using the corresponding file type determination method. For example, it can be determined based on the file type.

[0069] S302, determine the byte position of the checksum in the file based on the file type.

[0070] The byte position of the checksum in a file can be determined using appropriate byte position determination methods. For example, the byte position of the checksum can be determined from the relevant format rules of the file type. Alternatively, a pre-defined list of relationships between various file types and the byte positions of the checksum can be used to determine the byte position of the checksum.

[0071] The following explanation uses GZIP files and ZIP files as examples.

[0072] 1. GZIP file:

[0073] According to RFC 1952, a GZIP file contains the following four parts:

[0074] 1. Header, containing 10 bytes

[0075]

[0076] 2. Optional extension head

[0077]

[0078] 3. Document Body

[0079]

[0080] 4. Endnote, containing 8 bytes

[0081]

[0082] Every GZIP file includes a CRC32 checksum and the length of the uncompressed raw data at the end. Therefore, the additional byte array A2 corresponding to the GZIP file type is the last 8 bytes of that file.

[0083] II. ZIP file:

[0084] According to the ZIP file format specification, a ZIP file consists of several segments, each segment representing a compressed file. Its overall structure is as follows:

[0085] [local file header 1]

[0086] [file data 1]

[0087] [data descriptor 1] ...

[0089] [local file header n]

[0090] [file data n]

[0091] [data descriptor n]

[0092] [archive decryption header](EFS)

[0093] [archive extra data record](EFS)

[0094] [central directory]

[0095] [zip64 end of central directory record]

[0096] [zip64 end of central directory locator]

[0097] [end of central directory record]

[0098] The format of each [local file header] is as follows:

[0099]

[0100]

[0101] file name(variable size)

[0102] extra field (variable size)

[0103] Each local file header contains a cyclic redundancy check (CRC32) and an uncompressed size. Therefore, the bytes corresponding to the CRC32 and uncompressed size of each file segment are used to construct an additional byte array A2 for the ZIP file.

[0104] The final byte array A consists of a basic byte array A1 and an additional byte array A2.

[0105] S303: Based on the byte position, obtain the bytes of the checksum in the file to form an additional byte array.

[0106] In one or more embodiments of this disclosure, the length of the appended byte array A2 is essentially determined during the character acquisition process of the file. By selecting appropriate m and p, the basic byte array A1 can be made much smaller than the file length, thus requiring significantly less time and computational resources to calculate the digest compared to calculating the entire file, thereby improving the overall speed of signing and verification.

[0107] One or more embodiments disclosed herein can balance security and efficiency for large compressed files. Taking a typical MRO (Measurement Report of Original Type) file as an example, this MRO file is approximately 300-400 MB. Using existing methods, calculating the MRO file digest takes about 1000 milliseconds. The MRO file is generated every 15 minutes and then collected by an upper-layer platform. The upper-layer platform must also spend approximately 1000 milliseconds verifying the integrity of the MRO file. Clearly, using existing digital signature methods for this MRO file would significantly increase system load and reduce processing speed.

[0108] The upper-level collection platform collects the latest generated MRO files every 15 minutes. Any attempt to tamper with an MRO file must be made within these 15 minutes. While it's possible to construct a file with the same signature but different content, given the large file size (MRO files are typically 300-400MB) and the requirement for tampering to complete the modification within a specific timeframe (15 minutes), it's safe to assume that tamperers will lack sufficient computing resources and time to complete the modification. This combination of file size and time constraints ensures the security of the compressed file signature implemented using the sampling technique in this invention.

[0109] See Figure 4 A compressed file signing device, comprising:

[0110] The sampling module 401 is used to sample bytes at specific positions in a file and form a byte array.

[0111] The digest calculation module 402 is used to calculate a digest of a byte array using a digest algorithm.

[0112] The signature generation module 403 is used to encrypt the digest using a private key to generate a signature.

[0113] In one implementation, the byte array includes a basic byte array and an additional byte array. The basic byte array includes bytes of the file's partially compressed data, and the additional byte array includes bytes of the file's checksum. Optionally, the additional byte array may also include bytes representing the file's uncompressed size.

[0114] In one implementation, the byte array includes a basic byte array; the sampling module 401 is used to obtain bytes at specific positions in the file to form a byte array, specifically for: dividing the file into m segments according to a preset partitioning rule; and obtaining bytes at preset positions in each segment to form a basic byte array.

[0115] Optionally, the default partitioning rule is to divide the file into m segments on average.

[0116] Optionally, the preset position of the segment is the first p bytes of the segment.

[0117] Optionally, the preset position of the segment is the last p bytes of the segment.

[0118] In one implementation, the byte array includes an additional byte array; the sampling module 401, used to obtain bytes at specific positions in the file to form the byte array, is specifically used to: determine the file type of the file; determine the byte position of the checksum in the file according to the file type; and obtain the bytes of the checksum in the file according to the byte position to form the additional byte array.

[0119] Exemplary embodiments of this disclosure also provide an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor. The memory stores a computer program executable by the at least one processor, which, when executed by the at least one processor, causes the electronic device to perform a method according to an embodiment of this disclosure.

[0120] Exemplary embodiments of this disclosure also provide a non-transitory computer-readable storage medium storing a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform a method according to embodiments of this disclosure.

[0121] Exemplary embodiments of this disclosure also provide a computer program product, including a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform a method according to an embodiment of this disclosure.

[0122] refer to Figure 5The present invention describes a structural block diagram of an electronic device 500 that can serve as a server or client of the present disclosure, which is an example of a hardware device that can be applied to various aspects of the present disclosure. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0123] like Figure 5 As shown, the electronic device 500 includes a computing unit 501, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 502 or a computer program loaded from a storage unit 508 into a random access memory (RAM) 503. The RAM 503 may also store various programs and data required for the operation of the device 500. The computing unit 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0124] Multiple components in electronic device 500 are connected to I / O interface 505, including: input unit 506, output unit 507, storage unit 508, and communication unit 509. Input unit 506 can be any type of device capable of inputting information to electronic device 500. Input unit 506 can receive input digital or character information and generate key signal inputs related to user settings and / or function control of electronic device. Output unit 507 can be any type of device capable of presenting information and may include, but is not limited to, a display, speaker, video / audio output terminal, vibrator, and / or printer. Storage unit 504 may include, but is not limited to, disk and optical disk. Communication unit 509 allows electronic device 500 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks, and may include, but is not limited to, modems, network cards, infrared communication devices, wireless communication transceivers and / or chipsets, such as Bluetooth TM devices, WiFi devices, WiMAX devices, cellular communication devices, and / or the like.

[0125] The computing unit 501 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 501 performs the various methods and processes described above. For example, in some embodiments, the methods of the embodiments of this disclosure can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 500 via ROM 502 and / or communication unit 509. In some embodiments, the computing unit 501 can be configured to perform the methods of the embodiments of this disclosure by any other suitable means (e.g., by means of firmware).

[0126] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0127] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0128] As used in this disclosure, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, device, and / or apparatus (e.g., disk, optical disk, memory, programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including machine-readable media that receive machine instructions as machine-readable signals. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0129] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0130] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0131] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other.

Claims

1. A method for signing compressed files, characterized in that, include: Obtaining bytes from a specific position in a file to form a byte array, the byte array comprising a basic byte array and an additional byte array, the basic byte array comprising bytes of partially compressed data of the file, the additional byte array comprising bytes of the file's checksum, and the additional byte array further comprising bytes representing the uncompressed size of the file, the process of obtaining bytes from a specific position in the file to form the byte array includes: Determine the file type of the file; Based on the file type, determine the byte position of the checksum in the file; Based on the byte position, obtain the bytes of the checksum in the file to form the additional byte array; A digest algorithm is used to compute a digest of the byte array; The digest is encrypted using the private key to generate a signature; The step of obtaining bytes at a specific position in the file to form a byte array includes: According to the preset partitioning rules, the file is divided into m segments on average; Obtain the bytes at the preset positions of each segment to form a basic byte array, wherein the bytes at the preset positions of the segments are the last p bytes of the segment.

2. A compressed file signing device, characterized in that, include: The acquisition module is used to acquire bytes at a specific position in a file to form a byte array. The byte array includes a basic byte array and an additional byte array. The basic byte array includes bytes of partially compressed data from the file, and the additional byte array includes bytes representing the file's checksum. The additional byte array also includes bytes representing the uncompressed size of the file. Acquiring bytes at a specific position in the file to form the byte array includes: Determine the file type of the file; Based on the file type, determine the byte position of the checksum in the file; Based on the byte position, obtain the bytes of the checksum in the file to form the additional byte array; A digest calculation module is used to calculate a digest of the byte array using a digest algorithm; The signature generation module is used to encrypt the digest using a private key to generate a signature; The step of obtaining bytes at a specific position in the file to form a byte array includes: According to the preset partitioning rules, the file is divided into m segments on average; Obtain the bytes at the preset positions of each segment to form a basic byte array, wherein the bytes at the preset positions of the segments are the last p bytes of the segment.

3. An electronic device, characterized in that, include: processor; as well as Stored program memory, The program includes instructions that, when executed by the processor, cause the processor to perform the method according to claim 1.

4. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to claim 1.

Images