Fast signature generation and verification

Abstract

Aspects of the disclosure relate to fast signature generation and verification. According to one aspect, the apparatus comprises: a memory to store the file; a processor to generate a first digest of the file and to generate a partial digest table of the file; and a communication bus to deliver the file, the first summary, and the partial summary table to a repository. In another aspect, the apparatus includes: a memory to store the file; a communication bus to extract a partial summary table from the file; and a processor to decompose the partial summary table to generate a delivered partial summary, generate a recipient partial summary using a hash function, compare the recipient partial summary to the delivered partial summary to generate a comparison; and determining a success state or determining a failure state.

Description

Technical Field

[0001] The present disclosure relates generally to the field of fast signature generation and verification, and in particular to fast signature generation and verification for digital signal processor (DSP) library files. Background Art

[0002] Information assurance of digital content provides information security against a variety of hostile threats. Digital signatures (e.g., encrypted additional data tags) are an important information assurance technology that provides authentication (verification of the digital content originator) and integrity (verification of unchanged digital content). However, using digital signatures to verify digital content may add undesirable processing overhead in time-critical applications (such as processor library downloads at initialization). Therefore, there is a need for an efficient way to perform authentication and integrity enforcement using digital signatures. Summary of the invention

[0003] In order to have a basic understanding of one or more aspects of the present disclosure, a summary of these aspects is given below. This overview is not an extensive review of all expected features of the present disclosure, and is neither intended to identify the key or important elements of all aspects of the present disclosure, nor is it intended to describe the scope of any or all aspects of the present disclosure. Its sole purpose is to provide some concepts of one or more aspects of the present disclosure in a simplified form as a preface to the more detailed description given later.

[0004] In one aspect, the present disclosure provides fast signature generation and verification. Therefore, a device for fast digital signature generation of a file includes: a memory configured to store a file; a processor coupled to the memory, the processor configured to generate a first digest of the file and to generate a partial summary table of the file; and a communication bus coupled to the processor, the communication bus configured to deliver the file, the first digest and the partial summary table to a repository.

[0005] In one example, the processor is further configured to generate the first digest using a hash function. In one example, the partial digest table includes the partial digest and the random address. In one example, the processor is further configured to generate the partial digest using a hash function and a cryptographic key. In one example, the cryptographic key is a private key associated with a public key, wherein the private key and the public key are part of a matching asymmetric key pair. In one example, the hash function is a secure hash algorithm (SHA).

[0006] Another aspect of the present disclosure provides an apparatus for fast digital signature verification of a file, the apparatus comprising: a memory configured to store the file; a communication bus coupled to the memory, the communication bus configured to extract a partial summary table from the file; and a processor coupled to the communication bus, the processor configured to: decompose the partial summary table to generate a delivered partial summary and a plurality of delivered random addresses; use a hash function to generate a receiver partial summary; compare the receiver partial summary with the delivered partial summary to generate a comparison; and determine a SUCCESS state for the file when a result of the comparison is that the receiver partial summary is completely consistent with the delivered partial summary, or determine a FAILED state for the file when a result of the comparison is that the receiver partial summary is inconsistent with the delivered partial summary.

[0007] In one example, the hash function is a secure hash algorithm (SHA). In one example, the processor is further configured to generate a recipient partial digest using a cryptographic key. In one example, the cryptographic key is a public key associated with a private key, wherein the private key and the public key are part of a matching asymmetric key pair. In one example, the processor is further configured to generate a recipient partial digest using a file. In one example, the comparison is a bitwise logical exclusive or (XOR) operation of the recipient partial digest and the delivered partial digest.

[0008] Another aspect of the present disclosure provides a method for fast digital signature generation for a file, the method comprising: generating a first digest of the file; generating a partial digest table of the file; and delivering the file, the first digest and the partial digest table to a repository.

[0009] In one example, the method further comprises generating a first digest using a hash function. In one example, the partial digest table comprises the partial digest and a plurality of random addresses. In one example, the method further comprises generating the partial digest using a hash function and a cryptographic key. In one example, the cryptographic key is a private key associated with a public key, wherein the private key and the public key are part of a matching asymmetric key pair. In one example, the hash function is a secure hash algorithm (SHA).

[0010] Another aspect of the present disclosure provides a method for fast digital signature verification of a file, the method comprising: extracting a partial summary table from the file; decomposing the partial summary table to generate a delivered partial summary and a plurality of delivered random addresses; using a hash function to generate a receiver partial summary; comparing the receiver partial summary with the delivered partial summary to generate a comparison; and determining a success state for the file when a result of the comparison is that the receiver partial summary is completely consistent with the delivered partial summary, or determining a failure state for the file when a result of the comparison is that the receiver partial summary is inconsistent with the delivered partial summary.

[0011] In one example, the hash function is a secure hash algorithm (SHA). In one example, the method also includes using a cryptographic key to generate a recipient partial digest. In one example, the cryptographic key is a public key associated with a private key, wherein the private key and the public key are part of a matching asymmetric key pair. In one example, the method also includes using a file to generate the recipient partial digest. In one example, the comparison is a bitwise logical exclusive OR (XOR) operation of the recipient partial digest and the delivered partial digest.

[0012] Another aspect of the present disclosure provides a non-transitory computer-readable medium storing computer executable code, the computer executable code being capable of operating on a device, the device comprising at least one processor and at least one memory coupled to the at least one processor, wherein the at least one processor is configured to implement fast digital signature generation for a file, the computer executable code comprising: instructions for causing a computer to generate a first digest of a file; instructions for causing a computer to generate a partial summary table of the file; and instructions for causing a computer to deliver the file, the first digest, and the partial summary table to a repository.

[0013] In one example, the non-transitory computer-readable medium further includes instructions for causing a computer to generate a first digest using a hash function, and wherein the partial digest table includes the partial digest and the file data specified by the random library address. In one example, the non-transitory computer-readable medium further includes instructions for causing a computer to generate a partial digest using a hash function and a cryptographic key, wherein the cryptographic key is a private key associated with a public key, wherein the private key and the public key are part of a matching asymmetric key pair.

[0014] Another aspect of the present disclosure provides a non-transitory computer-readable medium storing computer executable code, the computer executable code being capable of operating on a device, the device comprising at least one processor and at least one memory coupled to the at least one processor, wherein the at least one processor is configured to implement fast digital signature verification of a file, the computer executable code comprising: instructions for causing a computer to extract a partial summary table from a file; instructions for causing a computer to decompose the partial summary table to generate a delivered partial summary and a plurality of delivered random addresses; instructions for causing a computer to use a hash function to generate a recipient partial summary; instructions for causing a computer to compare the recipient partial summary with the delivered partial summary to generate a comparison; and instructions for causing a computer to determine a success status for the file when a result of the comparison is that the recipient partial summary is completely consistent with the delivered partial summary, or to determine a failure status for the file when a result of the comparison is that the recipient partial summary is inconsistent with the delivered partial summary.

[0015] In one example, the non-transitory computer-readable medium further includes instructions for causing a computer to generate a recipient partial digest using a cryptographic key, wherein the cryptographic key is a public key associated with a private key, wherein the private key and the public key are part of a matching asymmetric key pair. In one example, the non-transitory computer-readable medium further includes instructions for causing a computer to generate a recipient partial digest using a file.

[0016] These and other aspects of the present disclosure will be more fully understood when reading the following specific embodiments. After studying the description of the specific exemplary implementation of the present invention below in conjunction with the accompanying drawings, other aspects, features and specific implementations of the present disclosure will be obvious to those of ordinary skill in the art. Although the features of the present invention may be discussed below with respect to certain specific implementations and drawings, all specific implementations of the present invention may include one or more advantageous features of the advantageous features discussed herein. In other words, although one or more specific implementations may be discussed as having certain advantageous features, one or more of such features may also be used according to the various specific implementations of the present invention discussed herein. In a similar manner, although exemplary implementations may be discussed below as device, system or method implementations, it should be understood that such exemplary implementations may be implemented in various devices, systems and methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 An example of a general process flow diagram for digital signature verification is illustrated.

[0018] Figure 2 An example flow chart illustrating complete signature generation for a file.

[0019] Figure 3 An example flow chart illustrating full signature verification of a file.

[0020] Figure 4 An example flow chart illustrating rapid signature generation for a file.

[0021] Figure 5 An example flow chart illustrating fast signature verification of a file.

[0022] Figure 6 An example flow chart illustrating compound signature verification of a file.

[0023] Figure 7 An example apparatus for fast signature generation for a file is illustrated.

[0024] Figure 8 An example apparatus for rapid signature verification of a file is illustrated. DETAILED DESCRIPTION

[0025] The specific embodiments described below in conjunction with the accompanying drawings are intended as descriptions of various configurations and are not intended to represent the only configurations with which the concepts described herein can be practiced. In order to provide a thorough understanding of the various concepts, the specific embodiments include specific details. However, it is apparent to those skilled in the art that these concepts can be practiced without these specific details. In some instances, well-known structures and components are shown in block diagram form to avoid blurring these concepts.

[0026] Although the method is shown and described as a series of actions for the purpose of simplifying explanation, it should be understood and recognized that the method is not limited by the order of the actions, because according to one or more aspects, some actions can occur in an order different from the order shown and described herein and / or concurrently with other actions. For example, those skilled in the art will understand and recognize that the method can be alternatively represented as a series of related states or events such as in a state diagram. In addition, not all exemplified actions are required to implement the method according to one or more aspects.

[0027] Information assurance (IA) is a key function in modern communication, storage and processing applications. The ubiquity of digital content in the modern world also leads to extensive challenges in maintaining the information security of digital content against multi-faceted threats (such as hostile attacks). In this context, digital content may include messages, documents, files, software, library files, audio, video, images, etc. Generally speaking, digital content is a group of bits that are related or grouped together to form a larger entity.

[0028] One such information security challenge is authentication, i.e., verifying the true originator of digital content. Authentication is intended to provide assurance that digital content has a known source or identity. In one example, authentication ensures that the digital content retrieved by the recipient is legitimate and that no counterfeiting has occurred.

[0029] Another information security challenge is data integrity, i.e., verification that digital content has not been altered in transit from the originator to the recipient. That is, integrity means that the original digital content is preserved after delivery, storage, retrieval, etc., and no tampering has occurred.

[0030] One solution to the need for authentication and integrity of digital content is through the use of digital signatures. A digital signature can be an additional data file, also known as a tag, which can be encrypted or decoded so that the recipient of the digital content can verify its authenticity and integrity before using it.

[0031] In one example, a digital signature may be generated using a hash function. In one example, a hash function is a mathematical transformation of arbitrary input data to a digest or hash of the input data. For example, the digest may be a fixed-length digest. In one example, the digest is a data fingerprint that may be used to detect changes to the input data. For example, the input data is digital content, and the digest is a compact representation of the digital content. For example, a hash function may be performed by a hash algorithm.

[0032] For example, a hash function may have multiple desirable properties for information security purposes. In one example, the input to a hash function H may be represented as X, and the output of the hash function may be represented as Y=H(X). That is, the input X is transformed into the output Y by the hash function H. For example, the hash function may be a one-way function. For example, a one-way function has a property in which its output Y can be easily calculated from its input X, but in which it is computationally infeasible to determine its input X given its output Y. For example, a hash function may be selected so that incremental changes in input data result in large changes in the digest. For example, a hash function may be selected to provide collision resistance, i.e., it is computationally infeasible to find any two different inputs X1, X2 such that H(X1)=H(X2). In one example, computationally infeasible means that there is no practical means for successful execution using current computing resources.

[0033] In one example, there are two common cryptographic systems: public key cryptographic systems and private key cryptographic systems. Using a matching asymmetric key pair (i.e., a private (secret) key S k and the public key P k ) is the primary enabler of digital signature technology. Authentication of received digital content can be achieved by using a private key S kThe digital content or its digest is encrypted for verification to generate a digital signature that is transmitted to the recipient. The received digital signature can then be used with the private key S k Matching public key P k To decrypt, to recover the received digital content or verification digest. For example, authentication can be performed by calculating a recipient digest (from the received digital content) and by comparing the recipient digest with the verification digest.

[0034] In one example, the use of public key cryptography enables information security without the constraint of delivering two private keys to both the originator and the recipient as in private key cryptography (i.e., symmetric cryptography). That is, the public key can be distributed openly over any suitable channel (including insecure channels). In contrast, the private key must only be distributed over a secure channel and cannot use open distribution.

[0035] For example, the digest uses the originator's private key S k The original content is encrypted to generate an originator digital signature at the originator. In one example, the originator digital signature is transmitted to the recipient along with the originator digital content. Subsequently, in one example, the recipient uses a hash function to generate a recipient digest from the received digital content. In one example, the recipient also uses the originator public key P k To decrypt the received digital signature to produce a verification digest. For example, the originator private key and the originator public key are a matching asymmetric key pair. In one example, authentication can be determined by comparing the recipient digest with the verification digest. If the recipient digest is the same as the verification digest, the received digital content is authenticated (i.e., the received digital content has a verified source). If the recipient digest is different from the verification digest, the received digital content is not authenticated (i.e., the received digital content does not have a verified source). In one example, using a matching asymmetric key pair with a digital signature allows the received digital content to be authenticated.

[0036] In one example, digital signature verification requires at least three algorithms for authentication: (1) a key generation algorithm used to generate a cryptographic key (e.g., a private key S k , public key P k ), (2) a signature algorithm used to generate a digital signature using a cryptographic key, and (3) a verification algorithm used to verify the authenticity of the delivered digital content. For example, the cryptographic key is a matching asymmetric key pair (i.e., a private key that matches a public key).

[0037] Figure 1An example of a general processing flow chart 100 for digital signature verification is illustrated. For example, an originator 110 transmits an originator digital content 120 to a receiver 150 via a transmission medium 190, where it is received as a received digital content 160. In one example, the transmission medium 190 is a communication channel, such as a network. In another example, the transmission medium 190 is a storage channel, such as a memory. In another example, the transmission medium 190 is a processing channel, such as a computing device. In one example, the originator digital content 120 is input to a first hash algorithm 121 to generate a first digest 122. For example, the first hash algorithm 121 implements a selected hash function (e.g., SHA-256). In one example, the originator digital content 120 has an arbitrary length, and the first digest 122 has a first fixed length. In one example, the first digest 122 is encrypted by an encryptor 123 using an originator private key 124 to generate an originator digital signature 125. For example, the originator digital signature 125 is an encrypted version of the first digest 122. In one example, the originator digital content 120 may also be encrypted to produce encrypted digital content 126, which may be transmitted to the recipient 150 via the transmission medium 190.

[0038] In one example, the received digital content 160 is input to the second hash algorithm 161 to generate the second digest 162. For example, the second hash algorithm 161 implements the selected hash function. In one example, the received digital content 160 has an arbitrary length, and the second digest 162 has a second fixed length. For example, the first hash algorithm 121 and the second hash algorithm 161 are the same. In one example, the received digital content 160 is first decrypted before being input to the second hash algorithm 161 (for example, if the originator digital content 120 is encrypted at the originator 110).

[0039] In one example, the originator digital signature 125 is transmitted to the receiver 150 via the transmission medium 190, where it is received as the received digital signature 165. For example, the received digital signature 165 is decrypted by the decryptor 163 using the originator public key 164 to generate the third digest 166. In one example, the originator private key 124 and the originator public key 164 are a matching asymmetric key pair. In one example, authentication can be determined by comparing the second digest 162 with the third digest 166. In the case where the third digest 166 is the same as the second digest 162, the received digital content 160 is authenticated or verified (i.e., the received digital content 160 has a verified source). In the case where the third digest 166 is different from the second digest 162, the received digital content 160 is not authenticated or verified (i.e., the received digital content 160 does not have a verified source).

[0040] In one example, digital signature verification may be performed to perform authentication and integrity checks for processor library file downloads for digital signal processors (DSPs). In one example, processor library files are digital content. For example, a DSP may rely on multiple processor library files to perform various functions, such as fast Fourier transform (FFT), correlation processing, statistical processing, neural network processing, diagnostic collection, performance measurement, etc. In one example, processor library files are stored in a repository and need to be ingested by a processing engine to perform certain tasks. In this way, as part of the processor library file download, information security tasks may be performed, such as authentication and integrity verification. In one example, the digital signature associated with a specific processor library file needs to be verified.

[0041] In one example, an electronic device (e.g., a mobile phone) includes multiple processing engines, such as digital signal processors (DSPs). The multiple processing engines may include a central processing unit (CPU) for supervisory tasks and multiple DSPs for specialized tasks (particularly digitally intensive tasks, such as graphics processing, modem processing, image processing, etc.). In one example, the DSP is a computational DSP for general purpose computations.

[0042] For example, the DSP may execute several algorithms, such as computer vision (CV), artificial intelligence (AI), voice / audio processing, video processing, image processing, sensor processing, etc. In one example, the algorithm utilizes multiple files (e.g., processor library files) to perform certain computing tasks. For example, when downloaded from a repository, each file requires a digital signature verification for authentication.

[0043] In one example, the computer generates the selected file and generates a digital signature for the selected file during software / firmware compilation. In one example, the user process domain that utilizes the selected file needs to verify the attached digital signature when downloading the file from the repository. In one example, the process domain is a basic unit of system resources, for example, the process domain may include its own address space and a control thread.

[0044] In one example, the process for downloading a selected file in a user process domain (e.g., a processor (e.g., DSP) domain) is summarized in the following two steps:

[0045] Download the selected file to local storage (e.g., double data rate (DDR)

[0046] Random Access Memory (RAM)), and maps the memory locations of this local memory to the DSP memory

[0047] Perform full digital signature verification using a digest (e.g., hash value) of the selected file

[0048] In one example, full digital signature verification may require a timeline that is a significant portion of the total file download time. For example, for a total execution time of 235ms, a particular processor library file (e.g., a neural network framework for a neural processing engine) may require 112ms to download and 123ms for full digital signature verification. That is, digital signature verification may take up a large portion of the total time required for a file download.

[0049] Figure 2 An example flow chart 200 of full signature generation for a file is illustrated. In block 210, a file is stored in a processor memory location. For example, the file is a processor library file. In one example, the processor memory location is indicated by a root directory path. For example, the processor is a digital signal processor (DSP). In block 220, processor firmware is rebuilt. In one example, rebuilding the processor firmware includes compiling the processor firmware.

[0050] In box 230, an originator digest of the file is generated. In one example, the originator digest is generated using a hash function with the file as input. In one example, the hash function is a secure hash algorithm (SHA), such as SHA-256. For example, the originator digest is generated using a hash function using a cryptographic key. For example, the cryptographic key is a private key. In one example, the generation is performed during firmware compilation. In one example, the originator digest is saved to the processor firmware. In box 240, the reconstructed processor firmware, file, and originator digest are delivered from the originator process domain to the user process domain. In one example, the delivery is performed using a shared communication bus.

[0051] Figure 3 An example flow chart 300 of complete signature verification of a file is illustrated. In box 310, a handle is generated in a processor in a user process domain to begin downloading a file and a received digest. For example, the file is a processor library file. For example, the received digest is a received version of the originator's digest. In one example, the originator digest is generated at the originator using a hash function and a private key. In one example, the received digest is decrypted using a cryptographic key. For example, the cryptographic key is a public key. For example, the public key is associated with the private key as part of a matching asymmetric key pair. In one example, the handle is a unique identifier for each algorithm called on the processor during a session.

[0052] In box 320, a verification digest of the file is generated. In one example, the verification digest is generated using a hash function with the file as input. In one example, the hash function is a secure hash algorithm (SHA), such as SHA-256. For example, the verification digest is generated using a hash function. In box 330, the received digest is compared with the verification digest. In one example, the comparison is a bitwise logical exclusive OR (XOR) operation of the received digest and the verification digest. In the case where the result of the comparison is that the received digest is completely consistent with the verification digest, proceed to box 340 and determine the success state. In the case where the result of the comparison is that the received digest is inconsistent with the verification digest, proceed to box 350 and determine the failure state. In box 340, after determining the success state, the file is loaded and executed in the local processor. In one example, the local processor is a DSP. In box 350, after determining the failure state, an error message is created. In box 360, the local processor task is completed, the handle is terminated and the file is returned to the user process domain.

[0053] Figure 4 An example flow chart 400 for rapid signature generation of a file is illustrated. In block 410, a file is stored in a processor memory location. For example, the file is a processor library file. In one example, the processor memory location is indicated by a root directory path. For example, the processor is a digital signal processor (DSP). In block 420, processor firmware is rebuilt. In one example, rebuilding the processor firmware includes compiling the processor firmware.

[0054] In block 430, a first digest of the file is generated. In one example, the first digest is generated using a selected hash function with the file as input. In one example, the selected hash function is a secure hash algorithm (SHA), such as SHA-256. For example, the first digest is generated using a cryptographic key using the selected hash function. For example, the cryptographic key is a private key. For example, the public key is associated with the private key as part of a matching asymmetric key pair. In one example, the generation is performed during firmware compilation. In one example, the first digest is stored with the processor firmware.

[0055] In block 440, a partial summary table for the file is generated. In one example, the partial digest is generated using a selected hash function with the file as input. For example, the partial digest is a subset of the partial summary table. In one example, the selected hash function is a secure hash algorithm (SHA), such as SHA-256. For example, the partial digest is generated using a selected hash function and a cryptographic key. For example, the cryptographic key is a private key. For example, the public key is associated with the private key, wherein the public key and the private key are part of a matching asymmetric key pair. In one example, the generation is performed during firmware compilation. In one example, the partial summary table is stored with the processor firmware.

[0056] In one example, the partial summary table includes both the partial summary and the random address. For example, the generation of the partial summary also generates a plurality of random numbers (e.g., a number of M random numbers). For example, each random number may be composed of a plurality of bytes (e.g., a number of K bytes per random number). In one example, the number of bytes per random number is 4 (i.e., K=4). For example, each random number is used as a random address to read data from a location in a file.

[0057] In one example, the partial summary table includes one byte from each location specified by each random address. In one example, the selected hash function generates a partial summary from a sample segment of M bytes. In one example, the size of the partial summary is P bytes. For example, P=32. For example, the sample segment refers to M file values ​​specified by the address.

[0058] In one example, the partial summary table includes P bytes of partial summaries and K*M random addresses. For example, the size of the partial summary table is (P+K*M) bytes. In one example, the quantity M is set to a fraction F of the file size S. For example, the fraction is 0.1%. For example, the quantity M has a minimum value M min In one example, the quantity M is set to F*S and M min For example, M min =30. In one example, the number M is selected to ensure random selection of data from the file. In one example, a random address is stored to obtain a value from a library file and to generate a recipient partial digest during fast signature verification.

[0059] For example, if the file size S is 1 megabyte (ie, 1MB) and F = 0.001, then M = 1000. For example, if the file size S is 10 kilobytes (ie, 10 kB), F = 0.001 and M min =30, then M = max(F*S,M min) =max(10,30)=30. For example, the lower limit of the quantity M is M min .

[0060] In one example, partial summary table generation is repeated N times so that a total of N partial summary tables are generated. For example, each partial summary table has a partial summary of P bytes based on a sampling segment of M bytes. In one example, N=5 (i.e., a total of 5 partial summary tables are generated). In one example, a partial summary table is selected from the total of N partial summary tables during signature verification. In one example, the number N is selected to ensure random selection of a partial summary table for signature verification. In one example, partial summary table generation results in a total of N partial summary tables with K*M*N bytes of random addresses and N*P bytes of partial summaries.

[0061] In block 450, the reconstructed processor firmware, files, first summary, and partial summary table are delivered from the originator to the recipient. In one example, the delivery is performed using a shared communication bus. In one example, the recipient is a mobile device. For example, the delivery is to a storage device in the recipient.

[0062] Figure 5 An example flow chart 500 for fast signature verification of a file is illustrated. In block 510, a partial summary table in the user process domain is extracted by randomly selecting one partial summary table out of a total of N partial summary tables. In one example, the total partial summary tables are generated during firmware compilation.

[0063] In block 520, the partial summary table is decomposed to generate a delivered partial summary. For example, the delivered partial summary is obtained by reading P bytes of data from the selected partial summary table. For example, the delivered file is a delivered processor library file.

[0064] In block 530, a recipient partial digest is generated using a hash function. In one example, the recipient partial digest is generated using a hash function with the delivered file as input. In one example, the hash function is a secure hash algorithm (SHA), such as SHA-256. For example, the recipient partial digest is generated using a hash function and a cryptographic key. For example, the cryptographic key is a public key. For example, the public key is associated with a private key, where the public key and the private key are part of a matching asymmetric key pair. In one example, the size of the recipient partial digest is P bytes. For example, P=32.

[0065] In one example, the partial summary table extraction is performed after the receiver is initialized, the firmware is downloaded to the local memory, and the local processor is initialized. For example, the local processor initialization includes creating a user process domain. In one example, a random address of K*M bytes is read from the selected partial summary table. For example, a sampled segment value of M bytes is read from a random address of a file. For example, a receiver partial summary of P bytes is generated using the sampled segment value.

[0066] In block 540, the recipient partial digest is compared to the delivered partial digest. In one example, the comparison is a bitwise logical exclusive OR (XOR) operation of the recipient partial digest and the delivered partial digest. If the result of the comparison is a complete match between the recipient partial digest and the delivered partial digest, proceed to block 550 and determine a success status for the delivered file. If the result of the comparison is a mismatch between the recipient partial digest and the delivered partial digest, proceed to block 560 and determine a failure status for the delivered file.

[0067] In block 550, after determining a success status for the delivered file, the delivered file is loaded and executed in the local processor. In one example, the local processor is a DSP. In block 560, after determining a failure status for the delivered file, the delivered file is marked as UNVERIFIED in the local processor and an error message is created.

[0068] Figure 6 An example flow chart 600 of composite signature verification of a file is illustrated. In block 610, a handle is generated in the user process domain to start downloading the file into local memory (e.g., DDR memory). In block 620, if the download is being performed for the first time, a full signature verification of the file is performed. In one example, the full signature verification follows Figure 3 Description.

[0069] In block 630, in the case where the download is not being performed for the first time, i.e., after a previous download, a fast signature verification of the file is performed. In one example, the fast signature verification follows Figure 5 In block 640, in the event that the result of the quick signature verification is a failed status declaration for the file, a full signature verification of the file is performed. In one example, the full signature verification follows Figure 3 Description.

[0070] In block 650, if the result of the fast signature verification is a successful status declaration for the file, the file is loaded and executed in the local processor. In one example, the local processor is a DSP. In block 660, the local processor task is completed, the handle is terminated, and the file is released from the local memory.

[0071] In one example, the default location for file storage is a memory card (e.g., embedded multimedia card (EMMC), NAND (non-AND) flash memory, etc.). In one example, while the algorithm is executing, the file can be loaded into a double data rate (DDR) memory and mapped into a digital signal processor (DSP) memory. When the algorithm is completed, the file can be demapped from the DSP memory and released from the DDR memory.

[0072] In one example, a method for composite signature verification of a file performs a full signature verification upon initial download of the file. Next, the method performs a partial signature verification upon each subsequent download of the file. For example, using the composite signature verification method greatly reduces the total verification time within the life of the processor while maintaining a low security risk.

[0073] For example, in the case where the file size is 5MB, only a few bytes (e.g., 32 bytes) may need to perform partial signature verification after the initial download. For example, the verification time for each subsequent download is greatly reduced relative to the verification time for the full signature verification.

[0074] Figure 7 An example apparatus 700 for rapid signature generation of a file is illustrated. The apparatus includes a processor 710, a memory 720, a shared communication bus 730, a repository 740, an encryptor 750, and an encryption key material 760. For example, the processor 710 executes a software and / or firmware algorithm to perform rapid signature generation. In one example, the algorithm is stored in the memory 720 or the repository 740. For example, the algorithm includes a hash algorithm, a key generation algorithm, a signature algorithm, etc. For example, the encryption key material 760 includes a private key that is part of a matching asymmetric key pair.

[0075] Figure 8 An example apparatus 800 for rapid signature verification of a file is illustrated. The apparatus includes a processor 810, a memory 820, a shared communication bus 830, a repository 840, a decryptor 850, and a decryption key material 860. For example, the processor 810 executes a software and / or firmware algorithm to perform rapid signature verification. In one example, the algorithm is stored in the memory 820 or the repository 840. For example, the algorithm includes a hash algorithm, a key generation algorithm, a verification algorithm, etc. For example, the decryption key material 860 includes a public key that is part of a matching asymmetric key pair.

[0076] In one aspect, one or more of the steps in the accompanying drawings for providing fast signature generation and verification may be performed by one or more processors, which may include hardware, software, firmware, etc. In one aspect, one or more of the steps in the accompanying drawings for providing fast signature generation and verification may be performed by one or more processors, which may include hardware, software, firmware, etc. For example, the one or more processors may be used to execute the software or firmware required to perform the steps in the flowcharts of the accompanying drawings. Software should be broadly interpreted to mean instructions, instruction sets, codes, code segments, program codes, programs, subroutines, software modules, applications, software applications, software packages, routines, subroutines, objects, executable files, threads of execution, procedures, functions, etc., whether referred to as software, firmware, middleware, microcode, hardware description language or otherwise.

[0077] The software may reside on a computer-readable medium. The computer-readable medium may be a non-transient computer-readable medium. By way of example, non-transient computer-readable media include magnetic storage devices (e.g., hard disks, floppy disks, magnetic strips), optical disks (e.g., compact discs (CDs) or digital versatile discs (DVDs)), smart cards, flash memory devices (e.g., cards, sticks or key drives), random access memory (RAM), read-only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), registers, removable disks, and any other suitable medium for storing software and / or instructions that can be accessed and read by a computer. By way of example, the computer-readable medium may also include carrier waves, transmission lines, and any other suitable medium for sending software and / or instructions that can be accessed and read by a computer. The computer-readable medium may reside in a processing system, outside a processing system, or distributed across multiple entities including the processing system. The computer-readable medium may be implemented in a computer program product. By way of example, a computer program product may include a computer-readable medium in a packaging material. The computer-readable medium may include software or firmware for rapid signature generation and verification. Those skilled in the art will recognize how best to implement the described functionality presented throughout this disclosure depending on the particular application and the overall design constraints imposed on the overall system.

[0078] Any circuits included in the processor are provided as examples only, and other components for performing the described functions may be included in various aspects of the present disclosure, including but not limited to instructions stored in computer-readable media, or any other suitable devices or components described herein and utilizing, for example, the processes and / or algorithms described herein with respect to the example flow charts.

[0079] Within the present disclosure, the word "exemplary" is used to mean "serving as an example, instance, or illustration." Any specific implementation or aspect described herein as "exemplary" is not necessarily to be construed as superior or superior to other aspects of the present disclosure. Likewise, the term "aspect" does not require that all aspects of the present disclosure include the features, advantages, or modes of operation discussed. The term "coupled" is used herein to refer to a direct or indirect coupling between two objects. For example, if object A physically contacts object B, and object B contacts object C, objects A and C may still be considered to be coupled to each other, even if they are not in direct physical contact with each other. The term "circuit" is used broadly and is intended to include both hardware implementations of electronic devices and conductors (where these electronic devices and conductors, when connected and configured, implement the execution of the functions described in the present disclosure, without limitation as to the type of electronic circuit) and software implementations of information and instructions (where these information and instructions, when executed by a processor, implement the execution of the functions described in the present disclosure).

[0080] One or more of the components, steps, features and / or functions illustrated in the drawings may be rearranged and / or combined into a single component, frame, feature or function, or may be embodied in several components, steps or functions. Additional elements, components, steps and / or functions may also be added without departing from the novel features disclosed herein. The devices, equipment, and / or components illustrated in the drawings may be configured to perform one or more methods, features, or steps described herein. The novel algorithms described herein may also be effectively implemented in software and / or embedded in hardware.

[0081] It should be understood that the specific order or hierarchy of steps in the disclosed methods is an illustration of an exemplary process. It should be understood that the specific order or hierarchy of steps in these methods can be rearranged based on design preferences. The attached method claims present elements of various steps in an exemplary order, but are not intended to be limited to the specific order or hierarchy presented unless specifically stated herein.

[0082] The foregoing description is provided to enable any person skilled in the art to practice the various aspects described herein. Various modifications to these aspects will be apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects. Therefore, the claims are not intended to be limited to the various aspects shown herein, but to conform to the full scope consistent with the text of the claims, wherein unless specifically stated otherwise, reference to an element in the singular form is not intended to mean "one and only one", but "one or more". Unless specifically stated, the term "some" refers to one or more. The phrase "at least one" referring to a list of items refers to any combination of those items, including a single member. As an example, "at least one of a, b, or c" is intended to cover: a; b; c; a and b; a and c; b and c; and a, b, and c. All structural and functional equivalents of the elements of the various aspects described throughout the present disclosure that are known or will be known later to a person of ordinary skill in the art are expressly incorporated herein by reference and are intended to be covered by the claims. In addition, regardless of whether such disclosures are explicitly recited in the claims, anything disclosed herein is not intended to be disclosed to the public. No element of a claim should be construed under 35 USC § 112, sixth paragraph, unless the element is expressly recited using the phrase “means for” or, in the case of a method claim, the element is recited using the phrase “frame for.”

Claims

1. A device for quickly generating a digital signature for a file, the device comprising: a memory configured to store the file; a processor coupled to the memory, the processor configured to generate a first summary of the file and to generate a partial summary table of the file; and A communication bus coupled to the processor is configured to deliver the file, the first summary, and the partial summary table to a repository. 2 . The apparatus of claim 1 , wherein the processor is further configured to generate the first digest using a hash function.

3. The apparatus of claim 1, wherein the partial summary table comprises a partial summary and a plurality of random addresses. 4 . The apparatus of claim 3 , wherein the processor is further configured to generate the partial digest using a hash function and a cryptographic key.

5. The apparatus of claim 4, wherein the cryptographic key is a private key associated with a public key, wherein the private key and the public key are part of a matching asymmetric key pair.

6. The apparatus of claim 4, wherein the hash function is a Secure Hash Algorithm (SHA).

7. A device for rapid digital signature verification of a file, the device comprising: a memory configured to store the file; a communication bus coupled to the memory, the communication bus configured to extract a partial summary table from the file; and a processor coupled to the communication bus, the processor being configured to: decomposing the partial summary table to generate a partial summary and a plurality of random addresses for delivery; Use a hash function to generate a recipient partial digest; comparing the recipient partial digest to the delivered partial digest to generate a comparison; as well as A success status for the file is determined when the result of the comparison is a complete consistency between the recipient partial digest and the delivered partial digest, or a failure status for the file is determined when the result of the comparison is a discrepancy between the recipient partial digest and the delivered partial digest.

8. The apparatus of claim 7, wherein the hash function is a Secure Hash Algorithm (SHA).

9. The apparatus of claim 7, wherein the processor is further configured to generate the recipient partial digest using a cryptographic key.

10. The apparatus of claim 9, wherein the cryptographic key is a public key associated with a private key, wherein the private key and the public key are part of a matching asymmetric key pair.

11. The apparatus of claim 7, wherein the processor is further configured to generate the recipient partial digest using the file.

12. The apparatus of claim 7, wherein the comparison is a bitwise logical exclusive OR (XOR) operation of the recipient partial digest and the delivered partial digest.

13. A method for quickly generating a digital signature for a file, the method comprising: generating a first digest of the document; generating a partial summary table of said files; as well as The file, the first summary, and the partial summary table are delivered to a repository. The method of claim 13 , further comprising using a hash function to generate the first digest. The method of claim 13 , wherein the partial summary table comprises a partial summary and a plurality of random addresses.

16. The method of claim 15, further comprising generating the partial digest using a hash function and a cryptographic key.

17. The method of claim 16, wherein the cryptographic key is a private key associated with a public key, wherein the private key and the public key are part of a matching asymmetric key pair.

18. The method of claim 16, wherein the hash function is a Secure Hash Algorithm (SHA).

19. A method for rapid digital signature verification of a file, the method comprising: extracting a partial summary table from the file; decomposing the partial summary table to generate a partial summary of a delivery and a plurality of random addresses of the delivery; Use a hash function to generate a recipient partial digest; comparing the recipient partial digest to the delivered partial digest to generate a comparison; as well as A success status for the file is determined when the result of the comparison is a complete consistency between the recipient partial digest and the delivered partial digest, or a failure status for the file is determined when the result of the comparison is a discrepancy between the recipient partial digest and the delivered partial digest.

20. The method of claim 19, wherein the hash function is a Secure Hash Algorithm (SHA).

21. The method of claim 19, further comprising generating the recipient partial digest using a cryptographic key.

22. The method of claim 21, wherein the cryptographic key is a public key associated with a private key, wherein the private key and the public key are part of a matching asymmetric key pair.

23. The method of claim 19, further comprising generating the recipient partial summary using the file.

24. The method of claim 19, wherein the comparison is a bitwise logical exclusive OR (XOR) operation of the recipient partial digest and the delivered partial digest.

25. A non-transitory computer-readable medium storing computer executable code, the computer executable code being operable on a device, the device comprising at least one processor and at least one memory coupled to the at least one processor, wherein the at least one processor is configured to implement fast digital signature generation for a file, the computer executable code comprising: instructions for causing a computer to generate a first digest of the document; instructions for causing the computer to generate a partial summary table of the file; and Instructions for causing the computer to deliver the file, the first digest, and the partial summary table to a repository.

26. The non-transitory computer-readable medium of claim 25, further comprising instructions for causing the computer to generate the first digest using a hash function, and wherein the partial digest table includes partial digests and file data specified by random library addresses.

27. The non-transitory computer-readable medium of claim 25, further comprising instructions for causing the computer to generate the partial digest using a hash function and a cryptographic key, wherein the cryptographic key is a private key associated with a public key, wherein the private key and the public key are part of a matching asymmetric key pair.

28. A non-transitory computer-readable medium storing computer executable code, the computer executable code being operable on a device, the device comprising at least one processor and at least one memory coupled to the at least one processor, wherein the at least one processor is configured to implement fast digital signature verification of a file, the computer executable code comprising: instructions for causing a computer to extract a portion of the summary table from the file; instructions for causing the computer to decompose the partial summary table to generate a partial summary of a delivery and a plurality of random addresses of the delivery; instructions for causing the computer to generate a recipient partial digest using a hash function; instructions for causing the computer to compare the recipient partial digest to the delivered partial digest to generate a comparison; and Instructions for causing the computer to determine a success status for the file when the result of the comparison is a complete match between the recipient partial digest and the delivered partial digest, or to determine a failure status for the file when the result of the comparison is a mismatch between the recipient partial digest and the delivered partial digest.

29. The non-transitory computer-readable medium of claim 28, further comprising instructions for causing the computer to generate the recipient partial summary using a cryptographic key, wherein the cryptographic key is a public key associated with a private key, wherein the private key and the public key are part of a matching asymmetric key pair.

30. The non-transitory computer-readable medium of claim 29, further comprising instructions for causing the computer to generate the recipient partial digest using the file.

Images