A verifiable resource delivery method and apparatus based on incremental encoding

Abstract

The application provides a verifiable resource transfer method and device based on incremental encoding, which comprises the following steps: pulling certificate information from a key server, and determining the mapping relationship between each communication entity and a public key; determining a target communication entity and an intermediate communication entity on a communication path based on the forwarding strategy of each communication entity and the certificate information; transmitting resource information on a source communication entity to the intermediate communication entity on the next path, verifying the incremental encoding contained in the resource information by the intermediate communication entity; if the verification is successful, attaching the verifiable encoding of the intermediate communication entity to the incremental encoding, sending the resource information to the intermediate communication entity on the next path, and repeating the verification process and the attachment process until the target communication entity receives the resource information. The incremental encoding generated hop by hop and verified hop by hop can prove the verifiable trust of the path nodes to the resource, and can solve the problem of trusted transfer of the resource in the network.

Description

Technical Field

[0001] This application relates to the field of computer network information security technology, and in particular to a verifiable resource transfer method and apparatus based on incremental coding. Background Technology

[0002] In modern cryptography, ensuring information security primarily considers five aspects: confidentiality, integrity, availability, authentication, and non-repudiation of information and information systems. During resource transfer and forwarding, the three most important and closely watched characteristics are confidentiality, integrity, and availability.

[0003] Confidentiality refers to the protection of information from being disclosed to or used by unauthorized users. Confidentiality can be ensured through information encryption, access control, and other methods. Integrity refers to the protection of information from damage or modification during transmission, exchange, and processing. The integrity of information can be guaranteed through hash algorithms. Availability refers to the characteristic that information can be used normally when accessed by authorized users as required.

[0004] Computer network architecture employs a "best-effort" packet forwarding mechanism to transmit data resource information, which presents security and untrust issues during transmission. Existing technologies typically address these security and untrust issues by encrypting information or establishing secure tunnels to protect resource transmission, such as the Secure Transport Layer Protocol (SSL / TLS) and zero-trust architectures.

[0005] SSL / TLS is a suite of protocols built on top of the transport layer of computer network architecture. SSL / TLS is used to establish encrypted connections between communicating entities, including but not limited to those between browsers and web servers, or between computer systems and servers. Currently, applications / protocols using SSL / TLS include email, instant messaging software, VoIP, and the widely used HTTPS. SSL / TLS guarantees the confidentiality, integrity, and authentication of information. However, the overhead of SSL / TLS for encrypting traffic is not negligible. Zero-trust architecture, also known as the zero-trust security model, describes a design and implementation mechanism for IT systems. Its core principle is "never trust, always verify." That is, nothing, no matter what, is trusted by default within the IT system. Before accessing the system, any person, thing, or event needs to be authenticated; any action performed within the system also needs authentication, even if it has been authenticated in previous actions. This places more stringent requirements on the encryption authentication and verification capabilities of IT systems.

[0006] In the internet, the two most prevalent types of entities are computer terminal devices and intermediate box devices. Computer terminal devices are generally intelligent, more versatile, and do not have particularly high requirements for forwarding performance; they can perform encryption and decryption operations and accept their overhead. However, intermediate box devices are generally more specialized for specific purposes such as forwarding filtering, and therefore their performance in processing tasks other than forwarding filtering is more limited. Summary of the Invention

[0007] This application aims to at least partially address one of the technical problems in the related art.

[0008] To achieve the above objectives, the first aspect of this application proposes a verifiable resource transfer method based on incremental coding, comprising:

[0009] Retrieve certificate information from the key server to determine the mapping relationship between each communication entity and the public key;

[0010] Based on the forwarding policies and certificate information of each communication entity, the target communication entity and intermediate communication entities on the communication path are determined.

[0011] The resource information on the source communication entity is transmitted to the intermediate communication entity on the next path, and the intermediate communication entity verifies the incremental encoding contained in the resource information.

[0012] If the verification is successful, the verifiable code of the intermediate communication entity is appended to the incremental code, and the processed resource information is sent to the intermediate communication entity on the next path. The verification and appending processes are repeated until the target communication entity receives the resource information.

[0013] Optionally, before retrieving certificate information from the key server and determining the mapping relationship between each communication entity and the public key, the following steps are also included:

[0014] Determine the public key, private key, and certificate generated by each communication entity;

[0015] Certificate information is obtained based on the public key and certificate of each communication entity, and the certificate information of each communication entity is uploaded to the key server.

[0016] Optionally, the resource information includes entity resources and session resources.

[0017] Optionally, the verifiable code includes a verifiable code identifier, a communication entity identifier, a signature algorithm identifier, a public key identifier, a signature level, and signature content.

[0018] Optionally, the incremental encoding includes a version number, an incremental encoding length, and a verifiable encoding list, wherein the verifiable encoding list is directional, flowing from the source communication entity to the target communication entity along the communication path.

[0019] Optionally, when verifying the incremental encoding by an intermediate communication entity, the method further includes:

[0020] Verify each verifiable code contained in the incremental encoding;

[0021] Based on the communication entity identifier and public key identifier in the verifiable encoding, determine whether it conforms to the mapping relationship between the communication entity and the public key;

[0022] If the mapping relationship is met, the signature content in the verifiable encoding is verified using the corresponding public key.

[0023] Optional, also includes:

[0024] If the mapping relationship is not met, or if the mapping relationship is met but the verification fails, the resource information is discarded.

[0025] Optional, also includes:

[0026] If the verification is successful, the intermediate communication entity or the target communication entity performs local processing on the received resource information, wherein the local processing includes storing and modifying the resource information.

[0027] Optionally, when appending the verifiable code of an intermediate communication entity to the incremental code, the method further includes:

[0028] The signature method is determined based on the version number in the incremental encoding.

[0029] Based on the determined signature method, the signature length and signature content are filled using the signature algorithm of the intermediate communication entity to generate a verifiable code;

[0030] The verifiable code is appended to the incremental code according to the order of communication entities on the communication path, and the incremental code length of the incremental code is adjusted.

[0031] To achieve the above objectives, a second aspect of this application proposes a verifiable resource transfer device based on incremental coding, comprising:

[0032] The first determining module is used to retrieve certificate information from the key server and determine the mapping relationship between each communication entity and the public key;

[0033] The second determining module is used to determine the target communication entity and intermediate communication entities on the communication path based on the forwarding policies and certificate information of the respective communication entities.

[0034] The verification module is used to transmit resource information from the source communication entity to an intermediate communication entity on the next path, and the intermediate communication entity verifies the incremental encoding contained in the resource information.

[0035] The generation and transmission module is used to, if the verification is successful, append the verifiable code of the intermediate communication entity to the incremental code, and send the resource information to the intermediate communication entity on the next path, repeating the verification process and the appending process until the target communication entity receives the resource information.

[0036] The technical solutions provided by the embodiments of this application bring at least the following beneficial effects:

[0037] It provides a verifiable and trusted resource transfer mechanism based on incremental coding with hop-by-hop generation and hop-by-hop verification. By attaching incremental coding to the resource, the communication entity using this mechanism can verify the resource and protect the resource. At the same time, it is compatible with the existing basic principles of resource transfer, so as to facilitate the secure hop-by-hop transfer and sharing of resources, verify the origin of the resource, protect the communication path, and solve the problem of trusted resource transfer in the network.

[0038] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0039] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0040] Figure 1 This is a flowchart illustrating a verifiable resource transfer method based on incremental coding according to an embodiment of this application;

[0041] Figure 2 This is a forwarding flowchart of a single communication entity according to an embodiment of this application;

[0042] Figure 3 This is a topology example diagram containing multiple communication entities shown according to embodiments of this application;

[0043] Figure 4 This is a block diagram illustrating a verifiable resource transfer device based on incremental coding, according to an embodiment of this application. Detailed Implementation

[0044] The embodiments of this application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0045] Figure 1 This application illustrates a verifiable resource transfer method based on incremental coding, comprising:

[0046] Step 101: Retrieve certificate information from the key server to determine the mapping relationship between each communication entity and the public key.

[0047] In the embodiments of this application, such as Figure 2 As shown, each communication entity needs to obtain the certificate information of other communication entities from the key server. It is understandable that each communication entity needs to have its own identification information. Based on the communication entity identification, the relevant information of the communication entity can be quickly found.

[0048] As one possible implementation, the key server can be a real physical server or a peer communication entity based on DH switching.

[0049] Understandably, before obtaining certificate information of other communication entities from the key server, such as... Figure 2 As shown, each communication entity needs to generate its own public and private keys and certificates. Then, based on its own information, it uploads the generated certificate information to the key server for storage through a certain mechanism so that other communication entities can query it.

[0050] This application does not impose specific restrictions on the public-key cryptography system used by the communication entities.

[0051] It should be noted that the key server is only responsible for storing and querying the public key certificate information of each communication entity. It is not responsible for generating, distributing, or destroying public keys, private keys, or certificate information. Each communication entity needs to retrieve the public key certificate information of other communication entities from the key server itself.

[0052] Step 102: Based on the forwarding policies and certificate information of each communication entity, determine the target communication entity and the intermediate communication entities on the communication path.

[0053] In this embodiment of the application, the target communication entity, as well as the communication path and intermediate communication entities in the resource transmission process, can be determined starting from the source communication entity by using the forwarding policy and certificate information of each entity.

[0054] It is understandable that the communication entities in the entire communication path use a "receive-process-forward" method to transfer resources. The communication entities process resource information hop by hop with each other. However, the forwarding of resources from the current communication entity to the next communication entity is an end-to-end process, which does not require the two communication entities to be in a direct connection state.

[0055] More specifically, the source communication entity is the originating node of the resource, which only sends out the resource from its own communication entity and completes the resource forwarding process; the intermediate communication entity is the forwarding node of the resource, which completes the complete process of "receiving-processing-forwarding" the resource; and the destination communication entity is the end node of the resource, which completes the process of "receiving-processing" the resource.

[0056] Step 103: The resource information on the source communication entity is transmitted to the intermediate communication entity on the next path, and the intermediate communication entity verifies the incremental encoding contained in the resource information.

[0057] In this embodiment of the application, resource information includes entity resources and session resources, wherein entity resources include data resources, digital resources, etc., and session resources include information, messages, etc.

[0058] In addition, the incremental encoding contained in the resource information includes a version number, incremental encoding length, and a verifiable encoding list. The verifiable encoding list is directional, flowing from the source communication entity to the target communication entity along the communication path.

[0059] It should be noted that the version number refers to the field used for version iteration updates of incremental encoding and to distinguish different signature methods; its value is an unsigned integer. The incremental encoding length refers to the length of the verifiable encoding list field in bytes in the incremental encoding format. The verifiable encoding list refers to the list of verifiable encodings of communication entities on the communication path, arranged in chronological order.

[0060] Verifiable encoding includes information such as verifiable encoding identifier, communication entity identifier, signature algorithm identifier, public key identifier, signature level, and signature content.

[0061] It should be noted that the verifiable code identifier is the identifier number of the current verifiable code, a string of numbers that can uniquely identify the current verifiable code; the communication entity identifier is the number that can uniquely identify the communication entity to which the current verifiable code is added, and this number can be used to quickly locate the relevant information of a communication entity on the communication path; the signature algorithm identifier refers to the number of the signature algorithm used by the current verifiable code; the public key identifier is the SKI (Subject Key Identifier) ​​used in the widely used X.509 certificate to locate the certificate holder, distinguish different certificates, and thus identify the public key; the signature length refers to the length of the signature content; the signature content refers to the signature of the resource information and the communication entity and its complete or partial path, and the specific signature method depends on the version number and signature algorithm used by the incremental encoding.

[0062] After explaining the meaning of each term, the verification process of incremental coding in this step is explained.

[0063] It is understandable that the verification process for incremental encoding is similar for the intermediate communication entities in this step and for other intermediate communication entities on the communication path.

[0064] When verifying incremental codes by an intermediate communication entity, the required incremental codes are extracted from the received resources. Then, all verifiable codes contained in the incremental codes are verified one by one. Based on the communication entity identifier and public key identifier in the verifiable codes, it is determined whether they conform to the mapping relationship between the communication entity and the public key. If they conform to the mapping relationship, the signature content in the verifiable codes is verified using the corresponding public key.

[0065] It should be noted that before verifying the signature content in the verifiable encoding using the corresponding public key, the resource content and encoding information need to be sorted according to the order specified by the version number field in the incremental encoding.

[0066] Understandably, the source communication entity does not need to perform the verification process.

[0067] Understandably, if the mapping relationship is not met or the mapping relationship is met but the verification fails, it indicates that there is a problem with the resource information and the resource information needs to be discarded.

[0068] Step 104: If the verification is successful, the verifiable code of the intermediate communication entity is appended to the incremental code, and the processed resource information is sent to the intermediate communication entity on the next path. The verification process and the appending process are repeated until the target communication entity receives the resource information.

[0069] In this embodiment of the application, if the verification is successful, the intermediate communication entity performs local processing on the received resource information, wherein the local processing includes storing and modifying the resource information.

[0070] It is understandable that the target communication entity is the end node of the resource, completing the "receive-process" process of the resource. Therefore, when the target communication entity receives the resource information and verifies it successfully, it can also process the received resource information locally.

[0071] It is understandable that the intermediate communication entities in this step are similar to other intermediate communication entities on the communication path in that the process of appending verifiable codes to incremental codes is similar.

[0072] When appending the verifiable code of an intermediate communication entity to the incremental code, the signature method needs to be determined based on the version number in the incremental code. Then, the fields of the non-signature content in the verifiable code are filled according to the determined signature method. Next, the resource content and encoding information are sorted, and the signature length and signature content are filled using the signature algorithm corresponding to the private key of the communication entity to generate the verifiable code. Finally, the verifiable code is appended to the incremental code according to the order of the communication entities in the communication path, and the incremental code length is adjusted.

[0073] It should be noted that if the version number is 0, all nodes traversed on the current complete communication path of the resource information need to be signed; if the version number is 1, the previous communication entity, the current communication entity, and the next communication entity on the communication path need to be signed.

[0074] Understandably, once the intermediate communication entity completes the receiving and processing process, it sends the combined resource information and incremental encoding as new resource information to the next intermediate communication entity. The next intermediate communication entity continues to execute the "receive-process-forward" process until the final resource information is delivered to the target communication entity.

[0075] It should be noted that intermediate communication entities may perform some special processing on resource information according to their local policies, but they may not modify the resource itself. Such processing includes, but is not limited to, not forwarding the information further or expressing a preference for the source or destination of a resource.

[0076] It should be noted that in some scenarios, each communication entity on the communication path can be a verifiable trusted resource transfer mechanism that does not employ incremental coding with hop-by-hop generation and hop-by-hop verification. This entity does not need to verify the incremental coding and add verifiable coding information.

[0077] To illustrate in more detail the verifiable trust resource transfer mechanism of incremental coding that generates and verifies hop-by-hop, as proposed in this application, please refer to... Figure 3 A flowchart containing three communication entities is provided.

[0078] In this topology example, communication entity 1 is the source communication entity, which is the origin node of the resource and only sends out the resource from this communication entity to complete the resource "forwarding" process; communication entity 2 is the intermediate communication entity, which is the forwarding node of the resource and completes the complete process of "receiving-processing-forwarding" the resource; communication entity 3 is the target communication entity, which is the end node of the resource and completes the process of "receiving-processing" the resource.

[0079] The specific steps are as follows:

[0080] Step 1) Each communication entity generates its own public key PK, private key pk, and certificate C.

[0081] For communication entity 1, communication entity 2, and communication entity 3, the generated public keys are PK1, PK2, and PK3, the private keys are pk1, pk2, and pk3, and the certificates are C1, C2, and C3.

[0082] Step 2) Each communication entity uploads the certificate information, including the public key information, to the key server.

[0083] For communication entity 1, communication entity 2, and communication entity 3, the information uploaded to the key server by each entity is: C1(PK1), C2(PK2), and C3(PK3).

[0084] Step 3) Each communication entity queries the key server to obtain the certificate information of other communication entities.

[0085] Other communication entity certificate information obtained by communication entity 1 from the key server: C2(PK2), C3(PK3); Other communication entity certificate information obtained by communication entity 2 from the key server: C1(PK1), C3(PK3); Other communication entity certificate information obtained by communication entity 3 from the key server: C1(PK1), C2(PK2).

[0086] Step 4) Communication entity 1 processes the resource and adds its own verifiable code VC1 to the incremental code M.

[0087] Step 5) Communication entity 1 forwards resources to communication entity 2.

[0088] Step 6) Communication entity 2 receives resources from communication entity 1.

[0089] Step 7): Communication entity 2 first retrieves the incremental code M from the received resources, then retrieves the verifiable code VC1 of communication entity 1 from M and verifies it. If the verification fails, the resource is discarded; if the verification passes, the resource is saved and its own verifiable code VC2 is added to the incremental code M.

[0090] Step 8) Communication entity 2 forwards resources to communication entity 3.

[0091] Step 9) Communication entity 3 receives resources from communication entity 2.

[0092] Step 10): Communication entity 3 first extracts the incremental code M from the received resources, then extracts the verifiable code VC1 of communication entity 1 and the verifiable code VC2 of communication entity 2 from M, and verifies them respectively. If the verification fails, the resource is discarded; if the verification passes, the resource is saved.

[0093] This application provides a verifiable and trusted resource transfer mechanism based on incremental coding with hop-by-hop generation and hop-by-hop verification. By attaching incremental coding to resources, the communication entities using this mechanism can verify the resources, thereby protecting the resources. At the same time, it is compatible with the existing basic principles of resource transfer, so as to facilitate the secure hop-by-hop transfer and sharing of resources, verify the origin of resources, protect the communication path, and solve the problem of trusted resource transfer in the network.

[0094] Figure 4 This is a block diagram of a verifiable resource transfer device 10 based on incremental coding, according to an embodiment of this application, comprising:

[0095] The first determining module 100 is used to retrieve certificate information from the key server and determine the mapping relationship between each communication entity and the public key;

[0096] The second determining module 200 is used to determine the target communication entity and intermediate communication entities on the communication path based on the forwarding policies and certificate information of the respective communication entities.

[0097] The verification module 300 is used to transmit resource information from the source communication entity to the intermediate communication entity in the next path, and the intermediate communication entity verifies the incremental encoding contained in the resource information.

[0098] The generation and transmission module 400 is used to, if the verification is successful, append the verifiable code of the intermediate communication entity to the incremental code, and send the resource information to the intermediate communication entity on the next path, repeating the verification process and the appending process until the target communication entity receives the resource information.

[0099] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0100] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this disclosure can be achieved, and this is not limited herein.

[0101] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A verifiable resource transfer method based on incremental encoding, characterized in that, Comprise: Pulling certificate information from a key server, determining the mapping relationship between each communication entity and public key; Based on the forwarding strategy of each communication entity and the certificate information, determine the target communication entity and the intermediate communication entity on the communication path; Transmit the resource information on the source communication entity to the intermediate communication entity on the next path, and verify the incremental encoding contained in the resource information by the intermediate communication entity; The incremental encoding contains version number, incremental encoding length and verifiable code list, wherein the verifiable code list has directionality, and flows from the source communication entity to the target communication entity on the communication path; If the verification is successful, the verifiable code of the intermediate communication entity is added to the incremental encoding, and the processed resource information is sent to the intermediate communication entity on the next path, and the verification process and the adding process are repeated until the target communication entity receives the resource information.

2. The method of claim 1, before pulling the certificate information from the key server, determining the mapping relationship between each communication entity and public key, further comprising: Determine the public key, private key and certificate generated by each communication entity; According to the public key and certificate of each communication entity, obtain the certificate information, and upload the certificate information of each communication entity to the key server.

3. The method of claim 1, wherein, The resource information includes entity resource and session resource.

4. The method of claim 1, wherein, The verifiable code contains verifiable code identification, communication entity identification, signature algorithm identification, public key identification, signature degree and signature content.

5. The method according to claim 1 or 4, characterized in that, When verifying the incremental encoding by a certain intermediate communication entity, further comprising: Verify each verifiable code contained in the incremental encoding one by one; According to the communication entity identification and public key identification in the verifiable code, judge whether it conforms to the mapping relationship between the communication entity and the public key; If it conforms to the mapping relationship, use the corresponding public key to verify the signature content in the verifiable code.

6. The method of claim 5, wherein, Further comprising: If it does not conform to the mapping relationship or conforms to the mapping relationship but fails to verify, discard the resource information.

7. The method of claim 1, wherein, Further comprising: If the verification is successful, the received resource information is locally processed by the intermediate communication entity or the target communication entity, wherein the local processing link includes storing and modifying the resource information.

8. The method of claim 1 or 4, wherein, When adding the verifiable code of a certain intermediate communication entity to the incremental encoding, further comprising: Determine the signature mode according to the version number in the incremental encoding; According to the determined signature mode, fill in the signature length and signature content using the signature algorithm of the intermediate communication entity to generate verifiable code; The verifiable code is added to the incremental encoding according to the order of the communication entities on the communication path, and the incremental encoding length of the incremental encoding is adjusted.

9. A verifiable resource transfer device based on incremental encoding, characterized in that Comprise: The first determination module is used for pulling the certificate information from the key server, and determining the mapping relationship between each communication entity and public key; The second determination module is used for determining the target communication entity and the intermediate communication entity on the communication path based on the forwarding strategy of each communication entity and the certificate information; A verification module is configured to transmit resource information on a source communication entity to an intermediate communication entity on a next path, and verify an incremental encoding contained in the resource information by the intermediate communication entity; the incremental encoding contains a version number, an incremental encoding length and a verifiable encoding list, wherein the verifiable encoding list is directional, and flows from the source communication entity to a target communication entity on the communication path; A generation and transmission module is configured to, if the verification is successful, append a verifiable encoding of the intermediate communication entity to the incremental encoding, and send the resource information to an intermediate communication entity on a next path, repeat the verification process and the appending process until the target communication entity receives the resource information.

Images