A data transmission integrity verification system and method based on a complete ring

Abstract

This invention discloses a data transmission integrity verification system and method based on an integral ring, relating to the field of data security technology. The device includes two entities: User A and User B. User A sends data, and User B receives data. Both User A and User B include a symmetric key store, an integrity verification module, and a data transmission module. The data transmission module receives the transmitted binary stream data and converts it into elements of the integral ring. Simultaneously, it converts the verified data back into a binary stream and sends it. The integrity verification module sequentially selects keys from the symmetric key store and performs integrity verification on the data using integer modulo. This invention relies solely on mathematical principles to design the integrity verification mechanism, performing data integrity verification based on the random selection of the basis of the integral ring. Its security depends solely on mathematical principles and does not rely on any mathematical problems, thus resisting various cryptographic attacks based on artificial intelligence and quantum computing.

Description

Technical Field

[0001] This invention relates to a data transmission integrity verification system and method based on a complete ring, belonging to the field of data security technology. Background Technology

[0002] Artificial intelligence (AI) and quantum computing, as the core forces of the new generation of technological revolution, are profoundly changing human society. While driving social progress, AI and quantum computing have also had a profound impact on the field of cybersecurity. AI has improved the automated defense level of information systems, while quantum computing has driven a computing revolution, enabling secure key distribution. However, while AI and quantum computing contribute to the development of cybersecurity, they also pose significant challenges. Especially in the field of cryptography, AI and quantum computing will reshape the landscape of cryptanalysis. AI, through deep learning, breaks through the limits of cryptanalysis, achieving autonomous identification of encryption mechanisms and automated discovery of vulnerabilities in cryptographic protocols. Quantum computing significantly reduces the security level of classical cryptographic systems. The quantum Shor algorithm, through the parallelism and superposition characteristics of quantum computing, can directly break RSA and elliptic curve cryptography (ECC). The quantum Grover algorithm can directly halve the security strength of symmetric encryption and hashing algorithms. Currently, a global wave of post-quantum cryptography (PQC) is sweeping the world. The United States will fully replace PQC by 2035. Meanwhile, the China Commercial Cryptography Standardization Institute officially launched a call for submissions for a new generation of quantum-resistant cryptographic algorithms in February 2025.

[0003] The nation is currently making every effort to develop a trusted data space, and trusted data transmission is the foundation for ensuring data security and building a trusted data space. Because data faces numerous security threats during transmission, such as counterfeiting, forgery, and tampering, establishing highly reliable integrity verification algorithms for data transmission and verifying the trustworthiness of transmitted data in real time is of great significance.

[0004] Given the significant threat that artificial intelligence and quantum computing pose to cryptographic systems, this invention proposes a data transmission integrity verification method based on integral rings. This method uses random distribution to resist cryptanalysis, and its security relies solely on mathematical principles, thus possessing unconditional security. Summary of the Invention

[0005] The technical problem to be solved by this invention is to propose a data transmission integrity verification system and method based on a complete ring. Unlike conventional cryptography which is based on mathematical problems and uses random distribution to resist cryptanalysis, this invention relies solely on mathematical principles to design an integrity verification mechanism to resist various cryptographic attacks based on artificial intelligence and quantum computing. It has unconditional security and improves the security of data integrity verification to resist security threats from artificial intelligence and quantum computing.

[0006] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:

[0007] The system of this invention includes two entities, User A and User B, which have identical structural components. For ease of description, User A is responsible for sending data, and User B is responsible for receiving data. The data referred to in this technical solution refers to data stored in computing devices and network communication data.

[0008] Both User A and User B consist of a symmetric key store, an integrity verification module, and a data transmission module. The data transmission module is primarily responsible for receiving the transmitted binary stream data and converting it into elements of the complete ring for subsequent verification by the integrity verification module. It is also responsible for converting the verified data back into a binary stream and sending it. The integrity verification module is responsible for randomly selecting a key from the symmetric key store and performing integrity verification on the data using modulo operations to ensure that the data is not tampered with.

[0009] make It is an integer ring (set of integers). For the set of natural numbers, mod is The standard modulo (remainder) operation.

[0010] The symmetric key store contains multiple sets of symmetric keys shared by users A and B. Each key is stored as an entry, and the specific structure of each entry is as follows:

[0011] .

[0012] For key tags, For the key, It is the radix used to calculate the check value. Among them, and All of the same length Both are randomly selected from Z. This represents the number of keystore data entries. Note that each key entry in the symmetric keystore is used only once, and then shifted sequentially one entry to the next. The keys are used only by the integrity verification module and are stored securely.

[0013] The integrity verification module has two functional parts:

[0014] Integrity verification module (as the data sender):

[0015] 1) Transform the input data into an integral loop. The elements in. Let the input data be... ,in For the data labels of this data, For the length of the data, the data content The data encoding module will Turn to Middle elements At this point, a group of elements is formed. .

[0016] 2) Calculate the checksum. Retrieve the next key entry sequentially from the symmetric key store. , for Calculate the check value

[0017]

[0018] 3) Turn to MAC (Macro Data Stream). Send to the transmission module.

[0019] Integrity verification module (as data receiver):

[0020] Let the input data be Retrieve the tag from the symmetric key store. Key entries Decrypt to obtain the data content. Transform it into a complete ring The elements in; let the converted integer be , If the value is 0, output T=1, indicating that the data has not been tampered with during transmission; otherwise, output T=0, indicating that the data has been tampered with during transmission.

[0021] Transmission module:

[0022] 1) As the data sender, transmitting data via a public network. Send to the data recipient.

[0023] 2) As a data recipient, receiving data through a public network. And send it to the integrity verification module.

[0024] The method of the present invention includes the following steps:

[0025] Initialization phase: User A and User B's symmetric key stores share N key entries. Initial key tag KID=0.

[0026] Step 1: Input data. User A's integrity verification module converts the input data content into an integrity loop. The elements in the array are used to generate an element group;

[0027] Step 2: User A's integrity verification module selects key entries from the symmetric key store in sequence;

[0028] Step 3: User A's integrity verification module uses element-wise modulo operation to convert the verification value into a binary stream, encrypts it with a key, concatenates it with the original data, and sends it to User A's transmission module.

[0029] Step 4: User A's transmission module sends data to User B via a public network;

[0030] Step 5: User B's transmission module receives the data and forwards it to User B's integrity verification module;

[0031] Step Six: User B's integrity verification module retrieves the key entry from the symmetric key store based on the key tag and decrypts the integrity verification value;

[0032] Step 7: User B's integrity verification module converts the decrypted data content into a complete loop. Elements in;

[0033] Step 8: User B takes the modulo of the element with respect to the radix. If the result is 0, output T=1, indicating that the data has not been tampered with during transmission; otherwise, output T=0, indicating that the data has been tampered with during transmission.

[0034] The beneficial effects of this invention are:

[0035] 1. Unlike conventional cryptography which is based on mathematical problems and is therefore vulnerable to cryptanalysis based on artificial intelligence and quantum computing, this invention relies solely on mathematical principles to design an integrity verification mechanism. It performs data integrity verification based on the random selection of the basis of the entire ring to resist various cryptographic attacks based on artificial intelligence and quantum computing.

[0036] 2. The security of this invention relies solely on mathematical principles and does not depend on any mathematical problems, thus possessing unconditional security. Attached Figure Description

[0037] Figure 1 This is a schematic diagram of a data transmission integrity verification system based on the entire loop;

[0038] Figure 2 This is a flowchart of the data transmission integrity verification system based on the entire loop. Detailed Implementation

[0039] The system framework diagram of the present invention is as follows: Figure 1 As shown, the workflow diagram of the data transmission integrity verification system based on the entire loop is as follows: Figure 2 As shown.

[0040] The technical solution of the present invention will be described in detail below with reference to two specific embodiments.

[0041] Example 1: Integrity verification of data transmission in a cloud storage scenario

[0042] User A (the file uploader) uploads a file to the cloud storage service provider (User B) through a client application. To ensure that the file is not tampered with during the upload process, the cloud storage service uses the integrity verification method proposed in this invention.

[0043] Initialization Phase: User A's client application and User B's cloud storage server pre-share N key entries via an out-of-band secure channel (e.g., during user registration or via a secure key exchange protocol). These key entries are stored in the respective symmetric key stores of User A and User B. Each key entry contains a key tag KID, a key Key, and a base key. KID is the tag for this key entry, used to identify the key entry used in subsequent data transmission. The initial key tag KID=0, and the base space A is the interval ( The set of all prime numbers in () ,base The key space is uniformly and randomly selected in the base space A. A set of 256-bit binary numbers, the key is in the key space. The base numbers are uniformly and randomly selected (prime numbers are generated using a random number generator). A key entry is formed by combining the key and the key. This key entry is shared between user A and user B.

[0044] Step 1: User A's client application splits the file to be uploaded into multiple data blocks. Each data block is processed as separate input data. The data encoding module converts the data content of each data block into a complete loop. For example, assuming the data content is 300 bits of binary data "100……001", the data encoding module converts it into elements. This requires a data length. The data encoding module generates an element group for this data block. , where represents the ID of the data block, the data length, and the transformed element, respectively.

[0045] Step 2: User A's client application's integrity verification module selects a key entry sequentially from its symmetric keystore. .

[0046] Step 3: User A's client application's integrity verification module utilizes the element For the base in the selected key entry Perform a modulo operation to obtain the check value. .Will Turn to MAC (Match Value) of a binary data stream. Compare the MAC value with the original data. Data packets are spliced ​​together.

[0047] Step 4: User A's transmission module sends the data packet to User B via the public network.

[0048] Step 5: User B's cloud storage server's transmission module receives the data packet and forwards it to User B's integrity verification module.

[0049] Step Six: User B's integrity verification module sequentially retrieves key entries from the symmetric key store. Analyze It is converted into a complete ring. elements in

[0050] Step 7: User B's integrity verification module will... For the base in the retrieved key entries Determine if the remainder is 0. If it is, output T=1, indicating that the data has not been tampered with during transmission. User B's cloud storage server can continue processing the data block, for example, by storing it in the storage system. Otherwise, it outputs T = 0, indicating that the data has been tampered with during transmission. User B's cloud storage server can discard the data block and send an error report to User A, requesting that the data be re-uploaded.

[0051] Example 2: Integrity verification of data transmission in application update scenarios

[0052] The client requests software packages from a trusted software repository. To ensure that the files are not tampered with during the download and transmission process, both the client and the trusted software repository use the integrity verification method proposed in this invention.

[0053] Initialization phase: User-side and trusted software repositories are shared in advance. Each key entry contains a key tag. These key entries are stored in the symmetric key stores of both the user's client and a trusted software repository. Key Heki . This is the tag for the key entry, used to identify the key entry used during subsequent data transmission; it is the initial key tag. , base space For the interval ( The set of all prime numbers in () ,base In base space Uniformly and randomly selected from the key space A set of 256-bit binary numbers, the key In key space Elements are uniformly and randomly selected from the base (generated using a random number generator). The generated base... and key This constitutes a key entry. This key entry is shared between the user and the trusted software repository.

[0054] Step 1: During the verification information generation phase, the trusted software repository divides the data to be uploaded into multiple data blocks. Each data block is processed as a separate input. The data encoding module converts the data content of each data block into a complete loop. For example, assuming the data content is 300 bits of binary data "100……001", the data encoding module converts it into elements. The data length is required here. The data encoding module generates an element group for this data block. , respectively representing the data blocks Data length and converted elements.

[0055] Step 2: The integrity verification module of the trusted software repository selects a key entry sequentially from its symmetric keystore. .

[0056] Step 3: The integrity verification module of the trusted software repository utilizes elements For the base in the selected key entry Perform a modulo operation to obtain the check value. ,Will Turn to MAC (Macro-MAC) of a binary data stream. Mix the MAC with the original data. Data packets are spliced ​​together. .

[0057] Step 4: The trusted software repository's transmission module sends the data packets to the user terminal.

[0058] Step 5: The data packet received by the user's transmission module is handed over to the user's integrity verification module.

[0059] Step Six: The integrity verification module on the user end sequentially retrieves key entries from the symmetric key store. And parse out the element group It is converted into a complete ring. elements in .

[0060] Step 7: User B's integrity verification module will... For the base in the retrieved key entries Perform a modulo operation and check if the remainder is 0. If it is, output T=1, indicating that the data has not been tampered with during transmission, the data integrity check has passed, and the output is... The client can continue processing the data block. Otherwise, output T = 0, indicating that the data has been tampered with during transmission. The client can discard the data block and send an error report to a trusted software repository, requesting a retransmission of the data.

[0061] The algorithm of this invention was implemented on a Xilinx FPGA 100MHz, and compared with mainstream algorithms SM3, SHA2-256, and SHA3-256. The results are as follows:

[0062] Throughput 7Gbps 3.5Gbps 3Gbps 4Gbps Resource Usage (LUT) 370 600 650 450 Resource usage (FF) 260 500 500 380

[0063] It is evident that the present invention is superior to existing algorithms in terms of both throughput and resource consumption.

[0064] The data referred to in this technical solution refers to any record of information in electronic or other ways, and in particular, the data refers to data stored in computing devices and network communication data.

Claims

1. A data transmission integrity verification system based on a complete ring, characterized in that, It includes two entities, User A and User B. User A is responsible for sending data, and User B is responsible for receiving data. The data involved refers to data stored on computing devices and network communication data. Both User A and User B's systems consist of a symmetric key store, an integrity verification module, and a data transmission module. The data transmission module receives the transmitted binary stream data, converts it into elements of an integer ring for subsequent verification by the integrity verification module, and then converts the verified binary stream data back into a binary stream and sends it. The binary stream data is information recorded electronically. The integrity verification module selects keys sequentially from the symmetric key store and performs integrity verification on the binary stream data using integer modulo. The symmetric key store stores the symmetric key shared by User A and User B. The workflow of the integrity verification module as the data sender is as follows: 1) Convert the input binary stream data into a complete ring. The elements in; let the input binary stream data be ,in, For the data labels of this data, The length of this data. This is the data content of the data; the data encoding module will... Turn to medium elements , forming an element group ; 2) Calculate the checksum; sequentially retrieve the next key entry from the symmetric key store. , for use right Modulo generation of verification value ; 3) Turn to MAC of bit binary data stream Send to the transmission module; The workflow of the integrity verification module as a data receiver is as follows: Let the input binary stream data be Retrieve the tag from the symmetric key store. Key entries Decrypt to obtain the data content of this binary stream. Transform it into a complete ring The elements in; let the converted integer be The modulo operation of h with respect to q is used to determine whether the remainder is 0. If it is 0, the output is T=1, indicating that the binary stream data has not been tampered with during transmission. Otherwise, the output is T=0, indicating that the binary stream data has been tampered with during transmission.

2. The data transmission integrity verification system based on a complete ring as described in claim 1, characterized in that, The symmetric key shared by user A and user B is stored in a symmetric key store according to entries. The specific structure of each entry is as follows: ， ； For key tags, For the key, It is the basis used to calculate the check value; where, and All of the same length Both are randomly selected from Z; This represents the number of keystore data entries; each key entry in the symmetric keystore is used only once, and then shifted sequentially one entry to the next; the key is only used by the integrity verification module and is stored securely.

3. The data transmission integrity verification system based on a complete ring as described in claim 1, characterized in that, The transmission module acts as both the data sender and the data receiver: 1) When the transmission module acts as the data sender, it transmits data through a public network. Send to the data recipient; 2) When the transmission module acts as a data receiver, it receives data through a public network. And send it to the integrity verification module.

4. A method for verifying data transmission integrity using the system described in any one of claims 1-3, characterized in that, Includes the following steps: Initialization phase: User A and User B's symmetric key stores share N key entries, and the initial key tag KID=0; Step 1: Input binary stream data. User A's integrity verification module converts the input binary stream data into an integral loop. The elements in the array are used to generate an element group; Step 2: User A's integrity verification module selects key entries from the symmetric key store in sequence; Step 3: User A's integrity verification module uses element-wise modulo operation to convert the verification value into a binary stream, encrypts it with a key, concatenates it with the binary stream data input in Step 1, and sends it to User A's transmission module. Step 4: User A's transmission module sends the concatenated binary stream data to User B via a public network; Step 5: User B's transmission module receives the assembled binary data sent by A and forwards this data to User B's integrity verification module; Step Six: User B's integrity verification module retrieves the key entry from the symmetric key store based on the key tag and decrypts the integrity verification value; Step 7: User B's integrity verification module converts the decrypted data content into a complete loop. Elements in; Step 8: User B takes the modulo of the element with respect to the base. If the result is 0, output T=1, indicating that the binary stream data has not been tampered with during transmission. Otherwise, output T=0, indicating that the binary stream data has been tampered with during transmission.

Images