Message authentication code generation and verification method and system

Abstract

The invention discloses a message authentication code generation and verification method and system, which are corresponding schemes, in the scheme, an HMAC algorithm is decomposed, and an HMAC key management system uses an HMAC key to pre-calculate an intermediate state value pair without key plaintext information; the HMAC generator uses the received intermediate state value pair to only carry out iterative compression operation of the password hash algorithm on the message content to be identified based on the prefix difference, so that the final message identification code can be efficiently synthesized; the HMAC verification party can use the received intermediate state value pair to calculate the message identification code by using the received intermediate state value pair based on the prefix difference through similar arithmetic logic, and verifies the message identification code sent by the HMAC generation party, so that cross-level legality verification is realized, non-landing protection of an HMAC key in the whole process is realized, and the security of the HMAC key is improved. And the performance of message authentication code calculation and the flexibility of authority control are obviously improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security and cloud computing technology, and in particular to a message authentication code generation and verification method and system. BACKGROUND

[0002] HMAC (Hash-based Message Authentication Code) is a message authentication code mechanism based on a cryptographic hash function and a shared key, which is widely used to protect the integrity of messages and verify that the message indeed comes from a party holding the same shared key. The Internet Engineering Task Force (IETF) has standardized the HMAC algorithm in RFC 2104 (the official specification document of the HMAC algorithm), and the calculation process is as follows: ;

[0003] where H represents the underlying cryptographic hash function; K represents the shared key; text represents the message to be authenticated; opad (Outer Padding) and ipad (Inner Padding) are fixed constant strings defined by RFC 2104, referred to as outer padding constant and inner padding constant; denotes a bitwise XOR operation; denotes sequence concatenation.

[0004] Current mainstream cryptographic hash algorithms are mainly divided into two structures: (1) Merkle-Damgård (MD) structure: This is the most widely used structure, which is an iterative construction method that extends the compression function to a complete cryptographic hash function. Typical algorithms include the SM3 algorithm, and the SHA-256, SHA-384, SHA-512 algorithms in the Secure Hash Algorithm (SHA) series (where SHA is the English name abbreviation of the algorithm, and the subsequent numerical value is the bit length of the message digest output by the algorithm). The core working principle is to pad the input message and then divide it into fixed-length message blocks. Then, use the compression function (CF) to process each message block one by one for iterative calculation: each round of operation takes the state output by the previous round and the current message block as input and outputs the updated state. The final output of the last round is the message digest (also known as the hash value). For example, for the SM3 algorithm, the length of the message block is 512 bits and the length of the state is 256 bits.

[0005] (2) Sponge Construction: This is the structure adopted by the new generation of cryptographic hash algorithms, and the typical algorithm is the SHA-3 series. In the "absorb" stage, the message blocks are injected into the internal state, and in the absorb stage, the internal state is updated step by step according to each message block through the permutation function, and finally in the "squeeze" stage, the internal state is used to generate the output message digest. For example, for the SHA-3-512 algorithm, the length of the message packet is 576 bits, and the length of the state is 1600 bits.

[0006] In the microservice architecture of cloud computing systems, the API (Application Programming Interface) calls of services usually use the HMAC message authentication code mechanism (such as the AWS Signature V4 authentication protocol) to verify identity and prevent tampering. This process usually includes the following two stages: (1) Key derivation stage: In order to limit the risk of key exposure, the system usually does not directly use long-term keys (Secret Access Key), but generates a special "derived key" based on scope information such as date (Date), region identifier (Region), service name (Service), etc. through multiple rounds of recursive HMAC operations. For example: Derived Key = HMAC(HMAC(HMAC("AWS4"||SK, Date), Region), Service, "aws4_request"); where AWS4 is a fixed string prefix, SK (Secret Key) is the secret key, "AWS4"||SK forms the initial key, and "aws4_request" is the termination symbol for multiple rounds of key derivation.

[0007] (2) Message authentication code generation stage: Use the derived key generated above to perform HMAC operations on the specific request content (such as Canonical Request) to obtain the final message authentication code.

[0008] However, the existing scheme has significant shortcomings in balancing high security and high performance requirements: (1) Key memory security risks: The traditional software implementation requires business servers (HMAC generator and HMAC verifier) to hold the plaintext Secret Key (SK) or derived Derived Key in memory in order to perform message authentication code generation and verification operations on high-concurrency request content at any time. Once the business server is subjected to network intrusion (for example, software vulnerabilities cause memory information leakage or dumping, key configuration file leakage or side channel attacks), attackers can obtain the key and then forge any legitimate request.

[0009] (2) Performance bottleneck of hardware solution: Although hardware security module (HSM) or key management service (KMS) can be used to store keys and perform HMAC operations to ensure that the key does not reside in the business server memory, in the high-concurrency scenario of microservice architecture, each API call needs to access the HSM or KMS through the network. This not only brings huge network delay, but also causes performance bottleneck due to the I / O throughput limit of HSM or KMS, and the hardware deployment cost is high.

[0010] Therefore, the industry urgently needs a message authentication code generation and verification technical solution that can ensure that the HMAC key does not "land" (does not appear in plaintext in the business server memory) in the whole process, and eliminate real-time dependence on external hardware devices, meet the high-performance and low-latency computing requirements of microservice architecture.

[0011] Therefore, the present application is proposed. SUMMARY

[0012] The purpose of the present application is to provide a message authentication code generation and verification method and system that can balance security and performance.

[0013] The purpose of the present application is achieved by the following technical solutions: A message authentication code generation and verification method, comprising: The HMAC key management system generates a first intermediate state value pair based on a cryptographic hash algorithm, combines the HMAC key with the prefix of the HMAC generator, and transmits it to the HMAC generator; and generates a second intermediate state value pair based on a cryptographic hash algorithm, combines the stored HMAC key with the prefix of the HMAC verifier, and transmits it to the HMAC verifier; wherein HMAC is a message authentication code based on a cryptographic hash. The HMAC generator determines an initial state of the iterative compression operation of the HMAC generator based on the first intermediate state pair and a difference between the prefix of the HMAC generator and the prefix of the HMAC verifier, performs the iterative compression operation of the cryptographic hash algorithm in combination with an input sequence constructed based on the message content to be authenticated, and obtains a first message authentication code. The first message authentication code and the message content to be authenticated are transmitted to the HMAC verifier. The HMAC verifier determines an initial state of the iterative compression operation of the HMAC verifier based on the second intermediate state pair and a difference between the prefix of the HMAC generator and the prefix of the HMAC verifier, performs the iterative compression operation of the cryptographic hash algorithm in combination with an input sequence constructed based on the message content to be authenticated, and obtains a second message authentication code. A verification result is output according to whether the second message authentication code is consistent with the first message authentication code.

[0014] A message authentication code generation and verification system for implementing the foregoing method, comprising an HMAC key management system, an HMAC generator, and an HMAC verifier. The HMAC key management system generates a first intermediate state pair based on a cryptographic hash algorithm in combination with an HMAC key and a prefix of the HMAC generator, and transmits the first intermediate state pair to the HMAC generator. The HMAC key management system generates a second intermediate state pair based on a cryptographic hash algorithm in combination with a stored HMAC key and a prefix of the HMAC verifier, and transmits the second intermediate state pair to the HMAC verifier. The HMAC is a message authentication code based on a cryptographic hash function. The HMAC generator determines an initial state of the iterative compression operation of the HMAC generator based on the first intermediate state pair and a difference between the prefix of the HMAC generator and the prefix of the HMAC verifier, performs the iterative compression operation of the cryptographic hash algorithm in combination with an input sequence constructed based on the message content to be authenticated, and obtains a first message authentication code. The first message authentication code and the message content to be authenticated are transmitted to the HMAC verifier. The HMAC verifier determines an initial state of the iterative compression operation of the HMAC verifier based on the second intermediate state pair and a difference between the prefix of the HMAC generator and the prefix of the HMAC verifier, performs the iterative compression operation of the cryptographic hash algorithm in combination with an input sequence constructed based on the message content to be authenticated, and obtains a second message authentication code. A verification result is output according to whether the second message authentication code is consistent with the first message authentication code.

[0015] It can be seen from the technical solutions provided by the application that the HMAC algorithm is decomposed, the intermediate state value pair without key plaintext information is pre-calculated by the HMAC key management system using the HMAC key, the intermediate state value pair received by the HMAC generation side is used to perform the iteration compression operation of the password hash algorithm on the message content (such as the API request message) to be identified based on the prefix difference, and the final message authentication code is efficiently synthesized; the intermediate state value pair received by the HMAC verification side is used to calculate the message authentication code based on the prefix difference through similar operation logic, and the message authentication code sent by the HMAC generation side is verified, so that the legality check across levels is realized, the HMAC key is protected in the whole process, and the performance of the message authentication code calculation and the flexibility of the authority control are significantly improved. BRIEF DESCRIPTION OF DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0017] Figure 1 The flowchart of the message authentication code generation and verification method provided by the embodiment of the present application.

[0018] Figure 2 The interaction timing diagram between the components in the message authentication code generation and verification method provided by the embodiment of the present application.

[0019] Figure 3 The flowchart of the HMAC key management system generating the intermediate state value pair provided by the embodiment of the present application.

[0020] Figure 4 The flowchart of the HMAC generation side generating the first message authentication code provided by the embodiment of the present application.

[0021] Figure 5 The schematic diagram of the message authentication code generation and verification system provided by the embodiment of the present application. DETAILED DESCRIPTION

[0022] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the present application.

[0023] Firstly, the terms possibly used in the present application are explained as follows: The term "and / or" means either one or both, for example, X and / or Y means three cases including "X", "Y" or "X and Y".

[0024] The terms "include", "contain", "have", "possess" or other similar semantic descriptions should be interpreted as non-exclusive inclusion. For example, including a technical feature element (such as raw materials, components, ingredients, carriers, dosage forms, materials, sizes, parts, components, mechanisms, devices, steps, processes, methods, reaction conditions, processing conditions, parameters, algorithms, signals, data, products or articles, etc.) should be interpreted as not only including the explicitly listed technical feature element, but also including other technical feature elements not explicitly listed but known in the art.

[0025] A message authentication code generation and verification method and system provided by the present application are described in detail below. The contents not described in detail in the embodiments of the present application belong to the prior art known to those skilled in the art. If no specific conditions are specified in the embodiments of the present application, the conventional conditions or the conditions recommended by the manufacturer are followed. If no manufacturer of the reagent or instrument used in the embodiments of the present application is specified, it is a conventional product that can be purchased on the market.

[0026] Embodiment one The embodiments of the present application provide a message authentication code generation and verification method, as shown in the following figure, which mainly includes the following steps: Figure 1 Step S1, the HMAC key management system generates an intermediate state value pair.

[0027] In this step: the HMAC key management system generates a first intermediate state value pair based on a cryptographic hash algorithm, combines the HMAC key and the prefix of the HMAC generator, and transmits it to the HMAC generator; and generates a second intermediate state value pair based on a cryptographic hash algorithm, combines the stored HMAC key and the prefix of the HMAC verifier, and transmits it to the HMAC verifier.

[0028] In the embodiments of the present application, the first intermediate state value pair is an intermediate state value pair used for generating a message authentication code, denoted as ; the second intermediate state value pair is an intermediate state value pair used for verifying a message authentication code, denoted as ; wherein U is a first intermediate state value, is a second intermediate state value, is a third intermediate state value.

[0029] The generation methods of the above three intermediate state values are as follows: ​(1) The first intermediate state value U is generated based on the stored HMAC key: the pre-processed key of the HMAC key K is calculated based on the cryptographic hash algorithm , the initial value IV defined by the cryptographic hash algorithm is taken as the state, the pre-processed key , and the exclusive OR value of the outer padding constant opad defined by the HMAC algorithm is taken as the input sequence, the compression operation of the cryptographic hash algorithm is performed (i.e., once), and the operation result is the first intermediate state value U.

[0030] This process is represented as: ; Among them, represents the compression function of the cryptographic hash algorithm, represents the exclusive OR operation.

[0031] (2) The generation process of the second intermediate state value and the third intermediate state value is as follows: the pre-processed key is taken as the starting sequence, and the exclusive OR value of the inner padding constant ipad defined by the HMAC algorithm is taken as the starting sequence; the prefix of the HMAC generator and the prefix of the HMAC verifier are independently subjected to block boundary alignment padding processing for each scope parameter (ScopeParameter) contained therein, so that the length of each scope parameter reaches an integer multiple of the packet length of the cryptographic hash algorithm, and the processed prefix of the HMAC generator and the prefix of the HMAC verifier are obtained, and then the starting sequence is spliced, respectively, to obtain two spliced sequences, the spliced sequence corresponding to the HMAC generator is called the first spliced sequence, and the spliced sequence corresponding to the HMAC verifier is called the second spliced sequence; the initial value IV defined by the cryptographic hash algorithm is taken as the state, and the first spliced sequence and the second spliced sequence are taken as the input sequences, and the iterative compression operation of the cryptographic hash algorithm is performed, and the corresponding operation result is the second intermediate state value and the third intermediate state value .

[0032] The above process is uniformly represented as: ; Among them, represents the iterative compression operation of the cryptographic hash algorithm (i.e., the input sequence is divided into blocks, and then is executed multiple times, each time processing one block and updating the state), represents sequence splicing. For the HMAC generator, in the above formula, is , is ; for the HMAC verifier, in the above formula, For , For .

[0033] In the embodiment of the present application, the block boundary alignment padding processing comprises: padding the bit sequence generated by the preset rule at the end of the scope parameter (for example, padding several bits of zero), so that the total length of the padded sequence reaches an integer multiple of the password hash algorithm packet length.

[0034] In the embodiment of the present application, the prefix of the HMAC generator and the prefix of the HMAC verifier each consist of zero, one or more ordered arrangement of scope parameters.

[0035] In step S2, the HMAC generator generates a first message authentication code.

[0036] In this step: the HMAC generator determines the initial state of the iterative compression operation of the HMAC generator based on the first intermediate state value, and according to the difference between the prefix of the HMAC generator and the prefix of the HMAC verifier, and performs the iterative compression operation of the password hash algorithm in combination with the input sequence constructed based on the message content to be authenticated, to obtain the first message authentication code. The first message authentication code and the message content to be authenticated are transmitted to the HMAC verifier.

[0037] The preferred embodiment of this step is as follows: (1) based on the second intermediate state value , and according to the difference between the prefix of the HMAC generator and the prefix of the HMAC verifier, to determine the first initial state of the iterative compression operation of the HMAC generator , in combination with the first input sequence constructed based on the message content to be authenticated, to perform the iterative compression operation of the password hash algorithm, and output the state obtained by the operation as the internal hash value of the HMAC generator .

[0038] In the embodiment of the present application, based on the second intermediate state value , and according to the difference between the prefix of the HMAC generator and the prefix of the HMAC verifier, to determine the first initial state of the iterative compression operation of the HMAC generator , comprising: If the prefix of the HMAC generator is the same as the prefix of the HMAC verifier , or the prefix of the HMAC verifier is the true prefix of the prefix of the HMAC generator , that is, it satisfies the relationship: , is the difference between the two prefixes, then the first initial state of the iterative compression operation of the HMAC generator ;

[0039] If the prefix of the HMAC generator is the prefix of the HMAC verifier , i.e. the relationship is satisfied: , then the block boundary padding process is independently performed for each scope parameter contained in the difference (the same as the way of the step S1 described above), so that the length of each scope parameter reaches an integer multiple of the password hash algorithm packet length, and the processed difference sequence is obtained, and then the iteration compression operation of the password hash algorithm is performed in combination with the second intermediate state value , and the state obtained by the operation is output as the first initial state . This process is represented as: .

[0040] In the embodiment of the present application, the iteration compression operation of the password hash algorithm is performed in combination with the first input sequence constructed based on the message content to be identified, and the state obtained by the operation is output as the internal hash value of the HMAC generator , which is represented as: ; wherein, represents the message content to be identified, represents the padding data generated according to the padding rule defined by the password hash algorithm.

[0041] (2) The first intermediate state value U is taken as the second initial state of the iteration compression operation of the HMAC generator, the second input sequence constructed based on the internal hash value of the HMAC generator is combined, the iteration compression operation of the password hash algorithm is performed, and the state obtained by the operation is output as the first message authentication code.

[0042] The above process is represented as: ; wherein, HMAC is the message authentication code based on the password hash algorithm , which is the first message authentication code generated by the HMAC generator.

[0043] Preferably, the present application can directly utilize the message to be identified to construct the input sequence; or the authorization code shared in advance by the HMAC generator and the HMAC verifier and unknown to the HMAC key management system is spliced with the message to be identified in a preset order to form an enhanced message sequence, and then the input sequence is constructed by using the enhanced message sequence. If the latter is adopted, the in the above-mentioned manner will be replaced by the enhanced message sequence.

[0044] In this embodiment of the invention, the message to be identified can be an API call request message constructed by the HMAC generator according to its own API call requirements.

[0045] Step S3: The HMAC verifier verifies the first message authentication code.

[0046] In this step: the HMAC verifier determines the initial state of the iterative compression operation based on the second intermediate state value pair and the difference between the prefix of the HMAC generator and the prefix of the HMAC verifier. Combined with the input sequence constructed based on the message content to be authenticated, the iterative compression operation of the cryptographic hash algorithm is performed to obtain the second message authentication code. The verification result is output based on whether the second message authentication code is consistent with the first message authentication code.

[0047] Those skilled in the art will understand that the first and second messages primarily serve as identifiers to distinguish between the two message authentication codes. Specifically, the first message authentication code represents the message authentication code generated by the HMAC generator, while the second message authentication code represents the message authentication code generated by the HMAC verifier.

[0048] The overall operational logic of this step is similar to that of step S2 mentioned above. Specifically, it is based on the third intermediate state value. The first initial state of the iterative compression operation of the HMAC verifier is determined by using the operational logic corresponding to that of the HMAC generator. The internal hash value of the HMAC verifier is calculated; and the second message authentication code is calculated by using the first intermediate state value U as the second initial state of the HMAC verifier's iterative compression operation, adopting the operation logic corresponding to that of the HMAC generator.

[0049] Specifically: HMAC verifiers based on and The inclusion relationship determines the first initial state of the HMAC verification iterative compression operation. (a) If and The contents are completely equal, or yes The true prefix, HMAC verifier directly sets (b) If yes A proper prefix (i.e., the generator has restricted permissions) satisfies the relation. (in (Indicating prefix difference sequences), the HMAC validator needs to target... Each scope parameter contained therein undergoes the same block boundary alignment and padding process as step S1 independently, resulting in the padded prefix difference sequence (denoted as...). ); then, as the state, the filled prefix difference sequence is taken as the input sequence, the iterative compression operation of the cryptographic hash algorithm is performed, and the state obtained by the operation is output as the initial state , the process of which is represented as: .

[0050] The way in which the hash value after the above is calculated is the same as the way in which the corresponding input sequence is constructed based on the hash value in the aforementioned step S2, and thus is not described in detail.

[0051] Finally, the HMAC verifier obtains a second message authentication code by performing the iterative compression operation of the cryptographic hash algorithm, and compares the second message authentication code with the first message authentication code. If the two are consistent, the verification is passed.

[0052] Compared with the prior art, the above scheme provided by the embodiments of the present application has the following beneficial effects: 1. High security: the HMAC key is physically isolated within the security boundary of the HMAC key management system, and the HMAC generator and the HMAC verifier only hold pairs of intermediate state values that do not contain key plaintext information. Even if the server is subject to memory leakage, the attacker can only obtain the intermediate state under a specific prefix, and cannot reverse engineer the key. Moreover, the state is strictly limited within a specific range defined by the scope parameter (e.g., valid only within a specific time or region), which greatly reduces the risk radiation range after the intermediate state is leaked.

[0053] 2. Flexible hierarchical permission control: the application innovatively adopts the block boundary alignment padding technology based on the scope parameter, constructs an intermediate state with cascading characteristics, and thus supports the inclusion relationship verification based on the proper prefix. Either the generator or the verifier holding a shorter message prefix (i.e., a wider permission range) only needs to perform the same block boundary alignment padding and iterative compression operation on the scope parameter of the difference part, so as to dynamically update the local intermediate state to adapt to the party holding a longer message prefix (i.e., a narrower permission range). This makes it possible to authenticate the microservice API call across layers and service ranges, without the need to distribute independent keys for each subdivided service, which significantly reduces the complexity of key management.

[0054] ​3. High performance and high availability: The HMAC generator uses pre-computed intermediate state value pairs, eliminating the complex key derivation process frequently performed in traditional schemes, simplifying it to an extremely low-overhead intermediate state copy. When generating the message authentication code, only the padding and iterative compression operations defined by the cryptographic hash algorithm need to be performed for the message content to be authenticated, without accessing the HSM or KMS through the network, and without repeatedly calculating the hash value of the prefix part. This eliminates the network delay and single point failure risk caused by external dependence, and can meet the extremely high concurrency requirements of API calls under the microservice architecture.

[0055] In order to more clearly show the technical solutions provided by the present application and the technical effects generated, the method provided by the embodiments of the present application is described in detail below with specific examples.

[0056] I. Overall summary of the scheme.

[0057] The method provided by the embodiments of the present application is a message authentication code generation and verification scheme based on HMAC intermediate state pre-computation, which uses the iterative structure characteristics of the HMAC algorithm to decompose it into two stages: 1. Intermediate state calculation stage: the HMAC key management system holds the HMAC key, and pre-computes the intermediate state value pair (U, V) which does not contain the key plaintext information but solidifies the key state. The calculation of V can include (or can not include) a specific message prefix (such as date, region) that is aligned and filled by block boundary to support the transmission of the intermediate state. 2. Message authentication code calculation stage: the HMAC generator receives U and V as the initial state, and takes the message content to be authenticated as the input sequence, and performs the iterative compression operation of the cryptographic hash algorithm, that is, the final message authentication code can be calculated. The HMAC verifier not only supports message authentication code verification in the same prefix case, but also can update the local intermediate state by performing the same padding and iterative compression operation on the difference part of the scope parameter based on the proper prefix inclusion relationship, so as to realize the legality verification across levels. The present application supports flexible message prefix configuration, and the HMAC key never leaves the security boundary of the key management system in the whole scheme, realizing the non-ground protection of the HMAC key in the whole process, significantly improving the performance of the message authentication code calculation and the flexibility of the authority control, and realizing the balance between security and performance.

[0058] Three subjects are involved in the present application scheme: the HMAC key management system, the HMAC generator, and the HMAC verifier, and the overall process includes: the HMAC key management system calculates the intermediate state value pair based on the HMAC key, the HMAC generator calculates the first message authentication code based on the intermediate state value pair, and the HMAC verifier verifies the first message authentication code based on the intermediate state value pair.

[0059] The HMAC key management system stores a root key; the HMAC key is calculated by the HMAC key management system based on the root key, combined with a set of ordered derivative parameters, using a preset key derivation algorithm.

[0060] The preset key derivation algorithm can adopt a recursive HMAC operation mode, and the main steps include: (a) initialization: taking the root key as the initial derivative key; (b) recursive calculation: performing HMAC operation on each derivative parameter in turn according to the arrangement order of the derivative parameters; in each round of operation, the result output in the previous round of operation is taken as the key of the current round of HMAC operation, and the derivative parameter corresponding to the current round is taken as the message input of the current round of HMAC operation; (c) output: taking the output result of the last round of HMAC operation as the HMAC key.

[0061] In the embodiment of the application, the cryptographic hash algorithm can be selected from SM3, SHA-256, SHA-384 or SHA-512, etc. For example, in the embodiment, the cryptographic hash algorithm can be selected as SM3 (group length 64 bytes). Logically, a complete data to be identified includes a message prefix (Prefix) and a message content (Message Content). The message prefix is optional and, when present, it is composed of one or more scope parameters (Scope Parameter) in order. The scope parameter refers to a discrete information unit used to limit the key scope, such as date, region identifier, service name, etc. For the prefix "20251208 / cn-north-1 / s3", it contains three scope parameters: parameter 1 (date) "20251208", parameter 2 (region identifier) "cn-north-1", and parameter 3 (service name) "s3". The message content corresponds to the actual API request, for example, " / order / create?id=123", which means that the client requests to create an order on the server and specifies the ID of the order as 123.

[0062] II. Overall flow of the scheme.

[0063] As shown in Figure 2 , the interaction timing diagram between the components in the scheme of the application is shown.

[0064] 1. Initialization and intermediate state value pair generation.

[0065] Before the business runs or is called for the first time, the HMAC generation party and the HMAC verification party respectively request and obtain their own intermediate state value pairs from the HMAC key management system. It is assumed in the embodiment that: 1.1~1.2, HMAC Generator holds a prefix specific to a particular service (e.g. "20251208 / RegionA"), obtains a first pair of intermediate state values from the HMAC key management system .

[0066] 1.3~1.4, HMAC Verifier holds a prefix specific to a wider scope (e.g. "20251208"), obtains a second pair of intermediate state values from the HMAC key management system .

[0067] 2, HMAC Generator generates a first message authentication code.

[0068] 2.1, determines the difference between the message content, its own and the HMAC Verifier's prefix.

[0069] 2.2, determines its own initial state based on the difference between its own and the HMAC Verifier's prefix.

[0070] 2.3, computes the first message authentication code.

[0071] The HMAC Generator appends the generated first message authentication code in the API request header and sends the API request message to the HMAC Verifier. The HMAC Generator's prefix may or may not be sent, when the difference between the HMAC Generator's and the Verifier's prefix is known to the HMAC Verifier.

[0072] 3, HMAC Verifier verifies the first message authentication code.

[0073] 3.1, receives the request from the HMAC Generator.

[0074] 3.2, HMAC Verifier performs verification based on the second pair of intermediate state values held locally . Assume the HMAC Verifier's prefix ("20251208") is a proper prefix of the HMAC Generator's prefix ("20251208 / RegionA"). The verification logic contains the handling of the proper prefix inclusion as follows: (3.2.1) Difference identification: At this point, the difference between the two is the complete scope parameter "RegionA".

[0075] (3.2.2) State update: Since in the preceding step, the HMAC key management system has processed "20251208" to obtain However, "RegionA" has not yet been processed. This is to restore an intermediate state consistent with the generator (i.e.,...). The verifier needs to perform a state update on the difference portion "RegionA", that is, to perform block boundary alignment padding on "RegionA" (using the same rules as the previous steps, such as using bit zero padding to 64 bytes), and then... As the state, the scope parameter of the padded difference portion is used as the input sequence to perform an iterative compression operation of the cryptographic hash algorithm. The result of this operation is the updated intermediate state, which will serve as the first initial state for the HMAC verifier's iterative compression operation. This is equivalent to the HMAC generator's method. .

[0076] 3.3 Local Recalculation: The verifier uses the updated initial state. The second message authentication code is calculated using the same operational logic as the HMAC generator in generating the first message authentication code.

[0077] Note: If and Equal or yes If it is a proper prefix, then the verifier directly uses it. Calculate the message authentication code; the above state update steps are unnecessary.

[0078] 3.4 Response processing.

[0079] The HMAC authenticator compares the second message authentication code with the first message authentication code in the request header. If they match, the authentication passes, the business logic is executed, and the business response data is returned; otherwise, an error message indicating authentication failure is returned.

[0080] III. Detailed introduction of the plan.

[0081] This section provides a detailed introduction to the working processes of the HMAC key management system, the HMAC generator, and the HMAC verifier.

[0082] 1. The HMAC key management system generates intermediate state value pairs.

[0083] Upon receiving an intermediate state retrieval request, the HMAC key management system performs calculations within a secure environment. For example... Figure 3 As shown, the HMAC key management system calculates intermediate state values ​​U and V (including those used for HMAC generation) through two independent paths. and used for verification ).

[0084] (1) Calculation scheme for the first intermediate state value U.

[0085] The HMAC key management system first preprocesses the HMAC key K. If the length of K exceeds the block length of the cryptographic hash algorithm (for example, the block length of the SM3 algorithm is 64 bytes), the preprocessed key of K is calculated based on the cryptographic hash algorithm ; otherwise . If the length of K is less than the block length of the cryptographic hash algorithm, zeros are padded until the length is equal to the block length of the cryptographic hash algorithm.

[0086] Then, the XOR value of and the outer padding constant opad is calculated to form the outer message block. Subsequently, the HMAC key management system takes the initial value IV defined by the cryptographic hash algorithm as the state, takes the outer message block as the input sequence, and performs the compression operation of the cryptographic hash algorithm to output the state obtained by the operation as the first intermediate state value U.

[0087] (2) The calculation scheme of the intermediate state value V.

[0088] The intermediate state value V includes and , and the calculation processes of the two are the same. The HMAC key management system calculates the XOR value of the preprocessed key and the inner padding constant ipad, and this value forms the first message block of the inner iteration compression operation, which is used as the starting sequence. Then, the HMAC key management system constructs the aligned prefix sequence . The specific process is as follows: for each scope parameter (for example, "20251208", "cn-north-1", etc.) included in the message prefix, block boundary padding is performed to make the length of each scope parameter complemented to an integer multiple of the block length (64 bytes) of the cryptographic hash algorithm.

[0089] The specific construction rules of the block boundary padding include but are not limited to the following methods: (a) Zero padding method (Zero-Padding).

[0090] This method aims to expand the sequence length to an integer multiple of the block length (for example, 64 bytes) of the cryptographic hash algorithm. The specific method is to continuously pad binary "0" bits at the end of the original sequence until the total length after padding reaches the smallest integer multiple of the block length that is greater than or equal to the length of the original sequence. Here, the original sequence refers to the sequence of the scope parameter before padding.

[0091] ​(b) Standard Padding.

[0092] This mode follows the standard specification of the selected cryptographic hash algorithm (such as SM3, SHA-256), and the padding data contains a field representing the length of the original sequence.

[0093] Taking the SHA-256 algorithm as an example, the specific mode includes the following steps in sequence: Step b1, append a binary bit "1" at the end of the original sequence.

[0094] Step b2, then append k binary bits "0", where k is the smallest non-negative integer satisfying the following congruence: (L+1+k) = 448 (mod 512), where mod is the modulo operation, and L is the length of the original sequence.

[0095] Step b3, append a fixed 64-bit length (i.e., packet length) field to store the length of the original sequence in Big-Endian.

[0096] Even if the length of the original sequence has met the packet integer multiple alignment condition, the above steps still need to be executed completely.

[0097] The HMAC key management system concatenates the sequences of each scope parameter after padding in sequence to obtain the complete aligned prefix sequence . Finally, the HMAC key management system concatenates the first message packet ( ) with the aligned prefix sequence , takes the initial value defined by the cryptographic hash algorithm as the initial state, and takes the complete sequence after concatenation as the input sequence to perform the iterative compression operation of the cryptographic hash algorithm.

[0098] This part is for the prefix of the HMAC generator and the prefix of the HMAC verifier respectively. For the HMAC generator, the state output after the iterative compression operation is , and for the HMAC verifier, the state output after the iterative compression operation is ; then, the HMAC key management system transmits , to the HMAC generator and the HMAC verifier respectively.

[0099] 2. The HMAC generator generates the first message authentication code.

[0100] After receiving , the HMAC generator completes the remaining part of the HMAC operation in memory, as shown in Figure 4 .

[0101] The HMAC generator first determines its initial state for iterative compression operations. Assume the prefix of the HMAC generator in this case... If the prefix of the HMAC validator is "20251208 / RegionA", then... and Consistent, or It is already If it is a proper prefix, then directly let If the HMA generator holds a shorter prefix, such as "20251208", while the HMAC verifier holds a different prefix... If the value is "20251208 / RegionA", then the generator needs to first process the difference in "RegionA" (i.e., Perform the same block boundary alignment and padding as described above, then combine... And the sequence after padding the difference (i.e. Using the input sequence as input, perform iterative compression operations of the cryptographic hash algorithm, output the updated intermediate state, and use it as the first initial state. .

[0102] Subsequently, the HMAC generator combines the first initial state. It uses the input message content (the message content to be authenticated) MessageContent and the padding data generated according to the padding rules defined by the cryptographic hash algorithm. The concatenated result is used as the first input sequence, and the iterative compression operation of the cryptographic hash algorithm is performed. The output state is used as the internal hash value. At this point, the HMAC generator has essentially calculated: .

[0103] Preferably, if the HMAC generator and the HMAC verifier share an authorization code unknown to the HMAC key management system, then in this scenario, the HMAC generator concatenates the authorization code and the message content in a preset order to form an enhanced message sequence; in the above operation, MessageContent is replaced by the enhanced message sequence.

[0104] Finally, the HMAC generator uses the received U as the second initial state. It then uses the internal hash value obtained in the previous step... and the padding data generated according to the padding rules defined by the cryptographic hash algorithm. The concatenation result is used as the second input sequence. The iterative compression operation of the cryptographic hash algorithm is performed, and the output state is the first message authentication code.

[0105] 3. The HMAC verifier verifies the first message authentication code.

[0106] HMAC verifiers base their data on the intermediate state values ​​they hold. Generate a second message authentication code. The technical process involved in this part is the same as that in the HMAC generator, so it will not be described in detail. Output the verification result by comparing whether the two message authentication codes are consistent.

[0107] Through the above description of the embodiments, those skilled in the art can clearly understand that the above embodiments can be implemented by software, or by using software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solutions of the above embodiments can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, mobile hard drive, etc.), including several instructions to cause a computer device (such as a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0108] Example 2 This invention also provides a message authentication code generation and verification system, which is mainly used to implement the methods provided in the foregoing embodiments, such as... Figure 5 As shown, the system mainly includes: an HMAC key management system, an HMAC generator, and an HMAC verifier; wherein: HMAC Key Management System: Based on a cryptographic hash algorithm, it generates a first intermediate state value pair by combining the HMAC key with the prefix of the HMAC generator and transmits it to the HMAC generator; and based on a cryptographic hash algorithm, it generates a second intermediate state value pair by combining the stored HMAC key with the prefix of the HMAC verifier and transmits it to the HMAC verifier; wherein, HMAC is a message authentication code based on a cryptographic hash algorithm. HMAC Generator: Based on the first intermediate state value pair and the difference between the prefix of the HMAC Generator and the prefix of the HMAC Verifier, determine the initial state of the iterative compression operation of the HMAC Generator, combine it with the input sequence constructed based on the message content to be authenticated, perform iterative compression operation of the cryptographic hash algorithm to obtain the first message authentication code, and transmit the first message authentication code and the message content to be authenticated to the HMAC Verifier. HMAC verifier: Based on the second intermediate state value pair and the difference between the prefix of the HMAC generator and the prefix of the HMAC verifier, the initial state of the HMAC verifier's iterative compression operation is determined. Combined with the input sequence constructed based on the message content to be authenticated, the iterative compression operation of the cryptographic hash algorithm is performed to obtain the second message authentication code. The verification result is output according to whether the second message authentication code is consistent with the first message authentication code.

[0109] Since the main technical details involved in the system have been described in detail in the previous embodiments, they will not be described again.

[0110] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above functional modules is taken as an example, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the system is divided into different functional modules to complete all or part of the functions described above.

[0111] The above description is only a preferred specific embodiment of the present application, but the protection scope of the present application is not limited to this. Any changes or replacements within the technical scope disclosed by the present application can be easily thought of by those skilled in the art, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims. The information disclosed in the background section of this document is only intended to deepen the understanding of the overall background of the present application, and should not be regarded as acknowledging or implying in any form that the information constitutes prior art known to those skilled in the art.

Claims

1. A method for generating and verifying message authentication codes, characterized in that, include: The HMAC key management system is based on a cryptographic hash algorithm. It combines the HMAC key with the prefix of the HMAC generator to generate a first intermediate state value pair, which is then transmitted to the HMAC generator. And based on the cryptographic hash algorithm, a second intermediate state value pair is generated by combining the stored HMAC key with the prefix of the HMAC verifier, and then transmitted to the HMAC verifier; wherein, HMAC is a message authentication code based on cryptographic hash. The HMAC generator determines the initial state of the iterative compression operation based on the first intermediate state value pair and the difference between the prefix of the HMAC generator and the prefix of the HMAC verifier. It then combines the input sequence constructed based on the message content to be authenticated and performs the iterative compression operation of the cryptographic hash algorithm to obtain the first message authentication code. The first message authentication code and the message content to be authenticated are then transmitted to the HMAC verifier. The HMAC verifier determines the initial state of its iterative compression operation based on the second intermediate state value pair and the difference between the prefix of the HMAC generator and the prefix of the HMAC verifier. It then combines the input sequence constructed based on the message content to be authenticated and performs iterative compression operation of the cryptographic hash algorithm to obtain the second message authentication code. Based on whether the second message authentication code matches the first message authentication code, the verification result is output.

2. The message authentication code generation and verification method according to claim 1, characterized in that, The first intermediate state value pair is an intermediate state value pair used to generate the message authentication code, denoted as... The second intermediate state value pair is an intermediate state value pair used to verify the message authentication code, denoted as... Where U is the first intermediate state value. This is the second intermediate state value. This is the third intermediate state value; The first intermediate state value U is generated based on the stored HMAC key: the preprocessed key is calculated using a cryptographic hash algorithm to obtain the HMAC key K. Using the initial value IV defined by the cryptographic hash algorithm as the state, and the preprocessed key... The XOR value of the input sequence with the external padding constant opad defined by the HMAC algorithm is used to perform the compression operation of the cryptographic hash algorithm. The result of the operation is the first intermediate state value U. The generation process of the second and third intermediate state values ​​is as follows: using the preprocessed key... The XOR value of the internal padding constant `ipad` defined by the HMAC algorithm is used as the starting sequence. For the prefixes of the HMAC generator and the HMAC verifier, block boundary alignment padding is independently performed on each scope parameter to ensure that the length of each scope parameter is an integer multiple of the block length of the cryptographic hash algorithm. This yields the processed prefixes of the HMAC generator and the HMAC verifier, which are then concatenated with the starting sequence to obtain two concatenated sequences. The concatenated sequence corresponding to the HMAC generator is called the first concatenated sequence, and the concatenated sequence corresponding to the HMAC verifier is called the second concatenated sequence. Using the initial value `IV` defined by the cryptographic hash algorithm as the state, and the first and second concatenated sequences as input sequences, the iterative compression operation of the cryptographic hash algorithm is performed on each. The corresponding operation result is the second intermediate state value. With the third intermediate state value .

3. The message authentication code generation and verification method according to claim 2, characterized in that, The block boundary alignment padding process includes: padding the end of the scope parameter with a bit sequence generated by a preset rule, so that the total length of the padded sequence is an integer multiple of the block length of the cryptographic hash algorithm.

4. The message authentication code generation and verification method according to claim 1, characterized in that, The prefix of the HMAC generator and the prefix of the HMAC verifier are each composed of zero or one or more ordered scope parameters.

5. The message authentication code generation and verification method according to claim 1, characterized in that, The HMAC generator, based on the first intermediate state value pair and the difference between the prefix of the HMAC generator and the prefix of the HMAC verifier, determines the initial state of the iterative compression operation of the HMAC generator. Combining this with the input sequence constructed based on the message content to be authenticated, it performs iterative compression operation of the cryptographic hash algorithm to obtain the first message authentication code, which includes: The first intermediate state value pair is Where U is the first intermediate state value. This is the second intermediate state value; Based on the second intermediate state value Based on the difference between the prefix of the HMAC generator and the prefix of the HMAC verifier, the first initial state of the iterative compression operation of the HMAC generator is determined. The first input sequence, constructed based on the message content to be authenticated, is combined with an iterative compression operation of a cryptographic hash algorithm. The output state is then used as the internal hash value of the HMAC generator. ; Using the first intermediate state value U as the second initial state for the iterative compression operation of the HMAC generator, combined with the internal hash value generated by the HMAC generator... The constructed second input sequence is subjected to iterative compression operations using a cryptographic hash algorithm, and the output state is used as the first message authentication code.

6. The message authentication code generation and verification method according to claim 5, characterized in that, The second intermediate state value Based on the difference between the prefix of the HMAC generator and the prefix of the HMAC verifier, the first initial state of the iterative compression operation of the HMAC generator is determined. include: If the prefix of the HMAC generator prefix of HMAC validator Same, or the prefix of the HMAC validator. It is the prefix of the HMAC generator. The proper prefix of , that is: , The first initial state of the HMAC generator iterative compression operation is the difference between the two prefixes. ; If the prefix of the HMAC generator It is the prefix of the HMAC validator. The proper prefix of , that is: , For the difference between two prefixes, then for the difference Each scope parameter within the algorithm is independently padded with block boundaries to ensure that the length of each scope parameter is an integer multiple of the block length of the cryptographic hash algorithm, thus obtaining the processed difference sequence. Combined with the second intermediate state value Perform iterative compression operations using a cryptographic hash algorithm, and output the resulting state as the first initial state. .

7. The message authentication code generation and verification method according to claim 5, characterized in that, Also includes: Fill data is generated according to the filling rules defined by the cryptographic hash algorithm. ; Based on the message content to be identified and the populated data Construct the first input sequence based on the internal hash value of the HMAC generator. With filling data Construct the second input sequence.

8. The message authentication code generation and verification method according to claim 5, characterized in that, The HMAC verifier, based on the second intermediate state value pair and the difference between the prefix of the HMAC generator and the prefix of the HMAC verifier, determines the initial state of the iterative compression operation of the HMAC verifier. Combining this with the input sequence constructed based on the message content to be authenticated, it performs iterative compression operation of the cryptographic hash algorithm to obtain the second message authentication code, which includes: The second intermediate state value pair is Where U is the first intermediate state value. This is the third intermediate state value; Based on the third intermediate state value The first initial state of the iterative compression operation of the HMAC verifier is determined by using the operational logic corresponding to that of the HMAC generator. And calculate the internal hash value of the HMAC verifier; Furthermore, the first intermediate state value U is used as the second initial state for the HMAC verifier's iterative compression operation. The operation logic corresponding to that of the HMAC generator is adopted, and the second message authentication code is obtained through the operation.

9. A method for generating and verifying a message authentication code according to any one of claims 1 to 8, characterized in that, Constructing the input sequence based on the message content to be identified includes: The HMAC generator constructs an API call request message based on its own API call requirements and uses it as the message to be authenticated; where API stands for Application Programming Interface. The input sequence can be constructed directly using the message to be authenticated; or, the authorization code, which is shared in advance by the HMAC generator and the HMAC verifier and is unknown to the HMAC key management system, can be concatenated with the message to be authenticated in a preset order to form an enhanced message sequence, and then the input sequence can be constructed using the enhanced message sequence.

10. A message authentication code generation and verification system, characterized in that, The method for implementing any one of claims 1 to 9 comprises: an HMAC key management system, an HMAC generator, and an HMAC verifier; wherein: HMAC Key Management System: Based on a cryptographic hash algorithm, it generates a first intermediate state value pair by combining the HMAC key with the prefix of the HMAC generator and transmits it to the HMAC generator; and based on a cryptographic hash algorithm, it generates a second intermediate state value pair by combining the stored HMAC key with the prefix of the HMAC verifier and transmits it to the HMAC verifier; wherein, HMAC is a message authentication code based on a cryptographic hash function. HMAC Generator: Based on the first intermediate state value pair and the difference between the prefix of the HMAC Generator and the prefix of the HMAC Verifier, determine the initial state of the iterative compression operation of the HMAC Generator, combine it with the input sequence constructed based on the message content to be authenticated, perform iterative compression operation of the cryptographic hash algorithm to obtain the first message authentication code, and transmit the first message authentication code and the message content to be authenticated to the HMAC Verifier. HMAC verifier: Based on the second intermediate state value pair and the difference between the prefix of the HMAC generator and the prefix of the HMAC verifier, the initial state of the HMAC verifier's iterative compression operation is determined. Combined with the input sequence constructed based on the message content to be authenticated, the iterative compression operation of the cryptographic hash algorithm is performed to obtain the second message authentication code. The verification result is output according to whether the second message authentication code is consistent with the first message authentication code.

Images