CN1309207C - Improving safety server performance by utilizing preprocessed data made ready for safety protocol transmission - Google Patents
Improving safety server performance by utilizing preprocessed data made ready for safety protocol transmission Download PDFInfo
- Publication number
- CN1309207C CN1309207C CNB011208945A CN01120894A CN1309207C CN 1309207 C CN1309207 C CN 1309207C CN B011208945 A CNB011208945 A CN B011208945A CN 01120894 A CN01120894 A CN 01120894A CN 1309207 C CN1309207 C CN 1309207C
- Authority
- CN
- China
- Prior art keywords
- file
- record
- mentioned
- length
- data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F15/00—Digital computers in general; Data processing equipment in general
- G06F15/16—Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/16—Implementing security features at a particular protocol layer
- H04L63/166—Implementing security features at a particular protocol layer at the transport layer
Abstract
A improved symmetry secure method, system and computer program product for block data. The invention concerns file transmission using a secure protocol such as Secure Sockets Layer (SSL) or Transaction Layer Security (TLS). Files to be served are pre- processed to insert empty spaces therein, in the location(s) where hash values are required according to the protocol definition. When the file is requested by a client, actual hash values are computed and substituted for the reserved empty spaces. This technique enables sending large blocks of data to an encryption engine and takes advantage of resulting processing efficiencies, without regard to smaller size limitations for message segments that are imposed by a security protocol definition.
Description
Technical field
The present invention relates to computer system, especially, the present invention relates to a kind of method, system and computer program, use a security protocol (as security socket layer, or " SSL ", or a similar confidentiality agreement, as the affairs processing layer confidentiality agreement, or " TLS ") data that will transmit are carried out the performance that preprocessed data improves a security server in the network environment (for example the Internet).
Background technology
Security socket layer, or " SSL " are gateway protocols by Netscape communication company and the exploitation of the secret company of U.S.'s RSA laboratory data, can carry out safe network communication in an insecure environments.Particularly, SSL designed to be used in the internet environment, and it operates in a protocol layer on the TCP/IP (transmission control protocol/Internet protocol).Thereby application code resides on the SSL in the network protocol stack.After an application program (as browser) generation will be sent to the data of a peer layer in the network, data were transferred to the SSL layer, and wherein to the different secure routine of data operation, the SSL layer arrives the TCP layer to the data passes that is converted then.Receiver side connecting after the TCP layer receives the data of input, upwards is delivered to the SSL layer with it, and wherein working procedure returns to its primitive form with data, and recovered data is delivered to the reception application program then.The SSL of latest edition has detailed description in " ssl protocol, 3.0 versions " published on November 18th, 1996, can
Http:// home.netscape.com/eng/ss13/draft302.txtWorld Wide Web (" Web ") in obtain (being expressed as hereinafter, " SSL standard ").
Agreement (as TCP/IP) as the basis, the Internet is not to be designed to provide secure data transmission.The design original intention of the Internet is to be used for academic and science communication, and the imagination network user will work in nonantagonistic, a co-operating mode.Along with the Internet begins to expand to public network, the use beyond these corporations is restricted relatively, and the new user of great majority is in major company.These companies have data processing equipment, utilize different secure routines to protect their user data, as fire compartment wall, do not need to set up the confidentiality of the Internet itself.Yet in the past few years, the use of the Internet sharply enlarges.Now the millions of people is at internet usage and World Wide Web termly.(hereinafter, if do not distinguish especially, term " the Internet " is taken as identical notion with " World Wide Web ".) these users carry out different tasks, from the exchange Email to Query Information with handle business transaction.These users can be from family, from their cell phone, or visits the Internet from some other the environment, wherein is not that safety measure is arranged all.In order to support as the Internet development of a feasible businessfice, be commonly called " ecommerce " or abbreviate " e-commerce " as, must develop and be easy to access and cheap secrecy provision.SSL is a popular solution, and the normal application program of utilizing HTML (Hypertext Markup Language) (" HTTP ") to transmit and receive data is together used together.HTTP is the agreement that is most commonly used to be called as in the access internet port of World Wide Web.When HTTP makes when being used to provide safety communication with SSL, be collectively referred to as " HTTPS ".The Internet service of non-commercial also can benefit from the confidentiality that SSL provides.SSL has been proposed with other agreement except that HTTP and has together used, as Simple Mail Transfer protocol (" SMTP ") and NNTP (" NNTP ").
SSL is designed to provide several different but complementary type of security.First type is information privacy.Privacy is meant that the protection information content can not be read by the recipient who removes the sender and be scheduled to other people.Privacy comes that by the art that accesses to your password information is advanced encryption and decryption to be provided.SSL has used asymmetrical cryptography, and being also referred to as is the public key encryption art.If correct private key and the decipherment algorithm relevant with information creating person's public-key cryptography are arranged, the information receiver just can decipher an information encrypted.Second type, SSL is for just providing data integrity in information transmitted.Data integrity is meant the ability (thereby reflecting the unreliable of information) that the information receiver detects the information content and whether changed after it is created.An information creating person comes transmission information by an algorithm that can produce " informative abstract " or " message authentication ".In other words, because such algorithm is considered to " hashing algorithm ", be " hash " of an information so the output of algorithm is commonly referred to as.This summary or hash are sent out with information.When information was received, the recipient also handled it by an algorithm, produced the another one summary.Be not complementary with the summary that together sends with information if this handles the summary that draws by the recipient, can think that so being created its content of back in information has been subjected to change in one aspect.The evaluation of being known as of the feature of the third type of security that SSL provides.Communication by the Internet produces as the electronic signal sequence, and the intelligencer is invisible each other, can not determine intuitively with whose communication.Evaluation is a technology, assists in ensuring that no matter the party is a user or an application program for party's identity one.For example, a user buys commodity with credit card by the Internet, to him, any is arranged is very important, that is exactly to be sure of that the other end that is connecting waits for that the application program of his credit card information really is that he believed and the seller its transaction, rather than the forger that its credit card information is stolen in wait.
These security features are powerful, and provide very high protection for the Internet user.But the operation of ssl protocol produces very a large amount of processing expenditure.The secure internet server, as the secure HTTP server, must can in time corresponding very a large amount of security information requests for content.The overhead of ssl protocol makes these servers become the user and asks the bottleneck handled.The overhead of ssl protocol can be summed up as three factors: the network traffics (for example in exchange agreement, wherein in the process of information exchange, consult many different secret relevant parameters) that (1) is extra; (2) when a secured session begins, use the higher asymmetric key cryptography operation of relative costs at the secret key encryption of between client and server, transmitting and deciphering, and the symmetric cryptography of the chunk data that transmits between (3) user and server.
Effective realization of the ssl protocol of first factor by relating to socket is resolved.Second factor solved by the different cryptography hardware adapters and the producer of accelerator.When chunk data was encrypted, although the 3rd factor can not produce the many like that additional overhead of other factors, it consumed the considerable processing time.Many encryption hardware accelerators comprise the circuit of symmetric cryptography (being also referred to as " symmetric cryptography "), as everyone knows DES, 3DES and RC4 password.Yet the essence of ssl protocol makes it be difficult to raise the efficiency by these accelerators.This be because ssl protocol in the Payload of any independent message transmission, the maximum data of being transmitted is limited in 16 kilobytes.Therefore surpass this big or small information or file must be cut apart and exchange by message transmission repeatedly.(application program that some are more senior even can mandatory provision lower size restriction: to some known application programs, the size of the most appropriate to the occasion data segment is confirmed as 4K.) problem is that most encryption hardware card and accelerator all are most effective when being used for chunk data.Yet ssl protocol is forbidden the data block greater than dominant record size is encrypted, because each ciphered data piece must comprise that is spreaded all over the hashed value that data in the piece (before encryption) calculate.By using a plurality of data segments less than dominant record size, this restriction is forced large-scale information is sent to crypto engine, thereby causes the non-optimum utilization of crypto engine.(as using term herein, one " crypto engine " is meant an encryption, can be a hardware implementation procedure, as card or accelerator, but in particular environment, or in the combination of a hardware and software, also can realize by software.)
Affairs processing layer confidentiality agreement (TLS) be designed to one will finally substitute SSL follow (follow-on) secrecy technology.(SSL will end in 3.0 versions and 1.0 versions of TLS will originate in the SSL3.0 Version Spec the basis it.) TLS carries out standardization by IETF (network engineering task groups), " tls protocol, the version 1.0 " that is recorded in January, 1999 issue (RFC2246) in.Similar in information exchange in the tls protocol and the ssl protocol, thereby also will there be inefficient as described above problem in the realization of TLS.
A kind of method of the SSL of raising throughput is that whole agreement is joined in the hardware device.In this case, whole ssl protocol is to finish in network layer, and application program only can be seen (unencrypted) clearly data of turnover hardware card interface.Yet it may be inconvenient will effectively managing an independent hardware card, because a typical server may have hundreds of conversations of carrying out simultaneously.And different application program (and the different piece of same application program) sometimes may be to SSL processing requirements difference, identifies as different key values, user etc.The SSL hardware unit of a whole agreement of operation will be inflexible, and hardware card expense (no matter being on throughput or the price) will improve along with the increase of function.In addition, when will be when SSL and/or TLS increase new password, SSL hardware will be difficult to upgrade.
Summary of the invention
In sum, need a technology of improving encryption method to realize the symmetric cryptography of chunk data, can use one to transmit such as SSL or TLS security protocol.
An object of the present invention is to provide a technology, improve the symmetric cryptography of chunk data, be used for the transmission of carrying out such as the security protocol of SSL or TLS by.
Another object of the present invention provides this technology, can realize the advantage of bulk transmission data encipher, although data must be transmitted with the form of a plurality of fritters.
Further purpose of the present invention provides a technology, the data file that preliminary treatment sends with security protocol, wherein preprocessing process is created a kind of revision file of best encrypted form, uses the chunk data scale, but still follows the agreement of fritter data scale transmission.
For other purpose of the present invention and advantage,, will partly be understood or be grasped by practice of the present invention by following description with the elaboration of carrying out in the following description and the drawings to a certain degree.
For reaching above-mentioned purpose, the invention provides a kind of system that is used to improve the symmetric cryptography efficient of the chunk data by the security protocol transmission, comprising: be used for determining one will safe transmission the device of file; Be used for before safe transmission preliminary treatment this document device with the ciphering process of optimizing the symmetry that is adopted, further comprise: be used to calculate the device of file data record length used during safe transmission, wherein this record length length of equaling to transmit data segment deducts a hash length; This document is divided into the device of the data record sequence of an above-mentioned record length, and wherein last record can be less than described record length; Add the device of a white space in each record back of above-mentioned sequence; Write the device of an output file with each record and above-mentioned additional white space with above-mentioned sequence.
The present invention also provides a kind of method of file being handled for the symmetric cryptography efficient of improving chunk data transmission by a security protocol, and the step that comprises has:
Determine one will safe transmission file; With
Came preliminary treatment this document before safe transmission, optimize the ciphering process of the symmetry that is adopted, the step that further comprises has:
Calculating used file data record length during safe transmission, wherein this record length length of equaling to transmit data segment deducts a hash length, and wherein this hash length is the length of transmission hash that data segment adopts;
This document is divided into the data record sequence of an above-mentioned record length, wherein last record is less than or equal to described record length, wherein, when the length of last record during less than described record length, an additional filling block to this last record so that the length of this last record equals described record length;
At each additional white space in record back of above-mentioned sequence, wherein this white space length equals described hash length; With
Each record and the above-mentioned additional white space of above-mentioned sequence are write an output file.
In order to realize aforesaid purpose, and, the invention provides a kind of method, system and computer program, be used to improve the mode of utilizing the chunk data symmetric cryptography that a security protocol transmits according to the purposes of the present invention of summary description here.This technology comprises: confirm one will be by the file of safe transmission; Preliminary treatment this document before safe transmission is handled to optimize the symmetric cryptography that will adopt.Preliminary treatment further comprises: calculating will be used for the data record size of file in the safe transmission process, and wherein the record length size that equals a span line deducts the length of a hash; With file division is a record series of record length, and wherein last record can be shorter than record length; Each additional white space in record back at records series; Each record of records series is write an output file and additional white space in this output file.Can be in the end before a data block additional step carries out, additional filling block in record in the end.
Can hang up (prepend) file header in advance in first record of the ground of output file, wherein the content of storing in the file header comprises one or more following information: (1) symmetric cryptography is handled used cryptographic algorithm sign; (2) be used for the hashing algorithm sign that symmetric cryptography is handled operation record before; (3) record length.
This technology may further comprise: receive a file request; In response to this reception, the location output file; Obtain a hash key and an encryption key relevant with the request that receives; The hash key that utilization is obtained uses a hashing algorithm to each record in the sequence; At each record,, thereby create a hash file with the alternative additional white space of the result of hashing algorithm; The encryption key that utilization is obtained and a cryptographic algorithm of carrying out the symmetric cryptography processing are encrypted hash file, thereby are created an encrypt file; And the file of response request transmission encryption.Like this, this technology also may further include: hang up a file header in output file in advance, wherein the storage of this document head comprises the information of the sign of a symmetric encipherment algorithm; And the encryption key that obtains added to encrypt in the used file header.Perhaps, the file header of Gua Qiing can be stored the information that comprises hashing algorithm sign in advance, and like this, this technology further comprises adds the hash secret key of obtaining in the file header of file of English to.This document head may further include encrypts used initialization vector.
Security protocol can be security socket layer (SSL), affairs processing layer confidentiality agreement (TLS), or other security protocol.
Description of drawings
With reference to the accompanying drawing of back, the present invention will be described below, and in all accompanying drawings, identical reference number is represented identical assembly.
Fig. 1 is the module map that can implement computer workstation environment of the present invention;
Fig. 2 is the diagrammatic sketch that can implement networked computer environment of the present invention;
Fig. 3 and Fig. 4 A, Fig. 4 B can be used to realize the flow chart of the logic of the preferred embodiments of the invention for explanation; With
What Fig. 5 A and Fig. 5 B illustrated is according to the preferred embodiments of the invention, to the situation of data file before and after handling that will be transferred to the requestor.
Embodiment
Being one and typically can implementing word station hardware environment of the present invention of Fig. 1 explanation.The environment of Fig. 1 comprises typical sole user's computer workstation 10, as a personal computer, comprises relevant external equipment.Workstation1 0 comprises a microprocessor 12 and connects also can be according to the bus 14 of communication between existing techniques in realizing microprocessor 12 and the workstation1 0.Usually workstation1 0 comprises a user interface adapter 16, by bus 14 microprocessor 12 is connected with one or more interface equipments, as keyboard 18, mouse 20, and/or other interface equipment 22, these equipment can be the Any user interface equipments, as a touch-screen, digitlization input touch dish etc.Bus 14 also by a display adapter 26, with a display device 24, as a lcd screen or monitor, is connected with microprocessor 12.Bus 14 also is connected with memory 28 microprocessor 12 with long term memory 30, long term memory can comprise hard disk drive, disc driver, tape drive etc.
Workstation1 0 can and other computer or computer network between communication, for example by communication channel and modulator-demodulator 32.Perhaps, workstation1 0 can utilize the wave point on 32 to carry out communication, blocks as a CDPD (modular digital data packet).Workstation1 0 can interrelate with other similar computer in Local Area Network or the wide area network (WAN), and perhaps work station can be a client in the client/server that matches with another computer, or the like.All these configurations, and suitable communication hardware and software all are to belong to this technical field.
Fig. 2 illustrates that can be implemented a data processing network 40 of the present invention.Data processing network 40 can comprise a plurality of independent networks, and as wireless network 42 and network 44, wherein each network can comprise a plurality of independent workstation1s 0.In addition, be appreciated that as those skilled in the art to comprise one or more local area network (LAN)s (in the drawings show) that one of them local area network (LAN) can comprise a plurality of intelligent workstations that are connected in host-processor.
Still with reference to figure 2, network 42 and 44 can also comprise mainframe computer or server, as a gateway computer 46 or apps server 47 (can visit a data thesaurus 48).Gateway computer 46 is as the entrance that enters each network 44.Gateway 46 preferably connects 50a by a communication and links to each other with another network 42.Gateway 46 also can utilize communication connection 50b, 50c directly to link to each other with one or more work stations.Gateway computer can utilize enterprise systems architecture system/370 of IBM, enterprise systems architecture system/390 computers to use together, as: utilize the modulator-demodulator of computer to connect by telephone wire; Utilize LAN card, as Token Ring or Ethernet; Utilize portable modulator-demodulator to set up wireless connections; Or the like.User's computer can be the computer processor with processing (with optional communication) ability of any type, comprises portable computer, palm or removable computer; The car installing is equipped with; Desktop computer; Mainframe computer; Or the like.Similarly, remote server can be any dissimilar computer with processing and ability to communicate.These technology are being well-known in the art, and used hardware device and software are easy to obtain.Below, subscriber computer will be known as one " work station ", " equipment " or " computer ", and the use of these terms or term " server " all is meant the data processing equipment of above-described any type.
In preferred embodiments, the present invention realizes with the form of one or more computer software programs.Software can be used as one or more modules (be also referred to as the code subprogram, or " object " in the object based programming) and realizes.Logic realization of the present invention can be integrated with the program code of implementing ssl protocol, one or more independently application modules that can provide by the service of this routine call maybe can be provided realize, and can not deviate from notion of the present invention disclosed herein.The server that is used for the present invention's operation can play the effect of the webserver, and wherein the webserver provides the request that responds by the user of Internet connection of serving.Perhaps, server can be in the Intranet or extranet of a group, and the teller work station is one of them parts, or is in other network environment.
Below will be by the preferred embodiments of the invention being discussed in greater detail with reference to figure 3-5.
Fig. 3 explanation is according to the logic of a file of preliminary treatment of embodiment preferred.A file is prepared in this preliminary treatment, so that required processing is minimum when adopting ssl protocol, and can be sent to crypto engine with the form of one or more big data blocks, so that the optimization process that realizes in crypto engine.And shown in Figure 4 be the logic that optimum adopts when receiving a file request in the server, wherein the file optimum carries out preliminary treatment according to the logic of Fig. 3.
Preliminary treatment optimum among Fig. 3 carried out before the file request that receives a client.Preliminary treatment also can be carried out after receiving a such request immediately, and does not depart from scope of the present invention.(under latter event, the preprocessed file that is produced by the operation among Fig. 3 preferably stores in the lasting memory, can raise the efficiency when realizing follow-up client requests like this.) briefly, pretreatment operation is exactly hole of insertion, place of a hashed value of ssl protocol needs hereof, or a white space.
Pretreatment operation originates in square frame 300 among Fig. 3, obtains herein pretreated literary composition waited and realizes.According to application program, can use the computer of Mid Frequency, as application system/400 (being also referred to as AS/400).(" enterprise systems architecture system/370 " are the trade marks of IBM; " enterprise systems architecture system/390 ", " application system/400 " and " AS/400 " are the registered trade marks of IBM.)
Those skilled in the art are appreciated that gateway computer 46 can be positioned at the place far apart from network 42, and similarly, workstation1 0 can be far apart from network 42 and 44.For example, network 42 can be positioned at California, and gateway 46 can be positioned at the Texas, and one or more workers organize station 10 can be positioned at New York.Workstation1 0 can utilize the procotol such as transmission control protocol/Internet protocol (" TCP/IP "), by the medium of many mutual connections, as portable phone, radio frequency network, satellite network etc., is connected to wireless network 42.Wireless network 42 preferably utilizes network to connect 50a, as TCP or UDP (User Datagram Protoco (UDP)), by IP, X.25, frame relay, ISDN (integrated services network), PSTN (Public Switched Telephone Network) etc., be connected to gateway 46.Workstation1 0 also can utilize dial-up connection 50b or 50c to be directly connected to gateway 46.And wireless network 42 and network 44 can be connected to one or more networks (not showing in the drawings) with being similar to mode shown in Figure 2.
The software program code of embodiment of the present invention is usually by the microprocessor 12 of server (as the server 47) long term storage media 30 from some type, as access in the CD drive.Software program code can be included in arbitrarily on the medium of knowing that together use with data handling system, as disk, hard disk drive, or CD drive.Code can be distributed in these medium, or can be by the user of other similar system network by certain type, to other computer system, gives user with assignment of code from the internal memory of a computer system or storage device.Perhaps, program code can be included in the internal memory 28, utilizes bus 14 to come access by microprocessor 12.Software program code is covered in internal memory, the physical medium, and/or be well-known, will not do further discussion here by the technology and the method for network allocation software code.
The user that needs are used to handle file of the present invention can be connected to a server with his computer by wired connection or wireless connections.Wired connection is to use physical medium, and as being connected that cable and telephone wire are realized, and the wireless connections use is as medium such as satellite connection, radio frequency ripple, infrared waves.Many interconnection techniques can together be used by the medium different with these, as: utilize the modulator-demodulator of computer to connect by telephone wire; Utilize LAN card, as Token Ring or Ethernet; Utilize portable modulator-demodulator to set up wireless connections; Or the like.User's computer can be the computer processor with processing (with optional communication) ability of any type, comprises portable computer, palm or removable computer; The car installing is equipped with; Desktop computer; Mainframe computer; Or the like.Similarly, remote server can be any dissimilar computer with processing and ability to communicate.These technology are being well-known in the art, and used hardware device and software are easy to obtain.Below, subscriber computer will be known as one " work station ", " equipment " or " computer ", and the use of these terms or term " server " all is meant the data processing equipment of above-described any type.
In preferred embodiments, the present invention realizes with the form of one or more computer software programs.Software can be used as one or more modules (be also referred to as the code subprogram, or " object " in the object based programming) and realizes.Logic realization of the present invention can be integrated with the program code of implementing ssl protocol, one or more independently application modules that can provide by the service of this routine call maybe can be provided realize, and can not deviate from notion of the present invention disclosed herein.The server that is used for the present invention's operation can play the effect of the webserver, and wherein the webserver provides the request that responds by the user of Internet connection of serving.Perhaps, server can be in the Intranet or extranet of a group, and the teller work station is one of them parts, or is in other network environment.
Below will be by the preferred embodiments of the invention being discussed in greater detail with reference to figure 3-5.
Fig. 3 explanation is according to the logic of a file of preliminary treatment of embodiment preferred.A file is prepared in this preliminary treatment, so that required processing is minimum when adopting ssl protocol, and can be sent to crypto engine with the form of one or more big data blocks, so that the optimization process that realizes in crypto engine.And shown in Figure 4 be the logic that optimum adopts when receiving a file request in the server, wherein the file optimum carries out preliminary treatment according to the logic of Fig. 3.
Preliminary treatment optimum among Fig. 3 carried out before the file request that receives a client.Preliminary treatment also can be carried out after receiving a such request immediately, and does not depart from scope of the present invention.(under latter event, the preprocessed file that is produced by the operation among Fig. 3 preferably stores in the lasting memory, can raise the efficiency when realizing follow-up client requests like this.) briefly, pretreatment operation is exactly hole of insertion, place of a hashed value of ssl protocol needs hereof, or a white space.
Pretreatment operation originates in square frame 300 among Fig. 3, obtains herein pretreated file.Can create a selectable file header, as shown in the square frame 310.This document head comprises the information of relevant this document, and similar file and improve the efficient that subsequent file is encrypted can be used to be distinguished from each other.Ssl protocol prepares to adopt multiple different bulk cryptographic algorithm and hashing algorithm.There are many difference between different algorithms.For example for bulk RC4 password, two cover SSL passwords are arranged, wherein a cover adopts MD5 hashing algorithm and adopts the SHA-1 hashing algorithm when another set of.The MD5 hash adopts 128, and the SHA-1 employing is 140.Such one is adopted the pretreated file of MD5 hash to compare with adopting the pretreated file of SHA-1 hash, needs to insert a less hole.May also there be other difference between two cover passwords and algorithms, as for not being the file that terminates in the specific edge of a transmission log length multiple, whether needs to fill at the afterbody of file.Because these difference, the most handy more than one form carries out independent preliminary treatment to file.The head of each storage version can be used for discerning that preprocessed file uses is that a kind of algorithm like this, which cover password of cicada be used for agreement between user and server, just can select suitable storage version.(square frame 430 below with reference to Fig. 4 is discussed this content.) when inserting a hole, file header preferably indicates used record length (although this information can be omitted, adopting the default records length of a 16K usually).
Shown in Fig. 5 A is the example of data file before handling according to the present invention that will be transferred to the requestor.This document content is stored as a byte sequence with prior art.Shown in Fig. 5 B is this data file after handling according to the logic of Fig. 3.Selectable file header is shown in 510, stores once at the section start of preprocessed file.(notice that this document head is not transferred to the user, but the present invention will be at the inner this document head that uses of server.)
Get back to Fig. 3, in square frame 320, calculate the used record length of transmission message segment of this document.Comprise the length that deducts hash from the data length that is used for information payload.For example, if the data of each message segment transmission 16K byte, and the hash of 128 (16 bytes) is used for the MD5 hash as mentioned above, and the record length that calculates of square frame 320 is the 16K-16 byte so.If used selectable file header, it is written in the file of establishment (square frame 330).As mentioned above, be written to information in the file header and preferably include a preparation cryptographic algorithm and the sign of hashing algorithm and used record length that this document adopted.(will describe as following,, when preparing file encryption and being transferred to specific user, can insert out of Memory subsequently in file header according to Fig. 4.)
Whether the file that square frame 340 inquiries are being handled is in the end.If then the processing of Fig. 3 finishes.Otherwise, carry out repeated treatments by the logic of square frame 350 and 360, until the end that arrives input file.Square frame 350 obtains the subsequent byte of input file, and its length is represented with the record length that calculates in the square frame 320, and an additional white space is to the end of these data.It is consistent that the length of white space and the hashing algorithm of the file of preparing require.If the byte number that still need handle in the input file is less than the record length that calculates, and this used cover password requires the filling short block of the type, the filling of square frame 350 earlier additional requirement before additional white space so.Then, square frame 360 is written to the data block that square frame 350 produces in the output file, after this, square frame 340 is got back in control.
How output file explanation among Fig. 5 B utilizes the pretreatment operation among Fig. 3 that the input file among Fig. 5 A is made amendment.White space (as unit 525,535) is presented at the back of each data block (as unit 520,530).Ssl protocol needs the place of hash to insert white space in each data module.Data module 590 back last in this example are packing spaces 592, are last white space 595 then.
When receiving transfer files to user's request, the logic in the calling graph 4.When receiving when request (square frame 400 among Fig. 4 A), carry out a test, whether the preprocessed version of determining this document available (square frame 410).If unavailable, then this document can be handled and transmits according to prior art, shown in square frame 420, after this, finishes at the processing procedure among Fig. 4 of this request.(perhaps, as described above, logic that can calling graph 3 is created a preprocessed version of this document.At that rate, after pretreatment operation was finished, the preliminary treatment of Fig. 4 preferably proceeded to square frame 430.) if the detection of square frame 410 obtains a definite results, then square frame 430 detects, and determines whether a preparation is used for the version of agreement is used between server and the request client cryptographic algorithm and hashing algorithm available.If unavailable, so then this document can be handled and transmits according to previous technology, shown in square frame 420; Perhaps, in another embodiment, logic that can calling graph 3 is created a suitable version of this document, and after this, the processing of Fig. 4 preferably proceeds to square frame 440.
, control to arrive square frame 440 when but the preprocessed version of a requested file is the time spent.Be transferred to send requesting users before, this document has white space in the position that needs insert the desired hashed value of SSL.Square frame 450 obtains and is used for the encryption key and the hash key of the transmission of further document.According to ssl protocol, each SSL is connected, all to redefine encryption key and hash key.This must postpone the calculating of hashed value, and (why Here it is will pass through to add white space at the residing document location of hashed value, rather than the good hashed value of calculating is stored pretreated file up to learning predetermined recipient.)。
Then, square frame 460 (Fig. 4 B) detects the end that determines whether to arrive the file of handling.If not, then repeat to call square frame 480 and 495 and handle output file, further prepare to be transferred to the predesignated subscriber.Square frame 480 is utilized as this user's agreement (according to previous SSL handshaking protocol technology) hashing algorithm and comes the hash of the next data module of calculation document.Then, square frame 495 is inserted into the white space that this data module keeps with the hash that calculates, and control subsequently turns back to square frame 460.(best usage data buffer or temporary file, rather than directly be written to again in the pretreated file.)
When the hashed value of the whole file that will transmit had all been calculated, control arrived square frame 470.Square frame 470 together with transmit employed encryption key to the user, together is sent to crypto engine with the data processed buffering.If, so preferably this vector together is sent to engine for the starting crypto engine uses an initialization vector.Crypto engine comes partition data (for example, the dominant record size of ssl protocol is 16K) according to used record length after the data buffering is encrypted (utilization is appropriate to the data module of the length of used particular encryption engine).Then, shown in square frame 490, utilize the SSL information and the technology of prior art, a plurality of data segments of file are inserted in the Payload (data segment of each information load) of waiting the SSL information sent out, and are transferred to the user.(the actual transmission of data is preferably directly from carrying out the crypto engine: for the purpose of complete, this operation is shown among Fig. 4, but this to be not ciphered data must turn back to before being transferred to the user carries out the same logic of this operation among Fig. 4.) so far, the processing that utilizes development of the present invention that user's request is carried out finishes.
Of preferred embodiment selectable aspect, the file header of handling can upgrade, and comprises the additional information before the square frame 470 into.Additional information comprises: the encryption key that crypto engine is used; If any, also comprise an initialization vector that is used to start cryptographic algorithm.In this mode, all required information of crypto engine all are embodied in the file header.When using a design to be used for obtaining file and returning the hardware device of effective SSL record of bulk or during software interface, this method is advantageous.
On the other hand, also can comprise hash key in the file header.When using this method, the Hash process shown in the square frame 460,480 and 495 is not to carry out before crypto engine sending file, but is carried out afterwards receiving file by crypto engine.
On the other hand, when Hash process will be carried out by crypto engine, hash key was delivered to crypto engine (front is to discuss) in the process of square frame 470.
The pile line operation of carrying out encryption by parallel encryption engine (or a crypto engine array) can make processing procedure more effective, and ciphering process can carry out with the request and the response overlapping of user/server like this.
As described above, utilize a security protocol,, the invention provides the improvement technology that a chunk data that need are transferred to the requestor carries out symmetric cryptography, when sending a file, improved handling capacity, reduced time of delay to the user as SSL or TLS.In some sense, prepare and storage file to the form of crypto engine can send greater than the chunk data of 16K.Together with simple modification, only need make a spot of modification to existing SSL processing to handled file.Need not revise SSL or tls protocol.This technology provides a kind of being easy to revise (comprise and change hashed value length) solution flexibly of use by changing information pay(useful) load size and change cryptographic algorithm and hashing algorithm.This technology can be only additional treatments by seldom improve the SSL throughput.
Though the preferred embodiments of the invention are described, for those these those skilled in the art that understand basic conception of the present invention, the change and the correction that can add this scheme.Technology disclosed herein is based on some the predetermined feature to processed security protocol (SSL and TLS).Clearly, those skilled in the art in the technical field under the inventive concept disclosed herein can adapt to the modification of these security protocols, if make amendment, comprise with one and replacing completely with the new agreement with identical semanteme of agreement discussed herein.So,, comprise embodiment preferred and all these variations and correction in aim of the present invention and scope with making up additional rights statement.
Claims (8)
1. method of file being handled for the symmetric cryptography efficient of improving chunk data transmission by a security protocol, the step that comprises has:
Determine one will safe transmission file; With
Came preliminary treatment this document before safe transmission, optimize the ciphering process of the symmetry that is adopted, the step that further comprises has:
Calculating used file data record length during safe transmission, wherein this record length length of equaling to transmit data segment deducts a hash length, and wherein this hash length is the length of transmission hash that data segment adopts;
This document is divided into the data record sequence of an above-mentioned record length, wherein last record is less than or equal to described record length, wherein, when the length of last record during less than described record length, an additional filling block to this last record so that the length of this last record equals described record length;
At each additional white space in record back of above-mentioned sequence, wherein this white space length equals described hash length; With
Each record and the above-mentioned additional white space of above-mentioned sequence are write an output file.
2. method as claimed in claim 1, further be included in first record of above-mentioned output file and hang up the step of a file header in advance, wherein the content of storing in this document head comprises one or more following information: (1) symmetric cryptography is handled used cryptographic algorithm sign; (2) one are used for the hashing algorithm sign that symmetric cryptography is handled operation record before; (3) record length.
3. method as claimed in claim 1, the step that further comprises has:
Receive a request to above-mentioned file;
In response to the above-mentioned step that is used to receive, the location output file;
Obtain a hash key and an encryption key relevant with the request of above-mentioned reception;
Utilize the above-mentioned hash key that obtains, each record in the sequence is used a hashing algorithm;
At each above-mentioned record,, thereby create a hash file with the alternative above-mentioned additional white space of the result of hashing algorithm;
The encryption key that utilization is obtained and a cryptographic algorithm of carrying out the symmetric cryptography processing are encrypted above-mentioned hash file, thereby are created an encrypt file; With
According to the above-mentioned encrypt file of request transmission.
4. method as claimed in claim 3, the step that further comprises has:
Hang up a file header in above-mentioned output file in advance, wherein this document head canned data comprises the sign of a symmetric encipherment algorithm; With
Add the above-mentioned encryption key that obtains to above-mentioned encrypting step used file header.
5. method as claimed in claim 3, the step that further comprises has:
Hang up a file header in above-mentioned output file in advance, wherein the storage of this document head comprises the information of this hashing algorithm sign;
Add the above-mentioned hash secret key of obtaining to above-mentioned use hashing algorithm step used file file header.
6. as the method for claim 4 or 5, wherein this document head further comprises the initialization vector that above-mentioned encrypting step is used.
7. method as claimed in claim 1, wherein said security protocol are security socket layer.
8. method as claimed in claim 1, wherein said security protocol are the affairs processing layer confidentiality agreement.
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| US58996700A | 2000-06-08 | 2000-06-08 | |
| US09/589967 | 2000-06-08 |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN1329417A CN1329417A (en) | 2002-01-02 |
| CN1309207C true CN1309207C (en) | 2007-04-04 |
Family
ID=24360320
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CNB011208945A Expired - Fee Related CN1309207C (en) | 2000-06-08 | 2001-06-07 | Improving safety server performance by utilizing preprocessed data made ready for safety protocol transmission |
Country Status (3)
| Country | Link |
|---|---|
| KR (1) | KR100423191B1 (en) |
| CN (1) | CN1309207C (en) |
| GB (1) | GB2366974B (en) |
Families Citing this family (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR100434379B1 (en) * | 2001-09-21 | 2004-06-04 | 엘지전자 주식회사 | Apparatus and method of IP packet encryption by block cryptographic algorithm |
| US20040158635A1 (en) * | 2003-01-23 | 2004-08-12 | Digi International Inc.. | Secure terminal transmission system and method |
| ATE413762T1 (en) * | 2004-09-17 | 2008-11-15 | Alcatel Lucent | DEVICE FOR EXCHANGING MESSAGES BETWEEN CUSTOMER EQUIPMENT (CPE) AND SERVERS |
| US7512974B2 (en) | 2004-09-30 | 2009-03-31 | International Business Machines Corporation | Computer system and program to update SSL certificates |
| BRPI0517026A (en) | 2004-10-25 | 2008-09-30 | Rick L Orsini | secure data analyzer method and system |
| US9443097B2 (en) | 2010-03-31 | 2016-09-13 | Security First Corp. | Systems and methods for securing data in motion |
| CN102647428A (en) * | 2012-05-02 | 2012-08-22 | 四川建设网有限责任公司 | Encrypting and decrypting system and method adopting trusteeship control based on communication network |
| CA2900504A1 (en) | 2013-02-13 | 2014-08-21 | Security First Corp. | Systems and methods for a cryptographic file system layer |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1150726A (en) * | 1995-09-15 | 1997-05-28 | 汤姆森多媒体公司 | Process for pledging data for secure data exchange protocol |
| US5673316A (en) * | 1996-03-29 | 1997-09-30 | International Business Machines Corporation | Creation and distribution of cryptographic envelope |
| JPH103257A (en) * | 1996-06-18 | 1998-01-06 | Toshiba Corp | Method and device for adding electronic signature, and method for verifying electronic signature |
| US5761311A (en) * | 1995-09-19 | 1998-06-02 | Microsoft Corporation | Blind encryption |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| FI107205B (en) * | 1999-02-16 | 2001-06-15 | Sonera Oyj | A method to secure information |
-
2001
- 2001-05-15 KR KR10-2001-0026321A patent/KR100423191B1/en not_active IP Right Cessation
- 2001-06-06 GB GB0113692A patent/GB2366974B/en not_active Expired - Fee Related
- 2001-06-07 CN CNB011208945A patent/CN1309207C/en not_active Expired - Fee Related
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1150726A (en) * | 1995-09-15 | 1997-05-28 | 汤姆森多媒体公司 | Process for pledging data for secure data exchange protocol |
| US5761311A (en) * | 1995-09-19 | 1998-06-02 | Microsoft Corporation | Blind encryption |
| US5673316A (en) * | 1996-03-29 | 1997-09-30 | International Business Machines Corporation | Creation and distribution of cryptographic envelope |
| JPH103257A (en) * | 1996-06-18 | 1998-01-06 | Toshiba Corp | Method and device for adding electronic signature, and method for verifying electronic signature |
Also Published As
| Publication number | Publication date |
|---|---|
| KR100423191B1 (en) | 2004-03-18 |
| KR20010110991A (en) | 2001-12-15 |
| CN1329417A (en) | 2002-01-02 |
| GB2366974A (en) | 2002-03-20 |
| GB0113692D0 (en) | 2001-07-25 |
| GB2366974B (en) | 2004-01-21 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CA2394451C (en) | System, method and computer product for delivery and receipt of s/mime-encrypted data | |
| US7360079B2 (en) | System and method for processing digital documents utilizing secure communications over a network | |
| US7076651B2 (en) | System and method for highly secure data communications | |
| CN1227858C (en) | System and method for enabling secure acess to service in computer network | |
| EP1854243B1 (en) | Mapping an encrypted https network packet to a specific url name and other data without decryption outside of a secure web server | |
| US7370018B2 (en) | Systems and methods for processing claims in real-time | |
| US8190899B1 (en) | System and method for establishing a remote connection over a network with a personal security device connected to a local client without using a local APDU interface or local cryptography | |
| US7913261B2 (en) | Application-specific information-processing method, system, and apparatus | |
| US20040181668A1 (en) | Methods for conducting server-side encryption/decryption-on-demand | |
| AU2004313091A1 (en) | Secure file transfer for web service | |
| US20060018478A1 (en) | Secure communication protocol | |
| CN1679066A (en) | Network attached encryption | |
| EP1384370B1 (en) | Method and system for authenticating a personal security device vis-a-vis at least one remote computer system | |
| US20040088539A1 (en) | System and method for securing digital messages | |
| CN111756751B (en) | Message transmission method and device and electronic equipment | |
| CN1309207C (en) | Improving safety server performance by utilizing preprocessed data made ready for safety protocol transmission | |
| CN100493072C (en) | A encryption system and method for wireless transmissions from personal palm computers to world wide web terminals | |
| US8520840B2 (en) | System, method and computer product for PKI (public key infrastructure) enabled data transactions in wireless devices connected to the internet | |
| EP1766921B1 (en) | Method and apparatus for remote management | |
| CN111147344B (en) | Virtual private network implementation method, device, equipment and medium | |
| Rao et al. | Development of a Transport Layer using SMS | |
| JP2004186943A (en) | Method, device, system, and program for proxy execution of unauthorized action prevention function and storage medium stored with the program | |
| Park et al. | Design of security functionality in P2P applications | |
| JP2003167814A (en) | Data processing system and method | |
| Wang et al. | Application of IPsec to teleradiology |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C06 | Publication | ||
| PB01 | Publication | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| C19 | Lapse of patent right due to non-payment of the annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |