Authenticating data packet based on hash image of the data packet in erasure coding-based data transmission

Provided is a method of authenticating and verifying data packet transmission, and apparatuses for performing the same. The method and corresponding apparatus are configured to encode data packets through erasure coding. The method and corresponding apparatus are also configured to generate authentication packets for the encoded data packets based on hash images of the encoded data packets.

CROSS-REFERENCE TO RELATED APPLICATION(S)

This application claims the benefit under 35 USC 119(a) of Korean Patent Application No. 10-2013-0147659, filed on Nov. 29, 2013, in the Korean Intellectual Property Office, the entire disclosure of which is incorporated herein by reference for all purposes.

BACKGROUND

The following description relates to a method of authenticating and verifying data packet transmission, and apparatuses for performing the same.

2. Description of Related Art

In a data transmission environment, erasure coding applied to transmit data without loss. The erasure coding may include encoding and decoding.

Encoded data packets may be generated by encoding original data packets. In this case, a number of the encoded data packets may be greater than a number of the original data packets. To restore the original data packets through the decoding, a greater or equal number of packets received from among the encoded data packets than the number of the original data packets may be required. However, when at least one modulated packet is included in the received packets, the original data packets may not be restored through the decoding.

SUMMARY

In accordance with an embodiment, there is provided a method to authenticate data packet transmission, the method includes encoding data packets through erasure coding; and generating authentication packets for the encoded data packets based on hash images of the encoded data packets.

The generating may include generating, based on parameters for transmission of the data packets, the authentication packets until the hash images related to the encoded data packets are incorporated into a single signature packet.

The generating may include generating the hash images of the encoded data packets, verifying whether the hash images are included in a single signature packet, and generating signature packets included in the authentication packets based on a result of the verifying.

In response to the verifying that the hash images of the encoded data packets are included in the single signature packet, the verifying may include encoding the single signature packet through the erasure coding and generating the encoded signature packets to be the signature packets.

In response to the verifying indicating that the hash images are excluded from the single signature packet, the verifying may include generating hash packets including the hash images of the encoded data packets, encoding the hash packets through the erasure coding, generating the encoded hash packets included in the authentication packets, and verifying whether the hash images of the encoded hash packets are included in the single signature packet and generating the signature packets based on a result of the verifying.

The parameters may include at least one of a packet loss rate, a current number of packets, information of a hash function applied to the hash images, and information on a size of a unit signature packet including the hash images.

The hash images related to the encoded data packets may include at least one of hash images of the encoded data packets and hash images of packets of the encoded data packets.

A size of the single signature packet may be identical to a size of a data packet.

In accordance with an embodiment, there is provided a data transmission apparatus, including an encoder configured to encode data packets through erasure coding; and an authentication unit configured to generate an authentication packet for the data packets based on hash images of the encoded data packets.

The authentication unit may include an authentication packet generation unit configured to verify whether the hash images are included in a single signature packet and generate at least one of hash packets included in the hash images and the single signature packet based on a result of the verifying, and a digital signature generation unit configured to generate a digital signature for each of the encoded signature packets based on the single signature packet.

The authentication unit may be configured to generate the authentication packet until the hash images related to the encoded data packets are incorporated into a single signature packet based on parameters to transmit the data packets.

The authentication packet generation unit may be configured to generate the single signature packet in response to the hash images related to the encoded data packets being included in the single signature packet.

The hash images related to the encoded data packets may include at least one of hash images of the encoded data packets and hash images of packets related to the encoded data packets.

The parameters may include at least one of a packet loss rate, a number of current packets, information of a hash function applied to the hash images, and information on a size of a unit signature packet including the hash images.

A size of the single signature packet may be identical to a size of a data packet.

In accordance with an embodiment, there is provided a method to verify data packet transmission, the method includes receiving authentication packets and verifying a signature packet included in the authentication packets; and decoding the verified signature packet and verifying data packets based on hash images included in the decoded signature packet.

The decoding may include verifying hash packets included in the authentication packets using the hash images included in the decoded signature packet, and decoding the verified hash packets and verifying the data packets based on hash images included in the decoded hash packets.

The method may also include requesting an external device to transmit the data packets.

The method may also decode decoding the verified data packets and generate decoded data packets.

The decoded data packets may be identical to the data packets received from external devices.

DETAILED DESCRIPTION

The following detailed description is provided to assist the reader in gaining a comprehensive understanding of the methods, apparatuses, and/or systems described herein. However, various changes, modifications, and equivalents of the systems, apparatuses and/or methods described herein will be apparent to one of ordinary skill in the art. Also, descriptions of functions and constructions that are well known to one of ordinary skill in the art may be omitted for increased clarity and conciseness.

FIG. 1is a block diagram illustrating an example of a data transmission system100.

Referring toFIG. 1, the data transmission system100includes a data transmission apparatus200and a data reception apparatus300.

The data transmission apparatus200and the data reception apparatus300may be implemented using a personal computer (PC), a data server, or a portable electronic device.

The portable electronic device may include, but is not limited to, a laptop computer, a mobile phone, a smartphone, a tablet PC, a mobile internet device (MID), a personal digital assistant (PDA), an enterprise digital assistant (EDA), a digital still camera, a digital video camera, a portable multimedia player (PMP), a personal navigation device or a portable navigation device (PND), a handheld game console, or an electronic book (e-book).

The data transmission apparatus200and the data reception apparatus300communicate with one another. For example, the data transmission apparatus200and the data reception apparatus300mutually transmit and receive a signal or data.

The data transmission apparatus200encodes data packets through, for example, erasure coding and generate encoded data packets.

The data transmission apparatus200generates authentication packets for data packets using hash images related to the encoded data packets. For example, the data transmission apparatus200generates the authentication packets until the hash images related to the encoded data packets are incorporated into a single signature packet. In accordance with an alternative example, the data transmission apparatus200generates the authentication packets until the hash images related to the encoded data packets are incorporated into at least one signature packet. For example, the authentication packets are encoded packets.

The data transmission apparatus200transmits generated packets to the data reception apparatus300. For example, the data transmission apparatus200transmits the encoded data packets and the authentication packets to the data reception apparatus300.

The data reception apparatus300receives packets transmitted from the data transmission apparatus200. For example, the data reception apparatus300receives the encoded data packets and the authentication packets transmitted from the data transmission apparatus200.

The data reception apparatus300receives the authentication packets transmitted from an external device, for example, the data transmission apparatus200, and verifies a digital signature of a single signature packet or, in the alternative, at least one signature packet included in the authentication packets.

The data reception apparatus300decodes the single signature packet or, in the alternative, the at least one verified signature packet, and verifies the data packets transmitted from the data transmission apparatus200based on hash images included in the at least one decoded signature packet. For example, data packets transmitted from the data transmission apparatus200are encoded data packets.

In an example, the data reception apparatus300requests the data transmission apparatus200to transmit the data packets. For example, the data reception apparatus300verifies a digital signature of at least one signature packet included in authentication packets, and then requests the data transmission apparatus200to transmit the data packets.

FIG. 2is a block diagram illustrating an example of the data transmission apparatus200ofFIG. 1.

Referring toFIGS. 1 and 2, the data transmission apparatus200includes an erasure encoder210, an authentication unit230, and a transceiver250.

The erasure encoder210encodes data packets DATA_P through erasure coding, and generates encoded data packets E_DATA. The erasure encoder210transmits the encoded data packets E_DATA to the authentication unit230.

The erasure encoder210encodes authentication packets generated at the authentication unit230through the erasure coding. For example, the erasure encoder210encodes a signature packet AU_P generated by the authentication unit230and generates encoded signature packets E_AU. The erasure encoder210encodes hash packets HA_P generated at the authentication unit230, and generates encoded hash packets E_HA. For example, the authentication packets include at least one of the hash packets HA_P and the signature packet AU_P.

In this example, the erasure encoder210generates encoded packets by encoding current packets through the erasure coding based on first parameters. For example, the erasure encoder210generates N encoded packets using Equation 1 based on the first parameters.
N=ceiling(M/(1−P))  [Equation 1]

For example, the first parameters include at least one of a number M of current packets and a packet loss rate P. The packet loss rate P is a packet loss rate to provide a resistance through the erasure coding performed by the erasure encoder210. For example, the packet loss rate P indicates that, although a maximum of P*100% packets encoded by the erasure encoder210may be lost during transmission, decoding is possible by using the remaining packets. The packet loss rate P may be programmed and/or set.

The erasure encoder210transmits at least one encoded packet, for example, the encoded data packets E_DATA and the encoded hash packets E_HA to the transceiver250. The erasure encoder210transmits the encoded signature packets E_AU to a digital signature authentication unit237.

The authentication unit230generates at least one authentication packet for the data packets DATA_P using hash images related to the encoded data packets E_DATA. For example, the authentication unit230generates the at least one authentication packet until the hash images related to the encoded data packets E_DATA are incorporated into a single signature packet AU_P based on second parameters for a transmission of the data packets DATA_P. For example, the second parameters include at least one of a packet loss rate P, a number of current packets, such as current encoded packets, information on a hash function applied to the hash images, and a size of a unit signature packet, such as the signature packet AU_P including the hash images.

The authentication unit230includes an authentication packet generation unit233and a digital signature generation unit237.

The authentication packet generation unit233computes hash images related to the encoded data packets E_DATA based on the hash function. In an example, the authentication packet generation unit233computes hash images of the encoded data packets E_DATA. In another example, the authentication packet generation unit233computes hash images of the encoded hash packets E_HA. For example, the hash images include at least one of the hash images of the encoded data packets E_DATA and hash images of packets, for example, the encoded hash packets E_HA related to the encoded data packets E_DATA.

The authentication packet generation unit233verifies whether the hash images related to the encoded data packets E_DATA are included in the single signature packet AU_P, and generates at least one of the signature packet AU_P and the hash packets including the hash images based on a result of the verifying.

For instance, the authentication packet generation unit233verifies whether the hash images of the encoded data packets E_DATA are included in the single signature packet AU_P, and generates at least one of the single signature packet AU_P and the hash packets HA_P including the hash images based on a result of the verifying. In an example, when the result of the verifying indicates that the hash images are included in the single signature packet AU_P, the authentication packet generation unit233generates the signature packet AU_P including the hash images. In another example, when the result of the verifying indicates that the hash images are not included in the single signature packet AU_P, the authentication packet generation unit233generates the hash packets HA_P including the hash images. Also, the authentication packet generation unit233verifies whether the hash images of the encoded hash packets E_HA are included in the single signature packet AU_P, and generates at least one of the single signature packet AU_P and the hash packets HA_P including the hash images of the encoded hash packets E_HA based on a result of the verifying.

In this example, the authentication packet generation unit233verifies whether the hash images related to the encoded data packets E_DATA are included in the single signature packet AU_P using Equation 2, based on the second parameters.
|AU_P|≧N|hash|  [Equation 2]

As an example, when a size, for example, N|hash| of the hash images related to the encoded data packets E_DATA is less than or equal to a size, for example, |AU_P| of the single signature packet AU_P, the authentication packet generation unit233generates the single signature packet AU_P including the hash images related to the encoded data packets E_DATA.

In Equation 2, |AU_P| indicates a size of a unit signature packet, for example, the signature packet AU_P. N denotes a number of current encoded packets. For example, N, the number of current encoded packets may be equal to a number of current hash images generated at the authentication packet generation unit233. |hash| indicates a size of a hash image. For example, when the authentication packet generation unit233computes hash images using an identical hash function, a size, for example, |hash| of each of the hash images generated by the authentication packet generation unit233is identical.

When a size, for example N|h( )| of the hash images related to the encoded data packets E_DATA is greater than a size, for example, |AU_P| of the single signature packet AU_P, the authentication packet generation unit233generates K hash packets HA_P including the hash images related to the encoded data packets E_DATA using Equation 3 based on the second parameters.
K=ceiling(N|h( )|/|AU_P|)  [Equation 3]

In an example, a size, for example, |AU_P| of the signature packet AU_P is equal to a size of a hash packet, for example, a size of a data packet.

For example, the authentication packet generation unit233generates authentication packets. The authentication packets include, for example, the signature packet AU_P and/or the hash packets HA_P. The authentication packet generation unit233generates the authentication packets until the hash images related to the encoded data packets E_DATA are included in the single signature packet AU_P, based on the second parameters for transmission of the data packets DATA_P.

The digital signature generation unit237receives the encoded signature packets E_AU from the erasure encoder210, and generates a digital signature for each of the encoded signature packets E_AU. The digital signature generation unit237transmits the encoded signature packets E_AU including the digital signature to the transceiver250.

The transceiver250transmits generated packets to the data reception apparatus300. For example, the transceiver250transmits, to the data reception apparatus300, at least one of the encoded signature packets E_AU including the digital signature, the encoded hash packets E_HA, and the encoded data packets E_DATA.

The data transmission apparatus200generates separate packets, for example, the hash packets HA_P including the hash images of the encoded data packets E_DATA, to verify integrity of the encoded data packets E_DATA.

In addition, the data transmission apparatus200encodes the hash packets HA_P through the erasure coding, and generates the encoded hash packets E_HA having a resistance to a loss occurring in a process of data transmission.

Also, the data transmission apparatus200generates the digital signature for the encoded signature packets E_AU. In an illustrative configuration, the data transmission apparatus200generates the digital signature exclusively for the encoded signature packets E_AU.

FIG. 3is a diagram illustrating an example of authenticating data packet transmission of the data transmission apparatus200ofFIG. 1.

InFIG. 3, for clarity and conciseness, as an illustrative example, a number of data packets DATA_P to be transmitted is “5”, a data loss rate P is “0.2”, and |AU_P|=5|hash| to describe an authenticating data packet transmission performed at the data transmission apparatus200.

Referring toFIG. 3, the erasure encoder210encodes five data packets DATA_P1 to DATA_P5, and generates seven encoded data packets E_DATA1 to E_DATA7. The erasure encoder210transmits the encoded data packets E_DATA1 to E_DATA7 to the authentication packet generation unit233.

The authentication packet generation unit233may generate hash images of the encoded data packets E_DATA1 to E_DATA7 using a hash function. For example a number of the hash images of the encoded data packets E_DATA1 to E_DATA7 may be “7”. Because the seven hash images are not included in a single signature packet AU_P, the authentication packet generation unit233generates hash packets HA_P1 and HA_P2 including the seven hash images. For example, the authentication packet generation unit233generates two hash packets HA_P1 and HA_P2 by separating the seven hash images, and transmits the hash packets HA_P1 and HA_P2 to the erasure encoder210.

The erasure encoder210encodes the two hash packets HA_P1 and HA_P2 through erasure coding, and generates three encoded hash packets E_HA1 to E_HA3. The erasure encoder210transmits the encoded hash packets E_HA1 to E_HA3 to the authentication packet generation unit233. By encoding the hash packets HA_P1 and HA_P2 including the hash images through the erasure coding, the hash packets HA_P1 and HA_P2 have lower losses.

The authentication packet generation unit233generates hash images of the encoded hash packets E_HA1 to E_HA3 based on a hash function. For example, a number of the hash images of the encoded data packets E_DATA is “3”. The authentication packet generation unit233generates the single signature packet AU_P including the three hash images because the three hash images are included in the single signature packet AU_P. For example, the authentication packet generation unit233transmits the single signature packet AU_P including the three hash images to the erasure encoder210.

The erasure encoder210encodes the single signature packet AU_P through erasure coding, and generate two encoded signature packets E_AU1 and E_AU2. The erasure encoder210transmits the encoded signature packets E_AU1 and E_AU2 to the digital signature generation unit237.

The digital signature generation unit237generates a digital signature SIG for each of the encoded signature packets E_AU1 and E_AU2. In this example, among data storing areas of the encoded signature packets E_AU1 and E_AU2, the digital signature SIG may be included in an area in which two hash images are present. All generated packets are reliably provided because the digital signature generation unit237generates the digital signature SIG only for the encoded signature packets E_AU1 and E_AU2 at a highest level.

FIG. 4is a diagram illustrating an example of the data reception apparatus300ofFIG. 1.

Referring toFIGS. 1 and 4, the data reception apparatus300includes a transceiver310, a verification unit330, and an erasure decoder350.

The transceiver310receives authentication packets and data packets transmitted from the data transmission apparatus200. For example, the transceiver310receives encoded authentication packets and encoded data packets E_DATA transmitted from the data transmission apparatus200. For example, the authentication packets include at least one of encoded signature packets E_AU and encoded hash packets E_HA. For example, each of the encoded signature packets E_AU includes a digital signature.

The transceiver310transmits the encoded signature packets E_AU to a digital signature verification unit333, and transmits the encoded hash packets E_HA and the encoded data packets E_DATA to a packet verification unit337.

The verification unit330verifies the packets transmitted from the transceiver310. For example, the verification unit330verifies at least one of the encoded data packets E_DATA, the encoded hash packets E_HA, and the encoded signature packets E_AU.

The verification unit330includes the digital signature verification unit333and the packet verification unit337.

The digital signature verification unit333verifies the digital signature of at least one encoded signature packet among the encoded signature packets E_AU, and transmits at least one verified signature packet V_AU to the erasure decoder350. By verifying the digital signature of the at least one encoded signature packet, the digital signature verification unit333reduces overhead occurring in an overall process of verifying the digital signature.

The packet verification unit337verifies the encoded data packets E_DATA based on hash images included in at least one decoded signature packet D_AU. For example, the packet verification unit337verifies the encoded hash packets E_HA based on hash images included in the at least one decoded signature packet D_AU. The packet verification unit337verifies the encoded data packets E_DATA based on hash images included in decoded hash packets D_HA decoded by the erasure decoder350.

The packet verification unit337transmits verified hash packets V_HA and verified data packets V_DATA to the erasure decoder350.

The erasure decoder350decodes packets verified by the verification unit330. For example, the erasure decoder350decodes the at least one verified signature packet V_AU verified at the digital signature verification unit333, and generates the decoded hash packets D_HA. Also, the erasure decoder350decodes verified data packets V_DATA verified by the packet verification unit337and generates decoded data packets D_DATA. In one example, the decoded data packets D_DATA is identical to the data packets DATA_P transmitted from the data transmission apparatus200.

By verifying the digital signature of the at least one encoded signature packet E_AU only, the data reception apparatus300reduces overhead occurring in an overall process of verifying the digital signature.

FIG. 5is a diagram illustrating an example of verifying data packet transmission of the data reception apparatus300ofFIG. 1.

For increased clarity and conciseness, descriptions about an operation in which the data reception apparatus300verifies packets generated based on the aforementioned method ofFIG. 3will be provided with reference toFIG. 5.

Referring toFIG. 5, the digital signature verification unit333verifies at least one encoded signature packet E_AU1 based on a digital signature SIG included in the at least one encoded signature packet E_AU1. In this example, the erasure decoder350generates a single decoded signature packet D_AU based on a single encoded signature packet E_AU1 verified based on encoded signature packets E_AU1 and E_AU2. For example, the decoded signature packet D_AU includes three hash images. By verifying the digital signature SIG of the at least one encoded signature packet E_AU1, the digital signature verification unit333reduces an amount of overhead verification.

The packet verification unit337verifies three encoded hash packets E_HA1 to E_HA3 based on the three hash images included in the decoded signature packet D_AU. In this example, the erasure decoder350generates two decoded hash packets D_HA1 and D_HA2 based on two encoded hash packets verified from among the encoded hash packets E_HA1 to E_HA3. In one example, the decoded hash packets D_HA1 and D_HA2 includes seven hash images.

The packet verification unit337verifies seven encoded data packets E_DATA1 to E_DATA7 based on the seven hash images included in the decoded hash packets D_HA1 and D_HA2. In this example, the erasure decoder350generates decoded data packets D_DATA1 to D_DATA5 based on five data packets E_DATA1 to E_DATA5 verified from among the encoded data packets E_DATA1 to E_DATA7.

FIG. 6is a flowchart illustrating an example of an operating method of the data transmission apparatus200ofFIG. 1.

Referring toFIG. 6, at operation410, the operating method encodes, at the data transmission apparatus200, data packets through erasure coding, and generates encoded data packets.

At operation430, the operating method, at the data transmission apparatus200, generates authentication packets for data packets based on hash images related to the encoded data packets.

FIG. 7is a flowchart illustrating an example of an operating method of the data reception apparatus300ofFIG. 1.

Referring toFIG. 7, at operation510, the operating method, at the data reception apparatus300, receives authentication packets transmitted from an external device, for example, the data transmission apparatus200, and verifies a digital signature of at least one signature packet included in the authentication packets.

At operation530, the operating method, at the data reception apparatus300, decodes the at least one verified signature packet, and verifies data packets, for example, the encoded data packets transmitted from the data transmission apparatus200based on hash images included in the at least one decoded signature packet.

FIG. 8is a block diagram illustrating another example of a data transmission system600.

Referring toFIG. 8, the data transmission system600includes a data transmission apparatus700and a plurality of data reception apparatuses, for example, a data reception apparatus800-1to a data reception apparatus800-n, n being a natural number greater than “1”.

The data transmission apparatus700and the plurality of data reception apparatuses may be implemented by a PC, a data server, or a portable electronic device.

The portable electronic device may be implemented through a laptop computer, a mobile phone, a smartphone, a tablet PC, an MID, a PDA, an EDA, a digital still camera, a digital video camera, a PMP, a PND, a handheld game console, or an e-book.

The data transmission apparatus700and each of the plurality of data reception apparatuses may communicate with one another. For example, the data transmission apparatus700and each of the plurality of data reception apparatuses may mutually transmit and receive a signal or data in a broadcast or multicast environment. Also, the data transmission apparatus700and the plurality of data reception apparatuses may transmit and receive a signal or data in a data environment for small wireless devices, for example, a Zigbee with low power consumption.

In practice, operations and configurations of the data transmission apparatus700and the plurality of data reception apparatuses ofFIG. 8may be identical to operations and configurations of the data transmission apparatus200and the data reception apparatus300and; thus; repeated descriptions will be omitted for conciseness and ease of description.

The units and apparatuses described herein may be implemented using hardware components. The hardware components may include, for example, controllers, sensors, processors, generators, drivers, and other equivalent electronic components. The hardware components may be implemented using one or more general-purpose or special purpose computers, such as, for example, a processor, a controller and an arithmetic logic unit, a digital signal processor, a microcomputer, a field programmable array, a programmable logic unit, a microprocessor or any other device capable of responding to and executing instructions in a defined manner. The hardware components may run an operating system (OS) and one or more software applications that run on the OS. The hardware components also may access, store, manipulate, process, and create data in response to execution of the software. For purpose of simplicity, the description of a processing device is used as singular; however, one skilled in the art will appreciated that a processing device may include multiple processing elements and multiple types of processing elements. For example, a hardware component may include multiple processors or a processor and a controller. In addition, different processing configurations are possible, such a parallel processors.

It is to be understood that in the embodiment of the present invention, the operations inFIGS. 6 and 7are performed in the sequence and manner as shown although the order of some operations and the like may be changed without departing from the spirit and scope of the described configurations. In accordance with an illustrative example, a computer program embodied on a non-transitory computer-readable medium may also be provided, encoding instructions to perform at least the methods described inFIGS. 6 and 7.

Program instructions to perform a method described inFIGS. 6 and 7, or one or more operations thereof, may be recorded, stored, or fixed in one or more computer-readable storage media. The program instructions may be implemented by a computer. For example, the computer may cause a processor to execute the program instructions. The media may include, alone or in combination with the program instructions, data files, data structures, and the like. Examples of computer-readable media include magnetic media, such as hard disks, floppy disks, and magnetic tape; optical media such as CD ROM disks and DVDs; magneto-optical media, such as optical disks; and hardware devices that are specially configured to store and perform program instructions, such as read-only memory (ROM), random access memory (RAM), flash memory, and the like. Examples of program instructions include machine code, such as produced by a compiler, and files containing higher level code that may be executed by the computer using an interpreter. The program instructions, that is, software, may be distributed over network coupled computer systems so that the software is stored and executed in a distributed fashion. For example, the software and data may be stored by one or more computer readable recording mediums. Also, functional programs, codes, and code segments for accomplishing the example embodiments disclosed herein may be easily construed by programmers skilled in the art to which the embodiments pertain based on and using the flow diagrams and block diagrams of the figures and their corresponding descriptions as provided herein.