METHOD AND SYSTEM FOR AUTHENTICATING A DATA STREAM

• US 20160204942A1
• Filed: 08/23/2013
• Published: 07/14/2016
• Est. Priority Date: 08/23/2013
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Europe Ltd (NEC Corporation)
• Inventors: Bohli, Jens-Matthias, Li, Wenting
• Granted Patent: US 10,263,783 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

A method for authenticating a data stream includes selecting a number of data fragments of the data stream, defining at least two granularity levels for the selected data fragments, dividing each of the selected data fragments according to the granularity levels, generating a hierarchical authentication structure including elements representing hash values of the divided selected data fragments on the different granularity levels, selecting at least a portion of the hash values of the hierarchical authentication structure for transmission to a receiver, reconstructing the granularity value on the top level of the hierarchical authentication structure based on the transmitted hash values, and performing authentication of the data fragments of the data stream based on comparing the reconstructed value on the top granularity level of the hierarchical authentication structure with the signed value on the top granularity level of the generated hierarchical authentication structure,

Claims

1. A method for authenticating a data stream. the method comprising:

a) selectins a number of data fragments of the data stream;

b) defining at least two granularity levels for the selected data fragments;

c) dividing each of the selected data fragments according to the granularity levels;

d) generating a hierarchical authentication structure, including elements, representing hash values of the divided selected data fragments on the different granularity levels, wherein a hash value, for a data fragment on a higher granularity level is based on hash values of data fragments on a lower granularity level,

e) selecting at least a portion of the hash values of the hierarchical authentication structure for transmission to a receiver,

f) reconstructing the granularity value on the top level of the hierarchical authentication structure, based on the transmitted hash values and that

g) performing authentication of the data fragments of the data stream based on comparing the reconstructed value on the top granularity level of the hierarchical authentication structure, with the signed value on the top granularity level of the generated hierarchical authentication structure.

2. The method according to claim 1, wherein in step e), hash values on one selected granularity level are selected for transmission.

3. The method according to claim 1, wherein the granularity levels are at least partially defined based on the semantic representation of the data stream.

4. The method according to claim 1, wherein the granularity level for the hash values to be transmitted is adapted during transmission of the data stream according to transmission properties between sender and receiver of the data stream.

5. The method according to claim 4, wherein packet loss and/or bandwidth between sender and receiver is determined for providing the transmission properties.

6. The method according to claim 1, wherein an erasure code is used for transmitting partitions of the hash values according to step e).

7. The method according to claim 6, wherein a linear error correcting code, and/or a cyclic error correcting code is used as an era sure code.

8. The method according to claim 1, wherein the data stream is analyzed, and based on the result an erasure code and/or the granularity levels are determined.

9. The method according to claim 1, wherein sender identity information is generated and used for authentication of the data stream.

10. The method according to claim 1, wherein the hash values and/or sender identity information and/or signature information are transmitted via a secure channel.

11. A system for authenticating a data stream, the system comprising:

a sending entity; and

a receiving entity connected to the sending entity;

wherein the sending entity is operable to generate a hierarchical authentication structure, including elements representing hash values of divided fragments on different granularity levels, wherein a hash value for a data fragment on a higher granularity level is based on hash values of data fragments on a lower granularity level, and

wherein the receiving entity is operable to authenticate data fragments of the data stream based on comparing a reconstructed value on a top granularity level of the hierarchical authentication structure with a signed value on a top level of the generated hierarchical authentication structure.