Data encryption method, device, electronic device and storage medium

Abstract

The present application provides a data encryption method, device, electronic device and storage medium, which determines the encryption mode of the data to be encrypted according to the number of bytes of the received data to be encrypted or the encryption priority; if the encryption mode is determined to be the first encryption mode, first ciphertext data is generated and output according to the acquired data to be encrypted and key data; if the encryption mode is determined to be the second encryption mode, second ciphertext data is generated according to the acquired operator data and key data, and third ciphertext data is generated and output according to the second ciphertext data and the data to be encrypted, so as to improve the efficiency and compatibility of data encryption.

Description

Technical Field

[0001] The present application relates to the field of data encryption technology, and in particular to a data encryption method, device, electronic device and storage medium. Background Art

[0002] In the prior art, when implementing the AES encryption algorithm based on FPGA, if the AES256-ECB encryption method is used, the implementation difficulty is low and the stability is good, but the encryption efficiency is low; if the AES256-CTR encryption method is used, the CTR operator can be reused and the encryption efficiency is high, but the security is poor and the timing requirements for the key, CTR operator and plaintext data stream are high. Especially in the process of high-speed data communication, if the CTR operator has not been encrypted when the plaintext data stream arrives, the plaintext data stream needs to be blocked to wait for the CTR operator to complete the encryption. The blocking of data encryption will cause a large amount of data caching requirements, so the efficiency of existing data encryption is low and the compatibility is not high. Summary of the invention

[0003] In view of this, the purpose of the present application is to provide a data encryption method, device, electronic device and storage medium to improve the efficiency and compatibility of data encryption.

[0004] In a first aspect, the present application provides a data encryption method, the method comprising: determining the encryption mode of the data to be encrypted based on the number of bytes or encryption priority of the received data to be encrypted; if the encryption mode is determined to be the AES256-ECB encryption mode, generating and outputting first ciphertext data based on the acquired data to be encrypted and key data; if the encryption mode is determined to be the AES256-CTR encryption mode, generating second ciphertext data based on the acquired operator data and key data, and generating and outputting third ciphertext data based on the second ciphertext data and the data to be encrypted.

[0005] Preferably, the step of determining the encryption mode of the data to be encrypted based on the number of bytes of the received data to be encrypted specifically includes: determining the size of the number of valid bytes of the data to be encrypted and the preset number of bytes; if the number of valid bytes of the data to be encrypted is less than the preset number of bytes, generating a first mode selection signal to indicate that the encryption mode is the AES256-CTR encryption mode; if the number of valid bytes of the data to be encrypted is greater than the preset number of bytes, generating a second mode selection signal to indicate that the encryption mode is the AES256-ECB encryption mode.

[0006] Preferably, the step of determining the encryption mode of the data to be encrypted based on the received encryption priority of the data to be encrypted specifically includes: determining the size of the encryption priority of the data to be encrypted and the preset encryption priority; if the encryption priority of the data to be encrypted is less than the preset encryption priority, generating a second mode selection signal to indicate that the encryption mode is the AES256-ECB encryption mode; if the encryption priority of the data to be encrypted is greater than the preset encryption priority, generating a first mode selection signal to indicate that the encryption mode is the AES256-CTR encryption mode.

[0007] Preferably, the first ciphertext data or the second ciphertext data is generated in the following manner: determine the initial value and initial input data corresponding to N, wherein the initial value of N is 0, and when N is 0, the input data corresponding to N is the data to be encrypted or the operator data; generate the first key matrix corresponding to N according to the key data, and calculate the output data according to the first key matrix corresponding to N and the initial input data, N=N+1, and use the output data as the initial input data corresponding to the current N; determine whether the current N reaches a preset value; if not, jump to generate the first key matrix corresponding to N according to the key data and continue execution; if so, use the current output data as the first ciphertext data or the second ciphertext data.

[0008] Preferably, the third ciphertext data is generated in the following manner: based on the second ciphertext data, determining the second ciphertext matrix corresponding to each byte to be encrypted; for each byte of the data to be encrypted, encrypting the byte according to the second ciphertext matrix corresponding to the byte to generate fourth ciphertext data corresponding to the byte; and using the fourth ciphertext data corresponding to all bytes of the data to be encrypted as the third ciphertext data.

[0009] Preferably, each byte of the data to be encrypted includes multiple bits of first target data, and the second ciphertext data includes multiple bits of second target data. For each byte of the data to be encrypted, the fourth ciphertext data corresponding to the byte is generated in the following manner: for each bit of the first target data in the byte, the first target data is XORed with the second target data at the same bit in the second ciphertext data to generate the fourth ciphertext data corresponding to the byte.

[0010] Preferably, the third ciphertext data is outputted in the following manner: valid bytes of the data to be encrypted are determined, and data at positions corresponding to the valid bytes of the data to be encrypted in the third ciphertext data are outputted as the third ciphertext data.

[0011] In a second aspect, the present application provides a data encryption device, the device comprising:

[0012] A processing module, used for determining an encryption mode of the data to be encrypted according to the number of bytes or encryption priority of the received data to be encrypted;

[0013] A first encryption module, configured to generate and output first ciphertext data according to the acquired data to be encrypted and key data if the encryption mode is determined to be the AES256-ECB encryption mode;

[0014] The second encryption module is used to generate second ciphertext data according to the acquired operator data and key data if the encryption mode is determined to be the AES256-CTR encryption mode, and to generate and output third ciphertext data according to the second ciphertext data and the data to be encrypted.

[0015] In a third aspect, the present application also provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of the data encryption method as described above are performed.

[0016] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the data encryption method as described above are executed.

[0017] The data encryption method, device, electronic device and storage medium provided by the present application determine the encryption mode of the data to be encrypted according to the number of bytes or encryption priority corresponding to the received data to be encrypted. If the encryption mode is determined to be the AES256-ECB encryption mode, the first ciphertext data is generated and output according to the acquired data to be encrypted and key data. If the encryption mode is determined to be the AES256-CTR encryption mode, the second ciphertext data is generated according to the acquired operator data and key data, and the third ciphertext data is generated and output according to the second ciphertext data and the data to be encrypted. Compared with the method of using a single encryption form in the prior art, the present application can use a more suitable encryption method for encryption according to the attributes of different data to be encrypted, with better compatibility, shortened encryption time, and higher efficiency of data encryption.

[0018] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 A flowchart of an AES 256 encryption algorithm provided in an embodiment of the present application;

[0021] Figure 2 A schematic diagram of an AES 256-ECB encryption mode algorithm provided in an embodiment of the present application;

[0022] Figure 3 A schematic diagram of an AES 256-CTR encryption mode algorithm provided in an embodiment of the present application;

[0023] Figure 4 A flowchart of a data encryption method provided in an embodiment of the present application;

[0024] Figure 5 A flowchart of the steps for determining an encryption mode provided in an embodiment of the present application;

[0025] Figure 6 Another flowchart of steps for determining an encryption mode provided in an embodiment of the present application;

[0026] Figure 7 A block diagram of a dual-mode encryption algorithm module provided in an embodiment of the present application;

[0027] Figure 8 A schematic diagram of the structure of a data encryption device provided in an embodiment of the present application;

[0028] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, each other embodiment obtained by those skilled in the art without making creative work belongs to the scope of protection of the present application.

[0030] First, the application scenarios to which the present application is applicable are introduced. The present application can be applied to data encryption in FPGA chips.

[0031] Advanced Encryption Standard (AES) is a symmetric encryption algorithm, that is, the encryption key is the same as the decryption key. According to the encryption key length, it can be divided into three types: AES 128, AES 192, and AES 256. Among them, the data length of the plaintext and ciphertext of the AES 256 encryption type is 16 bytes, the key length of the AES 256 encryption method is 32 bytes (256 bits), the encryption cycle is 14 times, and the reliability of the ciphertext is the highest.

[0032] The main process of AES 256 encryption algorithm is as follows Figure 1 The main process includes key expansion, round key addition, S-box transformation, row shift transformation, column confusion transformation, etc. Among them, the round key addition step is used to expand the key K into 60 groups of round key matrices through a preset algorithm. , each four groups are used as a first key matrix, which is used in the round key addition process of the plaintext in one cycle. The plaintext P is the data to be encrypted, and the ciphertext C is the first encrypted data or the second encrypted data.

[0033] like Figure 2 As shown in FIG, it is a schematic diagram of the algorithm of AES 256-ECB encryption mode. Figure 3 As shown in the figure, it is a schematic diagram of the algorithm of AES 256-CTR encryption mode. Among them, AES 256-CTR is an application mode of AES 256 encryption. The prerequisite is that there is an AES-256 encryption algorithm process and a variable operator CTR. The operation process of the AES 256-CTR algorithm module is as follows: Figure 3 As shown in the figure, the operator CTR is encrypted by the AES-256 algorithm, and then the plaintext P is directly XORed with the encrypted CTR value to obtain the ciphertext C. Therefore, the encryption object of AES 256-CTR is the CTR operator, and the CTR operator is encrypted and XORed with the plaintext to obtain the ciphertext.

[0034] AES 256-ECB mode is the basic process of AES 256 encryption. Its advantages are: (1) The basic algorithm process of AES 256 must be implemented in any mode, so the ECB mode is the easiest of all AES 256 encryption modes; (2) When decrypting AES 256-ECB encrypted data, in addition to the ciphertext, only the key is required. There are no other variables that may cause decryption failure, and the stability is good. However, the disadvantage of AES 256-ECB mode is that the plaintext to be encrypted each time must be 16 bits. If the valid data of the plaintext is less than 16 bits, the plaintext data must be completed before encryption. This not only increases the workload, but also affects the encryption speed.

[0035] The significance of the CTR mode design lies in: (1) When the CTR operator remains unchanged for a period of time, the value of the encrypted CTR remains unchanged. There is no need to run the AES-256 encryption process again. Instead, the plaintext data that arrives each time can be bitwise XORed with the encrypted CTR, which greatly improves the encryption efficiency. (2) When the CTR operator and key are known on the ground, the value of the encrypted CTR can be calculated in advance. When the data is received on the ground, a bitwise XOR calculation can be performed to complete the decryption operation.

[0036] However, the disadvantages of the CTR mode are also obvious: (1) If the CTR operator changes many times, it is still necessary to run the AES 256 algorithm multiple times, and the encryption algorithm must be completed before the plaintext data is ready, which has certain requirements for the coordination of the key, CTR operator and plaintext data stream; (2) If the CTR operator changes less often, the XOR encrypted CTR value of the plaintext remains unchanged for a period of time. If there is a certain pattern in the ciphertext, part of the data may be reverse cracked; (3) When using the CTR algorithm, in addition to knowing the value of the key, the CTR key value corresponding to each piece of data must also be known, which puts forward certain requirements for the source of the CTR operator and data transmission. However, in the AES 256-CTR mode, even if the valid data of the plaintext is less than 16 bits, the decryption party can successfully decrypt the plaintext, and the encryption process only takes the time of a synchronized clock.

[0037] Therefore, for data to be encrypted with different attributes, it is necessary to select a suitable encryption mode to improve encryption efficiency, especially in high-speed data communications.

[0038] Based on this, the embodiments of the present application provide a data encryption method, device, electronic device and storage medium.

[0039] See also Figure 4 , Figure 4 The following is a flow chart of a data encryption method provided by an embodiment of the present application. Figure 4 As shown in , the data encryption method provided by the embodiment of the present application includes:

[0040] S101. Determine an encryption mode of the data to be encrypted according to the number of bytes or encryption priority of the received data to be encrypted.

[0041] In one embodiment, Figure 5 The figure is a flowchart of a step of determining an encryption mode provided by an embodiment of the present application. The steps of determining the encryption mode of the data to be encrypted can be performed according to the number of bytes of the received data to be encrypted, and specifically include:

[0042] S1010: Determine the size of the valid byte number of the data to be encrypted and the preset byte number.

[0043] S1030. If the number of valid bytes of the data to be encrypted is less than the preset number of bytes, a first mode selection signal is generated to indicate that the encryption mode is the AES256-CTR encryption mode.

[0044] S1050. If the number of valid bytes of the data to be encrypted is greater than the preset number of bytes, a second mode selection signal is generated to indicate that the encryption mode is the AES256-ECB encryption mode.

[0045] In this embodiment, the encryption mode can be determined according to the number of valid bytes of the received data to be encrypted. The preset number of bytes here can be 15 bytes. At this time, when the valid identifier of the received data to be encrypted (plain text) indicates that the number of valid bytes of the data to be encrypted is 16 bytes, the AES256-ECB encryption mode can be selected. At this time, it takes 15 time intervals to output the encryption result, and the encryption result is not easy to be cracked by a third party. The decryption party only needs to obtain the corresponding key data to decrypt the information of the data to be encrypted.

[0046] If the number of valid bytes of the received data to be encrypted is only 8 bits due to data loss or other reasons, it can be encrypted using the AES256-CTR encryption mode. Since the CTR operator has already encrypted the data before it arrives, it can be used directly. This only requires a time interval of a synchronized clock to output the encryption result.

[0047] In one embodiment, Figure 6 As shown, it is another flow chart of the steps of determining the encryption mode provided by the embodiment of the present application. The steps of determining the encryption mode of the data to be encrypted can be performed according to the encryption priority of the received data to be encrypted, specifically including:

[0048] S1020. Determine the size of the encryption priority of the data to be encrypted and the preset encryption priority.

[0049] S1040. If the encryption priority of the data to be encrypted is less than the preset encryption priority, a second mode selection signal is generated to indicate that the encryption mode is the AES256-ECB encryption mode.

[0050] S1060. If the encryption priority of the data to be encrypted is greater than the preset encryption priority, a first mode selection signal is generated to indicate that the encryption mode is the AES256-CTR encryption mode.

[0051] In this embodiment, an encryption priority can be set for each data to be encrypted according to factors such as the importance of the data to be encrypted, and a corresponding encryption priority mark can be generated and marked on the data to be encrypted. For example, if the data to be encrypted is important data and has a high requirement for encryption reliability, the encryption priority of the data to be encrypted can be the first priority. At this time, the preset encryption priority can be the second priority. If the encryption priority of the data to be encrypted is less than the preset encryption priority, the AES256-ECB encryption mode is used for encryption, thereby ensuring the reliability of the encryption of the data to be encrypted.

[0052] Specifically, the encryption mode of the data to be encrypted can be determined in combination with the number of bytes of the plasticizer to be encrypted and the encryption priority, so as to select a suitable encryption mode for the data to be encrypted, thereby ensuring the efficiency of data encryption and improving the compatibility of data encryption.

[0053] The mode selection signal here is used to indicate the encryption mode of the data to be encrypted.

[0054] S102: If it is determined that the encryption mode is the AES256-ECB encryption mode, first ciphertext data is generated and output according to the acquired data to be encrypted and key data.

[0055] S103. If it is determined that the encryption mode is the AES256-CTR encryption mode, second ciphertext data is generated according to the acquired operator data and key data, and third ciphertext data is generated and output according to the second ciphertext data and the data to be encrypted.

[0056] Compared with the method of using a single encryption form in the prior art, the data encryption method provided in the embodiment of the present application can use a more appropriate encryption method for encryption in a targeted manner according to the attributes of different data to be encrypted, has better compatibility, shortens the encryption time, and has higher data encryption efficiency.

[0057] In the AES256-ECB encryption mode, the first ciphertext data is generated according to the data to be encrypted and the key data, and in the AES256-CTR encryption mode, the second ciphertext data is generated according to the operator data and the key data. Both can be used as follows: Figure 1 The encryption process of AES 256 is shown in FIG. Specifically, in FPGA, it can be implemented in the form of a pipeline.

[0058] In this embodiment, a pipeline encryption algorithm module is provided to implement pipeline AES 256 encryption. The pipeline encryption algorithm module may include a key expansion module and 15 cyclic algorithm modules, each corresponding to 15 cycles in the encryption process.

[0059] In the pipeline encryption algorithm module, for the basic algorithms of finite fields, finite field addition and finite field multiplication can be implemented in FPGA. This is because finite field addition is essentially an XOR process, and finite field multiplication is a shift and XOR process with conditional judgment, which is achievable for the logic gate circuit of FPGA. For S-box transformation, it is essentially a byte operation. However, if a module for byte-form S-box transformation is designed, it is necessary to call the S-box addressing submodule 16 times each time the matrix is ​​transformed, which is not conducive to the algorithm design and the internal register design of FPGA. In addition, in the actual algorithm use process, the S-box transformation is operated on a 4-word matrix, so the S-box transformation is designed in the form of a 16-byte matrix in the FPGA. For row shift transformation, it is only a data shift operation in FPGA, and no other algorithm support is required. For column confusion transformation, it is a conditionally constrained finite field multiplication, which can be implemented by calling the finite field multiplication module multiple times. For round key addition, it is a bitwise XOR operation of data in FPGA, and no other algorithm support is required. The key expansion process and AES-256 encryption process are both implemented based on the above-mentioned sub-module algorithm design, so the overall algorithm flow is feasible in FPGA.

[0060] Specifically, the first ciphertext data or the second ciphertext data is generated in the following manner:

[0061] Determine the initial value and initial input data corresponding to N, where the initial value of N is 0. When N is 0, the input data corresponding to N is the data to be encrypted or the operator data. Generate the first key matrix corresponding to N according to the key data, and calculate the output data according to the first key matrix corresponding to N and the initial input data, N=N+1, and use the output data as the initial input data corresponding to the current N. Determine whether the current N reaches the preset value. If not, jump to generate the first key matrix corresponding to N according to the key data and continue to execute. If so, use the current output data as the first ciphertext data or the second ciphertext data.

[0062] It can be understood that here, 60 sets of round key matrices are expanded according to the current key data , each four groups as a first key matrix. Taking AES256-CTR encryption mode as an example, first convert the current data to be encrypted and Input the first cyclic algorithm module, the first cyclic algorithm performs round key addition calculation according to the input data to output the first output data. Then the first output data and The second cyclic algorithm module is input, and the second algorithm module performs S-box transformation, row shift transformation, column confusion transformation and round key addition calculation according to the input data to output the second output data. At this time, the first cyclic algorithm module can output the first output data corresponding to the next data to be encrypted according to the next data to be encrypted and the corresponding first key matrix. Therefore, the time interval between the output of the encryption result of the current data to be encrypted and the encryption result of the next data to be encrypted is only one synchronization clock.

[0063] By adopting the pipeline encryption algorithm module, compared with the method in the prior art that the encryption of the current data to be encrypted must be completed before the next data to be encrypted can be encrypted, the shortest time interval between the output of two data to be encrypted is only one synchronization clock, while the shortest time interval between the output of two data to be encrypted in the prior art requires 15 synchronization clocks. Therefore, in the process of generating the first ciphertext data or the second ciphertext data, the pipeline encryption algorithm module can be selected to improve data encryption efficiency, avoid data blocking, and reduce data cache pressure.

[0064] In an embodiment of the present application, the AES 256-CTR mode can first input the CTR operator and the key into the pipeline encryption algorithm module to obtain the encrypted CTR operator (i.e., the second ciphertext data), and then input the second ciphertext data and the data to be encrypted into the XOR calculation module to output the final encryption result (i.e., the third ciphertext data).

[0065] Specifically, the third ciphertext data is generated in the following manner:

[0066] According to the second ciphertext data, a second ciphertext matrix corresponding to each byte to be encrypted is determined. For each byte of the data to be encrypted, the byte is encrypted according to the second ciphertext matrix corresponding to the byte to generate fourth ciphertext data corresponding to the byte. The fourth ciphertext data corresponding to all bytes of the data to be encrypted are used as the third ciphertext data.

[0067] The XOR here can be to XOR each byte of the second ciphertext data with the byte at the corresponding position in the second ciphertext matrix. Exemplarily, the CTR operator data is 128 bits wide and can be equally divided into 16 8-bit wide bytes of data, which are independent of each other. In the data stream algorithm, after each CTR operator (operator data) is encrypted to obtain the 128-bit wide encrypted C_CTR data (second encrypted data), if the number of valid bytes of the encrypted data is 8 bytes, the second encrypted data is XORed with the 8-bit width of the plaintext from the lower 8 bits, and the XOR object is intercepted to the higher bit every 8 bits of width when the plaintext arrives next time. That is, CTR is encrypted by the AES 256 algorithm to obtain the encrypted C_CTR operator with a bit width of 128 bits. When P(0) [7:0] arrives, C_CTR[7:0] is selected to be XORed with P(0) [7:0] and obtain C(0)[7:0], where 7:0 indicates the 8-bit data in the first byte of the data. When the next clock of the data stream arrives, P(1)[7:0] selects C_CTR[15:8] for XOR; in the next clock, P(2)[7:0] selects C_CTR[23:16] for XOR; P(3)[7:0] and C_CTR[31:24] for XOR; P(4)[7:0] and C_CTR[39:32] for XOR; P(5)[7:0] and C_CTR[47:40] for XOR; P(6)[7:0] and C_CTR[55:48] for XOR; P(7)[7:0] and C_CTR[63:56] for XOR; P(8)[7:0] selects C_CTR[7:0] for XOR; R[71:64] performs XOR; in the next clock, P(9)[7:0] selects C_CTR[79:72] for XOR; P(10)[7:0] performs XOR with C_CTR[87:80]; P(11)[7:0] performs XOR with C_CTR[95:88]; P(12)[7:0] performs XOR with C_CTR[103:96]; P(13)[7:0] performs XOR with C_CTR[111:104]; P(14)[7:0] performs XOR with C_CTR[119:112]; P(15)[7:0] performs XOR with C_CTR[127:120]. Each XOR above corresponds to an input data clock edge. After 16 8-bit data input clocks, the 128-bit width of C_CTR is fully utilized, and the next set of CTR and C_CTR values ​​needs to be replaced.

[0068] According to the above logic, the encryption operator C_CTR obtained by each group of CTR through the AES256 algorithm can correspond to 16 encryption operations of 8-bit wide data. In the data stream system, based on the input clock of the data stream, the update frequency of the CTR operator is 1 / 16 of the data stream input clock. Set a counter in the FPGA for triggering. Whenever 16 data stream input clock counts are detected, the values ​​of CTR and C_CTR are updated, which is equivalent to giving the AES256 encryption algorithm a clock trigger.

[0069] In AES256-CTR mode, CTR is generally used as a self-increment operator, that is, each CTR input is the previous input plus 1. Therefore, the value of the encryption operator C_CTR will be updated after every 128-bit wide valid data (16 bytes) to ensure the effectiveness of encryption.

[0070] Specifically, each byte of the data to be encrypted includes multiple bits of first target data, and the second ciphertext data includes multiple bits of second target data. For each byte of the data to be encrypted, the fourth ciphertext data corresponding to the byte is generated in the following manner:

[0071] For each bit of the first target data in the byte, the first target data is XORed with the second target data at the same bit in the second ciphertext data to generate fourth ciphertext data corresponding to the byte.

[0072] It can be understood that, for 8 bits of data in a byte of the data to be encrypted and 8 bits of data in a corresponding byte of the second ciphertext data, the bit data at corresponding positions are XORed.

[0073] Specifically, in the embodiment of the present application, the third ciphertext data can also be output in the following manner:

[0074] The valid bytes of the data to be encrypted are determined, and the data at the position corresponding to the valid bytes of the data to be encrypted in the third ciphertext data is output as the third ciphertext data.

[0075] In this step, if the valid bytes of the data to be encrypted are 8 bits, the decryption party only needs to complete the decryption based on the last 8 bytes of the third ciphertext data and the CTR operator data. In this case, only the last 8 bytes can be output to the decryption party, which reduces the resource consumption of the system.

[0076] In one embodiment, Figure 7As shown, it is a block diagram of a dual-mode encryption algorithm module provided by an embodiment of the present application. The dual-mode encryption module (AES 256 Double Mode Module) is used to determine the encryption module to be run according to the received encryption mode selection signal, and encrypt the input data to be encrypted to output the encryption result. Among them, the CLK channel is used to receive the synchronous clock signal, and the pText[127:0] channel is used to receive the data to be encrypted. Key[255:0] is used to receive key data. pText_EN is used to receive the plaintext valid identifier, and the plaintext valid identifier is used to indicate the number of valid data of the data to be processed. The CTR[127:0] channel is used to receive the CTR operator data. CTR_EN is used to receive the CTR operator valid identifier, and the CTR operator valid identifier is used to indicate the number of valid data of the CTR operator. The valid data of the CTR operator here needs to be 126 bits, otherwise an error can be reported. The Mode channel is used to receive the encryption mode selection signal. Specifically, the high and low levels can be used to distinguish the two modes. The cText[127:0] channel is used to output the first ciphertext data or the third ciphertext data. cText_EN is used to receive a ciphertext valid flag, and the ciphertext valid flag is used to indicate the valid data quantity of the first ciphertext data or the third ciphertext data.

[0077] Based on the same inventive concept, a data encryption device corresponding to the data encryption method is also provided in the embodiment of the present application. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the above-mentioned data encryption method in the embodiment of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0078] See also Figure 8 , Figure 8 This is a schematic diagram of the structure of a data encryption device provided in an embodiment of the present application. Figure 8 As shown in , the data encryption device 800 includes:

[0079] The processing module 810 is used to determine the encryption mode of the data to be encrypted according to the number of bytes or encryption priority of the received data to be encrypted;

[0080] The first encryption module 820 is used to generate and output first ciphertext data according to the acquired data to be encrypted and key data if the encryption mode is determined to be the AES256-ECB encryption mode;

[0081] The second encryption module 830 is used to generate second ciphertext data according to the acquired operator data and key data if the encryption mode is determined to be the AES256-CTR encryption mode, and to generate and output third ciphertext data according to the second ciphertext data and the data to be encrypted.

[0082] In a preferred embodiment, the processing module 810 is specifically used to determine the size of the valid byte number of the data to be encrypted and the preset byte number; if the valid byte number of the data to be encrypted is less than the preset byte number, a first mode selection signal is generated to indicate that the encryption mode is the AES256-CTR encryption mode; if the valid byte number of the data to be encrypted is greater than the preset byte number, a second mode selection signal is generated to indicate that the encryption mode is the AES256-ECB encryption mode.

[0083] In a preferred embodiment, the processing module 810 is specifically used to determine the size of the encryption priority of the data to be encrypted and the preset encryption priority; if the encryption priority of the data to be encrypted is less than the preset encryption priority, a third mode selection signal is generated to indicate that the encryption mode is the AES256-CTR encryption mode; if the encryption priority of the data to be encrypted is greater than the preset encryption priority, a fourth mode selection signal is generated to indicate that the encryption mode is the AES256-ECB encryption mode.

[0084] In a preferred embodiment, the first encryption module 820 or the second encryption module 830 is specifically used to determine the initial value and initial input data corresponding to N, wherein the initial value of N is 0. When N is 0, the input data corresponding to N is the data to be encrypted or the operator data; according to the key data, a first key matrix corresponding to N is generated, and output data is calculated according to the first key matrix corresponding to N and the initial input data, N=N+1, and the output data is used as the initial input data corresponding to the current N; it is determined whether the current N reaches a preset value; if not, it jumps to generate the first key matrix corresponding to N according to the key data and continues to execute; if so, the current output data is used as the first ciphertext data or the second ciphertext data.

[0085] In a preferred embodiment, the second encryption module 830 is specifically used to determine the second ciphertext matrix corresponding to each byte to be encrypted based on the second ciphertext data; for each byte of the data to be encrypted, encrypt the byte according to the second ciphertext matrix corresponding to the byte to generate fourth ciphertext data corresponding to the byte; and use the fourth ciphertext data corresponding to all bytes of the data to be encrypted as the third ciphertext data.

[0086] In a preferred embodiment, the second encryption module 830 is specifically used for each byte of the data to be encrypted including multiple bits of first target data, and the second ciphertext data including multiple bits of second target data. For each byte of the data to be encrypted, the fourth ciphertext data corresponding to the byte is generated in the following manner: for each bit of the first target data in the byte, the first target data is XORed with the second target data at the same bit in the second ciphertext data to generate the fourth ciphertext data corresponding to the byte.

[0087] In a preferred embodiment, the processing module 810 is specifically used to determine the valid bytes of the data to be encrypted, and output the data at the position corresponding to the valid bytes of the data to be encrypted in the third ciphertext data as the third ciphertext data.

[0088] See also Fig. 9 , Fig. 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Fig. 9 As shown in , the electronic device 900 includes a processor 910 , a memory 920 and a bus 930 .

[0089] The memory 920 stores machine-readable instructions executable by the processor 910. When the electronic device 900 is running, the processor 910 communicates with the memory 920 through the bus 930. When the machine-readable instructions are executed by the processor 910, the steps of the data encryption method in the above method embodiment can be executed. The specific implementation method can be found in the method embodiment, which will not be repeated here.

[0090] An embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the data encryption method in the above method embodiment can be executed. The specific implementation method can be found in the method embodiment, which will not be repeated here.

[0091] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0092] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0093] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0094] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0095] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0096] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A data encryption method, characterized in that: The method comprises: The mode selector determines the encryption mode of the data to be encrypted according to the number of bytes or encryption priority corresponding to the received data to be encrypted and generates a signal for indicating the encryption mode selection; The mode selector sends the encryption mode selection signal to the Mode channel of the dual-mode encryption algorithm module; If the encryption mode is determined to be the AES256-ECB encryption mode, the dual-mode encryption algorithm module generates and outputs first ciphertext data according to the acquired data to be encrypted and key data; If the encryption mode is determined to be the AES 256-CTR encryption mode, the dual-mode encryption algorithm module generates second ciphertext data according to the acquired operator data and key data, and generates and outputs third ciphertext data according to the second ciphertext data and the data to be encrypted; The first ciphertext data or the second ciphertext data is generated in the following manner: Determine an initial value and initial input data corresponding to N, wherein the initial value of N is 0. When N is 0, the input data corresponding to N is the data to be encrypted or the operator data; Generate a first key matrix corresponding to N according to the key data, and calculate output data according to the first key matrix corresponding to N and the initial input data, N=N+1, and use the output data as the initial input data corresponding to the current N; Determine whether the current N reaches a preset value; If not, jump to generate the first key matrix corresponding to N according to the key data and continue to execute; If yes, the current output data is used as the first ciphertext data or the second ciphertext data; And, generate the third ciphertext data in the following manner: Determine, according to the second ciphertext data, a second ciphertext matrix corresponding to each byte to be encrypted; For each byte of the data to be encrypted, encrypt the byte according to the second ciphertext matrix corresponding to the byte to generate fourth ciphertext data corresponding to the byte; Using the fourth ciphertext data corresponding to all bytes of the data to be encrypted as the third ciphertext data; Furthermore, each byte of the data to be encrypted includes multiple bits of first target data, the second ciphertext data includes multiple bits of second target data, and for each byte of the data to be encrypted, fourth ciphertext data corresponding to the byte is generated in the following manner: For each bit of the first target data in the byte, the first target data is XORed with the second target data at the same bit in the second ciphertext data to generate fourth ciphertext data corresponding to the byte.

2. The method according to claim 1, characterized in that The step of determining the encryption mode of the data to be encrypted according to the number of bytes corresponding to the received data to be encrypted specifically includes: Determine the size of the valid byte number of the data to be encrypted and the preset byte number; If the number of valid bytes of the data to be encrypted is less than the preset number of bytes, a first mode selection signal is generated to indicate that the encryption mode is the AES256-CTR encryption mode; If the number of valid bytes of the data to be encrypted is greater than the preset number of bytes, a second mode selection signal is generated to indicate that the encryption mode is the AES256-ECB encryption mode.

3. The method according to claim 1, characterized in that The step of determining the encryption mode of the data to be encrypted according to the encryption priority corresponding to the received data to be encrypted specifically includes: Determine the size of the encryption priority of the data to be encrypted and the preset encryption priority; If the encryption priority of the data to be encrypted is less than the preset encryption priority, a second mode selection signal is generated to indicate that the encryption mode is the AES256-ECB encryption mode; If the encryption priority of the data to be encrypted is greater than the preset encryption priority, a first mode selection signal is generated to indicate that the encryption mode is the AES256-CTR encryption mode.

4. The method according to claim 2, characterized in that: The third ciphertext data is output in the following manner: Determine the valid bytes of the data to be encrypted, and output the data at the position corresponding to the valid bytes of the data to be encrypted in the third ciphertext data as the third ciphertext data.

5. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and the processor executes the machine-readable instructions to perform the steps of the data encryption method as described in any one of claims 1 to 4.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the data encryption method according to any one of claims 1 to 4 are executed.

Images