System script encryption method, system script decryption method and system script encryption equipment

Abstract

The invention discloses a script encryption method and decryption method and device of a system, and the method comprises the following steps: carrying out the first encryption of a script file through a first encryption algorithm, and uploading the obtained encrypted script file to a server side; encrypting the key of the first encryption algorithm by using a second encryption algorithm to obtain an encrypted key file; disassembling the encrypted key file into a plurality of sub-files which are arranged in sequence; changing the arrangement sequence of the plurality of sub-files, and storing the sub-files in a resource folder of the system; by adopting the technical scheme, the security of the key of the first encryption algorithm is enhanced, so that the data security in the script file transmission process is ensured.

Description

Technical Field

[0001] The present application relates to the field of data encryption, and in particular to a system script encryption method and decryption method and device. Background Art

[0002] When a system (such as a digital entertainment on-demand system) is started, it usually loads the required script from the server. However, in the data transmission link between the server and the terminal device (on-demand system), the script data may be subject to a variety of network attacks such as man-in-the-middle attacks and sniffing attacks, resulting in malicious tampering or theft of the script content. Once the script is tampered with, after the terminal device receives and executes these tampered scripts, it may cause the terminal device to be maliciously modified or damaged, such as system crashes, data leaks, etc., seriously affecting the normal operation of the device and the user experience. In order to avoid such security risks, a more secure encryption solution is urgently needed to ensure the security of the script during transmission and storage.

[0003] Although there are many encryption technologies on the market, such as symmetric encryption and asymmetric encryption, in actual applications, these technologies are often restricted by various factors and cannot fully meet the security requirements of server-side script delivery. Although asymmetric encryption solves the problem of key distribution, its encryption speed and efficiency are relatively low, which makes it difficult to meet the real-time requirements of large-scale data transmission. Although symmetric encryption has higher encryption speed and efficiency, the key storage problem becomes a shortcoming, and the key is easy to leak. Summary of the invention

[0004] In view of the above problems, the present application provides a systematic script encryption method to solve the problem of insufficient security of key storage in existing symmetric encryption, so as to improve the security of script transmission.

[0005] To achieve the above object, the inventor provides a systematic script encryption method, which comprises the following steps:

[0006] Encrypt the script file for the first time using a first encryption algorithm, and upload the encrypted script file to the server;

[0007] Encrypt the key of the first encryption algorithm using the second encryption algorithm to obtain an encrypted key file;

[0008] Decompose the encrypted key file into several sub-files arranged in sequence;

[0009] Change the order of several sub-files and store them in the system's resource folder.

[0010] Furthermore, the first encryption algorithm is a symmetric encryption algorithm.

[0011] Furthermore, the symmetric encryption algorithm includes AES and RSA.

[0012] Furthermore, the second encryption algorithm is a shift encryption algorithm or an XOR encryption algorithm.

[0013] Furthermore, in the step of decomposing the encrypted key file into a plurality of sub-files arranged in sequence, the step includes:

[0014] The Gradle script is used to read the encrypted key file and decompose the encrypted key file into several sub-files arranged in sequence according to preset rules.

[0015] Furthermore, in the step of changing the arrangement order of the plurality of sub-files and storing them in the resource folder of the system, the following steps are included:

[0016] Transform the order of several subfiles using a linear equation of the offset coefficient.

[0017] A method for decrypting a script of a system, comprising the following steps:

[0018] Get the encrypted script from the server;

[0019] Correct and reorganize the arrangement order of several corresponding sub-files stored in the resource folder of the system to obtain the encrypted key file;

[0020] Decrypting the encrypted key file using a second decryption method corresponding to the second encryption method to obtain a key of the first encryption algorithm;

[0021] The encrypted script is decrypted using the key of the first encryption algorithm to obtain the script.

[0022] Furthermore, the method also includes performing data integrity verification on the encrypted script obtained from the server.

[0023] Furthermore, the MD5 algorithm is used to perform data integrity verification on the encrypted script obtained from the server.

[0024] Furthermore, after executing the script file, the MD5 value of the script file is recorded, and when a script file with the same MD5 value is received, it is no longer executed.

[0025] A device comprises a memory and a processor, wherein a computer program is stored in the memory, and the steps of the method are implemented when the computer program is executed by the processor.

[0026] Different from the prior art, the above technical solution adopts a multi-layer encryption scheme to improve the security of the script transmission process; first, the script file is preliminarily encrypted using a first encryption algorithm to ensure data security during the script file transmission process; then, the key of the first encryption algorithm is encrypted twice to further enhance the security of the key; the encrypted key file is stored in the resource file of the device code to prevent unauthorized access and modification, thereby protecting the integrity and security of the system's script; in order to prevent the exposure of the resource file and cause key leakage, during the storage process, the encrypted key file is disassembled into several sub-files, and the arrangement order of several sub-files is changed according to a specific algorithm, making it difficult for attackers to predict or infer the correct sub-file combination method. Even if the attacker obtains all the sub-files, he needs to crack the arrangement order algorithm to correctly combine the key, which greatly increases the difficulty of cracking.

[0027] The above-mentioned records related to the invention content are only an overview of the technical solution of the present application. In order to enable ordinary technicians in the field to more clearly understand the technical solution of the present application, and then implement it according to the text of the specification and the contents recorded in the drawings, and to make the above-mentioned purpose and other purposes, features and advantages of the present application easier to understand, the following is an explanation in combination with the specific implementation mode and drawings of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The drawings are only used to illustrate the principles, implementation methods, applications, characteristics and effects of the specific embodiments of the present invention and other related contents, and shall not be considered as limiting the present application.

[0029] In the drawings of the specification:

[0030] Figure 1 A schematic diagram of a flow chart of a script encryption method of a system described in an implementation method;

[0031] Figure 2 A schematic flow chart of a script decryption method of a system described in an implementation method. DETAILED DESCRIPTION

[0032] In order to explain in detail the possible application scenarios, technical principles, specific schemes that can be implemented, and the purposes and effects that can be achieved, the following is a detailed description of the specific embodiments listed in conjunction with the accompanying drawings. The embodiments described herein are only used to more clearly illustrate the technical solutions of the present application, and are therefore only used as examples, and cannot be used to limit the scope of protection of the present application.

[0033] Reference to "embodiment" herein means that the specific features, structures or characteristics described in conjunction with the embodiment may be included in at least one embodiment of the present application. The term "embodiment" appearing in various places in the specification does not necessarily refer to the same embodiment, nor does it particularly limit its independence or association with other embodiments. In principle, in the present application, as long as there is no technical contradiction or conflict, the various technical features mentioned in the embodiments can be combined in any way to form a corresponding implementable technical solution.

[0034] Unless otherwise defined, the technical terms used in this document have the same meanings as those generally understood by those skilled in the art to which this application belongs; the use of relevant terms in this document is only for describing specific embodiments and is not intended to limit this application.

[0035] In the description of this application, the term "and / or" is an expression used to describe the logical relationship between objects, indicating that three relationships may exist, for example, A and / or B, which means: A exists, B exists, and A and B exist at the same time. In addition, the character " / " in this article generally indicates that the objects before and after are in an "or" logical relationship.

[0036] In the present application, terms such as “first” and “second” are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship of quantity, priority or sequence between these entities or operations.

[0037] Without further limitations, in this application, the words "include", "comprises", "has" or other similar open-ended expressions used in sentences are intended to cover non-exclusive inclusion. These expressions do not exclude the presence of additional elements in the process, method or product including the elements, so that the process, method or product including a series of elements may include not only those limited elements, but also other elements not explicitly listed, or also include elements inherent to such process, method or product.

[0038] Similar to the understanding in the Examination Guidelines, in this application, expressions such as "greater than", "less than", "exceed" and the like are understood to exclude the number itself; expressions such as "above", "below", "within" and the like are understood to include the number itself. In addition, in the description of the embodiments of this application, "multiple" means more than two (including two), and similar expressions related to "multiple" are also understood in this way, such as "multiple groups", "multiple times", etc., unless otherwise clearly and specifically limited.

[0039] In the description of the embodiments of the present application, space-related expressions used, such as "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "vertical", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise", "axial", "radial", "circumferential", etc., indicate the orientation or position relationship based on the orientation or position relationship shown in the specific embodiments or drawings, and are only for the convenience of describing the specific embodiments of the present application or facilitating the reader's understanding, and do not indicate or imply that the referred device or component must have a specific position, a specific orientation, or be constructed or operated in a specific orientation, and therefore cannot be understood as a limitation on the embodiments of the present application.

[0040] A system script encryption method adopts a multi-layer encryption scheme to improve the security of the script transmission process; first, a first encryption algorithm is used to preliminarily encrypt the script file to ensure data security during the script file transmission process; then, the key of the first encryption algorithm is encrypted twice to further enhance the security of the key of the first encryption algorithm; the encrypted key file is stored in a resource file of a device code to prevent unauthorized access and modification of the encrypted key file, thereby protecting the integrity and security of the system script; in order to prevent the exposure of the resource file from causing the key of the first encryption algorithm to leak, during the storage process, the encrypted key file is disassembled into several sub-files, and the arrangement order of the several sub-files is changed according to a specific algorithm, so that it is difficult for an attacker to predict or infer the correct sub-file combination method. Even if the attacker obtains all the sub-files, the algorithm for cracking the arrangement order needs to be cracked to correctly combine the key, which greatly increases the difficulty of cracking.

[0041] See also Figure 1 As shown, the following provides an implementation of a system script encryption method of the present invention, which includes the following steps:

[0042] S11, encrypting the script file for the first time using a first encryption algorithm, and uploading the encrypted script file to the server;

[0043] S12, using the second encryption algorithm to encrypt the key of the first encryption algorithm to obtain an encrypted key file;

[0044] S13, disassembling the encrypted key file into a plurality of sub-files arranged in sequence;

[0045] S14. Change the arrangement order of several sub-files and store them in the resource folder of the system.

[0046] The first encryption algorithm mentioned above can encrypt the script file and upload it to the server to ensure the security of the script file during transmission. The system loads the encrypted script file from the server side and uses the key of the first encryption algorithm to decrypt it to avoid leakage of the script file during network transmission. It can be a symmetric encryption algorithm or an asymmetric encryption algorithm, that is, the key of the first encryption algorithm mentioned above refers to the private key of the asymmetric encryption algorithm or the key of the symmetric encryption algorithm. The first encryption algorithm includes but is not limited to DES (Data Encryption Standard), AES (Advanced Encryption Standard), RSA (Rivest-Shamir-Adleman), ElGamal algorithm, etc. Preferably, the first encryption algorithm is a symmetric encryption algorithm. The symmetric encryption algorithm has the advantages of efficient encryption speed and low resource consumption.

[0047] The second encryption algorithm is used to encrypt the key of the first encryption algorithm, ensure the security of the key of the first encryption algorithm stored in the resource folder of the system, and avoid the leakage of the key of the first encryption algorithm; when the system loads the encrypted script file from the server side and needs the key of the first encryption algorithm to decrypt the encrypted script file, the second encryption algorithm can be used to reversely decrypt the encrypted key file to obtain the key of the first encryption algorithm. The second encryption algorithm can be a symmetric encryption algorithm or an asymmetric encryption algorithm, or an encryption algorithm based on a specific operation; such as a shift encryption algorithm, which generates ciphertext by rearranging or shifting the characters or letters in the plaintext according to a certain rule. For example, the XOR encryption algorithm uses the reversibility of the XOR operation to realize encryption and decryption. During the encryption process, the key of the first encryption algorithm is XORed with the key of the second encryption algorithm to generate an encrypted key file; during the decryption process, the encrypted key file is XORed with the same key of the second encryption algorithm again to restore it to the key of the first encryption algorithm.

[0048] In order to prevent the exposure of resource files and cause key leakage, during the storage process, the encrypted key file is disassembled into several sub-files, and the arrangement order of the several sub-files is changed according to a specific algorithm. Among them, in the step of disassembling the encrypted key file into several sub-files arranged in order, the encrypted key file can be disassembled into several sub-files arranged in order according to preset rules, so that each sub-file can contain a part or a specific block of the encrypted key file. The above preset rules may include the size of the disassembled sub-files and the number of sub-files. The size of the disassembled sub-files can be equal or unequal, that is, they can be evenly or unevenly disassembled according to the size or content structure of the encrypted key file. Usually, an initial serial number is generated for each sub-file, which is usually automatically generated according to the disassembly order. The above disassembly of the encrypted key file can be practical with a custom script or tool, or an existing script with the function of disassembly and segmentation, such as a Gradle script, that is, the Gradle script is used to read the encrypted key file, and the encrypted key file is disassembled into several sub-files arranged in order according to the preset rules.

[0049] Changing the order of the plurality of sub-files may be accomplished by using the reordered new sequence numbers as part of a new file name (eg, by renaming the sub-files), or by moving the sub-files to new locations to reflect the reordered order.

[0050] The specific process of changing the arrangement order of several sub-files may include the following steps:

[0051] Define a linear equation for transforming the arrangement order, such as selecting a suitable offset coefficient (e.g., an integer) and defining a linear equation (e.g., y=ax+b, where a is the slope, b is the intercept, x is the initial sequence number, and y is the sorted sequence number).

[0052] For each sub-file, its new sequence number is calculated using a defined linear equation, which generally involves substituting the initial sequence number of the sub-file (or an attribute related to the initial sequence number) into the equation for calculation. According to the calculated new sequence number, the sub-file is renamed (e.g., including the new sequence number in the file name) or moved to a new location (e.g., arranged according to the new sequence number in a new directory structure).

[0053] Of course, in order to quickly restore the original order of the sub-files during decryption, the mapping relationship can be saved in the process of calculating the new sequence number, that is, in the process of calculating the new sequence number, the mapping relationship between the initial sequence number of each sub-file and the new sequence number after reordering is recorded. Indexes or labels can also be used to assign a unique index or label to each sub-file before reordering. These indexes or labels remain unchanged during the sorting process and can be used to track the original position of each sub-file.

[0054] The sub-files in the transformed arrangement order of the sub-files may be directly stored in the resource folder of the system, or may be packaged and stored in the resource folder of the system according to the transformed arrangement order of the sub-files.

[0055] See also Figure 2 As shown, the present invention also provides a system script decryption method, comprising the following steps:

[0056] S21, obtaining the encrypted script from the server;

[0057] S22, correcting and reorganizing the arrangement order of the corresponding sub-files stored in the resource folder of the system to obtain an encrypted key file;

[0058] S23, decrypting the encrypted key file using a second decryption method corresponding to the second encryption method to obtain a key of the first encryption algorithm;

[0059] S24. Decrypt the encrypted script using the key of the first encryption algorithm to obtain the script.

[0060] In the above step of correcting and reorganizing the arrangement order of the corresponding sub-files stored in the resource folder of the system to obtain the encrypted key file, the mapping relationship (the mapping relationship between the initial sequence number and the new sequence number) can be saved in the process of calculating the new sequence number. Indexes or labels can also be used. If the index or label of each sub-file is recorded, the original order can be directly restored according to these indexes or labels, and the sub-files only need to be rearranged according to the original order of the index or label. The original order can also be restored by using the opposite linear transformation of the linear equation.

[0061] During the transmission of the encrypted script, the encrypted script may be subject to malicious attacks or accidental interference (such as system failure, software error or human error), resulting in content tampering. Detect whether the encrypted script has undergone any changes during the transmission process to ensure the authenticity of the data, that is, it also includes data integrity verification of the encrypted script obtained from the server. The implementation method can be through hash functions, data verification, digital signatures, etc. Taking the hash function as an example, the hash function is used to generate a hash value for the encrypted script and verify it at the receiving end. If the hash value does not match, it means that the data may have been tampered with during the transmission process. Specifically, the MD5 algorithm is used to perform data integrity verification on the encrypted script obtained from the server. The MD5 algorithm is a widely used hash function. MD5 is used to verify the integrity and validity of the encrypted script sent by the server to ensure that the script sent by the server has not been tampered with. You can follow the steps below:

[0062] Load the encrypted script file from the server.

[0063] Get the original MD5 checksum of the encrypted script file: The server provides the MD5 checksum of the encrypted script file, which is calculated when the encrypted script file is generated or uploaded to the server.

[0064] Calculate the existing MD5 value of the encrypted script file: Use the MD5 algorithm to calculate the MD5 value of the encrypted script file locally.

[0065] Compare MD5 values: Compare the locally calculated MD5 value with the original MD5 checksum.

[0066] If the two are the same, it means that the script file has not been tampered with during the transmission process and maintains integrity and validity. If the two are different, it means that the script file may have been tampered with and needs to be stopped immediately and relevant response strategies should be adopted.

[0067] To improve efficiency, you can write an automated script to batch download server-side script files and calculate their MD5 values.

[0068] Then, the script can automatically compare it with the MD5 checksum provided by the server and output the checksum result.

[0069] Furthermore, after executing the script file, the MD5 value of the script file is recorded, and when a script file with the same MD5 value is received, it is no longer executed.

[0070] Under normal circumstances, a script file is generally used for one repair. When the device receives the script file and makes the corresponding repair, it will not execute the same script file again. To avoid replay attacks in the network, the device first performs an MD5 value check on the received script file. If the script file with the same MD5 value has been executed, it will not be executed again, ensuring that the script file is only executed once to avoid malicious interception and replay attacks.

[0071] The present invention also provides a device, which includes a memory and a processor, wherein a computer program is stored in the memory, and the steps of the above method are implemented when the computer program is executed by the processor.

[0072] The processor described in the embodiments of the present application can be implemented by hardware, firmware, software or a combination thereof, and can use a circuit, a single or multiple application-specific integrated circuits (Application Specific Integrated Circuit, ASIC), a digital signal processor (Digital Signal Processor, DSP), a digital signal processing device (Digital Signal Processing Device, DSPD), a programmable logic device (Programmable Logic Device, PLD), a field programmable gate array (Field Programmable Gate Array, FPGA), a central processing unit (Central Processing Unit, CPU), a controller, a microcontroller, at least one of a microprocessor, and also includes other physical, biological or chemical structures that can achieve similar or equivalent functions to the processors listed above, such as biological neurons, quantum computing units, DNA computing units, etc., so that the processor can execute some or all of the steps in the computer program or method involved in the various embodiments of the present application, or any combination of the steps mentioned therein.

[0073] The computer program involved in the embodiment can be stored in a computer device readable storage medium, which includes but is not limited to a disk, a tape, a magnetic card, a floppy disk, a flash memory, an optical disk, an optical card, a read-only memory (ROM), a random access memory (RAM), an erasable programmable ROM (EPROM) and an electrically erasable programmable ROM (EEPROM), etc., and also includes other biological, physical or chemical structures that can achieve the same or equivalent functions as the storage media listed above, such as DNA, RNA, protein and other units with information storage capabilities. In a specific embodiment, the storage medium involved can be one of the above-mentioned media types, or a combination of the above-mentioned media types. In different embodiments, the computer program involved in the embodiment can be stored in a single medium in a centralized manner, or it can be stored in multiple media in a distributed manner. The memory containing the computer device readable storage medium can be a non-volatile memory or a random access memory. These computer device readable storage media can be built into the device, or they can be connected to the device involved in the embodiment as an external device or a part of an external device. In some embodiments, a memory with a computer device readable storage medium is deployed locally; in other embodiments, a solution of deploying the memory away from the processor may also be adopted, such as a network attached memory accessed via an RF circuit or an external port and a communication network, wherein the communication network may be the Internet, one or more intranets, a local area network (LAN), a wide area network (WLAN), a storage area network (SAN), etc., or a suitable combination thereof, as long as the computer device can access the memory. In addition, the computer program involved in the embodiment may be stored in plaintext / ciphertext form, or may be designed as training data, which may be integrated and reorganized through model training and implicitly stored in the parameter state of a deep neural network or other machine learning model.

[0074] Finally, it should be noted that although the above embodiments have been described in the specification and drawings of this application, this does not limit the scope of patent protection of this application. All technical solutions generated by replacing or modifying equivalent structures or equivalent processes based on the essential concept of this application using the contents recorded in the specification and drawings of this application, as well as directly or indirectly implementing the technical solutions of the above embodiments in other related technical fields, are included in the scope of patent protection of this application.

Claims

1. A system script encryption method, characterized in that: The following steps are involved: Encrypt the script file for the first time using a first encryption algorithm, and upload the encrypted script file to the server; Encrypt the key of the first encryption algorithm using the second encryption algorithm to obtain an encrypted key file; Decompose the encrypted key file into several sub-files arranged in sequence; Change the order of several sub-files and store them in the system's resource folder.

2. The script encryption method of the system according to claim 1, characterized in that: The first encryption algorithm is a symmetric encryption algorithm.

3. The script encryption method of the system according to claim 1, characterized in that: The second encryption algorithm is a shift encryption algorithm or an XOR encryption algorithm.

4. The script encryption method of the system according to claim 1, characterized in that: In the step of decomposing the encrypted key file into a plurality of sub-files arranged in sequence, the following steps are included: The Gradle script is used to read the encrypted key file and decompose the encrypted key file into several sub-files arranged in sequence according to preset rules.

5. The script encryption method of the system according to claim 1, characterized in that: In the step of changing the arrangement order of the plurality of sub-files and storing them in the resource folder of the system, it includes: Transform the order of several subfiles using a linear equation of the offset coefficient.

6. A system script decryption method, using the system script encryption method of claims 1-6, characterized in that: The following steps are involved: Get the encrypted script from the server; Correct and reorganize the arrangement order of several corresponding sub-files stored in the resource folder of the system to obtain the encrypted key file; Decrypting the encrypted key file using a second decryption method corresponding to the second encryption method to obtain a key of the first encryption algorithm; The encrypted script is decrypted using the key of the first encryption algorithm to obtain the script.

7. The script encryption method of the system according to claim 6, characterized in that: It also includes data integrity verification of the encrypted script obtained from the server.

8. The script encryption method of the system according to claim 7, characterized in that: Use the MD5 algorithm to verify the data integrity of the encrypted script obtained from the server.

9. The script encryption method of the system according to claim 6, characterized in that: After executing the script file, the MD5 value of the script file is recorded. When a script file with the same MD5 value is received, it will not be executed again.

10. A device, characterized in that: The method comprises a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images