Encryption method, encryption device, storage medium and electronic device

Abstract

The present disclosure provides an encryption method, an encryption device, a computer-readable storage medium and an electronic device, which relate to the field of information security technology. The encryption method comprises: selecting at least one first module and at least one second module from a plurality of preset encryption modules; wherein different encryption modules use different encryption algorithms; controlling the first module to encrypt the data to be processed, and controlling the second module to encrypt the interference data. The present disclosure conceals the power consumption information of the real encryption process, which increases the difficulty for attackers to crack the encrypted information through power consumption analysis.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to an encryption method, an encryption device, a computer-readable storage medium, and an electronic device. Background Art

[0002] With the development of computer and communication technology, people are paying more and more attention to information security. For example, in mobile communications, users often need to send information related to personal privacy and property. Data encryption provided by the PDCP (Packet Data Convergence Protocol) layer can ensure the security of information during the communication process.

[0003] In related technologies, the security engine of PDCP uses algorithms such as Snow 3G (byte stream encryption algorithm of 3G communication system), ZUC (Zu Chongzhi algorithm), and AES (Advanced Encryption Standard) to encrypt data. However, these algorithms cannot protect against energy analysis attacks. By monitoring the power consumption information of PDCP during encryption or decryption, attackers can analyze the password and crack the security engine to steal data. Summary of the invention

[0004] The present disclosure provides an encryption method, an encryption device, a computer-readable storage medium and an electronic device, thereby solving the problem that related technologies cannot protect against energy analysis attacks to a certain extent.

[0005] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0006] According to a first aspect of the present disclosure, there is provided an encryption method, comprising: selecting at least one first module and at least one second module from a plurality of preset encryption modules; wherein different encryption modules adopt different encryption algorithms; controlling the first module to encrypt data to be processed, and controlling the second module to encrypt interference data.

[0007] According to a second aspect of the present disclosure, there is provided an encryption device, comprising: a selection unit, for selecting at least one first module and at least one second module from a plurality of preset encryption modules; wherein different encryption modules adopt different encryption methods; and a control unit, for controlling the first module to encrypt the data to be processed, and controlling the second module to encrypt the interference data.

[0008] According to a third aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the encryption method of the first aspect and possible implementation methods thereof are implemented.

[0009] According to a fourth aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the encryption method of the above-mentioned first aspect and its possible implementation methods by executing the executable instructions.

[0010] The technical solution disclosed in this disclosure has the following beneficial effects:

[0011] While encrypting the data to be processed, another encryption module is controlled to encrypt the interference data. On the one hand, the power consumption information leaked to the outside during encryption is the superposition result of the two encryption processes, which conceals the real power consumption information and increases the difficulty for attackers to crack the encrypted information through power consumption analysis. On the other hand, this solution is applicable to both hardware and software implementations, with low cost and high availability.

[0012] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and are used together with the specification to explain the principles of the present disclosure. Obviously, the drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0014] Figure 1 A structural diagram of a mobile terminal in this exemplary embodiment is shown;

[0015] Figure 2 An architectural diagram of a security engine in this exemplary embodiment is shown;

[0016] Figure 3 A flowchart showing an encryption method in this exemplary embodiment is shown;

[0017] Figure 4 A flowchart showing the selection of the first module and the second module in this exemplary embodiment is shown;

[0018] Figure 5 A flowchart of encryption by a first module in this exemplary embodiment is shown;

[0019] Figure 6A schematic diagram showing a method of adding mask protection in this exemplary embodiment is shown;

[0020] Figure 7 A flowchart showing another method of encrypting by the first module in this exemplary embodiment is shown;

[0021] Figure 8 Another schematic diagram of adding mask protection in this exemplary embodiment is shown;

[0022] Fig. 9 An architectural diagram showing another security engine in this exemplary embodiment;

[0023] Fig.10 A structural block diagram of an encryption device in this exemplary embodiment is shown. DETAILED DESCRIPTION

[0024] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0025] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0026] In related technologies, the PDCP security engine mainly encrypts communication data through KeyStream, which will leak power consumption information. If an attacker cracks the KeyStream through power consumption analysis, the plaintext of the communication data can be parsed; in addition, if the KeyStream is obtained, the attacker can easily crack the Key (key) used to start the encryption algorithm, thereby cracking the entire algorithm.

[0027] In view of the above problems, an exemplary embodiment of the present disclosure provides an encryption method, which can be deployed in a security engine to encrypt communication data, application data, etc. to resist energy analysis attacks.

[0028] In order to implement the above encryption method, an exemplary embodiment of the present disclosure provides an electronic device, including: a processor; a memory for storing executable instructions of the processor, and also for storing application data. The processor can implement various program methods, such as the encryption method of the exemplary embodiment, by executing the above executable instructions. The electronic device can be a smart phone, a tablet computer, a personal computer, a smart wearable device, etc.

[0029] Below Figure 1 Taking the mobile terminal 100 in FIG. 1 as an example, the structure of the above electronic device is exemplarily described. It should be understood by those skilled in the art that, in addition to the components specifically used for mobile purposes, Figure 1 The construction in can also be applied to fixed type equipment.

[0030] like Figure 1 As shown, the mobile terminal 100 may specifically include: a processor 110, an internal memory 121, an external memory interface 122, a USB (Universal Serial Bus) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 171, a receiver 172, a microphone 173, an earphone interface 174, a sensor module 180, a display screen 190, a camera module 191, an indicator 192, a motor 193, a button 194 and a SIM (Subscriber Identification Module) card interface 195, etc.

[0031] The processor 110 may include one or more processing units, for example, the processor 110 may include an AP (Application Processor), a modem processor, a GPU (Graphics Processing Unit), an ISP (Image Signal Processor), a controller, an encoder, a decoder, a DSP (Digital Signal Processor), a baseband processor and / or an NPU (Neural-Network Processing Unit), etc. The processor 110 may perform encryption processing on the data, for example, executing the encryption method in this exemplary embodiment.

[0032] In some implementations, the processor 110 may include one or more interfaces, and may be connected to other components of the mobile terminal 100 via different interfaces.

[0033] The external memory interface 122 may be used to connect an external memory card. The internal memory 121 may be used to store computer executable program codes, and may also store data (such as images, videos) created during the use of the mobile terminal 100.

[0034] The USB interface 130 is an interface that complies with USB standard specifications and can be used to connect a charger to charge the mobile terminal 100 , or to connect headphones or other electronic devices.

[0035] The charging management module 140 is used to receive charging input from a charger. While charging the battery 142, the charging management module 140 can also power the device through the power management module 141; the power management module 141 can also monitor the status of the battery.

[0036] The wireless communication function of the mobile terminal 100 can be implemented by antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, modulation and demodulation processor and baseband processor. Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. The mobile communication module 150 can provide solutions for wireless communications including 2G / 3G / 4G / 5G applied to the mobile terminal 100. The wireless communication module 160 can provide wireless communication solutions including WLAN (Wireless Local Area Networks) (such as WiFi (Wireless Fidelity) network), BT (Bluetooth), GNSS (Global Navigation Satellite System), FM (Frequency Modulation), NFC (Near Field Communication), IR (Infrared) and the like applied to the mobile terminal 100.

[0037] The mobile terminal 100 can realize a display function through a GPU, a display screen 190 and an AP, etc., can realize a shooting function through an ISP, a camera module 191, an encoder, a decoder, a GPU, a display screen 190 and an AP, etc., and can also realize an audio function through an audio module 170, a speaker 171, a receiver 172, a microphone 173, an earphone interface 174 and an AP, etc.

[0038] The sensor module 180 may include a depth sensor 1801 , a pressure sensor 1802 , a gyro sensor 1803 , an air pressure sensor 1804 , and the like.

[0039] The indicator 192 may be an indicator light, which may be used to indicate the charging status, power change, message, missed call, notification, etc. The motor 193 may generate a vibration prompt, or may be used for touch vibration feedback, etc. The buttons 194 include a power button, a volume button, etc.

[0040] The mobile terminal 100 may support one or more SIM card interfaces 195 for connecting to SIM cards to implement mobile communications and voice calls.

[0041] Based on the above electronic device, the exemplary embodiment of the present disclosure further provides an architecture of a security engine. The security engine refers to a component inside the electronic device for performing data encryption processing, for example, it can be a security engine of PDCP. Figure 2As shown, the security engine 200 may include a MUX (data selector) 210, a hiding control module 220, a Snow 3G module 230, a ZUC module 240, and an AES module 250. Among them, the Snow 3G module 230, the ZUC module 240, and the AES module 250 are encryption modules that actually perform data processing. In this exemplary embodiment, the security engine 200 may include multiple encryption modules, each of which uses a different encryption algorithm to encrypt data, including but not limited to Figure 2 The Snow 3G algorithm, ZUC algorithm, and AES algorithm shown in .

[0042] It should be noted that in network protocols such as PDCP, the security engine 200 can represent the bottom layer; the application layer refers to the layer that contains encrypted data-related services, which can be a general term for the upper layer of the security engine 200, such as the transport layer, session layer, etc.

[0043] The application layer inputs the data to be processed into the security engine 200 and enters the data transmission path (Data Path) in the security engine 200. The MUX 210 in the path selects one or more encryption modules, such as the Snow 3G module 230, and inputs the data to be processed into the module for encryption; at the same time, the hidden control module 220 interferes with the power consumption information during the encryption process. After the encryption is completed, the ciphertext data corresponding to the data to be processed is obtained and output to the application layer through the data transmission path.

[0044] Figure 3 An exemplary process of the encryption method is shown, which may include the following steps S310 and S320:

[0045] Step S310, selecting at least one first module and at least one second module from a plurality of preset encryption modules; wherein different encryption modules use different encryption algorithms;

[0046] Step S320, controlling the first module to encrypt the data to be processed, and controlling the second module to encrypt the interference data.

[0047] Through the above method, while encrypting the data to be processed, another encryption module is controlled to encrypt the interference data. On the one hand, the power consumption information leaked to the outside during encryption is the superposition result of the two encryption processes, which conceals the real power consumption information and increases the difficulty for attackers to crack the encrypted information through power consumption analysis. On the other hand, this solution is applicable to both hardware and software implementation, with low cost and high availability.

[0048] Below Figure 3 Each step in the procedure is described in detail.

[0049] In step S310, at least one first module and at least one second module are selected from a plurality of preset encryption modules.

[0050] The encryption module is the algorithm module that actually performs data encryption processing, such as Figure 2 The Snow 3G module 230, ZUC module 240, and AES module 250 in the security engine are configured. In this exemplary embodiment, multiple encryption modules are provided in the security engine, each module adopts a different encryption algorithm, and a first module and a second module are selected from them. The first module is used for data encryption, and the second module is used for generating interference information. Exemplarily, the first module and the second module can be randomly selected in the encryption module.

[0051] In an optional embodiment, reference Figure 4 As shown, step S310 may include the following steps S410 and S420:

[0052] Step S410, selecting a first module from the above-mentioned multiple encryption modules through a data selector in the security engine;

[0053] Step S420: Select a second module from encryption modules other than the first module through the hidden control module in the security engine.

[0054] That is, first select the first module, and then select the second module from the remaining encryption modules. The first module is used for data encryption this time, and can be selected and actually started by the data selector. The second module is used to generate interference information, and can be selected and "pseudo-started" by the hidden control module.

[0055] It should be noted that the present disclosure does not limit the number of first modules and second modules. For example, the data to be processed can be divided into multiple groups, and the data of different groups can be encrypted by multiple first modules respectively; or interference information can be generated by multiple second modules to increase the difficulty of power consumption analysis.

[0056] In step S320, the first module is controlled to encrypt the data to be processed, and the second module is controlled to encrypt the interference data.

[0057] The interference data can be any data other than the data to be processed, such as random data or data that needs to be encrypted in other applications. While the first module encrypts the data to be processed, the second module encrypts the interference data. The power consumption of the two encryption processes is superimposed together, which realizes the concealment of the power consumption information of the encryption process of the first module. In this way, the power consumption information of the encryption process of the data to be processed cannot be obtained from the outside, and power consumption analysis attacks cannot be carried out.

[0058] In an optional implementation, first random data may be generated as interference data, and the result of encrypting the interference data by the second module is not actually used, which is equivalent to "idle running" the second module, generating interfering power consumption. The first random data may be a true random number or a pseudo-random number, which is not particularly limited in the present disclosure.

[0059] Furthermore, the first random data can be generated according to the data to be processed, such as the first random data can have the same or similar number of bits, data volume, complexity, etc. as the data to be processed. Exemplarily, the number of bits, data volume, and complexity of the data to be processed are determined, and then the number of bits, data volume, and complexity of the data to be processed are respectively taken as the center value, and a certain margin is added to obtain the number of bits range, data volume range, and complexity range, and then the first random data satisfying the range is generated. As a result, when the second module encrypts the interference data, it can generate more interfering power consumption.

[0060] For example, the first module is an AES module and the second module is a ZUC module. When the AES module is started to encrypt the data to be processed, the ZUC module is also started to encrypt the first random data input by the application layer. If an attacker monitors the power consumption, what is obtained is the result of the superposition of the AES encryption power consumption curve and the ZUC encryption power consumption curve, and it is impossible to separate a single power consumption curve, thereby increasing the difficulty of the attack.

[0061] In addition to the above-mentioned encryption process of adding interference to conceal the real power consumption information, this exemplary embodiment can also add interference information to the encryption algorithm itself. The following two methods are provided:

[0062] Method 1: Reference Figure 5 As shown, the encryption of the data to be processed can be achieved by executing the following steps S510 and S520:

[0063] Step S510, using the second random data as a mask to generate a masked key stream;

[0064] Step S520: encrypt the data to be processed using the key stream to obtain ciphertext data.

[0065] Taking the AES module as an example, its workflow can be referred to Figure 6As shown, the AES module may include an encoder / decoder, an algorithm controller and a key generator. Parameters related to the encryption algorithm, such as the initial key, length, count, etc., may be input by the application layer. The key generator may generate a key stream based on the initial key; then, the algorithm controller loads the code of the encryption algorithm; and the encoder / decoder performs data encryption processing. In practical applications, the plain text of the data to be processed is input into the first module, and the first module uses a set of random numbers (second random data) as a mask to mask the key stream generated by the key generator. Specifically, the second random data may be XORed with the key stream to obtain a masked key stream, and then the plain text may be encrypted to obtain the ciphertext data (Cipher text) corresponding to the data to be processed, that is, Cipher text = Plain text^KeyStream^RNG2, where RNG2 represents the second random data. The processing process of the above-mentioned AES module is fully applicable to other encryption modules.

[0066] In an optional embodiment, Figure 5 The steps shown can be performed by the first module alone, for example, the second random data and the data to be processed are input into the first module, the first module uses the second random data to perform mask processing on the key stream, and then encrypts the data to be processed. In another optional implementation, Figure 5 The steps shown can be performed jointly by the first module and other modules. For example, the first module generates a key stream, and a mask processing module or a random data generation module provided separately uses the second random data as a mask to mask the key stream, and then inputs the masked key stream into the first module; the first module then uses the key stream to encrypt the data to be processed.

[0067] By introducing a mask, mask protection can be provided for the key stream, so that the information of the key stream will not be leaked during the above encryption process, further increasing the monitoring power consumption and the difficulty of attack cracking.

[0068] If the data to be processed is communication data, that is, data that needs to be sent, the normal use of the receiving end also needs to be considered.

[0069] In an optional implementation, the ciphertext data can be unmasked by the above-mentioned mask (i.e., the second random data), and the unmasked ciphertext data is sent. Generally, the sending end can store the second random data, for example, storing the second random data in a specific register or RAM (Random Access Memory), and after the encryption is completed, the second random data is read and the ciphertext data is unmasked. Specifically, the ciphertext data can be XORed with the second random data to obtain the unmasked ciphertext data, which is then sent to the receiving end. In this way, after receiving the ciphertext data, the receiving end can decrypt the data normally through the key stream without the mask information.

[0070] The unmasking process can be performed in the security engine or by the application layer.

[0071] In an optional implementation, the sending end may also send ciphertext data and a mask. Generally, a random data path may be added between the sending end and the receiving end, and the path is used to transmit the mask (i.e., the second random data). The receiving end may use the key stream and the second random data to decode the ciphertext data, i.e., Plain text = Cipher text^KeyStream^RNG2. In this way, the sending end does not need to remove the mask, and does not need to store the second random data separately. In the transmission process of the ciphertext data, a layer of protection of the mask is added, which can provide a higher level of security. Furthermore, in order to improve the protection of the mask itself, the mask may also be encrypted and transmitted. For example, the sending end uses a pre-agreed asymmetric encryption public key to encrypt the mask, and then transmits it to the receiving end. The receiving end uses the corresponding private key to decrypt and obtain the mask.

[0072] Method 2: Reference Figure 7 As shown, the encryption of the data to be processed can also be achieved by executing the following steps S710 and S720:

[0073] Step S710, masking the preset parameters of the first module by using third random data;

[0074] Step S720, using the preset parameters after masking to generate a key stream, and using the key stream to encrypt the data to be processed to obtain ciphertext data.

[0075] The preset parameters are one or more parameters used by the encryption algorithm, which are generally used to generate the key stream, including but not limited to: initial key, count, length, etc. Using the third random data as a mask to mask the preset parameters is equivalent to adding a layer of mask protection inside the encryption algorithm. Figure 8As shown in the figure, taking the preset parameter as the initial key as an example, after the application layer inputs the set parameters into the AES module, the AES module performs an XOR operation on the initial key through the third random data to generate a masked initial key, and then uses the masked initial key to generate a key stream, and then uses the key stream to encrypt the data to be processed. In this encryption process, mask protection is implemented from the initial key stage. This protection method can cover the generation of the key stream, the encryption of the data to be processed, etc., thereby achieving more comprehensive protection and further increasing the difficulty of power consumption analysis attacks.

[0076] In an optional embodiment, Figure 7 The steps shown can be performed by the first module alone, for example, the third random data and the data to be processed are input into the first module, the first module uses the third random data to perform mask processing of preset parameters, regenerates the key stream, and then encrypts the data to be processed. In another optional implementation, Figure 7 The steps shown can be performed by the first module and other modules together. For example, after the application layer determines the preset parameters for generating the key stream, it first inputs them into the mask processing module or the random data generation module. In this module, the preset parameters are masked using the third random data as a mask, and then the masked preset parameters are input into the first module; the first module then uses the preset parameters to generate the key stream and encrypts the data to be processed.

[0077] It should be understood that in practical applications, the above-mentioned method 1 or method 2 can be selected according to specific needs. In an optional implementation, the above-mentioned method 1 and method 2 can also be combined, that is, the preset parameters are masked by the third random data, and after the key stream is generated, the key stream is masked by the second random data, thereby achieving double protection with higher security.

[0078] It should be noted that the first, second and third random data may be different random numbers that are independent of each other. Fig. 9 As shown, based on Figure 2The security engine 200 in the security engine 200 may be increased with a random data generation module 260, which may be deployed in the security engine 200 to directly output random data to each encryption module, such as generating first random data and outputting it to the second module, generating second random data or third random data and outputting it to the first module. In addition, the random data generation module 260 may also be deployed in the application layer, and after generating the random data, the random data may be transmitted to the corresponding encryption module through the data port and the data transmission path between the application layer and the application engine 200. In an optional embodiment, the random data generation module 260 may also perform mask processing, such as using the second random data as a mask to mask the key stream generated by the first module, and using the third random data as a mask to mask the preset parameters of the first module.

[0079] The exemplary embodiment of the present disclosure also provides an encryption device that can be deployed in a security engine. Fig.10 As shown, the encryption device 1000 may include:

[0080] The selection unit 1010 selects at least one first module and at least one second module from a plurality of preset encryption modules; wherein different encryption modules use different encryption methods;

[0081] The control unit 1020 is used to control the first module to encrypt the data to be processed, and control the second module to encrypt the interference data.

[0082] In an optional implementation, the interference data may be random data.

[0083] In an optional implementation, the control unit 1020 is further configured to:

[0084] First random data is generated according to the data to be processed to serve as interference data.

[0085] In an optional implementation, the control unit 1020 is configured to:

[0086] Using the second random data as a mask, generating a masked key stream;

[0087] The data to be processed is encrypted using the above key stream to obtain ciphertext data.

[0088] In an optional implementation, the control unit 1020 is further configured to demask the ciphertext data using the mask; the encryption device may further include an interaction unit configured to send the demasked ciphertext data.

[0089] In an optional implementation, the encryption device 1000 may further include an interaction unit for sending ciphertext data and a mask.

[0090] In an optional implementation, the control unit 1020 is configured to:

[0091] Masking the preset parameters of the first module by using the third random data;

[0092] A key stream is generated using preset parameters that have been masked, and the data to be processed is encrypted using the key stream to obtain ciphertext data.

[0093] In an optional implementation, the above-mentioned multiple encryption modules are located in a security engine of the Packet Data Convergence Protocol PDCP.

[0094] In an optional implementation, the selection unit 1010 is configured to:

[0095] Selecting a first module from a plurality of encryption modules through a data selector in a security engine;

[0096] A second module is selected from encryption modules other than the first module through a hidden control module in the security engine.

[0097] In an optional implementation, the encryption algorithm includes but is not limited to Snow 3G algorithm, ZUC algorithm, and AES algorithm.

[0098] The specific details of each part of the above device have been described in detail in the implementation method part, so they will not be repeated here.

[0099] The exemplary embodiments of the present disclosure further provide a computer-readable storage medium, which can be implemented in the form of a program product, including a program code. When the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification, for example, to execute Figure 3 , Figure 4 , Figure 5 or Figure 7 The program product may be in the form of a portable compact disk read-only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0100] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0101] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0102] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0103] Program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0104] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuit", "module" or "system".

[0105] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and embodiments are to be regarded as exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

[0106] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. An encryption method, characterized in that: include: Selecting at least one first module and at least one second module from a plurality of preset encryption modules; wherein different encryption modules use different encryption algorithms; Controlling the first module to encrypt the data to be processed, and controlling the second module to encrypt the interference data at the same time; the interference data is data other than the data to be processed; The interference data is generated in the following manner: taking the number of bits, the amount of data, and the complexity of the data to be processed as the center value, adding a certain margin to obtain a number of bits range, a data amount range, and a complexity range, and generating first random data within the number of bits range, the data amount range, and the complexity range as the interference data; The controlling the first module to encrypt the data to be processed includes: masking the preset parameters of the first module through third random data; generating a key stream using the masked preset parameters, and encrypting the data to be processed using the key stream to obtain ciphertext data.

2. The method according to claim 1, characterized in that The first module is an AES module, and the second module is a ZUC module.

3. The method according to claim 1, characterized in that The controlling the first module to encrypt the data to be processed includes: dividing the data to be processed into multiple groups, and encrypting data of different groups respectively by multiple first modules.

4. The method according to claim 1, characterized in that The controlling the first module to encrypt the data to be processed includes: Using the second random data as a mask, generating a masked key stream; The data to be processed is encrypted using the key stream to obtain ciphertext data.

5. The method according to claim 4, characterized in that The method further comprises: The ciphertext data is unmasked by using the mask, and the unmasked ciphertext data is sent.

6. The method according to claim 4, characterized in that The method further comprises: The ciphertext data and the mask are sent.

7. The method according to claim 1, characterized in that The multiple encryption modules are located in a security engine of a packet data convergence protocol PDCP.

8. The method according to claim 7, characterized in that The selecting at least one first module and at least one second module from a plurality of preset encryption modules comprises: Selecting the first module from among the multiple encryption modules through a data selector in the security engine; The second module is selected from the encryption modules other than the first module through the hidden control module in the security engine.

9. The method according to any one of claims 1 to 8, characterized in that: The encryption algorithms include Snow 3G, Zu Chongzhi's algorithm ZUC, and Advanced Encryption Standard AES algorithm of the 3G communication system.

10. An encryption device, characterized in that: include: A selection unit, which selects at least one first module and at least one second module from a plurality of preset encryption modules; wherein different encryption modules adopt different encryption methods; A control unit, configured to control the first module to encrypt the data to be processed, and simultaneously control the second module to encrypt the interference data; the interference data is data other than the data to be processed; The interference data is generated in the following manner: taking the number of bits, the amount of data, and the complexity of the data to be processed as the center value, adding a certain margin to obtain a number of bits range, a data amount range, and a complexity range, and generating first random data within the number of bits range, the data amount range, and the complexity range as the interference data; The controlling the first module to encrypt the data to be processed includes: masking the preset parameters of the first module through third random data; generating a key stream using the masked preset parameters, and encrypting the data to be processed using the key stream to obtain ciphertext data.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

12. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to perform the method of any one of claims 1 to 9 by executing the executable instructions.

Images