Encryption method identification method, device and storage medium

Abstract

The present application discloses an encryption method identification method, device and storage medium, which relates to the field of network security, in order to quickly determine the encryption method. The specific scheme is: obtain the data to be decrypted; use N encryption methods to decrypt the data to be decrypted respectively to obtain N decryption results, and calculate the information entropy of the data to be decrypted and the information entropy of the N decryption results; according to the N encryption methods, the N decryption results, the information entropy of the data to be decrypted and the information entropy of the N decryption results, obtain the target decryption result and the encryption method corresponding to the target decryption result. The present application is used in the data decryption process.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to an encryption identification method, device and storage medium. Background Art

[0002] When transmitting data in a message, in addition to strong encryption with a key, weak encryption without a key can also be used. Usually, weak encryption will be used for multiple layers of encryption, making the encryption method and the number of encryption layers unknown. When cracking, it is not certain which encryption method was used for encryption. Summary of the invention

[0003] The embodiments of the present application provide an encryption method identification method, device and storage medium to achieve rapid determination of the encryption method.

[0004] In order to achieve the above technical objectives, the embodiments of the present application adopt the following technical solutions:

[0005] In a first aspect, the present application provides a method for identifying an encryption method, the method comprising: obtaining data to be decrypted; using N encryption methods to respectively decrypt the data to be decrypted to obtain N decryption results, and calculating the information entropy of the data to be decrypted and the information entropy of the N decryption results; obtaining a target decryption result and an encryption method corresponding to the target decryption result based on the N encryption methods, the N decryption results, the information entropy of the data to be decrypted, and the information entropy of the N decryption results.

[0006] From the above, it can be seen that the encryption method identification method provided by the present application is based on the principle that the information entropy of the data during the encryption process will increase, and the information entropy of the data during the correct decryption process will decrease. When decrypting each layer, N encryption methods are traversed to try to decrypt the decrypted data, and the information entropy of the data before and after decryption is calculated. According to the N encryption methods, the N decryption results after decrypting the decrypted data with the N encryption methods and the information entropy of the data to be decrypted before decryption and the information entropy of the N decryption results, the target decryption result and the encryption method corresponding to the target decryption result are obtained. The optimal decryption result and encryption method are indicated by the information entropy, so that the encryption method can be quickly determined.

[0007] In some embodiments of the present application, the encryption method is a weak encryption method, which refers to encryption according to encryption rules instead of encryption using a key. Decryption of data in the weak encryption method can be convenient because the key does not need to be known.

[0008] In other embodiments of the present application, the target decryption result includes a decryption result whose information entropy is less than the information entropy of the data to be decrypted among the N decryption results. Based on the principle that the information entropy of the data during the encryption process will increase and the information entropy of the data during the correct decryption process will decrease, if the decryption result whose information entropy is less than the information entropy of the data to be decrypted indicates that the correct encryption method is more likely to be obtained.

[0009] In some other embodiments of the present application, the first encryption method among the N encryption methods corresponds to a first threshold, and when the information entropy of the decryption result corresponding to the first encryption method is reduced by a value greater than or equal to the first threshold compared with the information entropy of the data to be decrypted, the decryption result corresponding to the first encryption method belongs to the target decryption result. Different encryption methods have different degrees of reduction in information entropy.

[0010] In some other embodiments of the present application, the following further includes: when the information entropy of the target decryption result meets the condition, the target decryption result is used as the data to be decrypted for the next round of decryption. Decryption of multiple encryptions can be achieved.

[0011] In other embodiments of the present application, the information entropy of the target decryption result satisfies a condition, including: the value of the information entropy of the target decryption result relative to the information entropy of the data to be decrypted is greater than a second threshold. When there are multiple target decryption results, the decryption result and decryption method can be selected from them.

[0012] In other embodiments of the present application, according to N encryption methods, N decryption results, information entropy of the data to be decrypted, and information entropy of the N decryption results, a target decryption result and an encryption method corresponding to the target decryption result are obtained, including: inputting the N encryption methods, N decryption results, information entropy of the data to be decrypted, and information entropy of the N decryption results into a machine learning model to obtain a target decryption result and an encryption method corresponding to the target decryption result. More complex decryption can be achieved through a machine learning model.

[0013] In a second aspect, the present application provides an encryption method identification device, including an acquisition module for acquiring data to be decrypted; a decryption module for decrypting the data to be decrypted using N encryption methods to obtain N decryption results, and calculating the information entropy of the data to be decrypted and the information entropy of the N decryption results; a judgment module for obtaining a target decryption result and an encryption method corresponding to the target decryption result based on the N encryption methods, the N decryption results, the information entropy of the data to be decrypted, and the information entropy of the N decryption results.

[0014] According to a third aspect, an encryption method identification device is provided, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute instructions to implement the encryption method identification method provided in the first aspect above.

[0015] In a fourth aspect, the present application provides a computer-readable storage medium, comprising instructions. When the instructions are executed on a computer, the computer is caused to execute the method provided in the first aspect.

[0016] In a fifth aspect, the present application provides a computer program product, which, when executed on a computer, enables the computer to execute the method provided in the first aspect above.

[0017] It should be noted that the above instructions may be stored in whole or in part on a computer-readable storage medium. The computer-readable storage medium may be packaged together with the processor of the encrypted identification device, or may be packaged separately from the processor of the encrypted identification device, which is not limited in this application.

[0018] The description of the second, third, fourth and fifth aspects of this application can refer to the detailed description of the first aspect; and the beneficial effects described in the second, third, fourth and fifth aspects can refer to the beneficial effect analysis of the first aspect, which will not be repeated here.

[0019] In this application, the above names do not limit the identification devices or functional modules of the encryption method. In actual implementation, these identification devices or functional modules of the encryption method may appear with other names. As long as the functions of the identification devices or functional modules of each encryption method are similar to those of this application, they belong to the scope of the claims of this application and their equivalent technologies.

[0020] These and other aspects of the present application will become more apparent from the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a schematic diagram of an implementation environment involved in an encryption identification method provided in an embodiment of the present application;

[0022] Figure 2 It is a structural flow chart of an identification device in an encryption mode provided in an embodiment of the present application;

[0023] Figure 3 It is a structural flow chart of another encryption method identification device provided in an embodiment of the present application;

[0024] Figure 4 It is a flowchart of an encryption identification method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] First, some concepts involved in this application are described:

[0026] Strong encryption: A secret key is used during the encryption process and cannot be directly cracked by an algorithm, such as RSA (Ron Rivest, Adi Shamir, Leonard Adleman) encryption. Both symmetric and asymmetric encryption are strong encryption.

[0027] Symmetric encryption: Symmetric encryption means that the same key is used for encryption and decryption, usually called the session key.

[0028] Asymmetric encryption: Asymmetric encryption means using different keys for encryption and decryption, usually including two keys - public key and private key. The public key is used for encryption and the private key is used for decryption. The public key and private key are used in pairs, otherwise they cannot be decrypted correctly.

[0029] Weak encryption: Encryption is performed according to certain encryption rules (such as encoding, substitution, displacement and other algorithms). That is, no key is used for encryption during the encryption process, and the other side can reversely decrypt according to the encryption rules, such as Base64 encryption.

[0030] In software application development, data encryption has become a common requirement, but there is no unified requirement in the industry for the encryption level of data encryption during data transmission. As mentioned above, encryption methods include strong encryption and weak encryption. Under normal circumstances, strong encryption methods that require keys are usually used to complete encryption, but the transmission key is also a technically difficult problem to solve. Therefore, in many data transmission scenarios, multiple weak encryption methods are used to make the data look like strong encryption, making the original data difficult to crack.

[0031] When the weak encryption method is unknown and the number of encryption layers is unknown, if all encryption methods are traversed for all decryption results of the previous layer when decrypting each layer, the decryption efficiency will be extremely low. To this end, based on the principle that the information entropy of the data during the encryption process will increase, and the information entropy of the data during the correct decryption process will decrease, the embodiment of the present application provides an encryption method identification method, device and storage medium. When decrypting each layer, multiple encryption methods are traversed to try to decrypt the data, and the information entropy of the data before and after decryption is calculated. According to the decryption method, decryption result, and the information entropy of the data before decryption and the information entropy of the decryption result after decryption, the target decryption result and the encryption method corresponding to the target decryption result are obtained. The optimal decryption result and encryption method are indicated by the information entropy, so that the encryption method can be quickly determined.

[0032] In particular, the machine learning model can be input and select at least one set of preferred decryption results and encryption methods according to the degree of reduction in information entropy. It can also further determine whether to perform the next level of decryption on the preferred decryption results, thereby quickly decoding multiple encryption methods.

[0033] like Figure 1 As shown, an application scenario for identifying the encryption method of data is provided. In the message transmitted from the first device 11 to the second device 12, the encrypted (multiple encrypted) data is carried, and the encryption method identification device 13 obtains the message by capturing the packet, and then obtains the encrypted data, so as to identify the encryption method.

[0034] It should be noted that the encryption method identification method, device and storage medium provided in the embodiments of the present application can be applied not only to the above-mentioned data transmission scenario, but also to the scenario of describing the encryption method of locally stored data.

[0035] like Figure 2 As shown, in the case of dividing the modules according to functions, the encryption method recognition device 13 provided in the embodiment of the present application may include an acquisition module 21, a decryption module 22 and a judgment module 23, which are used to perform the following steps: Figure 4 The identification method of the encryption method shown.

[0036] like Figure 3 As shown, in the case of adopting an integrated unit, the encryption identification device 13 provided in the embodiment of the present application may include a processor 31, a memory 32 and a communication interface 33. Figure 2 The modules shown can be integrated into the processor 31. The communication interface 33 is used to communicate with other devices, such as obtaining messages from the network. The memory 32 is used to store executable instructions for the processor 31 to execute, so that the processor 31 can implement the following when executing the instructions. Figure 4 The identification method of the encryption method shown.

[0037] like Figure 4 As shown, the encryption method identification method provided in the embodiment of the present application includes:

[0038] S401, obtaining data to be decrypted.

[0039] This step can be performed by the acquisition module 21 described above.

[0040] For example, a Hyper Text Transfer Protocol (HTTP) message transmitted during a transaction between the first device 11 and the second device 12 can be obtained, and the encryption parameters included in the message can be used as the data to be decrypted. Specifically, this can be accomplished by using HTTP message interception tools such as burpsuite and fidder.

[0041] S402, using N encryption methods to respectively decrypt the data to be decrypted to obtain N decryption results, and calculating the information entropy of the data to be decrypted and the information entropy of the N decryption results.

[0042] This step can be performed by the decryption module 22 described above.

[0043] These N encryption methods can be the weak encryption methods mentioned above, and the decryption process is the inverse process of the encryption process. The information entropy of the data to be decrypted before decryption is calculated. Using each encryption method to decrypt the data to be decrypted can obtain a decryption result, and the information entropy of the decryption result is calculated. Therefore, one encryption method can obtain a decryption result and the information entropy of the decryption result.

[0044] The calculation formula of information entropy H(x) is as follows:

[0045] H(x)=E[log(2,1 / P(Xi))]=-∑P(Xi)log(2,P(Xi))(i=1,2,..n) Formula 1

[0046] Wherein, E[] represents expectation; P(xi) represents the probability of occurrence of random variable Xi; Xi represents a random variable. In the embodiment of the present application, it is assumed that a character may take n values ​​as a symbol set. When calculating the information entropy of the data to be decrypted, Xi represents that each character of the data to be decrypted adopts a value in the symbol set. When calculating the information entropy of the decryption result, Xi represents that each character of the decryption result adopts a value in the symbol set.

[0047] S403. Obtain a target decryption result and an encryption method corresponding to the target decryption result according to the N encryption methods, the N decryption results, the information entropy of the data to be decrypted, and the information entropy of the N decryption results.

[0048] This step can be performed by the judgment module 23 mentioned above.

[0049] Based on the principle that the information entropy of data during the encryption process will increase, while the information entropy of data during the correct decryption process will decrease, the decryption result with an information entropy smaller than that of the data to be decrypted can be selected from N decryption results as the target decryption result, and the encryption method corresponding to the target decryption result can be determined (i.e., the encryption method used when decrypting to obtain the target decryption result).

[0050] Furthermore, a threshold may correspond to each of the N encryption methods. When the information entropy of the decryption result corresponding to the encryption method is reduced by a value greater than or equal to the threshold compared with the information entropy of the data to be decrypted, the decryption result obtained by the encryption method belongs to the target decryption result.

[0051] In addition, a decision can also be made through a machine learning model to determine the target decryption result and the corresponding encryption method in a more complex way, such as inputting N encryption methods, N decryption results, the information entropy of the data to be decrypted, and the information entropy of the N decryption results into the machine learning model to obtain the target decryption result and the encryption method corresponding to the target decryption result. The machine learning model may include a decision tree model, a Bayesian model, etc., which is not limited in this application. Among them, the efficiency of the decision tree model will be better than the efficiency of the Bayesian model.

[0052] Of course, the machine learning model must be trained in advance. During the training process, the original data (corresponding to the decryption result in the decryption process), an encryption method, the encryption result obtained after the original data is encrypted by the encryption method (corresponding to the data to be decrypted in the decryption process), the information entropy of the original data, and the information entropy of the encryption result are used as a set of input sets for the machine learning model. Multiple sets of input sets obtained by the same original data through multiple encryption methods are input into the machine learning model and trained to obtain a trained machine learning model.

[0053] The target decryption result is not limited to one, and there may be multiple ones. The decryption result with the largest reduction in information entropy of the decryption result relative to the information entropy of the data to be decrypted may be selected as the decrypted plaintext to be output to the user.

[0054] In addition, when the information entropy of the target decryption result meets the conditions, the target decryption result is used as the data to be decrypted for the next round of decryption, and the multi-layer encrypted data can be decrypted. For example, if the information entropy of the target decryption result is reduced by a value greater than a threshold relative to the information entropy of the data to be decrypted, the target decryption result can be used as the data to be decrypted for the next round of decryption. Otherwise, the target decryption result can be output to the user as the decrypted plaintext.

[0055] From the above, it can be seen that the encryption method identification method provided by the present application is based on the principle that the information entropy of the data during the encryption process will increase, and the information entropy of the data during the correct decryption process will decrease. When decrypting each layer, N encryption methods are traversed to try to decrypt the decrypted data, and the information entropy of the data before and after decryption is calculated. According to the N encryption methods, the N decryption results after decrypting the decrypted data with the N encryption methods and the information entropy of the data to be decrypted before decryption and the information entropy of the N decryption results, the target decryption result and the encryption method corresponding to the target decryption result are obtained. The optimal decryption result and encryption method are indicated by the information entropy, so that the encryption method can be quickly determined.

[0056] It should be noted that, in order to realize the above functions, the identification device of the above encryption method includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the embodiments of the present application.

[0057] The embodiment of the present application can divide the functional modules of the recognition device of the above encryption method according to the above method example. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0058] The embodiment of the present application also provides a computer-readable storage medium, which includes computer instructions. When the computer instructions are executed on the above-mentioned encryption recognition device, the encryption recognition device performs each function or step in the above-mentioned method embodiment. For example, the computer-readable storage medium can be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), a magnetic tape, a floppy disk, and an optical data storage device.

[0059] The embodiment of the present application also provides a computer program product. When the computer program product runs on the above-mentioned encryption method identification device, the above-mentioned encryption method identification device performs each function or step in the above-mentioned method embodiment.

[0060] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0061] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0062] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0063] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0064] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks or optical disks.

[0065] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application shall be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. An encrypted identification method, characterized in that: The method comprises: Obtain the data to be decrypted; Decrypt the data to be decrypted using N encryption methods to obtain N decryption results, and calculate the information entropy of the data to be decrypted and the information entropy of the N decryption results; Obtaining a target decryption result and an encryption method corresponding to the target decryption result according to the N encryption methods, the N decryption results, the information entropy of the data to be decrypted, and the information entropy of the N decryption results; The encryption method is a weak encryption method, which refers to encryption according to encryption rules without using a key for encryption.

2. The method according to claim 1, characterized in that The target decryption result includes a decryption result whose information entropy is smaller than the information entropy of the data to be decrypted among the N decryption results.

3. The method according to claim 1, characterized in that The first encryption method among the N encryption methods corresponds to a first threshold. When the information entropy of the decryption result corresponding to the first encryption method is reduced by a value greater than or equal to the first threshold compared with the information entropy of the data to be decrypted, the decryption result corresponding to the first encryption method belongs to the target decryption result.

4. The method according to claim 1, characterized in that Also includes: When the information entropy of the target decryption result meets the condition, the target decryption result is used as the data to be decrypted for the next round of decryption.

5. The method according to claim 4, characterized in that The information entropy of the target decryption result satisfies the following conditions: The value by which the information entropy of the target decryption result decreases relative to the information entropy of the data to be decrypted is greater than a second threshold.

6. The method according to any one of claims 1 to 5, characterized in that: The obtaining, according to the N encryption methods, the N decryption results, the information entropy of the data to be decrypted, and the information entropy of the N decryption results, a target decryption result and an encryption method corresponding to the target decryption result, comprises: The N encryption methods, the N decryption results, the information entropy of the data to be decrypted, and the information entropy of the N decryption results are input into a machine learning model to obtain the target decryption result and the encryption method corresponding to the target decryption result.

7. An encrypted identification device, characterized in that: include: An acquisition module, used for acquiring data to be decrypted; A decryption module, used to respectively decrypt the data to be decrypted using N encryption methods to obtain N decryption results, and calculate the information entropy of the data to be decrypted and the information entropy of the N decryption results; A judgment module, used to obtain a target decryption result and an encryption method corresponding to the target decryption result according to the N encryption methods, the N decryption results, the information entropy of the data to be decrypted, and the information entropy of the N decryption results; The encryption method is a weak encryption method, which refers to encryption according to encryption rules without using a key for encryption.

8. An encrypted identification device, characterized in that: include: A processor, and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that: Instructions are stored, and when the instructions are executed by a processor of an identification device in an encrypted manner, the processor is caused to execute the method according to any one of claims 1 to 6.

Images