Data Deployment Method, System, Medium, and Their Terminals and Devices

Abstract

The present invention provides a data deployment method, system, medium, and its terminal and device. The method includes: decrypting the encrypted public key in the trusted storage space of the terminal using a preset symmetric key to obtain the public key in the key pair; receiving first signature data from the deployment device; decrypting the first signature data using the public key to obtain a first random number; encrypting the first random number and the feature identifier of the terminal using the public key to obtain first encrypted data; sending the first encrypted data to the deployment device, where the first encrypted data is used to verify whether the terminal is a legitimate terminal; receiving second signature data from the deployment device, verifying the signature of the second signature data, and when the signature verification passes, decrypting the sensitive data from the second signature data. Through the mutual authentication between the deployment device and the terminal, the present invention realizes the deployment of sensitive information, reduces the requirements for the storage space of the terminal, and facilitates the replacement of the encrypted public key.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a data deployment method, system, medium, terminal and device thereof. Background Art

[0002] In the product mass production stage, in order to implement various key tools, a large amount of sensitive information needs to be written into the product, such as user sensitive information for Google authentication. For such important and valuable information, a high-security mechanism must be available to ensure its privacy, integrity and security at all stages.

[0003] Currently, the two-way authentication of the deployment scheme requires two pairs of public and private keys to be deployed in advance. However, the key length of the asymmetric encryption (RSA) algorithm is relatively large, which requires a large amount of device storage space. Moreover, after the public and private keys are deployed in advance to the storage space of the terminal, they cannot be updated. Summary of the Invention

[0004] The purpose of the present invention is to provide a data deployment method, system, medium, terminal and device thereof, which realizes the deployment of sensitive information, reduces the storage space of the terminal, and facilitates the replacement of the public key.

[0005] To achieve the above object, in a first aspect, the present invention provides a data deployment method, including: decrypting the encrypted public key in the trusted storage space of the terminal by using a preset symmetric key to obtain the public key in the key pair; receiving the first signature data from the deployment device; decrypting the first signature data by using the public key to obtain a first random number; encrypting the first random number and the feature identifier of the terminal by using the public key to obtain a first encrypted data; sending the first encrypted data to the deployment device, where the first encrypted data is used to verify whether the terminal is a legal terminal; receiving the second signature data from the deployment device; verifying the signature of the second signature data, and when the signature verification passes, decrypting and obtaining sensitive data from the second signature data.

[0006] The beneficial effect of the data deployment method provided by the present invention is that: through the two-way authentication between the deployment device and the terminal, the deployment of sensitive information is realized, and the privacy and security of data transmission are improved. Moreover, by presetting the symmetric key, the requirement for the storage space of the terminal is reduced. Storing the encrypted public key in the trusted storage space of the terminal facilitates the replacement of the encrypted public key.

[0007] Optionally, the symmetric key is pre-deployed to the secure storage area of the chip, and the chip is installed in the terminal. The beneficial effect is that: by pre-deploying the symmetric key to the secure storage area of the chip, the space of the secure storage area is reduced.

[0008] Optionally, the public key is saved as a ciphertext in the mirror file of the trusted storage space of the terminal. The beneficial effect is that: the public key is saved as a ciphertext in the mirror file of the trusted storage space of the terminal, which has a large space and is convenient for replacing the public key.

[0009] Optionally, encrypting the first random number and the feature identifier of the terminal with the public key to obtain first encrypted data includes: concatenating the first random number and the feature identifier to obtain concatenated data; encrypting the concatenated data with the public key to obtain the first encrypted data. The beneficial effect is that: by concatenating the data, the first random number and the feature identifier are combined together, increasing the privacy of the data.

[0010] In a second aspect, an embodiment of the present invention provides a data deployment method, which is applied to a deployment device. The method includes: generating a first random number, and signing and encrypting the first random number with the private key in a key pair to obtain first signature data; sending the first signature data to the terminal; receiving the first encrypted data from the terminal; decrypting the first encrypted data to obtain a second random number and a feature identifier; when the first random number is the same as the second random number and the feature identifier is matched in the identity database, determining that the terminal is a legitimate terminal; encrypting a transmission key and a sensitive data plaintext with the private key to obtain an encrypted transmission key and a sensitive data ciphertext, concatenating the sensitive data signature and the sensitive data ciphertext to form a sensitive data block, and concatenating the sensitive data block and the encrypted transmission key after ciphertext signing to obtain second signature data; sending the second signature data to the terminal.

[0011] The beneficial effect of the data deployment method provided by the present invention is that: by using different random numbers, replay attacks can be prevented, and the two-way authentication between the deployment device and the terminal is realized to deploy sensitive information, improving the privacy and security of data transmission.

[0012] Optionally, the transmission key is generated by using a third random number. The beneficial effect is that: it further ensures that replay attacks can be prevented.

[0013] Optionally, decrypting the first encrypted data to obtain a second random number includes: decrypting the first encrypted data with the private key to obtain concatenated data. Decomposing the concatenated data to obtain the second random number.

[0014] In a third aspect, an embodiment of the present invention provides a data deployment system for a terminal, including a first decryption module, which decrypts the encrypted public key in the trusted storage space of the terminal by using a preset symmetric key to obtain the public key in the key pair. A first receiving module, which receives first signature data from a deployment device. The first decryption module is further configured to verify and decrypt the first signature data by using the public key to obtain a first random number. A first encryption module, which encrypts the first random number and the feature identifier of the terminal by using the public key to obtain first encrypted data. A first verification module, which sends the first encrypted data to the deployment device, and the first encrypted data is used to verify whether the terminal is a legitimate terminal. The first receiving module is further configured to receive second signature data from the deployment device. The first verification module is further configured to verify the second signature data, and when the verification passes, decrypt the sensitive data from the second signature data.

[0015] The beneficial effects of the data deployment system provided by the present invention are as follows: Through the mutual authentication between the deployment device and the terminal, the deployment of sensitive information is realized, and the privacy and security of data transmission are improved. Moreover, by presetting the symmetric key, the requirement for the storage space of the terminal is reduced. Storing the encrypted public key in the trusted storage space of the terminal facilitates the replacement of the encrypted public key.

[0016] In a fourth aspect, an embodiment of the present invention provides a data deployment system for a deployment device, including: A second encryption module, which signs and encrypts a first random number generated by using the private key in the key pair to obtain first signature data. A sending module, which is configured to send the first signature data to the terminal. A second receiving module, which is configured to receive first encrypted data from the terminal. A second decryption module, which decrypts the first encrypted data to obtain a second random number and a feature identifier. A second verification module, which is configured to verify that when the first random number is the same as the second random number and the feature identifier is matched in the identifier database, it is determined that the terminal is a legitimate terminal. The second encryption module is further configured to encrypt the transmission key and the sensitive data plaintext by using the private key, sign the sensitive data plaintext by using the private key, splice the sensitive data ciphertext and the sensitive data signature to form the sensitive data block, and splice the sensitive data block and the encrypted transmission key after ciphertext signing to obtain second signature data. The sending module is further configured to send the second signature data to the terminal.

[0017] The beneficial effects of the data deployment system provided by the present invention are as follows: By using different random numbers, replay attacks can be prevented, and through the mutual authentication between the deployment device and the terminal, the deployment of sensitive information is realized, and the privacy and security of data transmission are improved.

[0018] In a fifth aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is run by a processor, the steps of the data deployment method are executed.

[0019] In a sixth aspect, an embodiment of the present invention provides a terminal, including a memory and a processor. A computer program that can run on the processor is stored on the memory, and when the processor runs the computer program, the steps of the data deployment method are executed.

[0020] In a seventh aspect, an embodiment of the present invention provides a deployment device, including a memory and a processor. A computer program that can run on the processor is stored on the memory, and when the processor runs the computer program, the steps of the data deployment method are executed. Description of the Drawings

[0021] Figure 1 It is a flowchart of the data deployment method applied to the terminal in the embodiment provided by the present invention;

[0022] Figure 2 It is a flowchart of the data deployment method applied to the deployment device in the embodiment provided by the present invention;

[0023] Figure 3 It is another flowchart of the data deployment method in the embodiment provided by the present invention;

[0024] Figure 4 It is a schematic structural diagram of the data deployment system in the embodiment provided by the present invention;

[0025] Figure 5 It is another schematic structural diagram of the data deployment system in the embodiment provided by the present invention. Detailed Embodiments

[0026] To make the objectives, technical solutions, and advantages of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein shall have the ordinary meaning as understood by those of ordinary skill in the art to which the present invention belongs. The words such as "including" used herein are intended to mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0027] In the mass production stage of terminal products, a large amount of sensitive information needs to be written into the products. For such important and valuable information, a high-security mechanism must be in place to ensure its privacy, integrity, and security at all stages. Currently, for the two-way authentication deployment solution, two pairs of public and private keys need to be deployed in advance. The key length of the asymmetric encryption (RSA) is relatively large, occupying a large amount of device storage space. Moreover, once the public and private keys are deployed in advance to the mobile phone storage space, they cannot be replaced.

[0028] In view of the problems existing in the prior art, an embodiment of the present invention provides a data deployment method, which is applied to a terminal. Referring to Figure 1 as shown, the method includes:

[0029] S101, the terminal decrypts the encrypted public key in the trusted storage space of the terminal by using a pre-set symmetric key to obtain the public key in the key pair.

[0030] In this step, the symmetric key is pre-deployed by the chip manufacturer to the secure storage area of the chip, and then the chip is installed in the terminal. By pre-setting the symmetric key to the secure storage area, the space of the secure storage area is reduced.

[0031] Among them, the public key is saved in the mirror file of the trusted storage space of the terminal in ciphertext form. This mirror file has a large space and is convenient for replacing the public key.

[0032] S102, the terminal receives the first signature data from the deployment device.

[0033] S103, the terminal verifies and decrypts the first signature data by using the public key to obtain a first random number.

[0034] S104, the terminal encrypts the first random number and the feature identifier of the terminal by using the public key to obtain a first encrypted data.

[0035] In this step, the first random number and the feature identifier can be concatenated to obtain concatenated data, and then the concatenated data is encrypted by using the public key to obtain the first encrypted data, thereby increasing the privacy of the data.

[0036] It should be noted that the feature identifier is the serial number of the terminal. Through the serial number, matching verification can be performed in the identification database to further verify the legality of the feature identifier.

[0037] S105, the terminal sends the first encrypted data to the deployment device, and the first encrypted data is used to verify whether the terminal is a legal terminal.

[0038] In this step, the deployment device verifies the legitimacy of the terminal.

[0039] S106. The terminal receives second signature data from the deployment device.

[0040] In this step, in order to further verify on the terminal.

[0041] S107. The terminal verifies the signature of the second signature data. When the signature verification passes, sensitive data is decrypted from the second signature data.

[0042] In this step, when the signature verification passes, sensitive data is decrypted from the second signature data, and the sensitive information is deployed to the terminal.

[0043] It should be noted that the sensitive information may be information (keybox) used for Google authentication and written into the terminal security storage area, the Keybox of Digital Rights Management (Widevine Level 1), the lc128 of High-bandwidth Digital Content Protection (HDCP), or other user private information. In this embodiment, the sensitive information is the keybox for Google authentication.

[0044] In this embodiment, through the mutual authentication between the deployment device and the terminal, the deployment of sensitive information is realized, improving the privacy and security of data transmission. Moreover, by presetting the symmetric key, the requirement for the terminal storage space is reduced. By storing the encryption public key in the terminal trusted storage space, it is convenient to replace the encryption public key.

[0045] In another embodiment disclosed in the present invention, a data deployment method is further provided, which is applied to a deployment device. Refer to Figure 2 As shown, this method includes:

[0046] S201. The deployment device generates a first random number, and signs and encrypts the first random number using the private key in the key pair to obtain first signature data.

[0047] In this step, the deployment device pre-generates a first random number, and then signs and encrypts the first random number using the private key in the key pair to obtain first signature data.

[0048] It should be noted that the private key and the public key disclosed above are a pair of key pairs.

[0049] S202. The deployment device sends the first signature data to the terminal.

[0050] S203, the deployment device receives the first encrypted data from the terminal.

[0051] S204, the deployment device decrypts the first encrypted data to obtain a second random number and a feature identifier.

[0052] S205, when the first random number is the same as the second random number and the feature identifier is matched in the identifier database, the deployment device determines that the terminal is a legitimate terminal.

[0053] In this step, it is determined whether the terminal is a legitimate terminal by judging whether the first random number is the same as the second random number.

[0054] S206, the deployment device encrypts the transmission key and the sensitive data plaintext using the private key to obtain an encrypted transmission key and a sensitive data ciphertext, and splices the sensitive data block and the encrypted transmission key after ciphertext signing to obtain a second signature data.

[0055] In this step, the transmission key is generated using a third random number.

[0056] S207, the deployment device sends the second signature data to the terminal.

[0057] In this step, the second signature data is sent to the terminal, and the terminal verifies the signature of the second signature data using the public key. When the verification passes, the sensitive data is decrypted from the second signature data.

[0058] In this embodiment, by using different random numbers, replay attacks can be prevented, and the two-way authentication between the deployment device and the terminal realizes the deployment of sensitive information, improving the privacy and security of data transmission.

[0059] It should be noted that the deployment device needs to maintain and save the feature identifier database of the terminal, and requires that when the chip is delivered to the terminal manufacturer at the time of factory shipment, the data file storing the feature identifier of the terminal is synchronously delivered, and the customer is required to import and save the data file to the deployment device in advance before the deployment of sensitive data.

[0060] To further illustrate the data interaction relationship between the terminal and the deployment device, refer to Figure 3 as shown in Figure 3 is another flowchart of the data deployment method, and this method includes:

[0061] S301, the deployment device generates a first random number, and signs and encrypts the first random number using the private key in the key pair to obtain a first signature data.

[0062] In this step, the deployment device pre-generates a first random number, and then signs and encrypts the first random number using the private key in the key pair to obtain first signature data.

[0063] It should be noted that the private key and the above-mentioned public key are a pair of key pairs.

[0064] S302. The terminal decrypts the encrypted public key in the terminal's trusted storage space using the pre-set symmetric key to obtain the public key in the key pair.

[0065] In this step, the symmetric key is pre-deployed by the chip manufacturer to the secure storage area of the chip, and then the chip is installed in the terminal. By pre-setting the symmetric key to be saved in the secure storage area, the space of the secure storage area is reduced.

[0066] Among them, the public key is saved in the mirror file of the terminal's trusted storage space in ciphertext form. This mirror file has a large space and is convenient for replacing the public key.

[0067] S303. The deployment device sends the first signature data to the terminal.

[0068] S304. The terminal receives the first signature data, and uses the public key to verify and decrypt the first signature data to obtain the first random number.

[0069] S305. The terminal encrypts the first random number and the terminal's feature identifier using the public key to obtain first encrypted data.

[0070] In this step, the first random number and the feature identifier can be data-concatenated to obtain concatenated data, and then the concatenated data is encrypted using the public key to obtain the first encrypted data, thereby increasing the privacy of the data.

[0071] S306. The terminal sends the first encrypted data to the deployment device.

[0072] In this step, the deployment device uses the first encrypted data to verify whether the terminal is a legal terminal.

[0073] S307. The deployment device decrypts the first encrypted data using the private key to obtain a second random number and a feature identifier.

[0074] S308. When the deployment device verifies that the first random number and the second random number are the same, and the feature identifier is matched in the identification database, it determines that the terminal is a legal terminal.

[0075] In this step, it is determined whether the terminal is a legal terminal by judging whether the first random number is the same as the second random number.

[0076] S309. The deployment device encrypts the transmission key and the plaintext of the sensitive data by using the private key to obtain the encrypted transmission key and the ciphertext of the sensitive data, splices the plaintext of the sensitive data and the ciphertext of the sensitive data to form a sensitive data block, and splices the sensitive data block and the encrypted transmission key after ciphertext signature to obtain the second signature data.

[0077] In this step, the transmission key is generated by using a third random number.

[0078] S310. The deployment device sends the second signature data to the terminal.

[0079] S311. The terminal verifies the signature of the second signature data. When the signature verification passes, the sensitive data is decrypted from the second signature data.

[0080] In still another embodiment disclosed by the present invention, a data deployment system is provided. Refer to Figure 4 As shown, the system includes a first decryption module 401 that decrypts the encrypted public key in the trusted storage space of the terminal by using a preset symmetric key to obtain the public key in the key pair. A first receiving module 402 that receives the first signature data from the deployment device. The first decryption module 401 is further configured to decrypt the first signature data by using the public key to obtain a first random number. A first encryption module 403 that encrypts the first random number and the feature identifier of the terminal by using the public key to obtain first encrypted data. A first verification module 404 that sends the first encrypted data to the deployment device, and the first encrypted data is used to verify whether the terminal is a legal terminal. The first receiving module 402 is further configured to receive the second signature data from the deployment device. The first verification module 404 is further configured to verify the signature of the second signature data. When the signature verification passes, the sensitive data is decrypted from the second signature data.

[0081] In the system provided in this embodiment, through the mutual authentication between the deployment device and the terminal, the deployment of sensitive information is realized, and the privacy and security of data transmission are improved. Moreover, by presetting the symmetric key, the requirement for the storage space of the terminal is reduced. Storing the encrypted public key in the trusted storage space of the terminal facilitates the replacement of the encrypted public key.

[0082] In still another embodiment disclosed by the present invention, a data deployment system is provided. Refer to Figure 5As shown, the system includes: a second encryption module 501 that signs and encrypts a first random number generated using the private key in a key pair to obtain first signature data. A sending module 502 for sending the first signature data to a terminal. A second receiving module 503 for receiving first encrypted data from the terminal. A second decryption module 504 for decrypting the first encrypted data to obtain a second random number. A second verification module 505 for verifying that when the first random number and the second random number are the same, determining that the terminal is a legitimate terminal. The second encryption module 501 is further configured to encrypt a transmission key using the private key to obtain an encrypted transmission key, and encrypt sensitive data using the encrypted transmission key to obtain second signature data. The sending module 502 is further configured to send the second signature data to the terminal.

[0083] In this embodiment, by using different random numbers, replay attacks can be prevented, and two-way authentication between the deployment device and the terminal is realized to deploy sensitive information, improving the privacy and security of data transmission.

[0084] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is run by a processor, the steps of the data deployment method are executed.

[0085] An embodiment of the present invention further provides a terminal, including a memory and a processor, where a computer program that can run on the processor is stored on the memory, and when the processor runs the computer program, the steps of the data deployment method are executed.

[0086] An embodiment of the present invention further provides a deployment device, including a memory and a processor, where a computer program that can run on the processor is stored on the memory, and when the processor runs the computer program, the steps of the data deployment method are executed.

[0087] The above is only the specific implementation manner of the embodiments of the present application, but the protection scope of the embodiments of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the embodiments of the present application should be covered by the protection scope of the embodiments of the present application. Therefore, the protection scope of the embodiments of the present application should be subject to the protection scope of the claims.

Claims

1. A data deployment method, characterized in that, it includes: Decrypt the encrypted public key in the terminal's trusted storage space using a pre - set symmetric key to obtain the public key in the key pair; Receive the first signature data from the deployment device; Verify and decrypt the first signature data using the public key to obtain the first random number; Encrypt the first random number and the feature identifier of the terminal using the public key to obtain the first encrypted data; Send the first encrypted data to the deployment device, and the first encrypted data is used to verify whether the terminal is a legitimate terminal; Receive the second signature data from the deployment device; Verify the second signature data, and when the verification passes, decrypt the sensitive data from the second signature data; Wherein, the symmetric key is pre - deployed to the secure storage area of the chip, and the chip is installed in the terminal.

2. The method according to claim 1, characterized in that, The public key is saved in the mirror file of the terminal's trusted storage space in ciphertext form.

3. The method according to claim 1, characterized in that, The step of encrypting the first random number and the feature identifier of the terminal using the public key to obtain the first encrypted data includes: Concatenate the first random number and the feature identifier to obtain concatenated data; Encrypt the concatenated data using the public key to obtain the first encrypted data.

4. A data deployment method, applied to a deployment device, characterized in that, the method includes: Generate a first random number, and sign and encrypt the first random number using the private key in the key pair to obtain the first signature data; Send the first signature data to the terminal; Receive the first encrypted data from the terminal; Decrypt the first encrypted data to obtain a second random number and a feature identifier; When the first random number is the same as the second random number and the feature identifier is matched in the identity database, determine that the terminal is a legitimate terminal; Encrypt the transmission key and the sensitive data plaintext using the private key to obtain the encrypted transmission key and the sensitive data ciphertext; Concatenate the sensitive data plaintext and the sensitive data ciphertext to form a sensitive data block; Perform ciphertext signature on the sensitive data block and the encrypted transmission key and then concatenate them to obtain the second signature data; Send the second signature data to the terminal.

5. The method according to claim 4, characterized in that, The transmission key is generated using a third random number.

6. The method according to claim 4, characterized in that, The step of decrypting the first encrypted data to obtain the second random number includes: Decrypt the first encrypted data using the private key to obtain concatenated data; Decompose the concatenated data to obtain the second random number.

7. A data deployment system for a terminal, characterized in that, it includes: A first decryption module, which decrypts the encrypted public key in the terminal's trusted storage space using a pre - set symmetric key to obtain the public key in the key pair; wherein, the symmetric key is pre - deployed to the secure storage area of the chip, and the chip is installed in the terminal; A first receiving module, which receives the first signature data from the deployment device; The first decryption module is further configured to verify and decrypt the first signature data by using the public key to obtain a first random number; The first encryption module encrypts the first random number and the feature identifier of the terminal by using the public key to obtain first encrypted data; The first verification module sends the first encrypted data to the deployment device, and the first encrypted data is used to verify whether the terminal is a legal terminal; The first receiving module is further configured to receive second signature data from the deployment device; The first verification module is further configured to verify the second signature data, and when the verification passes, decrypt the sensitive data from the second signature data.

8. A data deployment system for a deployment device Characterized in that It includes: The second encryption module signs and encrypts the first random number generated by using the private key in the key pair to obtain first signature data; The sending module is configured to send the first signature data to the terminal; The second receiving module is configured to receive the first encrypted data from the terminal; The second decryption module is configured to decrypt the first encrypted data to obtain a second random number and a feature identifier; The second verification module is configured to verify that when the first random number is the same as the second random number and the feature identifier is matched in the identification database, it is determined that the terminal is a legal terminal; The second encryption module is further configured to encrypt the transmission key and the sensitive data plaintext by using the private key to obtain an encrypted transmission key and a sensitive data ciphertext, splice the sensitive data plaintext and the sensitive data ciphertext to form a sensitive data block, and perform ciphertext signature on the sensitive data block and the encrypted transmission key and then splice them to obtain second signature data; The sending module is further configured to send the second signature data to the terminal.

9. A computer-readable storage medium, on which a computer program is stored, Characterized in that When the computer program is run by a processor, it executes the steps of the data deployment method according to any one of claims 1 to 6.

10. A terminal, including a memory and a processor, and a computer program that can run on the processor is stored on the memory, Characterized in that When the processor runs the computer program, it executes the steps of the data deployment method according to any one of claims 1 to 3.

11. A deployment device, including a memory and a processor, and a computer program that can run on the processor is stored on the memory, Characterized in that When the processor runs the computer program, it executes the steps of the data deployment method according to any one of claims 4 to 6.

Images