Firmware encryption and decryption method and device, computer device and readable storage medium

Abstract

Embodiments of the present application disclose a firmware encryption and decryption method and device, computer equipment and a readable storage medium, the encryption method comprising: obtaining a firmware address and firmware plaintext, respectively diffusing the firmware address and the firmware plaintext to obtain a diffusion address and diffusion plaintext; obtaining an encryption key, and using the encryption key to confuse the diffusion address to obtain a confusion key; according to a preset encryption function, using the confusion key to perform encryption operation on the diffusion plaintext to obtain intermediate ciphertext; and diffusing the intermediate ciphertext to obtain firmware ciphertext. By adding the information of the diffusion address in the encryption key, not only the difficulty of stealing the confusion key is improved, but also the firmware plaintext of each address is encrypted using different confusion keys, and by repeatedly encrypting the firmware, the difficulty of deciphering, the security and reliability of the firmware are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and in particular to a firmware encryption and decryption method and device, a computer device and a readable storage medium. BACKGROUND

[0002] With the rapid development of the Internet of Things, the application field of integrated circuit chips is becoming more and more extensive. In particular, single-chip microcomputers have gradually become an indispensable part of intelligent control systems due to their strong control ability and low power consumption. However, the firmware in the single-chip microcomputer is easily stolen illegally, resulting in technology leakage and economic losses.

[0003] There are various protection methods for single-chip microcomputer firmware. In the prior art, the firmware of the single-chip microcomputer is usually encrypted by means of instruction camouflage, read-write permission setting and bus reordering. However, the encryption method used in the prior art has a low security coefficient and is easily cracked.

[0004] Therefore, how to improve the security of the firmware has become a technical problem to be solved. SUMMARY

[0005] Therefore, the purpose of the present application is to provide a firmware encryption and decryption method and device, a computer device and a readable storage medium to improve the security of the firmware.

[0006] To achieve the above purpose, the technical solutions adopted by the embodiments of the present application are as follows:

[0007] In a first aspect, the present application provides a firmware encryption method, comprising:

[0008] obtaining a firmware address and a firmware plaintext, and respectively diffusing the firmware address and the firmware plaintext to obtain a diffusion address and a diffusion plaintext;

[0009] obtaining an encryption key, and using the encryption key to confuse the diffusion address to obtain a confusion key;

[0010] using the confusion key to perform encryption operation on the diffusion plaintext according to a preset encryption function to obtain intermediate ciphertext;

[0011] diffusing the intermediate ciphertext to obtain firmware ciphertext.

[0012] In one embodiment, the obtaining of the firmware address and the firmware plaintext and the respective diffusion of the firmware address and the firmware plaintext to obtain the diffusion address and the diffusion plaintext comprises:

[0013] respectively permuting the firmware address and the firmware plaintext to obtain the diffusion address and the diffusion plaintext.

[0014] In an embodiment, the obtaining the encryption key, and obfuscating the diffusion address by using the encryption key to obtain an obfuscated key, comprises:

[0015] XORing the preset encryption key and the diffusion address to obtain the obfuscated key.

[0016] In an embodiment, the performing encryption operation on the diffusion plaintext by using the obfuscated key according to a preset encryption function to obtain intermediate ciphertext, comprises:

[0017] Obtaining a character length of the obfuscated key;

[0018] Determining an offset of the diffusion plaintext according to the character length;

[0019] Shifting the diffusion plaintext according to the offset to obtain the intermediate ciphertext.

[0020] In an embodiment, the performing diffusion on the intermediate ciphertext to obtain firmware ciphertext, comprises:

[0021] Shuffling the intermediate ciphertext to obtain the firmware ciphertext.

[0022] In a second aspect, an embodiment of the present application provides a firmware decryption method, comprising:

[0023] Obtaining a firmware address, and performing diffusion on the firmware address to obtain a diffusion address;

[0024] Obtaining a decryption key, and obfuscating the diffusion address by using the decryption key to obtain an obfuscated key;

[0025] Obtaining firmware ciphertext, and performing inverse diffusion on the firmware ciphertext to obtain intermediate ciphertext;

[0026] Performing decryption operation on the intermediate ciphertext by using the obfuscated key according to a preset decryption function to obtain diffusion plaintext;

[0027] Performing inverse diffusion on the diffusion plaintext to obtain firmware plaintext.

[0028] In a third aspect, an embodiment of the present application provides a firmware encryption device, comprising:

[0029] A first diffusion module, configured to obtain a firmware address and firmware plaintext, and perform diffusion on the firmware address and the firmware plaintext respectively to obtain a diffusion address and diffusion plaintext;

[0030] A first obfuscation module, configured to obtain an encryption key, and obfuscate the diffusion address by using the encryption key to obtain an obfuscated key;

[0031] An encryption module is used to perform encryption operations on the diffused plaintext using the obfuscation key according to a preset encryption function to obtain intermediate ciphertext;

[0032] The second diffusion module is used to diffuse the intermediate ciphertext to obtain firmware ciphertext.

[0033] Fourthly, embodiments of the present invention provide a firmware decryption device, comprising:

[0034] The third diffusion module is used to diffuse the firmware address to obtain the diffused address;

[0035] The second obfuscation module is used to obtain the decryption key and use the decryption key to obfuscate the diffusion address to obtain the obfuscation key;

[0036] The first reverse diffusion module is used to obtain firmware ciphertext and perform reverse diffusion on the firmware ciphertext to obtain intermediate ciphertext.

[0037] The decryption module is used to perform decryption operations on the intermediate ciphertext using the obfuscation key according to a preset decryption function to obtain the diffused plaintext;

[0038] The second reverse diffusion module is used to reverse diffuse the diffused plaintext to obtain firmware plaintext.

[0039] Fifthly, embodiments of the invention provide a computer device, including: a processor and a memory, the memory storing a computer program, the processor executing the computer program to cause the computer device to perform the firmware encryption method or the firmware decryption method.

[0040] In a sixth aspect, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, wherein the computer program is executed by a processor to perform the firmware encryption method or the firmware decryption method.

[0041] Compared with existing technologies, the firmware encryption and decryption method, apparatus, computer device, and readable storage medium provided in this embodiment obtain a firmware address and firmware plaintext, and then diffuse the firmware address and firmware plaintext to obtain a diffused address and diffused plaintext, respectively. Next, an encryption key is obtained, and the diffused address is obfuscated using the encryption key to obtain an obfuscated key. Then, the diffused plaintext is encrypted using the obfuscated key according to a preset encryption function to obtain intermediate ciphertext. Finally, the intermediate ciphertext is diffused to obtain the firmware ciphertext. By incorporating the information of the diffused address into the encryption key, the difficulty of stealing the obfuscated key is increased, and it is ensured that firmware plaintext at each address is encrypted using a different obfuscated key. Furthermore, by repeatedly encrypting the firmware, the difficulty of decryption and the security and reliability of the firmware are improved.

[0042] In order to make the above objectives, features and advantages of the present application more obvious and comprehensible, below the preferred embodiments are specifically described, and the accompanying drawings are provided for detailed description as follows. BRIEF DESCRIPTION OF DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as limiting the scope of protection of the present application. In each drawing, similar components are marked with similar numerals.

[0044] Figure 1 A flow chart of the firmware encryption method provided by the embodiment of the present application is shown;

[0045] Figure 2 A flow chart of the firmware decryption method provided by the embodiment of the present application is shown;

[0046] Figure 3 A module schematic diagram of the firmware encryption device provided by the embodiment of the present application is shown;

[0047] Figure 4 A module schematic diagram of the firmware decryption device provided by the embodiment of the present application is shown.

[0048] Main component symbol explanation:

[0049] 100-firmware encryption device; 101-first diffusion module; 102-first confusion module; 103-encryption module; 104-second diffusion module; 200-firmware decryption device; 201-third diffusion module; 202-second confusion module; 203-first inverse diffusion module; 204-decryption module; 205-second inverse diffusion module. DETAILED DESCRIPTION

[0050] The technical solutions in the embodiments of the present application will be described clearly and completely below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments.

[0051] The components of the embodiments of the present application generally described and shown in the drawings herein can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0052] Hereinafter, the terms "include", "has", and similar terms are intended to mean that a particular feature, number, step, operation, component, part, or combination thereof, exists or is added, but does not preclude the presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0053] In addition, the terms "first", "second", "third", and the like are used only to distinguish descriptions, and are not understood to indicate or imply relative importance.

[0054] Unless otherwise defined, all terms used herein (including technical terms and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which various embodiments of the present application belong. The terms (such as those defined in a generally used dictionary) will be interpreted to have the same meaning as the contextual meaning in the relevant technical field and will not be interpreted to have an idealized or overly formal meaning unless clearly defined in various embodiments of the present application.

[0055] Embodiment 1

[0056] Please refer to Figure 1 The firmware encryption method provided by the embodiment of the present application comprises:

[0057] Step S101: Obtain a firmware address and a firmware plaintext, and respectively diffuse the firmware address and the firmware plaintext to obtain a diffusion address and a diffusion plaintext.

[0058] It can be understood that diffusion refers to rearranging data in information, specifically, making each bit of plaintext affect many bits in ciphertext, so as to hide the relationship between plaintext and ciphertext. Therefore, diffusing the firmware address and the firmware plaintext can effectively ensure the security of the firmware. It should be noted that the diffusion of the firmware address and the firmware plaintext can be performed simultaneously or individually, which is not limited here.

[0059] Optionally, the step S101 specifically comprises:

[0060] Respectively scrambling the firmware address and the firmware plaintext to obtain the diffusion address and the diffusion plaintext.

[0061] Exemplarily, the bit positions of the firmware address and the firmware plaintext are scrambled respectively by bit exchange, and the specific scrambling schemes of the two can be different, and the positions can be different. For example, the bit2 of the address data is exchanged to the bit7 when the firmware address is diffused, and the bit1 of the plaintext data is exchanged to the bit7 when the firmware plaintext is diffused. The scrambling of the specific bit positions can be responsive to actual needs, which is not limited here.

[0062] Therefore, by exchanging the bits of the firmware plaintext, the diffused plaintext is obtained, so that the plaintext attack can be effectively resisted. Each time the firmware address is scrambled, the bit position of the firmware address is automatically updated, so that the diffusion of the firmware address is more efficient.

[0063] Step S102: obtaining an encryption key, and scrambling the diffused address by using the encryption key to obtain a scrambled key.

[0064] In the embodiment of the application, the encryption key is preset, and can be generated based on a pseudo-random number generator or an encryption algorithm based on a password. The generation mode of the encryption key is determined according to actual conditions, which is not limited here.

[0065] It can be understood that the diffused address is scrambled by using the encryption key, which essentially adds the information of the diffused address to the encryption key, so that the relationship between the encryption key and the diffused address becomes complex, so as to ensure the security of the firmware. Moreover, the complex relationship between the diffused address and the encryption key makes it impossible for other users to infer the encryption key even if they obtain some data characteristics of the diffused address, thereby ensuring the security of the firmware.

[0066] Optionally, in the embodiment, the step S102 specifically includes:

[0067] The encryption key and the diffused address are subjected to an exclusive or operation to obtain the scrambled key.

[0068] The exclusive or operation means that the encryption key and the diffused address are subjected to a bit-by-bit exclusive or operation. Specifically, the corresponding equal-length bit positions of the encryption key and the diffused address are subjected to an exclusive or operation. The equal-length bit positions can be a single bit position or multiple equal-length bit positions.

[0069] It can be understood that, after the encryption key is added with the information of the different diffusion addresses, the confusion keys corresponding to the addresses in the firmware are not the same, the security of the confusion keys is effectively increased, so that the firmware corresponding to each address is encrypted by different confusion keys, and the security of the firmware is further improved. Of course, in actual application, table lookup replacement, offset and other methods can also be used to make the confusion keys more complex, so that the correlation between the encrypted data is not obvious, and the specific method can be determined according to actual conditions, which is not limited here.

[0070] Step S103: According to a preset encryption function, the diffusion plaintext is encrypted by using the confusion key, and an intermediate ciphertext is obtained.

[0071] Optionally, in the embodiment, the preset encryption function includes:

[0072] DataOut = DatIn + KeyIn;

[0073] Wherein, KeyIn is the confusion key, DatIn is the diffusion plaintext, and DataOut is the intermediate ciphertext.

[0074] Further, step S103 includes:

[0075] Obtaining the character length of the confusion key;

[0076] According to the character length, determining the offset of the diffusion plaintext;

[0077] According to the offset, the diffusion plaintext is offset to obtain the intermediate ciphertext.

[0078] Optionally, each bit in the diffusion plaintext is offset according to the offset. The offset can be forward or backward. Assuming that the offset is 2, if the diffusion plaintext is offset forward, A in the diffusion plaintext will be replaced by C; if the diffusion plaintext is offset backward, A in the diffusion plaintext will be replaced by Y, and the result obtained after offset is stored as the intermediate ciphertext. Therefore, by means of the character length of the confusion key and the diffusion plaintext offset direction, the security of the firmware encryption is improved.

[0079] Step S104: The intermediate ciphertext is diffused to obtain firmware ciphertext.

[0080] Specifically, the intermediate ciphertext is diffused, and the intermediate ciphertext can be replaced by bit exchange.

[0081] Exemplarily, the firmware ciphertext is obtained by shuffling the bit positions of the intermediate ciphertext, and the specific bit position exchange can be responsive to actual requirements, which is not limited here. Therefore, the firmware ciphertext is obtained by bit exchange of the intermediate ciphertext, further improving the security of the firmware encryption.

[0082] Optionally, in the embodiment, the firmware encryption method is an offline encryption method for the developed firmware. Specifically, the firmware is encrypted by the external device using the firmware encryption method in an offline state, that is, before communicating with the receiver. That is, the offline ciphertext firmware is calculated and generated by the external device before the receiver and the firmware to be encrypted are known.

[0083] Therefore, the firmware is encrypted by the offline encryption method, which can process the calculation required for encryption in advance, not only improving the encryption efficiency, but also being suitable for lightweight devices.

[0084] Optionally, the firmware ciphertext can be stored in the internal Flash (Flash EEPROM Memory, flash memory), ROM (Read-Only Memory, read-only memory) and RAM (Random Access Memory, random access memory) of the single-chip microcomputer and the like.

[0085] In the embodiment, the firmware address and the firmware plaintext are obtained, and the firmware address and the firmware plaintext are diffused respectively to obtain a diffusion address and a diffusion plaintext. An encryption key is obtained, and the diffusion address is confused using the encryption key to obtain a confusion key. According to a preset encryption function, the diffusion plaintext is encrypted using the confusion key to obtain an intermediate ciphertext. The intermediate ciphertext is diffused to obtain a firmware ciphertext. By adding the information of the diffusion address in the encryption key, not only the difficulty of stealing the confusion key is improved, but also the firmware plaintext of each address is encrypted using different confusion keys, and the decryption difficulty, security and reliability of the firmware are improved by repeatedly encrypting the firmware.

[0086] Embodiment 2

[0087] Please refer to Figure 2 The firmware decryption method provided by the embodiment of the application comprises:

[0088] Step S201: obtaining a firmware address, diffusing the firmware address to obtain a diffusion address.

[0089] Specifically, the CPU inside the single-chip microcomputer acquires the address corresponding to the firmware to be accessed, and obtains a decryption address by performing bit exchange on the address. The bit exchange position and the corresponding encryption method are consistent, thereby ensuring the integrity of the data and the correctness of the decryption.

[0090] Step S202: Obtain a decryption key, and use the decryption key to confuse the diffusion address, to obtain a confused key;

[0091] Optionally, the decryption key and the encryption key can use the same key, that is, the same key is used for encryption and decryption of the firmware, so that the single-chip microcomputer does not have to study and exchange the encryption algorithm of the external device, and only needs to know the key used for encryption and decryption. Not only simplifies the encryption process, but also makes the firmware encryption and decryption faster.

[0092] Further, the decryption key and the diffusion address are subjected to XOR operation to obtain the confused key.

[0093] Specifically, the decryption key and the diffusion address are subjected to bit-by-bit XOR operation for decryption by using the property of XOR operation. It can be understood that adding the diffusion address to the decryption key can restore each confused key, so that the decryption is more efficient and fast.

[0094] Step S203: Obtain firmware ciphertext, and perform inverse diffusion on the firmware ciphertext to obtain intermediate ciphertext.

[0095] Optionally, the firmware ciphertext can be directly loaded to the Flash inside the single-chip microcomputer through the test interface of the test bench, or the firmware ciphertext can be downloaded to the Flash inside the single-chip microcomputer through the download port of the single-chip microcomputer. The specific mode can be determined according to the actual situation, which is not limited here.

[0096] It can be understood that step S203 can be regarded as the inverse processing of step S104, that is, the ciphertext firmware is subjected to inverse diffusion. Specifically, the single-chip microcomputer reads the firmware ciphertext through the decryption address, and then performs bit exchange on the ciphertext firmware to obtain the intermediate ciphertext. Therefore, the ciphertext firmware is preliminarily decrypted by bit exchange to obtain the intermediate ciphertext, thereby efficiently decrypting the firmware ciphertext.

[0097] It should be particularly noted that steps S202 and S203 do not have a fixed execution order, and can be performed simultaneously, or can be performed in the order of step S202 first and step S203 second, or step S203 first and step S202 second. The specific execution order can be determined according to the actual situation, which is not limited here.

[0098] Step S204: decrypting the intermediate ciphertext by using the obfuscated key according to a preset decryption function, to obtain the diffusion plaintext.

[0099] Optionally, the preset decryption function comprises:

[0100] DataOut' = DatIn' - KeyIn';

[0101] wherein KeyIn' is the obfuscated key, DatIn' is the intermediate ciphertext, and DataOut is the diffusion plaintext.

[0102] Further, the character length of the obfuscated key is obtained, the offset of the intermediate ciphertext is determined according to the character length, and the intermediate ciphertext is offset according to the offset to obtain the diffusion plaintext.

[0103] It can be understood that the decryption function can be regarded as the inverse of the encryption function. Optionally, each bit in the intermediate ciphertext is offset according to the offset, which can be forward offset or backward offset; wherein, if the encryption process is forward movement, the decryption process is backward movement. And the result obtained by offset is stored as the diffusion plaintext. It is ensured that the intermediate ciphertext corresponding to each firmware address is decrypted by the corresponding obfuscated key, and the accuracy of firmware decryption is improved.

[0104] Step S205: inversely diffusing the diffusion plaintext to obtain the firmware plaintext.

[0105] Specifically, inversely diffusing the firmware decryption data can be regarded as the inverse process of diffusing the firmware plaintext. Further, the diffusion plaintext is rearranged, so as to analyze the relationship between the plaintext and the ciphertext in the firmware. Demonstratively, the diffusion plaintext is inversely shuffled corresponding to the encryption process by the way of bit exchange, to obtain the firmware plaintext data.

[0106] Therefore, by inversely diffusing the firmware decryption data, the firmware plaintext data is quickly obtained, and the integrity of the plaintext data obtained after decryption is ensured.

[0107] In the embodiment, the firmware address is diffused to obtain a diffusion address, the diffusion address is added to the decryption key to obtain the obfuscated key, the firmware ciphertext is inversely diffused to obtain the intermediate ciphertext, the intermediate ciphertext and the obfuscated key are decrypted according to the preset decryption function to obtain the diffusion plaintext, and the diffusion plaintext is inversely diffused to obtain the firmware plaintext. The corresponding firmware ciphertext is obtained by the firmware address, the accuracy of obtaining the firmware ciphertext is improved, the decryption time of the firmware is saved by using the decryption key, the accuracy of decryption and the integrity of data are ensured by multiple decryption operations of the firmware, and the resources occupied in the decryption process are small.

[0108] Embodiment 3

[0109] Please refer to Figure 3 The firmware encryption device 100 provided by the embodiment of the present application comprises a first diffusion module 101, a first confusion module 102, an encryption module 103 and a second diffusion module 104.

[0110] The first diffusion module 101 is configured to acquire a firmware address and firmware plaintext, and to diffuse the firmware address and the firmware plaintext respectively to obtain a diffusion address and diffusion plaintext.

[0111] The first confusion module 102 is configured to acquire an encryption key, and to confuse the diffusion address by using the encryption key to obtain a confusion key.

[0112] The encryption module 103 is configured to perform encryption operation on the diffusion plaintext by using the confusion key according to a preset encryption function to obtain intermediate ciphertext.

[0113] The second diffusion module 104 is configured to diffuse the intermediate ciphertext to obtain firmware ciphertext.

[0114] Optionally, the first diffusion module 101 is specifically configured to perform permutation on the firmware address and the firmware plaintext respectively to obtain the diffusion address and the diffusion plaintext.

[0115] Optionally, the first confusion module 102 is specifically configured to perform exclusive-OR operation on a preset encryption key and the diffusion address to obtain the confusion key.

[0116] Optionally, the encryption module 103 comprises:

[0117] An acquisition sub-module is configured to acquire the character length of the confusion key.

[0118] A determination sub-module is configured to determine the offset of the diffusion plaintext according to the character length.

[0119] An offset sub-module is configured to offset the diffusion plaintext according to the offset to obtain the intermediate ciphertext.

[0120] The firmware encryption device provided by the embodiment of the present application can realize the processes of the firmware encryption method in Embodiment 1, and can achieve the same technical effects. To avoid repetition, details are not described herein.

[0121] Embodiment 4

[0122] Please refer to Figure 4The embodiment of the present application provides a firmware decryption device 200, which comprises a third diffusion module 201, a second confusion module 202, a first inverse diffusion module 203, a decryption module 204 and a second inverse diffusion module 205.

[0123] The third diffusion module 201 obtains a firmware address, diffuses the firmware address to obtain a diffusion address.

[0124] The second confusion module 202 obtains a decryption key, and confuses the diffusion address by using the decryption key to obtain a confusion key.

[0125] The first inverse diffusion module 203 obtains firmware ciphertext, and inversely diffuses the firmware ciphertext to obtain intermediate ciphertext.

[0126] The decryption module 204 performs decryption operation on the intermediate ciphertext by using the confusion key according to a preset decryption function to obtain diffusion plaintext.

[0127] The second inverse diffusion module 205 inversely diffuses the diffusion plaintext to obtain firmware plaintext.

[0128] The firmware decryption device provided by the embodiment of the present application can realize the processes of the firmware decryption method in the above-mentioned embodiment 2, and can achieve the same technical effects, and thus, details are not repeated here.

[0129] Embodiment 5

[0130] The embodiment of the present application provides a computer device, which comprises a memory and a processor, the memory stores a computer program, and the computer program realizes the firmware encryption method in the embodiment 1 or the firmware decryption method in the embodiment 2 when the processor executes.

[0131] The embodiment of the present application further provides a computer readable storage medium, which stores a computer program, and the computer program realizes the firmware encryption method in the embodiment 1 or the firmware decryption method in the embodiment 2 when the processor executes.

[0132] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can also be implemented by other manners. The apparatus embodiments described above are merely illustrative, for example, the flowcharts and structural diagrams in the drawings show the possible implementation architecture, function and operation of the apparatus, method and computer program product according to the embodiments of the present application. In this regard, each block in the flowchart or block diagram can represent a module, a program segment or a part of code, which contains one or more executable instructions for implementing the specified logic function. It should also be noted that in alternative implementation manners, the functions noted in the blocks can also occur in different order from that noted in the drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and they can also be executed in reverse order, depending on the functions involved. It should also be noted that each block in the structural diagram and / or flowchart, and the combination of blocks in the structural diagram and / or flowchart, can be implemented by a dedicated hardware-based system for executing the specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0133] In addition, each functional module or unit in the embodiments of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0134] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part of the prior art that contributes to the technical solutions or the part of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a smart phone, a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0135] The above description is merely a specific implementation of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical range disclosed in the present application, which should be covered within the protection scope of the present application.

Claims

1. A firmware encryption method characterized by, The method comprises the following steps: obtaining a firmware address and a firmware plaintext, diffusing the firmware address and the firmware plaintext respectively to obtain a diffusion address and a diffusion plaintext; obtaining an encryption key, and using the encryption key to confuse the diffusion address to obtain a confusion key; performing encryption operation on the diffusion plaintext according to a preset encryption function and using the confusion key to obtain intermediate ciphertext; diffusing the intermediate ciphertext to obtain firmware ciphertext; the step of diffusing the firmware address and the firmware plaintext respectively to obtain the diffusion address and the diffusion plaintext comprises the following steps: performing permutation on the firmware address and the firmware plaintext respectively to obtain the diffusion address and the diffusion plaintext, and the permutation manner comprises bit exchange; the step of performing encryption operation on the diffusion plaintext according to a preset encryption function and using the confusion key to obtain intermediate ciphertext comprises the following steps: obtaining the character length of the confusion key; determining the offset of the diffusion plaintext according to the character length; offsetting the diffusion plaintext according to the offset to obtain the intermediate ciphertext.

2. The firmware encryption method of claim 1, wherein, the step of using the encryption key to confuse the diffusion address to obtain a confusion key comprises the following step: performing exclusive or operation on the encryption key and the diffusion address to obtain the confusion key.

3. The firmware encryption method of claim 1, wherein, the step of diffusing the intermediate ciphertext to obtain firmware ciphertext comprises the following step: performing permutation on the intermediate ciphertext to obtain the firmware ciphertext.

4. A firmware decryption method characterized by, The method comprises the following steps: obtaining a firmware address, diffusing the firmware address to obtain a diffusion address; obtaining a decryption key, and using the decryption key to confuse the diffusion address to obtain a confusion key; obtaining firmware ciphertext, and performing inverse diffusion on the firmware ciphertext to obtain intermediate ciphertext; performing decryption operation on the intermediate ciphertext according to a preset decryption function and using the confusion key to obtain diffusion plaintext; performing inverse diffusion on the diffusion plaintext to obtain firmware plaintext; the step of diffusing the firmware address to obtain a diffusion address comprises the following step: performing permutation on the firmware address to obtain the diffusion address, and the permutation manner comprises bit exchange; the step of performing decryption operation on the intermediate ciphertext according to a preset decryption function and using the confusion key to obtain diffusion plaintext comprises the following steps: obtaining the character length of the confusion key; determining the offset of the intermediate ciphertext according to the character length; offsetting the intermediate ciphertext according to the offset to obtain the diffusion plaintext.

5. A firmware encryption apparatus characterized by comprising: The method comprises the following steps: a first diffusion module is configured to obtain a firmware address and a firmware plaintext, and diffuse the firmware address and the firmware plaintext respectively to obtain a diffusion address and a diffusion plaintext; a first confusion module is configured to obtain an encryption key, and use the encryption key to confuse the diffusion address to obtain a confusion key; an encryption module is configured to perform encryption operation on the diffusion plaintext according to a preset encryption function and using the confusion key to obtain intermediate ciphertext; a second diffusion module is configured to diffuse the intermediate ciphertext to obtain firmware ciphertext; the first diffusion module is further configured to perform permutation on the firmware address and the firmware plaintext respectively to obtain the diffusion address and the diffusion plaintext; the encryption module comprises: An acquisition sub-module is configured to acquire a character length of the confusion key; A determination sub-module is configured to determine an offset of the diffusion plaintext according to the character length; An offset sub-module is configured to offset the diffusion plaintext according to the offset to obtain the intermediate ciphertext.

6. A firmware decryption apparatus characterized by comprising: The method of claim 4, comprising: A third diffusion module is configured to diffuse a firmware address to obtain a diffusion address; A second confusion module is configured to acquire a decryption key, and confuse the diffusion address by using the decryption key to obtain a confusion key; A first inverse diffusion module is configured to acquire firmware ciphertext, and inversely diffuse the firmware ciphertext to obtain an intermediate ciphertext; A decryption module is configured to perform decryption operation on the intermediate ciphertext by using the confusion key according to a preset decryption function to obtain a diffusion plaintext; A second inverse diffusion module is configured to inversely diffuse the diffusion plaintext to obtain firmware plaintext; The third diffusion module is further configured to scramble the firmware address to obtain the diffusion address.

7. A computer device, comprising: A memory and a processor are included, the memory is configured to store a computer program, and the computer program performs the firmware encryption method of any one of claims 1 to 3 or the firmware decryption method of claim 4 when running on the processor.

8. A computer-readable storage medium, characterized in that, including: The computer program is stored in the memory and performs the firmware encryption method of any one of claims 1 to 3 or the firmware decryption method of claim 4 when running on the processor.

Images