Encryption method, device, terminal device and computer-readable storage medium

Abstract

This application applies to the field of cryptography technology and provides an encryption method, apparatus, terminal device, and computer-readable storage medium, comprising: expanding an initial key input by a user to obtain an extended key, wherein the number of bytes of the extended key is greater than the number of bytes of the initial key; dividing the plaintext to be encrypted into multiple first data blocks based on the number of bytes of the extended key; and encrypting each of the first data blocks separately based on the extended key. This method improves the security of encrypted files even when a user enters a simple password.

Description

Technical Field

[0001] The present application belongs to the field of cryptographic technology, and in particular relates to an encryption method, apparatus, terminal device, and computer-readable storage medium. Background Art

[0002] File encryption is the process of encoding the plaintext in an original file using a key, resulting in ciphertext that is unreadable. File decryption is the reverse process. The data processing rules for encryption and decryption are the same. Data encryption is required in many application scenarios to ensure data security. For example, encrypting data files on a disk can make them less susceptible to theft and misuse.

[0003] In related technologies, improving the security of encrypted files typically requires users to set complex passwords or employ more complex encryption algorithms. Complex passwords, with their large number of characters and a wide variety of character types, are difficult for users to memorize and result in a poor user experience. Complex encryption algorithms also require a high computational load and require a high level of computing power from the encryption device. Summary of the Invention

[0004] The embodiments of the present application provide an encryption method, apparatus, terminal device, and computer-readable storage medium, which can improve the security of encrypted files.

[0005] In a first aspect, an embodiment of the present application provides an encryption method, comprising:

[0006] Expanding the initial key input by the user to obtain an extended key, where the number of bytes of the extended key is greater than the number of bytes of the initial key;

[0007] Dividing the plaintext to be encrypted into a plurality of first data blocks according to the number of bytes of the extended key;

[0008] Each of the first data blocks is encrypted according to the extended key.

[0009] In an embodiment of the present application, by expanding the initial key input by the user, an extended key with a larger number of bytes can be obtained. The user only needs to set a simple password to obtain a relatively complex password, which is beneficial to improving the security of the encrypted file; secondly, the encrypted plaintext is segmented and encrypted using the extended key, which improves the security of each data block in the plaintext to be encrypted, thereby improving the overall security of the encrypted file.

[0010] In a possible implementation of the first aspect, the step of expanding the initial key input by the user to obtain the expanded key includes:

[0011] Dividing the initial key into a plurality of initial byte segments, each of the initial byte segments including at least two bytes;

[0012] Performing XOR processing on the initial byte segments to obtain an extended byte segment corresponding to each initial byte segment;

[0013] The extended key is generated according to the initial byte segment and the extended byte segment.

[0014] In a possible implementation of the first aspect, performing XOR processing on the initial byte segments to obtain an extended byte segment corresponding to each initial byte segment includes:

[0015] Performing data conversion processing on the first byte segment to obtain a converted byte segment, wherein the first byte segment is the xth initial byte segment among the multiple initial byte segments;

[0016] The second byte segment and the converted byte segment are XORed to obtain an extended byte segment corresponding to the second byte segment, wherein the second byte segment is the yth initial byte segment among the multiple initial byte segments.

[0017] In a possible implementation of the first aspect, after performing an XOR operation on the second byte segment and the converted byte segment to obtain an extended byte segment corresponding to the second byte segment, the method further includes:

[0018] The third byte segment and the extended byte segment corresponding to the second byte segment are XORed to obtain the extended byte segment corresponding to the third byte segment, wherein the third byte segment is any byte segment of the multiple initial byte segments except the second byte segment.

[0019] In a possible implementation of the first aspect, performing data conversion on the first byte segment to obtain a converted byte segment includes:

[0020] swapping the bytes in the first byte segment to obtain a fourth byte segment;

[0021] Obtaining a first code value corresponding to the fourth byte segment from a preset data matrix;

[0022] An exclusive-OR process is performed on the first code value to obtain the converted byte segment.

[0023] In a possible implementation of the first aspect, encrypting each of the first data blocks according to the extended key includes:

[0024] For the i-th byte in the m-th first data block, obtain the extended byte segment corresponding to the i-th byte in the extended key;

[0025] Obtaining a second code value corresponding to the m from a preset data matrix;

[0026] Obtaining a third code value corresponding to the i from the data matrix;

[0027] An exclusive OR process is performed on the mth first data block, the extended byte segment corresponding to i, the second code value and the third code value to obtain the ciphertext of the i-th byte in the mth first data block.

[0028] In a possible implementation of the first aspect, the method further includes:

[0029] Dividing the ciphertext to be processed into a plurality of second data blocks according to the number of bytes of the extended key;

[0030] For the j-th byte in the n-th second data block, obtain the extended byte segment corresponding to the j-th byte in the extended key;

[0031] Obtaining a fourth code value corresponding to n from the data matrix;

[0032] Obtaining a fifth code value corresponding to j from the data matrix;

[0033] An exclusive OR process is performed on the nth second data block, the extended byte segment corresponding to j, the fourth code value and the fifth code value to obtain the meaning of the jth byte in the nth second data block.

[0034] In a second aspect, an embodiment of the present application provides an encryption device, comprising:

[0035] A key expansion unit, configured to expand an initial key input by a user to obtain an expanded key, wherein the number of bytes of the expanded key is greater than the number of bytes of the initial key;

[0036] a data dividing unit, configured to divide the encrypted plain text into a plurality of first data blocks according to the number of bytes of the extended key;

[0037] A data encryption unit is configured to encrypt each of the first data blocks according to the extended key.

[0038] In a third aspect, an embodiment of the present application provides a terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the encryption method as described in any one of the first aspects above is implemented.

[0039] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the encryption method as described in any one of the above-mentioned first aspects is implemented.

[0040] In a fifth aspect, an embodiment of the present application provides a computer program product, which, when executed on a terminal device, enables the terminal device to execute the encryption method described in any one of the above-mentioned first aspects.

[0041] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0043] Figure 1 This is a flowchart of the encryption method provided in the embodiment of the present application;

[0044] Figure 2 This is a schematic diagram of the structure of an encryption device provided in an embodiment of the present application;

[0045] Figure 3 This is a structural diagram of the terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] In the following description, specific details such as specific system structures and techniques are provided for purposes of illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obscuring the description of the present application with unnecessary detail.

[0047] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0048] It will also be understood that the term "and / or" used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0049] As used in this specification and the appended claims, the term "if" can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0050] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0051] References to "one embodiment" or "some embodiments" in this specification mean that a particular feature, structure, or characteristic described in conjunction with the embodiment is included in one or more embodiments of the present application. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in yet other embodiments" appearing in various places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized.

[0052] First, the technical background involved in the embodiments of this application is introduced.

[0053] File encryption is the process of encoding the plaintext in an original file using a key, resulting in ciphertext that is unreadable. File decryption is the reverse process. The data processing rules for encryption and decryption are the same. Data encryption is required in many application scenarios to ensure data security. For example, encrypting data files on a disk can make them less susceptible to theft and misuse.

[0054] Encryption methods are primarily categorized into symmetric and asymmetric encryption. Symmetric encryption is a more traditional encryption method, using the same key for both encryption and decryption. This approach offers low computational complexity, high speed, high efficiency, and low resource consumption, but also moderate security. Asymmetric encryption uses two keys, offering high security and easy key management, but also slow speed and high resource consumption. It's suitable for encrypting and decrypting small amounts of data or signing data. Therefore, symmetric encryption is generally used for low-cost chips and large file read / write operations.

[0055] Symmetric encryption technology mainly includes the following three algorithms:

[0056] (1) Data Encryption Standard (DES)

[0057] The DES algorithm has three entry parameters: Key, Data, and Mode. The Key, consisting of 8 bytes totaling 64 bits, is the DES algorithm's working key. The Data, also consisting of 8 bytes totaling 64 bits, represents the data being encrypted or decrypted. The Mode represents the DES operating mode, which can be either encryption or decryption. The DES encryption algorithm is relatively insecure and easily cracked.

[0058] (2) Triple Data Encryption Algorithm (3DES)

[0059] 3DES is equivalent to applying the DES encryption algorithm three times to each data block. Due to the increase in computing power, the key length of the original DES cipher has become susceptible to brute force attacks. 3DES is designed to provide a relatively simple method to prevent similar attacks by increasing the key length of DES, rather than designing an entirely new block cipher algorithm.

[0060] (3) Advanced Encryption Standard (AES)

[0061] The AES encryption algorithm is the Advanced Encryption Standard in cryptography. AES is a block cipher that divides plaintext into equal-length blocks, encrypting each block until the entire plaintext is encrypted. The AES standard specifies a maximum block length of 128 bits, and AES encrypts data byte by byte, meaning each block consists of 16 bytes (8 bits per byte). Keys can be 128, 192, or 256 bits long. This results in different recommended encryption rounds depending on the key length. The AES algorithm features a simple design, compact encoding, and resistance to all known attacks. It does not utilize a Feistel structure, and its round function consists of three different reversible uniform transformations: a nonlinear layer, a linear mixing layer, and a key addition layer. The AES algorithm can encode or decode large files quickly on powerful devices, but it still takes a long time on standard microcontrollers.

[0062] As can be seen from the above, in related technologies, improving the security of encrypted files typically requires users to set more complex passwords or use more complex encryption algorithms. Complex passwords, with their large number of characters and a wide variety of character types, are difficult for users to remember and result in a poor user experience. Complex encryption algorithms also require a high computational load and high computing power for the encryption device. Therefore, it is necessary to design an encryption algorithm that is both computationally efficient and highly secure.

[0063] See also Figure 1, is a flowchart of the encryption method provided in an embodiment of the present application. As an example and not a limitation, the method may include the following steps:

[0064] S101, expanding an initial key input by a user to obtain an extended key, wherein the number of bytes of the extended key is greater than the number of bytes of the initial key.

[0065] The number of bytes in the extended key can be determined based on the plaintext to be encrypted. For example, the number of bytes in the extended key is greater than the number of bytes in the initial key, but less than the number of bytes in the plaintext to be encrypted.

[0066] The specific expansion method is described in detail in the following embodiments.

[0067] S102: Divide the plaintext to be encrypted into a plurality of first data blocks according to the number of bytes of the extended key.

[0068] In the embodiments of this application, plaintext refers to unencrypted text (or character strings). In a communication system, it may be a bit stream, such as text, a bitmap, digitized voice, or a digitized video image. Plaintext can generally be simply considered to be a meaningful set of characters or bits, or a message that can be obtained through some public coding standard. After the plaintext is encrypted, the ciphertext is obtained. For the ciphertext, if you want to obtain the plaintext, you should decrypt it using the decryption algorithm corresponding to the encryption algorithm to recover the plaintext.

[0069] For example, assuming that the initial key set by the user is 16 bytes and the extended key is 1024 bytes, the plaintext to be encrypted can be divided into multiple first data blocks of 1024 bytes, and each first data block contains 1024 bytes.

[0070] In one case, if the last data block in the plaintext to be encrypted is less than 1024 bytes, it can be padded with a preset value to 1024 bytes. Accordingly, after decryption, the padded preset value is deleted to obtain the original plaintext to be encrypted.

[0071] Of course, in actual applications, there is a situation where the number of bytes in the extended key is greater than the number of bytes in the plaintext to be encrypted. In this case, the plaintext to be encrypted can be padded with a preset value to the number of bytes in the extended key, and then the padded plaintext to be encrypted can be encrypted using the extended key. Compared with the data block method, this method encrypts the plaintext to be encrypted as a whole. Once decrypted, the complete plaintext is obtained, which is less secure. Therefore, this method is not considered in the embodiments of this application.

[0072] S103: Encrypt each of the first data blocks according to the extended key.

[0073] It is possible to combine the extended key with the position of each character in each first data block so that each character corresponds to a different password, further improving the security of the encrypted file. Specific methods are described in the following embodiments.

[0074] In an embodiment of the present application, by expanding the initial key input by the user, an extended key with a larger number of bytes can be obtained. The user only needs to set a simple password to obtain a relatively complex password, which is beneficial to improving the security of the encrypted file; secondly, the encrypted plaintext is encrypted in segments using the extended key. Accordingly, during the decryption process, the data blocks are decrypted one by one, and the complete plaintext cannot be directly obtained, which improves the security of each data block in the plaintext to be encrypted, thereby improving the overall security of the encrypted file.

[0075] In one embodiment, S101 may include the following steps:

[0076] The initial key is divided into multiple initial byte segments, each of which includes at least two bytes; an exclusive-OR process is performed on the initial byte segments to obtain an extended byte segment corresponding to each initial byte segment; and the extended key is generated based on the initial byte segments and the extended byte segments.

[0077] For example, assuming that the user sets a 16-byte (128-bit) initial key, the initial key can be divided into 4 initial word stages, each of which includes 4 bytes (32 bits).

[0078] W[0](0~3)=K[0], K[1], K[2], K[3];

[0079] W[1](0~3)=K[4], K[5], K[6], K[7];

[0080] W[2](0~3)=K[8], K[9], K

[10] , K

[11] ;

[0081] W[3](0~3)=K

[12] , K

[13] , K

[14] , K

[15] ;

[0082] Where K[i] represents the i-th byte of the initial key K, 0≤i≤15. That is, the 1st to 4th bytes in the initial key belong to the first initial byte segment W[0], the 5th to 8th bytes in the initial key belong to the second initial byte segment W[1], the 9th to 12th bytes in the initial key belong to the second initial byte segment W[2], and the 13th to 16th bytes in the initial key belong to the second initial byte segment W[3].

[0083] It should be noted that the above is only an example of the division of the initial byte segments and does not specifically limit the number of initial key stages or the number of bytes contained in each initial byte segment. It can be set according to actual circumstances. For example, a 16-byte initial key can be divided into two initial byte segments, each containing 8 bytes; or a 16-byte initial key can be divided into eight initial byte segments, each containing 2 bytes.

[0084] XOR is a mathematical operation, the mathematical symbol is The operation rule is: if the two values ​​are different, the XOR result is 1. If the two values ​​are the same, the XOR result is 0.

[0085] The XOR operation is simple, efficient, and reversible: the XOR result of a and b, when XORed with a, yields b, which in turn yields a. Therefore, utilizing this property not only improves the efficiency of the encryption process but also simplifies the decryption process.

[0086] Optionally, one implementation of the XOR processing based on the initial word stage is to XOR the initial byte segments in pairs. Continuing with the above example, XORing W[0] and W[1], XORing W[1] and W[2], XORing W[2] and W[3], and XORing W[3] and W[0] can expand to four extended byte segments.

[0087] Due to the reversibility of the XOR operation, the number of extended byte segments obtained by the above method is limited, which has limitations.

[0088] In order to solve the above problem, in an embodiment of the present application, a method for implementing XOR processing according to the initial word stage is provided:

[0089] Performing data conversion processing on the first byte segment to obtain a converted byte segment, wherein the first byte segment is the xth initial byte segment among the multiple initial byte segments;

[0090] The second byte segment and the converted byte segment are XORed to obtain an extended byte segment corresponding to the second byte segment, wherein the second byte segment is the yth initial byte segment among the multiple initial byte segments.

[0091] The above method converts the data first, then XORs the converted byte segment with an initial byte segment. The resulting extended byte segment is then XORed with the other initial byte segments, preventing any reversible conversion back to the initial byte segment. Therefore, the above method can generate a larger number of extended byte segments, improving the reliability of the algorithm.

[0092] Optionally, when obtaining each extended byte segment, the above method can be used, that is, data conversion is performed first and then XOR is performed. However, since the conversion process is relatively cumbersome, if the conversion process needs to be performed for each extension, the data processing volume is large and the encryption efficiency is low.

[0093] In order to reduce the amount of data processing and improve encryption efficiency, in an embodiment of the present application, the method further includes:

[0094] The third byte segment and the extended byte segment corresponding to the second byte segment are XORed to obtain the extended byte segment corresponding to the third byte segment, wherein the third byte segment is any byte segment of the multiple initial byte segments except the second byte segment.

[0095] Continuing with the above example, based on the initial byte segments W[0], W[1], W[2], and W[3], the first round of expansion is as follows:

[0096]

[0097]

[0098]

[0099]

[0100] First, perform data conversion on W[3] to obtain the converted byte segment T(W[3]); XOR the converted byte segment T(W[3]) with the initial byte segment W[0] to obtain the first extended byte segment W[4]; XOR the extended byte segment W[4] with the initial byte segment W[1] to obtain the second extended byte segment W[5]; and so on. The process of the second round of expansion is as follows:

[0101]

[0102]

[0103]

[0104]

[0105] According to the above method, multiple rounds of expansion can be performed to expand multiple extended byte segments.

[0106] Through the above method, in each round of expansion, only one byte segment needs to be converted, which greatly saves encryption time.

[0107] It should be noted that, to facilitate decryption, it is often specified during the encryption process that byte segments that meet a preset condition are obtained by XORing the converted byte segments. For example, in the example above, it can be specified that when z in W[z] is a multiple of 4, W[z] is obtained by XORing a certain byte segment with a converted byte segment.

[0108] Of course, it is also necessary to specify which two byte segments are to be XORed, and the same rules are used during decryption. The specific rules are not limited in the embodiments of this application.

[0109] Optionally, the data conversion process may include:

[0110] The bytes in the first byte segment are swapped to obtain a fourth byte segment; a first code value corresponding to the fourth byte segment is obtained from a preset data matrix; and an XOR process is performed according to the first code value to obtain the converted byte segment.

[0111] In the embodiments of the present application, the elements in the preset data matrix can be pre-set, and the same data matrix is ​​used during the decryption process. In practical applications, the data matrix can be an S-box. The data matrix can be stored in a closed manner in the encryption device to improve the security of the algorithm.

[0112] Optionally, an implementation method of performing XOR processing based on the first code value is: performing XOR processing on the first code value and the fourth byte segment to obtain a converted byte segment.

[0113] In order to improve the security of the algorithm, optionally, another implementation method based on the XOR processing of the first code value is: calculating the sum of each element in the first code value to obtain the sum data; obtaining the second code value corresponding to the sum data from the data matrix; and performing XOR processing on the first code value and the second code value to obtain a conversion byte segment.

[0114] This method utilizes the data matrix twice, which increases the complexity of the conversion process and helps improve encryption security.

[0115] The following describes the process of obtaining the conversion byte segment T(W[3]) by taking the first byte segment as W[3] in the above example:

[0116] ① Swap the four elements of W[3](0~3) to get the fourth byte segment V[3](0~3):

[0117] That is, V[3](0~3)=V[3](0), V[3](1), V[3](2), V[3](3)=K

[13] , K

[14] , K

[15] , K

[12] .

[0118] In actual applications, the rules for swapping positions during encryption and decryption only need to remain consistent, and no specific restrictions are imposed on the rules.

[0119] ② Take V[3](0~3) as the input of the S-box, and use the high four bits and low four bits of each element in V[3] as the row and column of the S-box respectively, and retrieve the corresponding value as the first code value U[3](0~3):

[0120] U[3](h)=S[(V[3](h)&0xF0)>>4][V[3](h)&0x0F];

[0121] Where h is the subscript index, 0≤h≤3. & represents an AND operation. >> represents a right shift, and >>4 represents a right shift of 4 bits.

[0122] It should be noted that, in the embodiment of the present application, the XOR operation refers to a bitwise XOR, and the AND operation refers to a bitwise AND.

[0123] Assume that the S-box is a 16×16 matrix filled with the following hexadecimal values:

[0124] Row\Column 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 63 7c 77 7b f2 6b 6f c5 30 01 67 2b fe d7 ab 76 1 ca 82 c9 7d fa 59 47 f0 ad d4 a2 af 9c a4 72 c0 2 b7 fd 93 26 36 3f f7 CC 34 a5 e5 f1 71 d8 31 15 3 04 c7 23 c3 18 96 05 9a 07 12 80 e2 eb 27 b2 75 4 09 83 2c 1a 1b 6e 5a a0 52 3b d6 b3 29 e3 2f 84 5 53 d1 00 ed 20 fc b1 5b 6a cb be 39 4a 4c 58 cf 6 d0 ef aa fb 43 4d 33 85 45 f9 02 7f 50 3c 9f a8 7 51 a3 40 8f 92 9d 38 f5 bc b6 da 21 10 ff f3 d2 8 cd Oc 13 ec 5f 97 44 17 c4 a7 7e 3d 64 5d 19 73 9 60 81 4f dc 22 2a 90 88 46 ee b8 14 de 5e 0b db A e0 32 3a 0a 49 06 24 5c c2 d3 aC 62 91 95 e4 79 B e7 c8 37 6d 8d d5 4e a9 6c 56 f4 ea 65 7a ae 08 C ba 78 25 2e 1c a6 b4 c6 e8 dd 74 1f 4b bd 8b 8a D 70 3e b5 66 48 03 f6 Oe 61 35 57 b9 86 c1 1d 9e E e1 f8 98 11 69 d9 8e 94 9b 1e 87 e9 ce 55 28 df F 8c a1 89 0d bf e6 42 68 41 99 2d Of b0 54 bb 16

[0125] ③ Add the four elements of U[3] and take the lower eight bits to get the sum data X. Then take the upper four bits and lower four bits of X as the row and column of the S-box respectively, and retrieve the corresponding value second code value Y, that is:

[0126] X={U[3](0)+U[3](1)+U[3](2)+U[3](3)}&0x00FF;

[0127] Y=S[(X>>4)&0xF0][X&0x0F];

[0128] It should be noted that data overflow may occur after the four elements of U[3] are added together. Therefore, it is stipulated that the lower eight bits of the sum are taken as the sum data X.

[0129] ④ Perform XOR operation on U[3] and Y to obtain the conversion byte segment T[3].

[0130] Based on the above-mentioned process of obtaining the extended key, in one embodiment, the above-mentioned S103, encrypting each of the first data blocks according to the extended key, may include:

[0131] For the i-th byte in the m-th first data block, obtain the extended byte segment corresponding to the i-th byte in the extended key;

[0132] Obtaining a second code value corresponding to the m from a preset data matrix;

[0133] Obtaining a third code value corresponding to the i from the data matrix;

[0134] An exclusive OR process is performed on the mth first data block, the extended byte segment corresponding to i, the second code value and the third code value to obtain the ciphertext of the i-th byte in the mth first data block.

[0135] For example, assuming that the extended key length is 1024 bytes, the plaintext to be encrypted is cut into 1024-byte segments.

[0136] Divide into M data blocks A, take the mth (0≤m<M) data block A[m] and encode it to get E[m], that is:

[0137]

[0138] Where i is the subscript of the byte in each data block, 0≤i<1024. i%256 is the remainder when i is divided by 256, i / 256 is the quotient when i is divided by 256, and W[i%256](i / 256) represents the (i / 256)th byte in the (i%256)th extended byte segment. G[m]=S[(m>>4)&0xF0][m&0x0F], H[i]=S[(i>>4)&0xF0][i&0x0F].

[0139] Through the above method, the data block number m and byte subscript i are used to further scramble the extended byte segment to improve the security of the ciphertext.

[0140] Based on the encryption method described in the above embodiment, in one embodiment, the present application provides a decryption method, which specifically includes the following steps:

[0141] Dividing the ciphertext to be processed into a plurality of second data blocks according to the number of bytes of the extended key;

[0142] For the j-th byte in the n-th second data block, obtain the extended byte segment corresponding to the j-th byte in the extended key;

[0143] Obtaining a fourth code value corresponding to n from the data matrix;

[0144] Obtaining a fifth code value corresponding to j from the data matrix;

[0145] An exclusive OR process is performed on the nth second data block, the extended byte segment corresponding to j, the fourth code value and the fifth code value to obtain the plaintext of the jth byte in the nth second data block.

[0146] Taking the above encryption method as an example, the corresponding decryption process is described as follows: the ciphertext to be processed is divided into N data blocks B with 1024 bytes, and the nth (0≤n<N) data block B[n] is decoded to obtain D[n], that is:

[0147]

[0148] Wherein, j is the subscript of the byte of the data block, 0≤j<1024.

[0149] It should be noted that the rules involved in the decryption process (such as XOR processing, conversion processing, etc.) are consistent with the encryption process.

[0150] In the embodiment of the present application, by expanding the initial key input by the user, an extended key with a larger number of bytes can be obtained. The user only needs to set a simple password to obtain a relatively complex password, which is beneficial to improving the security of the encrypted file; secondly, the extended key is used to encrypt the plaintext to be encrypted in segments, which improves the security of each data block in the plaintext to be encrypted, thereby improving the overall security of the encrypted file. Thirdly, during the encryption process, the extended byte segment and the character position are combined so that the password corresponding to each plaintext character is different, which greatly improves the security of the substitution encryption method. In addition, the operations involved in the above encryption method (such as XOR processing) are simple and efficient, which greatly improves the speed of encoding and decoding, and is suitable for embedded chips to read large ciphertexts.

[0151] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0152] Corresponding to the encryption method described in the above embodiment, Figure 2 This is a structural block diagram of the encryption device provided in an embodiment of the present application. For the sake of convenience, only the parts related to the embodiment of the present application are shown.

[0153] Reference Figure 2 , the device comprises:

[0154] The key expansion unit 21 is configured to expand the initial key input by the user to obtain an expanded key, where the number of bytes of the expanded key is greater than the number of bytes of the initial key.

[0155] The data dividing unit 22 is configured to divide the plaintext to be encrypted into a plurality of first data blocks according to the number of bytes of the extended key.

[0156] The data encryption unit 23 is configured to encrypt each of the first data blocks according to the extended key.

[0157] Optionally, the key expansion unit 21 is further configured to:

[0158] Dividing the initial key into a plurality of initial byte segments, each of the initial byte segments including at least two bytes;

[0159] Performing XOR processing on the initial byte segments to obtain an extended byte segment corresponding to each initial byte segment;

[0160] The extended key is generated according to the initial byte segment and the extended byte segment.

[0161] Optionally, the key expansion unit 21 is further configured to:

[0162] Performing data conversion processing on the first byte segment to obtain a converted byte segment, wherein the first byte segment is the xth initial byte segment among the multiple initial byte segments;

[0163] The second byte segment and the converted byte segment are XORed to obtain an extended byte segment corresponding to the second byte segment, wherein the second byte segment is the yth initial byte segment among the multiple initial byte segments.

[0164] Optionally, the key expansion unit 21 is further configured to:

[0165] After performing an XOR operation on the second byte segment and the converted byte segment to obtain an extended byte segment corresponding to the second byte segment, an XOR operation is performed on the third byte segment and the extended byte segment corresponding to the second byte segment to obtain an extended byte segment corresponding to the third byte segment, wherein the third byte segment is any one byte segment of the multiple initial byte segments except the second byte segment.

[0166] Optionally, the key expansion unit 21 is further configured to:

[0167] swapping the bytes in the first byte segment to obtain a fourth byte segment;

[0168] Obtaining a first code value corresponding to the fourth byte segment from a preset data matrix;

[0169] An exclusive-OR process is performed on the first code value to obtain the converted byte segment.

[0170] Optionally, the data encryption unit 23 is further configured to:

[0171] For the i-th byte in the m-th first data block, obtain the extended byte segment corresponding to the i-th byte in the extended key;

[0172] Obtaining a second code value corresponding to the m from a preset data matrix;

[0173] Obtaining a third code value corresponding to the i from the data matrix;

[0174] An exclusive OR process is performed on the mth first data block, the extended byte segment corresponding to i, the second code value and the third code value to obtain the ciphertext of the i-th byte in the mth first data block.

[0175] Optionally, the device 2 further includes:

[0176] The data decryption unit 24 is configured to divide the ciphertext to be processed into a plurality of second data blocks according to the number of bytes of the extended key; obtain, for the jth byte in the nth second data block, an extended byte segment corresponding to the jth byte in the extended key; obtain a fourth code value corresponding to the nth byte from the data matrix; obtain a fifth code value corresponding to the jth byte from the data matrix; and perform an exclusive-OR operation on the nth second data block, the extended byte segment corresponding to the jth byte, the fourth code value, and the fifth code value to obtain the plaintext of the jth byte in the nth second data block.

[0177] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of this application. Their specific functions and technical effects can be found in the method embodiment section and will not be repeated here.

[0178] in addition, Figure 2 The encryption device shown can be a software unit, a hardware unit, or a combination of software and hardware units built into an existing terminal device, or can be integrated into the terminal device as an independent accessory, or can exist as an independent terminal device.

[0179] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0180] Figure 3 This is a schematic diagram of the structure of the terminal device provided in the embodiment of the present application. Figure 3 As shown, the terminal device 3 of this embodiment includes: at least one processor 30 ( Figure 3Only one is shown in the figure) a processor, a memory 31, and a computer program 32 stored in the memory 31 and executable on the at least one processor 30, wherein the processor 30 implements the steps of any of the above-mentioned encryption method embodiments when executing the computer program 32.

[0181] The terminal device may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The terminal device may include, but is not limited to, a processor and a memory. Those skilled in the art will understand that Figure 3 It is only an example of terminal device 3 and does not constitute a limitation on terminal device 3. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, it may also include input and output devices, network access devices, etc.

[0182] The processor 30 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. A general-purpose processor may be a microprocessor or any conventional processor.

[0183] In some embodiments, the memory 31 may be an internal storage unit of the terminal device 3, such as a hard disk or memory of the terminal device 3. In other embodiments, the memory 31 may also be an external storage device of the terminal device 3, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the terminal device 3. Furthermore, the memory 31 may also include both an internal storage unit of the terminal device 3 and an external storage device. The memory 31 is used to store an operating system, application programs, a boot loader, data, and other programs, such as the program code of the computer program. The memory 31 may also be used to temporarily store data that has been output or is about to be output.

[0184] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned various method embodiments can be implemented.

[0185] An embodiment of the present application provides a computer program product. When the computer program product is run on a terminal device, the terminal device can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0186] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and when the computer program is executed by the processor, it can implement the steps of the above-mentioned various method embodiments. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device capable of carrying the computer program code to the device / terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electric carrier signal, a telecommunication signal and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, a computer-readable medium cannot be an electric carrier signal or a telecommunication signal.

[0187] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0188] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0189] In the embodiments provided in this application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are merely illustrative. For example, the division of the modules or units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0190] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0191] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the scope of protection of the present application.

Claims

1. An encryption method, characterized in that: include: Dividing the initial key into a plurality of initial byte segments, each of the initial byte segments including at least two bytes; Performing XOR processing on the initial byte segments to obtain an extended byte segment corresponding to each initial byte segment; generating an extended key according to the initial byte segment and the extended byte segment, wherein the number of bytes of the extended key is greater than the number of bytes of the initial key; Dividing the plaintext to be encrypted into a plurality of first data blocks according to the number of bytes of the extended key; encrypting each of the first data blocks according to the extended key; The performing XOR processing on the initial byte segments to obtain an extended byte segment corresponding to each initial byte segment includes: In the first round of expansion, data conversion processing is performed on the first byte segment to obtain a converted byte segment, wherein the first byte segment is the xth initial byte segment among the multiple initial byte segments; Performing an XOR operation on the second byte segment and the converted byte segment to obtain an extended byte segment corresponding to the second byte segment, wherein the second byte segment is the yth initial byte segment among the multiple initial byte segments; performing an exclusive-OR operation on a third byte segment and an extended byte segment corresponding to the second byte segment to obtain an extended byte segment corresponding to the third byte segment, wherein the third byte segment is any byte segment of the multiple initial byte segments except the first byte segment and the second byte segment; And so on, until the extended byte segment corresponding to each initial byte segment is obtained.

2. The encryption method according to claim 1, wherein: The performing data conversion processing on the first byte segment to obtain a converted byte segment includes: swapping the bytes in the first byte segment to obtain a fourth byte segment; Obtaining a first code value corresponding to the fourth byte segment from a preset data matrix; An exclusive-OR process is performed on the first code value to obtain the converted byte segment.

3. The encryption method according to claim 1 or 2, wherein: Encrypting each of the first data blocks according to the extended key includes: For the i-th byte in the m-th first data block, obtain the extended byte segment corresponding to the i-th byte in the extended key; Obtaining a second code value corresponding to the m from a preset data matrix; Obtaining a third code value corresponding to the i from the data matrix; An exclusive OR process is performed on the mth first data block, the extended byte segment corresponding to i, the second code value and the third code value to obtain the ciphertext of the i-th byte in the mth first data block.

4. The encryption method according to claim 3, wherein: The method further comprises: Dividing the ciphertext to be processed into a plurality of second data blocks according to the number of bytes of the extended key; For the j-th byte in the n-th second data block, obtain the extended byte segment corresponding to the j-th byte in the extended key; Obtaining a fourth code value corresponding to n from the data matrix; Obtaining a fifth code value corresponding to j from the data matrix; An exclusive OR process is performed on the nth second data block, the extended byte segment corresponding to j, the fourth code value and the fifth code value to obtain the plaintext of the jth byte in the nth second data block.

5. An encryption device, characterized in that: include: a key expansion unit, configured to divide an initial key into a plurality of initial byte segments, each of the initial byte segments including at least two bytes; perform an exclusive-OR operation on the initial byte segments to obtain an extended byte segment corresponding to each initial byte segment; and generate an extended key based on the initial byte segments and the extended byte segments, wherein the number of bytes of the extended key is greater than the number of bytes of the initial key; a data dividing unit, configured to divide the plaintext to be encrypted into a plurality of first data blocks according to the number of bytes of the extended key; a data encryption unit, configured to encrypt each of the first data blocks respectively according to the extended key; The key expansion unit is further used to: perform data conversion processing on the first byte segment during the first round of expansion to obtain a converted byte segment, wherein the first byte segment is the xth initial byte segment among the multiple initial byte segments; perform XOR processing on the second byte segment and the converted byte segment to obtain an extended byte segment corresponding to the second byte segment, wherein the second byte segment is the yth initial byte segment among the multiple initial byte segments; perform XOR processing on the third byte segment and the extended byte segment corresponding to the second byte segment to obtain an extended byte segment corresponding to the third byte segment, wherein the third byte segment is any byte segment among the multiple initial byte segments except the first byte segment and the second byte segment; and so on, until an extended byte segment corresponding to each initial byte segment is obtained.

6. A terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 4 is implemented.

7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images