Software Package Encryption and Decryption Method, System, Electronic Device and Readable Storage Medium

Abstract

The present invention relates to the technical field of electronic circuits, and discloses a software package encryption and decryption method, a circuit, an electronic device and a readable storage medium. The method obtains a plurality of encryption keys arranged in a preset order, encrypts each encryption key in sequence, and encrypts the final key through a confusion algorithm. The encrypted ciphertext is sent to the server side and the target client side, so that the server side and the target client side respectively decrypt the ciphertext to obtain the client key, and then the encryption and decryption of the software package are realized through the decrypted client key. By encrypting through a plurality of encryption keys in sequence and then decrypting in sequence to obtain the client key among them, compared with pre-setting the encryption key in the target server side, the risk of leakage of the encryption key is avoided, thereby improving the security of the software package during encryption and decryption.

Description

Technical Field

[0001] The present invention relates to the technical field of autonomous driving, and particularly to a software package encryption and decryption method, system, electronic device, and readable storage medium. Background Art

[0002] At present, with the development of connected vehicle technology, in order to reduce the recall of problem vehicles, promptly handle after-sales problems, iteratively update the functions of market vehicles, and improve the user experience, major vehicle manufacturers are all deeply researching and applying the remote upgrade technology of in-vehicle device software. OTA (Over-the-Air Technology) is becoming increasingly important in automotive software upgrades. Therefore, the security of software packages during transmission must also be emphasized and considered. Each major manufacturer will develop its own encryption and decryption algorithms to ensure data security.

[0003] However, currently, the keys used for encrypting software packages are pre-installed into the terminal upgrade application when the vehicle leaves the factory. The keys themselves are not encrypted, which poses a risk of leakage and results in poor security for encrypting and decrypting software packages. Summary of the Invention

[0004] To provide a basic understanding of some aspects of the disclosed embodiments, a simple summary is given below. This summary is not a comprehensive review, nor is it intended to identify key / important elements or delineate the scope of protection of these embodiments. Instead, it serves as a preface to the detailed description that follows.

[0005] In view of the above-mentioned disadvantages of the prior art, the present invention discloses a software package encryption and decryption method, system, electronic device, and readable storage medium to improve the security of software packages during encryption and decryption.

[0006] The present invention discloses a software package encryption and decryption method, including: obtaining a key package corresponding to a target client, where the key package includes a plurality of encryption keys arranged in a preset order. Among them, the first encryption key is determined as the client key, the last encryption key is determined as the final key, and the encryption keys other than the final key are determined as target keys; determining the encrypted ciphertext corresponding to each encryption key according to the key package to obtain a ciphertext package, and storing the ciphertext package to the server side and the target client respectively. Among them, the encrypted ciphertext of the target key is obtained by encrypting the target key with the next encryption key of the target key, and the encrypted ciphertext of the final key is obtained by encrypting the final key with a preset confusion algorithm; the server side, in response to obtaining the client software package corresponding to the target client, decrypts the client key from the ciphertext package on the server side, and encrypts the client software package according to the decrypted client key to obtain an encrypted software package; the target client, in response to receiving the encrypted software package, decrypts the client key from the ciphertext package on the target client, and decrypts the encrypted software package according to the decrypted client key to obtain the client software package.

[0007] Optionally, storing the ciphertext package to the server side and the target client respectively further includes: obtaining a key identifier corresponding to the key package, where the key identifier includes a client field and / or a key version field. Among them, the client field is used to characterize the client type of the target client, and the key version field is used to characterize the key package; storing the key identifier to the server side and the target client respectively.

[0008] Optionally, after the server side encrypts the client software package according to the decrypted client key to obtain an encrypted software package, the method further includes: obtaining a key feature value corresponding to the client key; generating an encryption feature value according to at least one of the key feature value, the key identifier, and the identifier length of the key identifier; adding the encryption feature value to the encrypted software package, and sending the encrypted software package to the target client.

[0009] Optionally, before the server side decrypts the client key from the ciphertext package on the server side after obtaining the client software package corresponding to the target client, the method further includes: detecting the obtained client software package; if it is detected that there is an encryption feature value in the client software package, feedback information that the software package has been encrypted; if it is detected that there is no encryption feature value in the client software package, decrypt the client key from the ciphertext package on the server side.

[0010] Optionally, sending the encrypted software package to the target client includes one of the following: establishing a software package transmission channel between the server side and the target client, and sending the encrypted software package to the target client based on the software package transmission channel; storing the encrypted software package in a removable storage device to transmit the encrypted software package to the target client through the removable storage device.

[0011] Optionally, after the target client receives the encrypted software package and before decrypting the client key from the ciphertext package of the target client, the method further includes: detecting the received encrypted software package; if it is detected that the encrypted software package does not have an encryption eigenvalue, feedbacking an information of decryption failure; if it is detected that the encrypted software package has an encryption eigenvalue, extracting a key identifier from the encryption eigenvalue, and comparing the extracted key identifier with the key identifier stored in the target client to obtain a comparison result; if the extracted key identifier is the same as the key identifier stored in the target client, decrypting the client key from the ciphertext package of the target client.

[0012] Optionally, after the target client compares the extracted key identifier with the key identifier stored in the target client to obtain a comparison result, the method further includes: if the extracted key identifier is different from the key identifier stored in the target client, establishing a key update channel between the target client and the server side; sending a key update request to the server side through the key update channel, triggering the server side to feedback the key identifier stored in the server side and the ciphertext package corresponding to the key identifier after verifying the key update request; storing according to the key identifier and the ciphertext package feedbacked by the server side; decrypting the client key from the stored ciphertext package; decrypting the encrypted software package according to the decrypted client key to obtain the client software package.

[0013] The present invention discloses a software package encryption and decryption system, including: an acquisition module, configured to acquire a key package corresponding to a target client, where the key package includes a plurality of encryption keys arranged in a preset order. Among them, the first encryption key is determined as the client key, the last encryption key is determined as the final key, and the encryption keys other than the final key are determined as target keys; an encryption module, configured to determine encrypted ciphertexts corresponding to the respective encryption keys according to the key package to obtain a ciphertext package, and store the ciphertext package in the server side and the target client respectively. Among them, the encrypted ciphertext of the target key is obtained by encrypting the target key with the encryption key next to the target key, and the encrypted ciphertext of the final key is obtained by encrypting the final key through a preset confusion algorithm; the server side is configured to, in response to acquiring the client software package corresponding to the target client, decrypt the client key from the ciphertext package of the server side, and encrypt the client software package according to the decrypted client key to obtain an encrypted software package; the target client is configured to, in response to receiving the encrypted software package, decrypt the client key from the ciphertext package of the target client, and decrypt the encrypted software package according to the decrypted client key to obtain the client software package.

[0014] The present invention discloses an electronic device, including: a processor and a memory; the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory so that the electronic device executes the above method.

[0015] The present invention discloses a computer-readable storage medium, on which a computer program is stored: when the computer program is executed by a processor, the above method is implemented.

[0016] Advantages of the present invention:

[0017] By acquiring a plurality of encryption keys arranged in a preset order, encrypting each encryption key in sequence, and encrypting the final key through a confusion algorithm, and sending the encrypted ciphertext to the server side and the target client, the server side and the target client respectively decrypt the client key from the ciphertext, so as to realize the encryption and decryption of the software package through the decrypted client key. In this way, by encrypting with multiple encryption keys in sequence and then decrypting in sequence to obtain the client key among them, compared with pre-setting the encryption key in the target server side, the risk of leakage of the encryption key is avoided, thereby improving the security of the software package during encryption and decryption.

[0018] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit this application. Description of the Drawings

[0019] The accompanying drawings here are incorporated into the specification and constitute a part of this specification, showing embodiments consistent with this application, and are used together with the specification to explain the principles of this application. Obviously, the accompanying drawings in the following description are only some embodiments of this application. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings. In the drawings:

[0020] Figure 1 is a schematic flowchart of a software package encryption and decryption method in an embodiment of the present invention;

[0021] Figure 2 is a schematic flowchart of a ciphertext package encryption method in an embodiment of the present invention;

[0022] Figure 3 is a schematic flowchart of a ciphertext package decryption method in an embodiment of the present invention;

[0023] Figure 4 is a schematic flowchart of a vehicle terminal software upgrade method in an embodiment of the present invention;

[0024] Figure 5 is a schematic flowchart of another software package encryption and decryption method in an embodiment of the present invention;

[0025] Figure 6 is a schematic structural diagram of a software package encryption and decryption system in an embodiment of the present invention;

[0026] Figure 7 is a schematic structural diagram of an electronic device in an embodiment of the present invention. Detailed Embodiments

[0027] The following illustrates the embodiments of the present invention through specific specific examples. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments. Various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that, without conflict, the following embodiments and sub-samples in the embodiments can be combined with each other.

[0028] It should be noted that the drawings provided in the following embodiments only illustrate the basic concept of the present invention in a schematic manner. Therefore, only the components related to the present invention are shown in the drawings, rather than being drawn according to the number, shape, and size of the components in actual implementation. The types, quantities, and proportions of the components in actual implementation can be arbitrarily changed, and the component layout type may also be more complex.

[0029] In the following description, numerous specific details are explored to provide a more thorough explanation of the embodiments of the present invention. However, it will be apparent to those skilled in the art that the embodiments of the present invention can be implemented without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring the embodiments of the present invention.

[0030] In the specification and claims of the embodiments of the present disclosure and in the above-mentioned drawings, the terms "first", "second", etc. are used to distinguish similar objects and do not necessarily describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances so as to implement the embodiments of the present disclosure described herein. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion.

[0031] Unless otherwise specified, the term "plurality" means two or more.

[0032] In the embodiments of the present disclosure, the character " / " indicates that the objects before and after are in an "or" relationship. For example, A / B means: A or B.

[0033] The term "and / or" is a description of the associated relationship of objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or, A and B these three relationships.

[0034] Combined Figure 1 As shown, the embodiments of the present disclosure provide a method for encrypting and decrypting software packages, including:

[0035] Step S101, obtaining a key package corresponding to the target client, where the key package includes a plurality of encryption keys arranged in a preset order;

[0036] Among them, the first encryption key is determined as the client key, the last encryption key is determined as the final key, and the encryption keys other than the final key are determined as the target keys;

[0037] Step S102, determining the encrypted ciphertext corresponding to each encryption key according to the key package to obtain a ciphertext package, and storing the ciphertext package in the server side and the target client respectively;

[0038] Among them, the encrypted ciphertext of the target key is obtained by encrypting the target key with the encryption key after the target key, and the encrypted ciphertext of the final key is obtained by encrypting the final key with a preset confusion algorithm;

[0039] Step S103, in response to obtaining the client software package corresponding to the target client, the server side decrypts the client key from the ciphertext package in the server side and encrypts the client software package according to the decrypted client key to obtain an encrypted software package;

[0040] In step S104, upon receiving the encrypted software package, the target client decrypts the client key from the ciphertext package of the target client, and decrypts the encrypted software package according to the decrypted client key to obtain the client software package.

[0041] By using the software package encryption and decryption method provided in the embodiments of the present disclosure, by obtaining a plurality of encryption keys arranged in a preset order, encrypting each encryption key in sequence, and encrypting the final key by using a confusion algorithm, and sending the encrypted ciphertext to the server side and the target client, the server side and the target client respectively decrypt the ciphertext to obtain the client key, so as to implement the encryption and decryption of the software package by using the decrypted client key. In this way, by encrypting with a plurality of encryption keys in sequence and then decrypting in sequence to obtain the client key therein, compared with presetting the encryption key on the target server side, the risk of leakage of the encryption key is avoided, thereby improving the security of the software package during encryption and decryption.

[0042] In some embodiments, the target client is a vehicle terminal, and the vehicle terminal has a plurality of vehicle series information. Different key packages are allocated to each vehicle terminal according to different vehicle series information, and each key package is assigned a corresponding key identifier (key ID), and the key identifier is named according to the vehicle series information and the key package version.

[0043] In some embodiments, the server side is the cloud, and a key management module is provided in the cloud for managing the key package and the ciphertext package of the target terminal.

[0044] In some embodiments, based on the AES128 (Advanced Encryption Standard 128) encryption algorithm, the target key is encrypted by the encryption key after the target key to obtain the encrypted ciphertext of the target key.

[0045] Optionally, storing the ciphertext package to the server side and the target client respectively further includes: obtaining the key identifier corresponding to the key package, where the key identifier includes a client field and / or a key version field, where the client field is used to characterize the client type of the target client, and the key version field is used to characterize the key package; storing the key identifier to the server side and the target client respectively.

[0046] Optionally, after the server obtains the client software package corresponding to the target client and before decrypting the client key from the ciphertext package on the server side, the method further includes: detecting the obtained client software package; if an encryption eigenvalue is detected in the client software package, feedbacking information that the software package has been encrypted; if no encryption eigenvalue is detected in the client software package, decrypting the client key from the ciphertext package on the server side.

[0047] In some embodiments, the administrator uploads the client software package corresponding to the target client to the server side by logging in to the OTA cloud system.

[0048] In this way, it is determined whether the software package has been encrypted by whether the encryption eigenvalue exists in the software package, avoiding repeated encryption.

[0049] Optionally, after the server encrypts the client software package according to the decrypted client key to obtain an encrypted software package, the method further includes: obtaining the key eigenvalue corresponding to the client key; generating an encryption eigenvalue according to at least one of the key eigenvalue, the key identifier, and the identifier length of the key identifier; adding the encryption eigenvalue to the encrypted software package, and sending the encrypted software package to the target client.

[0050] In some embodiments, the encryption eigenvalue is written to the file content header of the encrypted software package.

[0051] Optionally, sending the encrypted software package to the target client includes one of the following: establishing a software package transmission channel between the server side and the target client, and sending the encrypted software package to the target client based on the software package transmission channel; storing the encrypted software package in a removable storage device to transmit the encrypted software package to the target client through the removable storage device.

[0052] Optionally, after the target client receives the encrypted software package and before decrypting the client key from the ciphertext package of the target client, the method further includes: detecting the received encrypted software package; if no encryption eigenvalue is detected in the encrypted software package, feedbacking decryption failure information; if an encryption eigenvalue is detected in the encrypted software package, extracting the key identifier from the encryption eigenvalue, and comparing the extracted key identifier with the key identifier stored in the target client to obtain a comparison result; if the extracted key identifier is the same as the key identifier stored in the target client, decrypting the client key from the ciphertext package of the target client.

[0053] In this way, it is determined whether the encryption key used by the server is the same as the decryption key used by the client through the key identifier in the encryption eigenvalue, so as to determine whether the ciphertext package of the target client is incorrect or the ciphertext package is lost, avoiding decoding failure caused by key mismatch.

[0054] Combined withFigure 2 As shown in Figure 2 , an embodiment of the present disclosure provides a ciphertext packet encryption method, including: obtaining a client key (AES128_KEY), a first key (KEY1), and a second key (KEY2); encrypting the client key using the AES128 algorithm according to the first key to obtain a client ciphertext; encrypting the first key using the AES128 algorithm according to the second key to obtain a first ciphertext; encrypting the second key using a confusion algorithm to obtain a second ciphertext; and generating a ciphertext packet based on the client ciphertext, the first ciphertext, and the second ciphertext.

[0055] Combined with Figure 3 As shown in Figure 3 , an embodiment of the present disclosure provides a ciphertext packet decryption method, including: decrypting the second ciphertext using a confusion reduction algorithm to obtain the second key; decrypting the first ciphertext using the AES128 algorithm according to the second key to obtain the first key; and decrypting the client ciphertext using the AES128 algorithm according to the first key to obtain the client key.

[0056] By using the ciphertext packet encryption method and the ciphertext packet decryption method provided by the embodiments of the present disclosure, by obtaining multiple encryption keys arranged in a preset order, encrypting each encryption key in sequence, and encrypting the final key using a confusion algorithm, and sending the encrypted ciphertext to the server side and the target client, the server side and the target client respectively decrypt the ciphertext to obtain the client key, so as to realize the encryption and decryption of the software package through the client key obtained by decryption. In this way, by encrypting with multiple encryption keys in sequence and then decrypting in sequence to obtain the client key among them, compared with pre-setting the encryption key on the target server side, the risk of encryption key leakage is avoided, thereby improving the security of the software package during encryption and decryption.

[0057] Optionally, after the target client compares the extracted key identifier with the key identifier stored in the target client to obtain a comparison result, the method further includes: if the extracted key identifier is different from the key identifier stored in the target client, establishing a key update channel between the target client and the server side; sending a key update request to the server side through the key update channel, triggering the server side to feedback the key identifier stored in the server side and the ciphertext packet corresponding to the key identifier after verifying the key update request; and storing according to the key identifier and the ciphertext packet feedback by the server side.

[0058] In this way, in the case where the key identifier of the software package is different from the key identifier stored in the target client, it is determined that the ciphertext packet of the target client is incorrect or the ciphertext packet is lost. The flexibility of key storage is improved through the key update mechanism. At the same time, it is convenient to update the key after the key is leaked, thereby improving the security of the key.

[0059] Optionally, the method further includes: if the target client does not have a key identifier, establishing a key update channel between the target client and the server; the target client sending a key update request to the server through the key update channel, triggering the server to feedback the key identifier stored in the server and the ciphertext package corresponding to the key identifier after verifying the key update request; storing according to the key identifier and the ciphertext package feedback by the server; decrypting the stored ciphertext package to obtain the client key; decrypting the encrypted software package according to the obtained client key to obtain the client software package.

[0060] Optionally, after the target client decrypts the encrypted software package according to the obtained client key to obtain the client software package, the method further includes: determining whether the decrypted client software package has an encryption eigenvalue; if the decrypted client software package does not have an encryption eigenvalue, performing software upgrade according to the client software package; if the decrypted client software package has an encryption eigenvalue, continuing to decrypt the client software package according to the encryption eigenvalue until the decrypted client software package does not have an encryption eigenvalue.

[0061] Combined with Figure 4 As shown, an embodiment of the present disclosure provides a method for software upgrade of a vehicle terminal, including:

[0062] Step S401, the OTA server of the vehicle terminal receives a new version of the encrypted software package;

[0063] Step S402, if the encrypted software package has an encryption eigenvalue, the OTA server extracts the key identifier in the encryption eigenvalue;

[0064] Step S403, the OTA server requests the key identifier stored in the vehicle terminal from the cache node of the vehicle terminal;

[0065] Step S404, the cache node sends the key identifier stored in the vehicle terminal to the OTA server;

[0066] Step S405, if the two key identifiers are different, the OTA server sends a key update request to the server through a preset key update channel;

[0067] Step S406, the OTA server receives the key identifier and the ciphertext package feedback by the server;

[0068] Step S407, the OTA server sends the key identifier and the ciphertext package to the cache node;

[0069] Step S408, the cache node updates according to the received key identifier and the ciphertext package;

[0070] Step S409, the cache node feeds back update information to the OTA server;

[0071] Step S410, the OTA server decrypts the ciphertext packet to obtain the client key;

[0072] Step S411, the OTA server decrypts the encrypted software packet according to the client key to obtain the client software packet;

[0073] Step S412, the OTA server performs software upgrade according to the client software packet.

[0074] Combined with Figure 5 As shown, the present disclosure provides a software packet encryption and decryption method, including:

[0075] Step S501, obtain the key packet corresponding to the target client;

[0076] Among them, the key packet includes multiple encrypted keys arranged in a preset order. The first encrypted key is determined as the client key, the last encrypted key is determined as the final key, and the encrypted keys other than the final key are determined as target keys;

[0077] Step S502, determine the encrypted ciphertext corresponding to each encrypted key according to the key packet to obtain the ciphertext packet;

[0078] Among them, the encrypted ciphertext of the target key is obtained by encrypting the target key with the next encrypted key of the target key, and the encrypted ciphertext of the final key is obtained by encrypting the final key with a preset confusion algorithm;

[0079] Step S503, store the ciphertext packet in the server side and the target client respectively;

[0080] Step S504, the server side obtains the client software packet corresponding to the target client;

[0081] Step S505, the server side determines whether there is an encryption feature value in the client software packet. If so, jump to step S506; if not, jump to step S507;

[0082] Step S506, the server side feeds back the information that the software packet has been encrypted.

[0083] Step S507, the server side decrypts from the ciphertext packet on the server side to obtain the client key;

[0084] Step S508, the server side encrypts the client software packet according to the decrypted client key to obtain the encrypted software packet;

[0085] Step S509, the server side generates an encryption feature value according to at least one of the key feature value, the key identifier, and the identifier length of the key identifier;

[0086] Step S510, the server adds the encrypted eigenvalue to the encrypted software package and sends the encrypted software package to the target client;

[0087] Step S511, the target client determines whether there is an encrypted eigenvalue in the encrypted software package. If so, it jumps to step S512; if not, it jumps to step S513;

[0088] Step S512, the target client extracts the key identifier from the encrypted eigenvalue and jumps to step S514;

[0089] Step S513, the target client feeds back a decryption failure message.

[0090] Step S514, the target client determines whether the extracted key identifier is the same as the key identifier stored in the target client. If so, it jumps to step S515; if not, it jumps to step S517;

[0091] Step S515, the target client decrypts the client key from the ciphertext package of the target client;

[0092] Step S516, the target client decrypts the encrypted software package according to the decrypted client key to obtain the client software package.

[0093] Step S517, the target client sends a key update request to the server through a preset key update channel;

[0094] Step S518, the target client decrypts the client key from the ciphertext package fed back by the server;

[0095] Step S519, decrypt the encrypted software package according to the decrypted client key to obtain the client software package.

[0096] Adopting the software package encryption and decryption method provided by the embodiments of the present disclosure, by obtaining a plurality of encryption keys arranged in a preset order, encrypting each encryption key in turn, and encrypting the final key through a confusion algorithm, and sending the encrypted ciphertext to the server and the target client, so that the server and the target client respectively decrypt the ciphertext to obtain the client key, thereby realizing the encryption and decryption of the software package through the decrypted client key, having the following advantages:

[0097] First, by encrypting through a plurality of encryption keys in turn and then decrypting in turn to obtain the client key among them, compared with presetting the encryption key on the target server, the risk of leakage of the encryption key is avoided, thereby improving the security of the software package during encryption and decryption;

[0098] Second, by determining whether the software package has been encrypted based on whether there is an encrypted eigenvalue in the software package, repeated encryption is avoided;

[0099] Third, by judging whether the encryption key used by the server is the same as the decryption key used by the client through the key identifier in the encrypted eigenvalue, it is possible to judge whether the ciphertext packet of the target client is in error or the ciphertext packet is lost, avoiding decoding failure caused by key mismatch;

[0100] Fourth, in the case where the key identifier of the software package is different from the key identifier stored in the target client, it is determined that the ciphertext packet of the target client is in error or the ciphertext packet is lost. The flexibility of key storage is improved through the key update mechanism. At the same time, it is convenient to update the key after the key is leaked, thereby improving the security of the key.

[0101] Combined with Figure 6 As shown in the figure, an embodiment of the present disclosure provides a software package encryption and decryption system, including an acquisition module 601, an encryption module 602, a server side 603, and a target client 604. The acquisition module 601 is used to acquire a key package corresponding to the target client. The key package includes a plurality of encryption keys arranged in a preset order. Among them, the first encryption key is determined as the client key, the last encryption key is determined as the final key, and the encryption keys other than the final key are determined as target keys; the encryption module 602 is used to determine the encrypted ciphertext corresponding to each encryption key according to the key package, obtain a ciphertext packet, and store the ciphertext packet in the server side and the target client respectively. Among them, the encrypted ciphertext of the target key is obtained by encrypting the target key with the next encryption key of the target key, and the encrypted ciphertext of the final key is obtained by encrypting the final key through a preset confusion algorithm; the server side 603 is used to respond to the acquisition of the client software package corresponding to the target client, decrypt the client key from the ciphertext packet of the server side, and encrypt the client software package according to the decrypted client key to obtain an encrypted software package; the target client 604 is used to respond to the reception of the encrypted software package, decrypt the client key from the ciphertext packet of the target client, and decrypt the encrypted software package according to the decrypted client key to obtain the client software package.

[0102] By using the software package encryption and decryption system provided by the embodiment of the present disclosure, by acquiring a plurality of encryption keys arranged in a preset order, encrypting each encryption key in turn, and encrypting the final key through a confusion algorithm, and sending the encrypted ciphertext to the server side and the target client, so that the server side and the target client respectively decrypt the ciphertext to obtain the client key, thereby realizing the encryption and decryption of the software package through the decrypted client key. In this way, by encrypting with a plurality of encryption keys in turn and then decrypting in turn to obtain the client key among them, compared with pre-setting the encryption key in the target server side, the risk of encryption key leakage is avoided, thereby improving the security of the software package during encryption and decryption.

[0103] Figure 7The figure shows a schematic structural diagram of a computer system of an electronic device suitable for implementing the embodiments of the present application. It should be noted that Figure 7 The computer system 700 of the illustrated electronic device is only an example and should not impose any limitations on the functions and usage scope of the embodiments of the present application.

[0104] As Figure 7 shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 702 or the program loaded from the storage section 708 into the random access memory (RAM) 703, such as executing the method in the above embodiments. In the RAM 703, various programs and data required for system operation are also stored. The CPU 701, ROM 702, and RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0105] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc. and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as required. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as required, so that the computer program read from it can be installed into the storage section 708 as required.

[0106] Particularly, according to the embodiments of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments of the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication section 709, and / or installed from the removable medium 711. When the computer program is executed by the central processing unit (CPU) 701, various functions defined in the system of the present application are executed.

[0107] It should be noted that the computer-readable medium shown in the embodiments of the present application may be a computer-readable signal medium, a computer-readable storage medium, or any combination of the two. A computer-readable storage medium may be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable computer program. Such a propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium may be transmitted by any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0108] The embodiments of the present disclosure also provide a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, it implements any one of the methods in this embodiment.

[0109] For the computer-readable storage medium in the embodiments of the present disclosure, those of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to the computer program. The foregoing computer program may be stored in a computer-readable storage medium. When the program is executed, it executes the steps including the above method embodiments; and the foregoing storage medium includes: ROM, RAM, magnetic disk, or optical disc and other media that can store program codes.

[0110] The electronic device disclosed in this embodiment includes a processor, a memory, a transceiver, and a communication interface. The memory and the communication interface are connected to the processor and the transceiver and complete communication with each other. The memory is used to store a computer program, the communication interface is used for communication, and the processor and the transceiver are used to run the computer program to enable the electronic device to execute each step of the above method.

[0111] In this embodiment, the memory may include a Random Access Memory (RAM), and may also include a non-volatile memory, such as at least one disk memory.

[0112] The above-mentioned processor may be a general-purpose processor, including a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), a Network Processor (NP), etc.; it may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0113] The above description and the accompanying drawings fully illustrate the embodiments of the present disclosure, enabling those skilled in the art to practice them. Other embodiments may include structural, logical, electrical, process, and other changes. The embodiments merely represent possible variations. Unless explicitly required, the individual components and functions are optional, and the order of operations may vary. Parts and sub-samples of some embodiments may be included in or replace parts and sub-samples of other embodiments. Moreover, the terms used in this application are only for describing the embodiments and do not limit the claims. As used in the description of the embodiments and the claims, unless the context clearly indicates otherwise, the singular forms "a", "an", and "the" are intended to also include the plural forms. Similarly, as used in this application, the term "and / or" refers to any and all possible combinations of one or more of the associated listed items. Additionally, when used in this application, the term "comprise" and its variants "comprises" and / or "comprising" etc. mean the presence of the stated sub-samples, wholes, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other sub-samples, wholes, steps, operations, elements, components, and / or groupings of these. Without further limitation, an element defined by the statement "comprising one..." does not exclude the presence of another identical element in the process, method, or device comprising the element. Herein, each embodiment may focus on the differences from other embodiments, and the same or similar parts among the embodiments may be referred to each other. For the methods, products, etc. disclosed in the embodiments, if they correspond to the method parts disclosed in the embodiments, the relevant parts may refer to the description of the method parts.

[0114] Those skilled in the art will recognize that the units and algorithm steps of the examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, or in a combination of computer software and electronic hardware. Whether these functions are executed in hardware or software can depend on the specific application and design constraints of the technical solution. The skilled person may use different methods for each specific application to implement the described functions, but such implementation should not be considered to exceed the scope of the embodiments of the present disclosure. The skilled person can clearly understand that for the sake of convenience and brevity of description, the specific working processes of the systems, devices, and units described above can refer to the corresponding processes in the foregoing method embodiments and will not be elaborated herein.

[0115] In the embodiments disclosed in this document, the disclosed methods, products (including but not limited to devices, equipment, etc.) can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units can be merely a logical function division. In actual implementation, there can be other division methods. For example, multiple units or components can be combined or integrated into another system, or some sub-samples can be ignored or not executed. Additionally, the couplings or direct couplings or communication connections shown or discussed between each other can be through some interfaces. The indirect couplings or communication connections of the devices or units can be in electrical, mechanical, or other forms. The units described as separate components may or may not be physically separated. The components shown as units may or may not be physical units, that is, they can be located in one place or distributed to multiple network units. Some or all of the units can be selected according to actual needs to implement this embodiment. Additionally, in the embodiments of this disclosure, the various functional units can be integrated in one processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit.

[0116] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to the embodiments of this disclosure. In this regard, each block in the flowchart or block diagram can represent a module, a program segment, or a part of code that contains one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions marked in the blocks can occur in a different order than that marked in the accompanying drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and sometimes they can also be executed in the reverse order, which can depend on the functions involved. In the descriptions corresponding to the flowcharts and block diagrams in the accompanying drawings, the operations or steps corresponding to different blocks can also occur in a different order than that disclosed in the description. Sometimes, there is no specific order between different operations or steps. For example, two consecutive operations or steps can actually be executed substantially in parallel, and sometimes they can also be executed in the reverse order, which can depend on the functions involved. Each block in the block diagram and / or flowchart, as well as the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system for performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

Claims

1. A software package encryption and decryption method, characterized in that Including: Obtain a key package corresponding to the target client, where the key package includes multiple encryption keys arranged in a preset order. Among them, the first encryption key is determined as the client key, the last encryption key is determined as the final key, and the encryption keys other than the final key are determined as target keys; Determine the ciphertext corresponding to each encryption key according to the key package to obtain a ciphertext package, and store the ciphertext package in the server and the target client respectively. Among them, the ciphertext of the target key is obtained by encrypting the target key with the next encryption key of the target key, and the ciphertext of the final key is obtained by encrypting the final key with a preset confusion algorithm; In response to obtaining the client software package corresponding to the target client, the server decrypts the client key from the ciphertext package of the server, and encrypts the client software package according to the decrypted client key to obtain an encrypted software package; In response to receiving the encrypted software package, the target client decrypts the client key from the ciphertext package of the target client, and decrypts the encrypted software package according to the decrypted client key to obtain the client software package.

2. The method according to claim 1, characterized in that Storing the ciphertext package in the server and the target client respectively further includes: Obtain a key identifier corresponding to the key package, where the key identifier includes a client field and / or a key version field. Among them, the client field is used to characterize the client type of the target client, and the key version field is used to characterize the key package; Store the key identifier in the server and the target client respectively.

3. The method according to claim 2, characterized in that After the server encrypts the client software package according to the decrypted client key to obtain an encrypted software package, the method further includes: Obtain a key feature value corresponding to the client key; Generate an encryption feature value based on at least one of the key feature value, the key identifier, and the identifier length of the key identifier; Add the encryption feature value to the encrypted software package and send the encrypted software package to the target client.

4. The method according to claim 3, wherein Before the server decrypts the client key from the ciphertext package of the server after obtaining the client software package corresponding to the target client, the method further includes: Detect the obtained client software package; If it is detected that there is an encryption feature value in the client software package, feedback information that the software package has been encrypted; If it is detected that there is no encryption feature value in the client software package, decrypt the client key from the ciphertext package of the server.

5. The method according to claim 3, wherein Sending the encrypted software package to the target client includes one of the following: Establish a software package transmission channel between the server and the target client, and send the encrypted software package to the target client based on the software package transmission channel; Store the encrypted software package in a removable storage device to transmit the encrypted software package to the target client through the removable storage device.

6. The method according to any one of claims 3 to 5, characterized in that, Before the target client decrypts the client key from the ciphertext packet of the target client after receiving the encrypted software package, the method further includes: Detecting the received encrypted software package; If it is detected that there is no encryption eigenvalue in the encrypted software package, feedback information indicating decryption failure; If it is detected that there is an encryption eigenvalue in the encrypted software package, extract the key identifier from the encryption eigenvalue, and compare the extracted key identifier with the key identifier stored in the target client to obtain a comparison result; If the extracted key identifier is the same as the key identifier stored in the target client, decrypt the client key from the ciphertext packet of the target client.

7. The method according to claim 6, wherein After the target client compares the extracted key identifier with the key identifier stored in the target client to obtain a comparison result, the method further includes: If the extracted key identifier is different from the key identifier stored in the target client, establish a key update channel between the target client and the server; Send a key update request to the server through the key update channel, and trigger the server to feedback the key identifier stored in the server and the ciphertext packet corresponding to the key identifier after verifying the key update request; Store according to the key identifier and ciphertext packet feedback by the server; Decrypt the client key from the stored ciphertext packet; Decrypt the encrypted software package according to the decrypted client key to obtain the client software package.

8. A software package encryption and decryption system, characterized in that Including: An acquisition module, configured to acquire a key packet corresponding to a target client, where the key packet includes a plurality of encryption keys arranged in a preset order. Among them, the first encryption key is determined as the client key, the last encryption key is determined as the final key, and the encryption keys other than the final key are determined as target keys; An encryption module, configured to determine the encrypted ciphertext corresponding to each encryption key according to the key packet to obtain a ciphertext packet, and store the ciphertext packet in the server and the target client respectively. Among them, the encrypted ciphertext of the target key is obtained by encrypting the target key with the next encryption key of the target key, and the encrypted ciphertext of the final key is obtained by encrypting the final key through a preset confusion algorithm; The server is configured to, in response to obtaining the client software package corresponding to the target client, decrypt the client key from the ciphertext packet of the server, and encrypt the client software package according to the decrypted client key to obtain an encrypted software package; The target client is configured to, in response to receiving the encrypted software package, decrypt the client key from the ciphertext packet of the target client, and decrypt the encrypted software package according to the decrypted client key to obtain the client software package.

9. An electronic device, characterized in that, Including: One or more processors; A storage device, configured to store one or more programs, and when the one or more programs are executed by the one or more processors, enable the electronic device to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Computer-readable instructions are stored thereon, which, when executed by a processor of a computer, cause the computer to perform the method according to any one of claims 1 to 7.

Images