Data encryption method, data decryption method and device, storage medium and terminal

Abstract

A data encryption method, a data decryption method and device, a storage medium and a terminal, the data encryption method comprising: when there is data to be written, generating a random number corresponding to the data to be written; obtaining a data encryption key according to a pre-stored original encryption key, the random number and first address information, and encrypting the data to be written using the data encryption key to obtain encrypted data, wherein the first address information is one of a data to be written address and a random number address; obtaining a random number encryption key based on the original encryption key, and encrypting the random number using the random number encryption key to obtain an encrypted random number; and performing a write operation on the encrypted data and the encrypted random number. The above scheme can improve data security.

Description

Technical Field

[0001] The present invention relates to the field of data encryption technology, and in particular to a data encryption method, a data decryption method and apparatus, a storage medium, and a terminal. Background Technology

[0002] Data in terminal device transaction systems is typically stored temporarily on Double Data Rate SDRAM (DDR) to save costs. To improve data security, the data is usually encrypted.

[0003] However, existing encryption methods are still vulnerable to swapping and replay attacks. A swapping attack involves exchanging transaction data at different memory addresses. A replay attack involves replacing current data with previously valid data. When data is subjected to swapping and replay attacks, data security is compromised. Summary of the Invention

[0004] The technical problem solved by the embodiments of the present invention is that existing data storage has low data security and is vulnerable to attacks.

[0005] To address the aforementioned technical problems, this invention provides a data encryption method, comprising: when there is data to be written, generating a random number corresponding to the data to be written; obtaining a data encryption key based on a pre-stored original encryption key, the random number, and first address information, and encrypting the data to be written using the data encryption key to obtain encrypted data, wherein the first address information is one of the address of the data to be written and the address of the random number; obtaining a random number encryption key based on the original encryption key, and encrypting the random number using the random number encryption key to obtain an encrypted random number; and performing a write operation on the encrypted data and the encrypted random number.

[0006] Optionally, obtaining the data encryption key based on the pre-stored original encryption key, the random number, and the first address information includes: obfuscating the original encryption key, the random number, and the first address information, and taking the obfuscated value as the data encryption key.

[0007] Optionally, obtaining the random number encryption key based on the original encryption key includes: obtaining the random number encryption key according to the original encryption key and the second address information, wherein the second address information is the other of the address to be written data and the random number address.

[0008] Optionally, obtaining the random number encryption key based on the original encryption key and the second address information includes: obfuscating the original encryption key and the second address information, and taking the obfuscated value as the random number encryption key.

[0009] Optionally, the data encryption method further includes: performing a hash verification on the data to be written, the random number, and the first address information to obtain a data hash value; performing a hash verification on the random number and the second address information to obtain a random number hash value, wherein the second address information is the other of the address of the data to be written and the address of the random number; and performing a write operation on the data hash value and the random number hash value.

[0010] Optionally, when there is data to be written, generating a random number corresponding to the data to be written includes any of the following: for each new piece of original data generated, dividing the original data into one or more data blocks according to a set data block size, using the data blocks as the data to be written, and generating a corresponding random number for each data block; or for each new piece of original data generated, generating a random number corresponding to the original data, dividing the original data into one or more data blocks according to a set data block size, using the data blocks as the data to be written, wherein the random number of the data to be written is the random number of the original data.

[0011] This invention also provides a data decryption method, comprising: acquiring encrypted data and an encrypted random number; generating a random number decryption key based on a pre-stored original decryption key; decrypting the encrypted random number using the random number decryption key to obtain plaintext random number; obtaining a data decryption key based on the plaintext random number, the original decryption key, and first address information, wherein the first address information is one of the address of the data to be written and the address of the random number; and decrypting the encrypted data using the data decryption key to obtain plaintext data.

[0012] Optionally, the data decryption method further includes: after obtaining the random number plaintext, performing a hash verification between the random number plaintext and the second address information to obtain a first hash value, wherein the second address information is the other of the address to be written data and the random number address; and performing a hash verification on the random number plaintext based on the first hash value and the obtained random number hash value.

[0013] Optionally, the data decryption method further includes: after obtaining the plaintext data, performing hash verification on the plaintext data, the random number plaintext, and the first address information to obtain a second hash value; and performing hash verification on the plaintext data based on the second hash value and the obtained data hash value.

[0014] This invention also provides a data encryption device, comprising: a random number generation unit, configured to generate a random number corresponding to the data to be written when there is data to be written; a data encryption unit, configured to obtain a data encryption key based on a pre-stored original encryption key, the random number, and first address information, and encrypt the data to be written using the data encryption key to obtain encrypted data, wherein the first address information is one of the address of the data to be written and the address of the random number; a random number encryption unit, configured to obtain a random number encryption key based on the original encryption key, and encrypt the random number using the random number encryption key to obtain an encrypted random number; and a writing unit, configured to perform a writing operation on the encrypted data and the encrypted random number.

[0015] This invention also provides a data decryption apparatus, comprising: an acquisition unit for acquiring encrypted data and an encrypted random number; a random number decryption key generation unit for generating a random number decryption key based on a pre-stored original decryption key; a random number decryption unit for decrypting the encrypted random number using the random number decryption key to obtain plaintext random number; a data decryption key generation unit for obtaining a data decryption key based on the plaintext random number, the original decryption key, and first address information, wherein the first address information is one of the address of the data to be written and the address of the random number; and a data decryption unit for decrypting the encrypted data using the data decryption key to obtain plaintext data.

[0016] This invention also provides a computer-readable storage medium storing a computer program thereon, characterized in that the computer program, when run by a processor, executes the steps of any of the above-described data encryption methods, or executes the steps of any of the above-described data decryption methods.

[0017] This invention also provides a terminal, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor runs the computer program, it executes the steps of any of the above-described data encryption methods or the steps of any of the above-described data decryption methods.

[0018] Compared with the prior art, the technical solution of the embodiments of the present invention has the following beneficial effects:

[0019] In this embodiment of the invention, when there is data to be written, a random number corresponding to the data to be written is generated. A data encryption key is obtained based on a pre-stored original encryption key, the random number, and first address information. This data encryption key is then used to encrypt the data to be written, resulting in encrypted data. A random number encryption key is then obtained based on the original encryption key, and this random number is used to encrypt the random number, resulting in an encrypted random number. Since the data encryption key is obtained based on the pre-stored original encryption key, the random number, and the first address information, it takes into account the random number corresponding to the data to be written. This random number can be automatically updated as data is written to prevent replay attacks. The first address information is also considered when obtaining the data encryption key, meaning it considers either the address of the data to be written or the address of the random number. Swapping attacks occur because the addresses of the swapped data are different, thus effectively preventing swapping attacks. Therefore, the data encryption method provided in this embodiment of the invention can improve data security.

[0020] Furthermore, a hash verification is performed on the data to be written, the random number, and the first address information to obtain a data hash value; a hash verification is performed on the random number and the second address information to obtain a random number hash value, where the second address information is the other of the address of the data to be written and the address of the random number; a write operation is performed on the data hash value and the random number hash value. Since the obtained data encryption key incorporates the first address information (one of the address of the data to be written and the address of the random number), and the calculation of the random number hash value incorporates the second address information, the introduction of both the first and second address information can effectively prevent swapping attacks, further improving data security. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of a data encryption principle in existing technology;

[0022] Figure 2 This is a flowchart of a data encryption method according to an embodiment of the present invention;

[0023] Figure 3 This is a schematic diagram of the encryption principle of data to be written in an embodiment of the present invention;

[0024] Figure 4 This is a schematic diagram illustrating the principle of data encryption key generation in an embodiment of the present invention;

[0025] Figure 5 This is a schematic diagram of a random number encryption principle in an embodiment of the present invention;

[0026] Figure 6 This is a data encryption principle diagram in an embodiment of the present invention;

[0027] Figure 7 This is a flowchart of a data decryption method according to an embodiment of the present invention;

[0028] Figure 8 This is a schematic diagram of the structure of a data encryption device according to an embodiment of the present invention;

[0029] Figure 9 This is a schematic diagram of the structure of a data decryption device according to an embodiment of the present invention. Detailed Implementation

[0030] As mentioned above, refer to Figure 1 This paper presents a schematic diagram of a data encryption principle in existing technology. Taking data from a transaction system as an example, the original data is divided into blocks of fixed size, such as Data_A, Data_B, etc. The transaction system's internal key is used to encrypt data blocks Data_A and Data_B respectively, and the encrypted data Data_A' and Data_B' are calculated and stored in their corresponding DDR addresses. Specifically, Data_A' is stored at address 0xA in DDR, and Data_B' is stored at address 0xB. The hash values ​​Hash_A and Hash_B of data block Data_A and Data_B are calculated and stored in their corresponding DDR addresses.

[0031] When the transaction system uses data block Data_A, it first decrypts Data_A' to obtain Data_A", then performs a hash check on Data_A" to calculate its hash value, Hash_A'. If Hash_A' equals Hash_A, then Data_A" is considered the original data and has not been tampered with. This process is repeated for each data block. Data_B' is decrypted to obtain Data_B", and then hashed to obtain Hash_B'. If Hash_B' equals Hash_B, then Data_B" is considered the original data and has not been tampered with. Conversely, if Hash_B' and Hash_B are not equal, then the data is considered to have been tampered with.

[0032] However, if an attacker simultaneously swaps the encrypted data and hash verification data (i.e., hash values) of two data blocks, they can complete the data modification. For example, an attacker could swap Data_A' and Data_B', and simultaneously swap Hash_A and Hash_B. At this point, the data at address A is Data_B, and the data at address B is Data_A. Since the hash values ​​are also swapped, both will pass hash verification, and the transaction system will assume the data has not been tampered with, thus failing to detect the data swapping attack. Furthermore, replacing the current data block with a previous data block in the transaction system can also complete the data modification, enabling a replay attack. Therefore, existing data encryption storage schemes are risky and have low data security.

[0033] To address the aforementioned issues, in this embodiment of the invention, when data is to be written, a random number corresponding to the data to be written is generated. A data encryption key is obtained based on a pre-stored original encryption key, the random number, and first address information. This data encryption key is then used to encrypt the data to be written, resulting in encrypted data. The first address information is either the address of the data to be written or the address of the random number. A random number encryption key is then obtained based on the original encryption key and used to encrypt the random number, resulting in an encrypted random number. Since the data encryption key is derived from the pre-stored original encryption key, the random number, and the first address information, it takes into account the random number corresponding to the data to be written. This random number can be automatically updated as data is written to prevent replay attacks. Furthermore, the first address information is considered when obtaining the data encryption key, meaning it considers either the address of the data to be written or the address of the random number. Swapping attacks occur because the addresses of swapped data differ, thus effectively preventing swapping attacks. Therefore, the data encryption method provided in this embodiment of the invention can improve data security.

[0034] To make the above-mentioned objectives, features and beneficial effects of the embodiments of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0035] This invention provides a data encryption method. The data encryption method can be executed by a terminal, a chip or chip module with data encryption function in the terminal, a chip or chip module with data processing function in the terminal, or a baseband chip in the terminal. Terminals include, but are not limited to, mobile phones, computers, tablets, and other terminal devices, and can also be servers, cloud platforms, base stations, etc. It is suitable for scenarios with high data security requirements, such as preventing unauthorized modification of data stored on external storage, thereby improving system security.

[0036] Reference Figure 2 The present invention provides a flowchart of a data encryption method according to an embodiment of the invention, which may specifically include the following steps:

[0037] Step 21: When there is data to be written, generate a random number corresponding to the data to be written;

[0038] Step 22: Based on the pre-stored original encryption key, the random number, and the first address information, obtain the data encryption key, and use the data encryption key to encrypt the data to be written to obtain encrypted data, wherein the first address information is one of the address of the data to be written and the address of the random number;

[0039] Step 23: Obtain a random number encryption key based on the original encryption key, and encrypt the random number using the random number encryption key to obtain an encrypted random number;

[0040] Step 24: Perform a write operation on the encrypted data and the encrypted random number.

[0041] For example, the data to be written can be transaction data, that is, data generated by a terminal with transaction functionality during a transaction. The terminal executing the data encryption method can be a terminal with transaction functionality or other terminals, as long as it can obtain the transaction data generated by the terminal with transaction functionality. The data to be written can also be other types of data, such as data generated by a base station or data generated by user equipment.

[0042] In some embodiments, in step 21, each time a new piece of raw data is generated, the raw data is divided into one or more data blocks according to a set data block size. These data blocks are used as the data to be written, and a corresponding random number is generated for each data block. That is, each data block has a one-to-one corresponding random number. The raw data can be divided into blocks of a fixed size, or it can be divided non-uniformly. In other words, when the raw data is divided into multiple data blocks, the sizes of the multiple data blocks can be the same or different.

[0043] In other embodiments, in step 21, for each new piece of original data generated, a random number corresponding to the original data is generated, and the original data is divided into one or more data blocks according to a set data block size. These data blocks are then used as the data to be written, and the random number of the data to be written is the same as the random number of the original data. That is, a corresponding random number is generated for each piece of original data, resulting in the same random number corresponding to the data blocks obtained from the same piece of original data.

[0044] In one specific embodiment of step 22, combined with Figure 3This invention provides a schematic diagram of a data encryption principle in an embodiment of the present invention. The original encryption key KEY, the random number RNG, and the first address information ADDR1 are obfuscated, and the obfuscated value is used as the data encryption key. The data to be written, Data, is encrypted using the data encryption key to obtain encrypted data Data'. The original encryption key KEY can be preset and stored.

[0045] Reference Figure 4 This invention provides a schematic diagram of a data encryption key generation principle in an embodiment of the invention. The explanation uses the Cyclic Redundancy Check (CRC) 32 algorithm to obfuscate the original encryption key KEY, the random number RNG, and the first address information ADDR1 to obtain the data encryption key as an example.

[0046] Specifically, crc_in0, crc_in1, ..., crc_in14, and crc_in15 are 16 preset internal hardware parameters. Using crc_in0, crc_in1, ..., crc_in6, and crc_in7 as initial values, a CRC32 checksum is performed on the first address information ADDR1, resulting in eight sets of 32-bit CRC checksum values. Figure 4 (Referred to as CRC32 in Chinese), the 8 sets of CRC check values ​​are concatenated to obtain the 256-bit first address check value ADDR1_CRC.

[0047] Using crc_in8, crc_in9, ..., crc_in14, and crc_in15 as initial values, CRC checksum calculations are performed on the random number RNG to obtain 8 sets of corresponding CRC checksum values. Figure 4 The result is CRC32 (referred to as CRC32) and concatenated to obtain a 256-bit random check value RNG_CRC.

[0048] The original encryption key KEY, the random number checksum RNG_CRC, and the first address checksum ADDR1_CRC are XORed to achieve obfuscation, resulting in an obfuscated value. This obfuscated value is then used as the data encryption key KEY'.

[0049] For example, the original encryption key KEY and the random number check value RNG_CRC are XORed to obtain the first XOR result. The first XOR result is then XORed with the first address check value ADDR1_CRC to obtain the second XOR result, which is used as the data encryption key KEY'.

[0050] For example, the original encryption key KEY and the first address check value ADDR1_CRC are XORed to obtain the first XOR result. The first XOR result is then XORed with the random number check value RNG_CRC to obtain the second XOR result, which is used as the data encryption key KEY'.

[0051] For example, perform an XOR operation on the random number check value RNG_CRC and ADDR1_CRC to obtain the first XOR result. Perform an XOR operation on the first XOR result and the original encryption key KEY to obtain the second XOR result, and use the second XOR result as the data encryption key KEY'.

[0052] In one specific implementation of step 23, refer to Figure 5 The present invention provides a schematic diagram of a random number encryption principle in an embodiment of the invention. Combined with... Figure 5 The random number encryption key is obtained based on the original encryption key KEY and the second address information ADDR2. The second address information is the other of the address of the data to be written and the random number address. When the second address information is the address of the data to be written, the random number encryption key is obtained based on the original encryption key and the address of the data to be written. When the second address information is a random number address, the random number encryption key is obtained based on the original encryption key and the random number address. The random number RNG is encrypted using the random number encryption key to obtain the encrypted random number RNG'.

[0053] The encryption algorithm used when encrypting the data to be written using the data encryption key and the encryption method used when encrypting the random number using the random number encryption key can be the same or different. The encryption algorithm can be the Advanced Encryption Standard (AES) algorithm, or other suitable encryption algorithms, such as the SM4 algorithm, Triple Data Encryption (3DES) algorithm, and other symmetric key algorithms. The SM4 algorithm is a block cipher algorithm.

[0054] Furthermore, the original encryption key and the second address information are obfuscated, and the obfuscated value is used as the random number encryption key.

[0055] For example, the original encryption key KEY and the second address information ADDR2 are obfuscated using the Cyclic Redundancy Check (CRC)32 algorithm to obtain a random number encryption key.

[0056] Specifically, crc_in0, crc_in1, ..., crc_in7 are eight preset internal hardware parameters. Using crc_in0, crc_in1, ..., cr_in6, cr_in7 as initial values, CRC checks are performed on the second address information ADDR2 to obtain eight corresponding CRC checksums. These eight CRC checksums are then concatenated to obtain a 32-bit second address checksum, ADDR2_CRC. The second address checksum ADDR2_CRC is then XORed with the original encryption key to obtain an obfuscated value, which is used as the random number encryption key.

[0057] In step 24, encrypted data and encrypted random numbers can be written to the DDR. Further, encrypted data can be written to the DDR address according to the address of the data to be written. An encrypted random number can be written to the DDR address according to the address of the random number.

[0058] As described above, when there is data to be written, a random number corresponding to the data to be written is generated. Based on the pre-stored original encryption key, the random number, and the first address information, a data encryption key is obtained, and the data to be written is encrypted using this data encryption key to obtain encrypted data. A random number encryption key is obtained based on the original encryption key, and the random number is encrypted using this random number encryption key to obtain an encrypted random number. Since the data encryption key is obtained based on the pre-stored original encryption key, the random number, and the first address information, it takes into account the random number corresponding to the data to be written. This random number can be automatically updated as data is written to prevent replay attacks. The first address information is also considered when obtaining the data encryption key, meaning it considers either the address of the data to be written or the address of the random number. Swapping attacks occur because the addresses of the swapped data are different, thus effectively preventing swapping attacks. Therefore, the data encryption method provided by this embodiment of the invention can improve data security.

[0059] In specific implementation, combined with Figure 3 The data to be written (Data), the random number (RNG), and the first address information (ADDR1) are hashed to obtain the data hash value (Hash_Data). Combined with... Figure 5 The random number RNG and the second address information ADDR2 are hashed and verified to obtain the random number hash value Hash_RNG. The second address information is the other one of the data address to be written and the random number address; a write operation is performed on the data hash value Hash_Data and the random number hash value Hash_RNG.

[0060] Furthermore, the data hash value and the random number hash value can be written into the DDR. Specifically, the data hash value and the random number hash value are written into the corresponding address in the DDR.

[0061] Hash verification is a message digest verification algorithm that compresses messages of arbitrary length into a fixed length.

[0062] To facilitate a better understanding and implementation of the embodiments of the present invention by those skilled in the art, reference is made to... Figure 6 A data encryption principle diagram according to an embodiment of the present invention is given below. Figure 6 The specific process of the data encryption method is explained in detail.

[0063] The raw data is divided into blocks of fixed size, namely Data_A and Data_B. The RNG hardware module can be used to generate random numbers RNG_A and RNG_B for data block Data_A.

[0064] The transaction system's internal key is used as the original encryption key. The original encryption key, the random number RNG_A of Data_A, and the data address information of Data_A are obfuscated. The obfuscated value is used as the data encryption key for data block Data_A. Data block Data_A is then encrypted to obtain encrypted data Data_A'.

[0065] The original encryption key and the address of the random number RNG_A are obfuscated. The obfuscated value is used as the encryption key for the random number RNG_A. RNG_A is then encrypted to obtain the encrypted random number RNG_A'.

[0066] Perform hash verification on RNG_A, Data_A, and the data address information of Data_A to obtain the data hash value. Figure 6 The diagram shows the Data Hash verification value (Hash_A).

[0067] Perform a hash check on RNG_A and the address of the random number to obtain the hash value of the random number. Figure 6 The diagram shows the RNG Hash verification value (RNG_Hash_A).

[0068] The original encryption key, the random number RNG_B of Data_B, and the data address information of Data_B are obfuscated. The obfuscated value is used as the data encryption key of data block Data_B. Data block Data_B is then encrypted to obtain encrypted data Data_B'.

[0069] The original encryption key and the address of the random number RNG_B are obfuscated. The obfuscated value is used as the encryption key for the random number RNG_B. RNG_B is then encrypted to obtain the encrypted random number RNG_B'.

[0070] Perform hash verification on RNG_B, Data_B, and the data address information of Data_B to obtain the hash value ( Figure 6 The diagram shows the Data Hash verification value (Hash_B).

[0071] Perform a hash check on RNG_B and the address of the random number to obtain the hash value of the random number. Figure 6 The diagram shows the RNG Hash verification value (RNG_Hash_B).

[0072] Store the encrypted data Data_A', the encrypted random number RNG_A', Hash_A, and RNG_Hash_A into the corresponding address 0xA in the DDR. Store the encrypted data Data_B', the encrypted random number RNG_B', Hash_B, and RNG_Hash_B into the corresponding address 0xB in the DDR.

[0073] This invention also provides a data decryption method. The data decryption method can be executed by a terminal, by a chip or chip module in the terminal that has data decryption functionality, by a chip or chip module in the terminal that has data processing functionality, or by a baseband chip in the terminal. The terminal includes, but is not limited to, mobile phones, computers, tablet computers, and other terminal devices, and can also be servers, cloud platforms, etc.

[0074] Reference Figure 7 The present invention provides a flowchart of a data decryption method according to an embodiment of the invention. The data decryption method may specifically include the following steps:

[0075] Step 71: Obtain the encrypted data and the encrypted random number;

[0076] Step 72: Generate a random decryption key based on the pre-stored original decryption key;

[0077] Step 73: Decrypt the encrypted random number using the random number decryption key to obtain the plaintext random number;

[0078] Step 74: Obtain the data decryption key based on the random number plaintext, the original decryption key, and the first address information, wherein the first address information is one of the address of the data to be written and the address of the random number;

[0079] Step 75: Decrypt the encrypted data using the data decryption key to obtain the plaintext data.

[0080] The original decryption key is matched with the original encryption key.

[0081] In a specific implementation, after obtaining the random number plaintext in step 73, the random number plaintext and the second address information are hashed to obtain a first hash value. The second address information is the other one of the data address to be written and the random number address. The random number plaintext is hashed according to the first hash value and the obtained random number hash value.

[0082] If the first hash value is the same as the hash value of the obtained random number, then the plaintext of the random number is correct and has not been tampered with. Conversely, if the first hash value is different from the hash value of the obtained random number, it indicates that the encrypted random number has been tampered with and can be interrupted.

[0083] After obtaining the plaintext data in step 75, a hash verification is performed on the plaintext data, the random number plaintext, and the first address information to obtain a second hash value; based on the second hash value and the obtained data hash value, a hash verification is performed on the plaintext data.

[0084] If the second hash value and the obtained data hash value are the same, the encrypted data is secure and has not been tampered with. Conversely, if the second hash value and the obtained data hash value are different, the data may be compromised and could be interrupted.

[0085] For example, continuing with the data block Data_A in the above embodiment, when the transaction system uses data block Data_A, it first uses the random number decryption key to decrypt the encrypted random number RNG_A' to obtain the plaintext random number RNG_A". The plaintext random number RNG_A" is then hashed to obtain the first hash value RNG_Hash_A'. If the first hash value RNG_Hash_A' is equal to the obtained hash value RNG_Hash_A, then RNG_A" is considered the original random number and has not been tampered with. Conversely, if the first hash value RNG_Hash_A' is not equal to the obtained hash value RNG_Hash_A, then RNG_A" has been tampered with.

[0086] If the first hash value RNG_Hash_A' is equal to the obtained hash value RNG_Hash_A, the data decryption key is obtained based on the random number plaintext RNG_A”, the original decryption key key, and the first address information to decrypt Data_A', obtaining Data_A”. Then, a hash operation is performed on Data_A”, the random number plaintext, and the first address information to obtain the second hash value Hash_A'. If the second hash value Hash_A' is equal to the obtained Hash_A, Data_A” is considered to be the original data and has not been tampered with.

[0087] In some non-limiting embodiments, the data encryption, decryption, and hash calculation in the above embodiments can be performed by hardware (such as hardware processors), reducing the impact on system performance.

[0088] The above scheme can effectively prevent data from being tampered with or replaced. For example, when using a data block from the previous trading system to replace the current trading system's data block for a replay attack, taking data block Data_A as an example, the attacker needs to replace four pieces of data simultaneously: RNG_A', the random hash value RNG_Hash_A, the encrypted data Data_A', and the random data number Data_Hash_A, in order to complete the data change and pass the system verification. This greatly increases the difficulty of the attack, thereby improving data security.

[0089] This invention also provides a data encryption device, which can be used to implement the data encryption method provided in the above embodiments. (Refer to...) Figure 8 A schematic diagram of a data encryption device according to an embodiment of the present invention is provided. The data encryption device 80 includes:

[0090] The random number generation unit 81 is used to generate a random number corresponding to the data to be written when there is data to be written.

[0091] The data encryption unit 82 is used to obtain a data encryption key based on a pre-stored original encryption key, the random number, and the first address information, and to encrypt the data to be written using the data encryption key to obtain encrypted data, wherein the first address information is one of the address of the data to be written and the address of the random number;

[0092] The random number encryption unit 83 is used to obtain a random number encryption key based on the original encryption key, and to encrypt the random number using the random number encryption key to obtain an encrypted random number;

[0093] The writing unit 84 is used to perform a writing operation on the encrypted data and the encrypted random number.

[0094] In specific implementations, the aforementioned data encryption device 80 may correspond to a chip in the terminal that has data encryption function, such as a SOC (System-On-a-Chip), a baseband chip, etc.; or correspond to a chip module in the terminal that includes a data encryption function; or correspond to a chip module that has a data processing function; or correspond to the terminal.

[0095] In specific implementation, the working principle and workflow of the data encryption device 80 can be found in the description of the data encryption method provided in any of the above embodiments, and will not be repeated here.

[0096] This invention also provides a data decryption apparatus, which can be used to implement the data decryption method provided in the above embodiments. (Refer to...) Figure 9A schematic diagram of a data decryption device according to an embodiment of the present invention is provided. The data decryption device 90 includes:

[0097] Acquisition unit 91 is used to acquire encrypted data and encrypted random numbers;

[0098] The random number decryption key generation unit 92 is used to generate a random number decryption key based on the pre-stored original decryption key;

[0099] The random number decryption unit 93 is used to decrypt the encrypted random number using the random number decryption key to obtain the random number plaintext;

[0100] The data decryption key generation unit 94 is used to obtain a data decryption key based on the random number plaintext, the original decryption key, and the first address information, wherein the first address information is one of the address of the data to be written and the address of the random number;

[0101] The data decryption unit 95 is used to decrypt the encrypted data using the data decryption key to obtain plaintext data.

[0102] In specific implementations, the aforementioned data decryption device 90 may correspond to a chip in the terminal that has data decryption function, such as a SOC (System-On-a-Chip), a baseband chip, etc.; or correspond to a chip module in the terminal that includes a data decryption function; or correspond to a chip module that has a data processing function; or correspond to the terminal.

[0103] In specific implementation, the working principle and workflow of the data decryption device 90 can be found in the description of the data decryption method provided in any of the above embodiments, and will not be repeated here.

[0104] This invention also provides a computer-readable storage medium storing a computer program thereon. When the computer program is run by a processor, it executes the steps of the data encryption method provided in any of the above embodiments of this invention, or executes the steps of the data decryption method provided in any of the above embodiments of this invention.

[0105] The computer-readable storage medium may include non-volatile or non-transitory memory, and may also include optical discs, hard disk drives, solid-state drives, etc.

[0106] Specifically, in this embodiment of the invention, the processor can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0107] It should also be understood that the memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (Synchlink DRAM, SLDRAM), and direct memory bus RAM (DR RAM).

[0108] This invention also provides a terminal, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor runs the computer program, it executes the steps of the data encryption method provided in any of the above embodiments, or executes the steps of the data decryption method provided in any of the above embodiments of this invention.

[0109] The memory and the processor are coupled, and the memory can be located inside or outside the terminal. The memory and the processor can be connected via a communication bus.

[0110] Terminals can include, but are not limited to, mobile phones, computers, tablets, and other terminal devices, as well as servers, cloud platforms, etc.

[0111] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer program can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, the computer program can be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means.

[0112] In the several embodiments provided in this application, it should be understood that the disclosed methods, apparatus, and systems can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for example, the division of units is merely a logical functional division, and other division methods may exist in actual implementation; for example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0113] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can be physically included separately, or two or more units can be integrated into one unit. The integrated units described above can be implemented in hardware or in a combination of hardware and software functional units. For example, for various devices or products applied to or integrated into a chip, each module / unit can be implemented using hardware such as circuits, or at least some modules / units can be implemented using software programs running on a processor integrated within the chip, while the remaining (if any) modules / units can be implemented using hardware such as circuits; for various devices or products applied to or integrated into a chip module, each module / unit can be implemented using hardware such as circuits, and different modules / units can be located in the same component (e.g., chip, circuit module, etc.) or different components of the chip module, or at least some modules / units can be implemented using hardware such as circuits. The components can be implemented using software programs that run on the processor integrated within the chip module. The remaining (if any) modules / units can be implemented using hardware methods such as circuits. For various devices and products applied to or integrated into the terminal, each of its components / units can be implemented using hardware methods such as circuits. Different modules / units can be located in the same component (e.g., chip, circuit module, etc.) or in different components within the terminal. Alternatively, at least some modules / units can be implemented using software programs that run on the processor integrated within the terminal, while the remaining (if any) modules / units can be implemented using hardware methods such as circuits.

[0114] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article indicates that the preceding and following related objects have an "or" relationship.

[0115] In the embodiments of this application, "multiple" refers to two or more.

[0116] The descriptions of "first," "second," "third," etc., appearing in the embodiments of this application are for illustrative purposes and to distinguish the objects being described. They have no order and do not indicate any special limitation on the number of devices in the embodiments of this application, nor do they constitute any limitation on the embodiments of this application.

[0117] It should be noted that the sequence number of each step in this embodiment does not represent a limitation on the execution order of each step.

[0118] While the present invention has been disclosed above, it is not limited thereto. Any person skilled in the art can make various modifications and alterations without departing from the spirit and scope of the invention; therefore, the scope of protection of the present invention should be determined by the scope defined in the claims.

Claims

1. A data encryption method, characterized in that, include: When there is data to be written, a random number corresponding to the data to be written is generated; Based on the pre-stored original encryption key, the random number, and the first address information, a data encryption key is obtained, and the data to be written is encrypted using the data encryption key to obtain encrypted data. The first address information is one of the address of the data to be written and the address of the random number. A random number encryption key is obtained based on the original encryption key, and the random number is encrypted using the random number encryption key to obtain an encrypted random number; Perform a write operation on the encrypted data and the encrypted random number.

2. The data encryption method as described in claim 1, characterized in that, The step of obtaining the data encryption key based on the pre-stored original encryption key, the random number, and the first address information includes: The original encryption key, the random number, and the first address information are obfuscated, and the obfuscated value is used as the data encryption key.

3. The data encryption method as described in claim 1, characterized in that, The process of obtaining a random number encryption key based on the original encryption key includes: The random number encryption key is obtained based on the original encryption key and the second address information, wherein the second address information is the other of the data address to be written and the random number address.

4. The data encryption method as described in claim 3, characterized in that, The step of obtaining the random number encryption key based on the original encryption key and the second address information includes: The original encryption key and the second address information are obfuscated, and the obfuscated value is used as the random number encryption key.

5. The data encryption method as described in claim 1, characterized in that, Also includes: Perform a hash check on the data to be written, the random number, and the first address information to obtain a data hash value; The random number and the second address information are hashed to obtain the hash value of the random number, and the second address information is the other one of the address of the data to be written and the address of the random number. Perform a write operation on the data hash value and the random number hash value.

6. The data encryption method as described in claim 1, characterized in that, When there is data to be written, the generation of a random number corresponding to the data to be written includes any of the following: Each time a new piece of raw data is generated, the raw data is divided into one or more data blocks according to the set data block size, the data blocks are used as the data to be written, and a corresponding random number is generated for each data block. For each new piece of raw data generated, a random number corresponding to the raw data is generated, and the raw data is divided into one or more data blocks according to the set data block size. The data blocks are used as the data to be written, and the random number of the data to be written is the random number of the raw data.

7. A data decryption method, characterized in that, include: Obtain encrypted data and encrypted random numbers; Generate a random decryption key based on the pre-stored original decryption key; The encrypted random number is decrypted using the aforementioned random number decryption key to obtain the plaintext random number; The data decryption key is obtained based on the random number plaintext, the original decryption key, and the first address information, wherein the first address information is one of the address of the data to be written and the address of the random number; The encrypted data is decrypted using the data decryption key to obtain the plaintext data.

8. The data decryption method as described in claim 7, characterized in that, Also includes: After obtaining the plaintext of the random number, the plaintext of the random number is hashed and verified with the second address information to obtain the first hash value. The second address information is the other one of the address of the data to be written and the address of the random number. The random number plaintext is hash-verified based on the first hash value and the obtained random number hash value.

9. The data decryption method as described in claim 7, characterized in that, Also includes: After obtaining the plaintext data, a hash check is performed on the plaintext data, the plaintext random number, and the first address information to obtain a second hash value; The plaintext data is hash-verified based on the second hash value and the obtained data hash value.

10. A data encryption device, characterized in that, include: A random number generation unit is used to generate a random number corresponding to the data to be written when there is data to be written. A data encryption unit is used to obtain a data encryption key based on a pre-stored original encryption key, the random number, and the first address information, and to encrypt the data to be written using the data encryption key to obtain encrypted data, wherein the first address information is one of the address of the data to be written and the address of the random number; A random number encryption unit is used to obtain a random number encryption key based on the original encryption key, and to encrypt the random number using the random number encryption key to obtain an encrypted random number; The writing unit is used to perform a writing operation on the encrypted data and the encrypted random number.

11. A data decryption device, characterized in that, include: The acquisition unit is used to acquire encrypted data and encrypted random numbers. A random number decryption key generation unit is used to generate a random number decryption key based on a pre-stored original decryption key; The random number decryption unit is used to decrypt the encrypted random number using the random number decryption key to obtain the random number plaintext; A data decryption key generation unit is used to obtain a data decryption key based on the random number plaintext, the original decryption key, and the first address information, wherein the first address information is one of the address of the data to be written and the address of the random number; The data decryption unit is used to decrypt the encrypted data using the data decryption key to obtain the plaintext data.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is run by the processor, it performs the steps of the data encryption method according to any one of claims 1 to 6, or the steps of the data decryption method according to any one of claims 7 to 9.

13. A terminal comprising a memory and a processor, wherein the memory stores a computer program capable of running on the processor, characterized in that, When the processor runs the computer program, it performs the steps of the data encryption method according to any one of claims 1 to 6, or the steps of the data decryption method according to any one of claims 7 to 9.

Images