Network device and data decryption method

Abstract

The application provides a network device applied to the field of encryption and decryption. The network device comprises a receiver and a chip. The chip comprises a hardware encryption and decryption component and an one-time programmable (OTP) storage area. The receiver is configured to receive a file to be decrypted. The file to be decrypted comprises ciphertext. The hardware encryption and decryption component is configured to obtain a root key plaintext from the OTP storage area, decrypt the ciphertext by using the root key plaintext, and obtain plaintext. In the application, the OTP storage area is protected by the chip. The root key plaintext in the OTP storage area cannot be read by an application program outside the chip, and therefore the security of the network device can be improved.

Description

Technical Field

[0001] This application relates to the field of encryption and decryption, and in particular to network devices and data decryption methods. Background Technology

[0002] Equipment manufacturers can update the software on network devices by sending device software packages, such as the Basic Input / Output System (BIOS), Operating System (OS), or applications. However, hackers may intercept these packages during the communication link. If a hacker obtains the package, they can perform binary reverse engineering to gain information that could be used to attack the software. Therefore, equipment manufacturers can set a root key in plaintext on the network device before it leaves the factory. Before sending the device software package, the manufacturer encrypts it using the root key in plaintext. Upon receiving the encrypted package, the network device decrypts it using the root key in plaintext to obtain the plaintext package.

[0003] In practical applications, even the root key in plaintext can be stolen by hackers. Hackers can use the root key in plaintext to decrypt encrypted software packages, thereby reducing the security of network devices. Summary of the Invention

[0004] This application provides a network device and a data decryption method. The root key plaintext in the OTP storage area of ​​the network device cannot be read by applications outside the chip, thus improving the security of the network device.

[0005] This application provides a network device in its first aspect. The network device includes a hardware encryption / decryption component, a one-time programmable (OTP) memory, and a receiver. The hardware encryption / decryption component and the OTP memory can be integrated into the chip of the network device. The hardware encryption / decryption component is a logic program protected by the chip. Specifically, the logic program of the hardware encryption / decryption component can be a logic circuit or a combination of logic circuit and software code. The logic circuit or software code of the hardware encryption / decryption component is internal to the chip. External applications cannot modify or obtain the relevant data of the hardware encryption / decryption component during processing. Similarly, the OTP memory is also protected by the chip. Data in the OTP memory cannot be modified or read by external applications. The receiver is used to receive a file to be decrypted. The file to be decrypted includes ciphertext. The hardware encryption / decryption component is used to obtain the root key plaintext from the OTP memory, and decrypt the ciphertext using the root key plaintext to obtain the plaintext. Here, ciphertext refers to encrypted data. Plaintext refers to unencrypted or decrypted data.

[0006] In this application, the root key plaintext in the OTP storage area cannot be read by applications outside the chip, thus improving the security of network devices.

[0007] In one alternative embodiment of the first aspect, a hardware encryption / decryption component is used to obtain the root key ciphertext from the OTP storage area. The hardware encryption / decryption component decrypts the root key ciphertext using the first key material and the key to obtain the root key plaintext. The root key ciphertext is obtained from the root key ciphertext, the first key material, and the key. Therefore, this application can further improve the security of network devices.

[0008] In one alternative approach of the first aspect, the hardware encryption / decryption component is further used to obtain a key and first key material from the file to be decrypted. The root key plaintext can be flexibly altered by changing the key or the first key material in the file to be decrypted. Therefore, this application can further improve the security of network devices.

[0009] In one alternative approach of the first aspect, the file to be decrypted further includes second key material. A hardware encryption / decryption component is used to derive a root key plaintext from the second key material to obtain a subkey. The hardware encryption / decryption component is then used to decrypt the ciphertext using the subkey to obtain the plaintext. Obtaining the subkey from the root key plaintext can further enhance the security of the network device.

[0010] In one alternative embodiment of the first aspect, the file to be decrypted further includes first encryption indication information. The hardware encryption / decryption component is also used to determine whether to decrypt the ciphertext based on the first encryption indication information. In practical applications, network devices may also receive plaintext. The network device cannot determine whether the file to be decrypted carries ciphertext or plaintext. If the first encryption indication information indicates that decryption is not required, this indicates that the file to be decrypted carries plaintext. The network device does not need to decrypt the plaintext. If the first encryption indication information indicates that decryption is required, this indicates that the file to be decrypted carries ciphertext. The network device needs to decrypt the ciphertext. Therefore, this application can improve the flexibility of encryption and decryption. For example, for unimportant software, the device manufacturer can choose not to encrypt it.

[0011] In one alternative approach of the first aspect, the OTP storage area stores second encryption indication information. The hardware encryption / decryption component determines whether to decrypt the ciphertext based on the first and second encryption indication information. Specifically, when both the second and first encryption indication information indicate that decryption is required, the hardware encryption / decryption component determines to decrypt the ciphertext. When the second encryption indication information indicates that decryption is required but the first encryption indication information indicates that decryption is not required, the hardware encryption / decryption component issues an alarm. When both the second and first encryption indication information indicate that decryption is not required, the hardware encryption / decryption component determines not to decrypt the ciphertext. When the second encryption indication information indicates that decryption is not required but the first encryption indication information indicates that decryption is required, the hardware encryption / decryption component issues an alarm. When the hardware encryption / decryption component issues an alarm, it may choose not to decrypt the ciphertext.

[0012] Therefore, this application can force certain network devices to only install encrypted or plaintext software packages, thereby improving the flexibility of network devices to adapt to different scenarios.

[0013] In one alternative embodiment of the first aspect, the file to be decrypted further includes first algorithm type indication information. The hardware encryption / decryption component is further configured to determine a target encryption / decryption algorithm within the hardware encryption / decryption component based on the first algorithm type indication information. The hardware encryption / decryption component is used to decrypt the ciphertext using the target encryption / decryption algorithm and the root key plaintext to obtain the plaintext. Multiple decryption algorithms can be pre-configured within the hardware encryption / decryption component. The hardware encryption / decryption component selects the target encryption / decryption algorithm from among the multiple decryption algorithms based on the first algorithm type indication information. Therefore, this application allows for flexible selection of decryption algorithms, thereby improving the security of network devices.

[0014] In one alternative embodiment of the first aspect, the OTP storage area includes second algorithm type indication information. The algorithm type represented by the second algorithm type indication information covers the algorithm type represented by the first algorithm type indication information. A hardware encryption / decryption component determines a target encryption / decryption algorithm based on the first and second algorithm type indication information. Specifically, when the algorithm type represented by the second algorithm type indication information covers the algorithm type represented by the first algorithm type indication information, the hardware encryption / decryption component selects the target encryption / decryption algorithm represented by the first algorithm type indication information. When the algorithm type represented by the second algorithm type indication information does not cover the algorithm type represented by the first algorithm type indication information, the hardware encryption / decryption component can issue an alarm. The hardware encryption / decryption component does not use the algorithm type represented by the first algorithm type indication information to decrypt the ciphertext. Therefore, this application can force certain network devices to use a specific encryption / decryption algorithm, thereby improving the security of network devices.

[0015] In one alternative approach of the first aspect, multiple encryption and decryption algorithms within the hardware encryption / decryption component share a root key ciphertext. However, the on-chip OTP storage space is limited. By sharing the root key ciphertext, storage space can be saved, thereby reducing the cost of network equipment.

[0016] In one alternative approach to the first aspect, the ciphertext is a BIOS, OS, or application.

[0017] A second aspect of this application provides a data decryption method. The data decryption method is applied to a network device. The network device includes a chip and a receiver. The chip includes a hardware encryption / decryption component and an OTP storage area. The data decryption method includes the following steps: the network device receives a file to be decrypted through the receiver. The file to be decrypted includes ciphertext. The network device obtains the root key plaintext from the OTP storage area. The network device decrypts the ciphertext using the hardware encryption / decryption component and the root key plaintext to obtain the plaintext. The hardware encryption / decryption component and the OTP storage area can be integrated into the chip of the network device. The hardware encryption / decryption component is a logic program protected by the chip. Specifically, the logic program of the hardware encryption / decryption component can be a logic circuit or a combination of logic circuit and software code. The logic circuit or software code of the hardware encryption / decryption component is internal to the chip. External applications cannot modify or obtain the relevant data during the processing of the hardware encryption / decryption component. Similarly, the OTP storage area is also protected by the chip. Data in the OTP storage area cannot be modified or read by external applications.

[0018] In this application, the root key plaintext in the OTP storage area cannot be read by applications outside the chip, thus improving the security of network devices.

[0019] In one alternative approach of the second aspect, the network device obtains the root key ciphertext from the OTP storage area. The network device decrypts the root key ciphertext using hardware encryption / decryption components, the first key material, and the key to obtain the root key plaintext.

[0020] In one alternative approach of the second aspect, before the network device decrypts the root key ciphertext to obtain the root key plaintext, the data decryption method further includes the following steps: the network device obtains the key and the first key material from the file to be decrypted.

[0021] In an alternative embodiment of the second aspect, the file to be decrypted further includes the second key material. The network device derives a root key plaintext using hardware encryption / decryption components and the second key material to obtain a subkey. The network device then decrypts the ciphertext using the hardware encryption / decryption components and the subkey to obtain the plaintext.

[0022] In an alternative approach of the second aspect, the file to be decrypted further includes first encryption indication information. Before the network device decrypts the ciphertext using hardware encryption / decryption components and the root key plaintext to obtain plaintext, the data decryption method further includes the following steps: the network device determines whether to decrypt the ciphertext based on the first encryption indication information. Wherein, if the first encryption indication information indicates that decryption is not required, this indicates that the network device received plaintext. The network device does not need to decrypt the plaintext. If the first encryption indication information indicates that decryption is required, this indicates that the network device received ciphertext. The network device needs to decrypt the ciphertext.

[0023] In one alternative approach of the second aspect, the OTP storage area includes second encryption indication information. The network device determines whether to decrypt the ciphertext based on the first and second encryption indication information. Specifically, when both the second and first encryption indication information indicate that decryption is required, the hardware encryption / decryption component determines to decrypt the ciphertext. When the second encryption indication information indicates that decryption is required but the first encryption indication information indicates that decryption is not required, the hardware encryption / decryption component issues an alarm. When both the second and first encryption indication information indicate that decryption is not required, the hardware encryption / decryption component determines not to decrypt the ciphertext. When the second encryption indication information indicates that decryption is not required but the first encryption indication information indicates that decryption is required, the hardware encryption / decryption component issues an alarm. When the hardware encryption / decryption component issues an alarm, it may choose not to decrypt the ciphertext.

[0024] In an alternative approach of the second aspect, the file to be decrypted further includes first algorithm type indication information. Before the network device decrypts the ciphertext using the hardware encryption / decryption component and the root key plaintext to obtain the plaintext, the data decryption method further includes the following steps: the network device determines the target encryption / decryption algorithm in the hardware encryption / decryption component based on the first algorithm type indication information. The network device decrypts the ciphertext using the target encryption / decryption algorithm and the root key plaintext to obtain the plaintext.

[0025] In one alternative approach of the second aspect, the OTP storage area includes second algorithm type indication information. The algorithm type represented by the second algorithm type indication information overrides the algorithm type represented by the first algorithm type indication information. The network device determines the target encryption / decryption algorithm in the hardware encryption / decryption component based on the first and second algorithm type indication information. When the algorithm type represented by the second algorithm type indication information does not override the algorithm type represented by the first algorithm type indication information, the hardware encryption / decryption component may issue an alarm. The hardware encryption / decryption component does not use the algorithm type represented by the first algorithm type indication information to decrypt the ciphertext.

[0026] A third aspect of this application provides an encryption device. The encryption device includes a processor and a transceiver. The processor encrypts ciphertext using plaintext based on a root key to obtain ciphertext. The transceiver sends a file to be decrypted to a network device. The file to be decrypted includes ciphertext. The network device includes a chip and a receiver. The chip includes hardware encryption / decryption components and an OTP storage area. The OTP storage area stores information related to the plaintext root key. The ciphertext is used by the hardware encryption / decryption components to decrypt the ciphertext using the plaintext root key to obtain plaintext.

[0027] In one alternative approach of the third aspect, the root key ciphertext is stored in the OTP storage area. The root key ciphertext is used by the hardware encryption / decryption component to decrypt the root key ciphertext using the first key material and the key, to obtain the root key plaintext.

[0028] In one alternative approach of the third aspect, the file to be decrypted also includes a key and first key material.

[0029] In an alternative approach of the third aspect, the file to be decrypted further includes second key material. The second key material is used by the hardware encryption / decryption component to derive a root key plaintext from the second key material to obtain a subkey. The ciphertext is used by the hardware encryption / decryption component to decrypt the ciphertext using the root key plaintext, obtaining plaintext, which includes: the ciphertext is used by the hardware encryption / decryption component to decrypt the ciphertext using the subkey, obtaining plaintext.

[0030] In an alternative approach of the third aspect, the file to be decrypted further includes first encryption indication information. The first encryption indication information is used by the hardware encryption / decryption component to determine whether to decrypt the ciphertext. If the first encryption indication information indicates that decryption is not required, this indicates that the network device received plaintext, and the network device does not need to decrypt the plaintext. If the first encryption indication information indicates that decryption is required, this indicates that the network device received ciphertext, and the network device needs to decrypt the ciphertext.

[0031] In one alternative approach of the third aspect, the OTP storage area stores second encryption indication information. The first encryption indication information is used by the hardware encryption / decryption component to determine whether to decrypt the ciphertext based on the first encryption indication information, including: the hardware encryption / decryption component determines whether to decrypt the ciphertext based on the first encryption indication information and the second encryption indication information. Specifically, when both the second and first encryption indication information indicate that decryption is required, the hardware encryption / decryption component determines to decrypt the ciphertext. When the second encryption indication information indicates that decryption is required but the first encryption indication information indicates that decryption is not required, the hardware encryption / decryption component issues an alarm. When both the second and first encryption indication information indicate that decryption is not required, the hardware encryption / decryption component determines not to decrypt the ciphertext; when the second encryption indication information indicates that decryption is not required but the first encryption indication information indicates that decryption is required, the hardware encryption / decryption component issues an alarm.

[0032] In an alternative approach of the third aspect, the file to be decrypted further includes first algorithm type indication information. The first algorithm type indication information is used by the hardware encryption / decryption component to determine the target encryption / decryption algorithm within the hardware encryption / decryption component. The ciphertext is used by the hardware encryption / decryption component to decrypt the ciphertext using the root key plaintext to obtain plaintext, which includes: the ciphertext is used by the hardware encryption / decryption component to decrypt the ciphertext using the target encryption / decryption algorithm and the root key plaintext to obtain plaintext.

[0033] In one alternative approach of the third aspect, the OTP storage area includes second algorithm type indication information. The algorithm type represented by the second algorithm type indication information covers the algorithm type represented by the first algorithm type indication information. The first algorithm type indication information is used by the hardware encryption / decryption component to determine the target encryption / decryption algorithm in the hardware encryption / decryption component based on the first algorithm type indication information and the second algorithm type indication information. When the algorithm type represented by the second algorithm type indication information does not cover the algorithm type represented by the first algorithm type indication information, the hardware encryption / decryption component can issue an alarm and not use the algorithm type represented by the first algorithm type indication information to decrypt the ciphertext.

[0034] In one alternative approach of the third aspect, multiple encryption and decryption algorithms in the hardware encryption and decryption component share a root key ciphertext.

[0035] In one alternative approach of the third aspect, the ciphertext is the BIOS, OS, or application.

[0036] A fourth aspect of this application provides a data encryption method. The data encryption method includes the following steps: an encryption device encrypts ciphertext using a root key plaintext to obtain ciphertext. The encryption device sends a file to be decrypted to a network device. The file to be decrypted includes the ciphertext. The network device includes a chip and a receiver. The chip includes a hardware encryption / decryption component and an OTP storage area. The OTP storage area stores information related to the root key plaintext. The ciphertext is used by the hardware encryption / decryption component to decrypt the ciphertext using the root key plaintext to obtain the plaintext.

[0037] In one alternative approach of the fourth aspect, the root key ciphertext is stored in the OTP storage area. The root key ciphertext is used by the hardware encryption / decryption component to decrypt the root key ciphertext using the first key material and the key, to obtain the root key plaintext.

[0038] In one alternative approach of the fourth aspect, the file to be decrypted also includes a key and first key material.

[0039] In one alternative approach of the fourth aspect, the file to be decrypted further includes second key material. The second key material is used by the hardware encryption / decryption component to derive a root key plaintext from the second key material to obtain a subkey. The ciphertext is used by the hardware encryption / decryption component to decrypt the ciphertext using the root key plaintext to obtain plaintext, which includes: the ciphertext is used by the hardware encryption / decryption component to decrypt the ciphertext using the subkey to obtain plaintext.

[0040] In one alternative approach of the fourth aspect, the file to be decrypted further includes first encryption indication information. The first encryption indication information is used by the hardware encryption / decryption component to determine whether to decrypt the ciphertext. If the first encryption indication information indicates that decryption is not required, this indicates that the network device received plaintext, and the network device does not need to decrypt the plaintext. If the first encryption indication information indicates that decryption is required, this indicates that the network device received ciphertext, and the network device needs to decrypt the ciphertext.

[0041] In one alternative approach of the fourth aspect, the OTP storage area stores second encryption indication information. The first encryption indication information is used by the hardware encryption / decryption component to determine whether to decrypt the ciphertext based on the first encryption indication information, including: the hardware encryption / decryption component determines whether to decrypt the ciphertext based on the first encryption indication information and the second encryption indication information. Specifically, when both the second and first encryption indication information indicate that decryption is required, the hardware encryption / decryption component determines to decrypt the ciphertext. When the second encryption indication information indicates that decryption is required but the first encryption indication information indicates that decryption is not required, the hardware encryption / decryption component issues an alarm. When both the second and first encryption indication information indicate that decryption is not required, the hardware encryption / decryption component determines not to decrypt the ciphertext; when the second encryption indication information indicates that decryption is not required but the first encryption indication information indicates that decryption is required, the hardware encryption / decryption component issues an alarm.

[0042] In an alternative approach of the fourth aspect, the file to be decrypted further includes first algorithm type indication information. The first algorithm type indication information is used by the hardware encryption / decryption component to determine the target encryption / decryption algorithm within the hardware encryption / decryption component. The ciphertext is used by the hardware encryption / decryption component to decrypt the ciphertext using the root key plaintext to obtain plaintext, which includes: the ciphertext is used by the hardware encryption / decryption component to decrypt the ciphertext using the target encryption / decryption algorithm and the root key plaintext to obtain plaintext.

[0043] In one alternative embodiment of the fourth aspect, the OTP storage area includes second algorithm type indication information. The algorithm type represented by the second algorithm type indication information covers the algorithm type represented by the first algorithm type indication information. The first algorithm type indication information is used by the hardware encryption / decryption component to determine the target encryption / decryption algorithm in the hardware encryption / decryption component based on the first algorithm type indication information, including: the first algorithm type indication information is used by the hardware encryption / decryption component to determine the target encryption / decryption algorithm in the hardware encryption / decryption component based on the first algorithm type indication information and the second algorithm type indication information. When the algorithm type represented by the second algorithm type indication information does not cover the algorithm type represented by the first algorithm type indication information, the hardware encryption / decryption component can issue an alarm and not use the algorithm type represented by the first algorithm type indication information to decrypt the ciphertext. Attached Figure Description

[0044] Figure 1 This is the first structural schematic diagram of the network device provided in this application;

[0045] Figure 2 This is a second structural diagram of the network device provided in this application;

[0046] Figure 3 This is a third structural diagram of the network device provided in this application;

[0047] Figure 4 This is the fourth structural diagram of the network device provided in this application;

[0048] Figure 5 This is a first structural schematic diagram of the encryption device provided in this application;

[0049] Figure 6 This is a second structural schematic diagram of the encryption device provided in this application;

[0050] Figure 7 This is a third structural diagram of the encryption device provided in this application;

[0051] Figure 8 This is a schematic diagram of the encryption system provided in this application;

[0052] Figure 9 This is a flowchart illustrating the data decryption method provided in this application;

[0053] Figure 10 This is a flowchart illustrating the data encryption method provided in this application. Detailed Implementation

[0054] This application provides a network device and a data decryption method. The root key plaintext in the OTP storage area of ​​the network device cannot be read by applications outside the chip, thus improving the security of the network device.

[0055] It should be understood that the terms "first," "second," or "target," etc., used in this application are for distinguishing purposes only and should not be construed as indicating or implying relative importance or order. Furthermore, for the sake of brevity and clarity, reference numerals and / or letters are repeated in several figures of this application. This repetition does not indicate a strict limiting relationship between the various embodiments and / or configurations.

[0056] The network device described in this application is used in the field of encryption and decryption. In this field, device manufacturers can improve the security of network devices by encrypting device software packages. However, in practical applications, the plaintext root key in a network device may be stolen by hackers, thereby reducing the security of the network device.

[0057] Therefore, this application provides a network device. Figure 1 This is the first structural diagram of the network device provided in this application. Figure 1 As shown, network device 100 includes receiver 101 and chip 105. Chip 105 includes OTP memory 104 and hardware encryption / decryption components 103. Chip 105 may be a processor. The processor may be a central processing unit (CPU), a network processor (NP), or a combination of CPU and NP. The processor may further include hardware chips or other general-purpose processors. The aforementioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.

[0058] Hardware encryption / decryption component 103 is a logic program protected by chip 105. Specifically, the logic program of hardware encryption / decryption component 103 can be a logic circuit or a combination of logic circuit and software code. The logic circuit or software code of hardware encryption / decryption component 103 is internal to chip 105. Applications outside chip 105 cannot modify or obtain the relevant data of hardware encryption / decryption component 103 during processing. Similarly, OTP memory area 104 is also protected by the chip. Data in OTP memory area 104 cannot be modified or read by applications outside chip 105. For example, a fuse can prevent applications outside chip 105 from reading data in OTP memory area 104. Furthermore, network device 100 can also generate pseudo data. Applications outside chip 105 read pseudo data from "OTP memory area 104". Pseudo data can be all 0s or all 1s. Hardware encryption / decryption component 103 can access OTP memory area 104 through logic circuit. Here, "applications outside chip 105" refers to applications whose logic circuit or code is located outside the chip. For example, if the code for an application is on the external memory of a network device, then the application is an external application to chip 105.

[0059] In practical applications, network device 100 may also include off-chip memory 102. Off-chip memory 102 can be volatile memory, non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), such as programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), non-volatile flash memory (NOR Flash), NAND flash memory, etc. Volatile memory can be random access memory (RAM), such as static random-access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (DRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), etc.

[0060] Receiver 101 can be a transceiver. The transceiver can be a wireless radio frequency module or an optical transceiver module. It can also be a communication protocol module. Network device 100 establishes a secure communication connection with external entities through the communication protocol module. The communication protocol module can be Transport Layer Security (TLS) or Internet Protocol Security (IPSec), etc. Receiver 101 is used to receive a file to be decrypted. The file to be decrypted includes ciphertext. External memory 102 is used to store the file to be decrypted. OTP storage area 104 stores information related to the root key plaintext. The information related to the root key plaintext can be written to the network device before it leaves the factory. The information related to the root key plaintext can be root key plaintext or root key ciphertext, etc. When the OTP storage area 104 stores the root key plaintext, hardware encryption / decryption component 103 is used to retrieve the root key plaintext from the OTP storage area 104. Hardware encryption / decryption component 103 is also used to retrieve ciphertext from external memory 102. The hardware encryption / decryption component 103 is used to decrypt ciphertext using the root key plaintext to obtain plaintext.

[0061] In this application, the root key plaintext in the OTP storage area 104 cannot be read by applications outside the chip, thus improving the security of network devices.

[0062] In practical applications, the root key plaintext in OTP storage area 104 can typically only be written once. Therefore, to facilitate upgrading the root key plaintext, the root key ciphertext can be stored in OTP storage area 104. For example, Figure 2 This is a second structural diagram of the network device provided in this application. (See diagram below.) Figure 2 As shown, network device 100 includes receiver 101, external memory 102, and chip 105. Chip 105 includes OTP storage area 104 and hardware encryption / decryption component 103. OTP storage area 104 stores root key ciphertext. The file to be decrypted received by receiver 101 includes ciphertext, key, and first key material. External memory 102 is used to store the file to be decrypted. Hardware encryption / decryption component 103 is used to obtain root key ciphertext from OTP storage area 104. Hardware encryption / decryption component 103 is also used to obtain key and first key material from external memory 102. Hardware encryption / decryption component 103 is used to obtain root key plaintext based on root key ciphertext, key, and first key material. Hardware encryption / decryption component 103 is also used to obtain ciphertext from external memory 102. Hardware encryption / decryption component 103 is used to decrypt ciphertext using root key plaintext to obtain plaintext.

[0063] It should be understood that in scenarios where upgrading the root key plaintext is not required, the key and the first key material can be stored in the OTP storage area 104. In this case, the hardware encryption / decryption component 103 is used to retrieve the root key ciphertext, the key, and the first key material from the OTP storage area 104. The hardware encryption / decryption component 103 is also used to retrieve the ciphertext from the external memory 102. After obtaining the root key plaintext based on the root key ciphertext, the key, and the first key material, the hardware encryption / decryption component 103 is used to decrypt the ciphertext using the root key plaintext to obtain the plaintext.

[0064] In practical applications, to improve the security of network devices, the hardware encryption / decryption component 103 can obtain a subkey from the root key plaintext. The hardware encryption / decryption component 103 then decrypts the ciphertext using the subkey to obtain the plaintext. For example, Figure 3 This is a third structural diagram of the network device provided in this application. (See diagram below.) Figure 3 As shown, network device 100 includes receiver 101, external memory 102, and chip 105. Chip 105 includes OTP storage area 104 and hardware encryption / decryption component 103. OTP storage area 104 stores a key, first key material, and root key ciphertext. The file to be decrypted received by receiver 101 includes ciphertext and second key material. External memory 102 is used to store the file to be decrypted. Hardware encryption / decryption component 103 is used to obtain the key, first key material, and root key ciphertext from OTP storage area 104. Hardware encryption / decryption component 103 is used to obtain root key plaintext based on root key ciphertext, key, and first key material. Hardware encryption / decryption component 103 is also used to obtain second key material from external memory 102. Hardware encryption / decryption component 103 is used to derive root key plaintext from second key material to obtain subkey. Hardware encryption / decryption component 103 is also used to obtain ciphertext from external memory 102. Hardware encryption / decryption component 103 is used to decrypt ciphertext using subkey to obtain plaintext.

[0065] In practical applications, receiver 101 may also receive a file to be decrypted carrying plaintext. Network device 100 cannot determine whether the file to be decrypted carries ciphertext or plaintext. Therefore, the file to be decrypted may also include first encryption indication information, and hardware encryption / decryption component 103 determines whether to decrypt the ciphertext in the file based on the first encryption indication information. For example, Figure 4 This is the fourth structural diagram of the network device provided in this application. Figure 4 As shown, network device 100 includes receiver 101, external memory 102, and chip 105. Chip 105 includes OTP storage area 104 and hardware encryption / decryption component 103. The file to be decrypted received by receiver 101 includes ciphertext, second key material, and first encryption indication information.

[0066] If the OTP storage area 104 does not contain encryption indication information, and the first encryption indication information indicates that decryption is not required, this indicates that the network device received plaintext. Network device 100 does not need to decrypt the plaintext and can directly load it. If the first encryption indication information indicates that decryption is required, this indicates that network device 100 received ciphertext. Network device 100 decrypts the ciphertext. For details on the decryption operation, see [link to relevant documentation]. Figure 3 The relevant description in the document.

[0067] like Figure 4 As shown, in practical applications, to improve the security of network device 100, the OTP storage area 104 may store second encryption instruction information. Network device 100 can use the second encryption instruction information to force it to only install encrypted or plaintext software packages.

[0068] For example, when both a second encryption indication and a first encryption indication exist, network device 100 determines whether to decrypt the ciphertext based on the second encryption indication. Specifically, when the second encryption indication indicates that decryption is required, hardware encryption / decryption component 103 decrypts the ciphertext. In this case, even if the first encryption indication indicates that decryption is not required (i.e., the file to be decrypted contains plaintext), hardware encryption / decryption component 103 will still decrypt the plaintext, resulting in an incorrect file. Furthermore, network device 100 cannot load the incorrect file, thus forcing network device 100 to only install encrypted software packages. When the second encryption indication indicates that decryption is not required, hardware encryption / decryption component 103 does not decrypt the ciphertext. In this case, even if the first encryption indication indicates that decryption is required (i.e., the file to be decrypted contains ciphertext), hardware encryption / decryption component 103 will not decrypt the ciphertext. Network device 100 cannot load the ciphertext, thus forcing network device 100 to only install plaintext software packages.

[0069] For example, when the second encryption indication information and the first encryption indication information representation need to be decrypted, the hardware encryption / decryption component 103 determines to decrypt the ciphertext. When the second encryption indication information representation needs to be decrypted but the first encryption indication information representation does not need to be decrypted, the hardware encryption / decryption component 103 issues an alarm. When the second encryption indication information and the first encryption indication information representation do not need to be decrypted, the hardware encryption / decryption component 103 determines not to decrypt the ciphertext. When the second encryption indication information representation does not need to be decrypted but the first encryption indication information representation does need to be decrypted, the hardware encryption / decryption component 103 issues an alarm. When the hardware encryption / decryption component 103 issues an alarm, it may choose not to decrypt the ciphertext. Therefore, this application can force the network device 100 to only install encrypted or plaintext software packages, thereby improving the flexibility of the network device to adapt to different scenarios.

[0070] In practical applications, the hardware encryption / decryption component 103 can be pre-configured with various encryption / decryption algorithms. These algorithms include international cryptographic algorithms and domestically developed cryptographic algorithms. International cryptographic algorithms are a series of encryption / decryption algorithms whose standards are primarily developed by foreign standards organizations or institutions. International cryptographic algorithms include symmetric encryption algorithms, asymmetric encryption algorithms, and cryptographic hash algorithms. Symmetric encryption algorithms include Data Encryption Standard (DES) and Advanced Encryption Standard (AES). Asymmetric encryption algorithms include Rivest-Shamir-Adleman (RSA), Elliptic Curve Cryptography (ECC), and Diffie-Hellman (DH). Cryptographic hash algorithms include Message Digest Algorithm Version 5 (MD5) and Secure Hash Algorithm (SHA). Domestically developed cryptographic algorithms, also known as Chinese cryptographic algorithms or commercial cryptographic algorithms, are a series of algorithms whose standards are developed by the State Cryptography Administration of China. These include symmetric encryption algorithms, elliptic curve asymmetric encryption algorithms, and hash algorithms. For example, symmetric encryption algorithms include SM1 and SM4. SM1 and SM4 can encrypt and protect message content or data, preventing it from being eavesdropped on or stolen during transmission or storage. The international cryptographic algorithms corresponding to SM1 and SM4 are DES, Triple Data Encryption Standard (3DES), and AES. Public key algorithms include SM2. SM2 is used for entity verification, digital signatures, and digital envelopes. When using the Internet Key Exchange (IKE) protocol for automatic negotiation, SM2 key authentication can be used for IKE negotiation. The international cryptographic algorithm corresponding to SM2 is RSA. Verification algorithms include SM3. SM3 is a 256-bit cryptographic algorithm. SM3 is used for symmetric key generation and integrity verification to determine whether a message has been tampered with during transmission. The international cryptographic algorithms corresponding to SM3 are MD5, SHA1, and SHA2.

[0071] The file to be decrypted may also include first algorithm type indication information. This first algorithm type indication information is used to characterize the encryption / decryption algorithm type of the ciphertext. For example, such as... Figure 4As shown, the file to be decrypted received by receiver 101 also includes first algorithm type indication information. Hardware encryption / decryption component 103 is further configured to determine the target encryption / decryption algorithm in hardware encryption / decryption component 103 based on the first algorithm type indication information. Hardware encryption / decryption component 103 is configured to decrypt the ciphertext using the target encryption / decryption algorithm and the root key plaintext to obtain the plaintext. For example, the first algorithm type indication information is SM1. Hardware encryption / decryption component 103 determines the target encryption / decryption algorithm to be SM1. Hardware encryption / decryption component 103 decrypts the ciphertext using SM1.

[0072] like Figure 4 As shown, in practical applications, to flexibly restrict the encryption / decryption algorithm type, the OTP storage area 104 can store second algorithm type indication information. The hardware encryption / decryption component 103 determines which encryption / decryption algorithm to use to decrypt the ciphertext based on the second algorithm type indication information and the first algorithm type indication information. When the algorithm type represented by the second algorithm type indication information covers the algorithm type represented by the first algorithm type indication information, the hardware encryption / decryption component 103 selects the target encryption / decryption algorithm represented by the first algorithm type indication information. For example, the second algorithm type indication information indicates that only domestic algorithms can be used. The algorithm type represented by the first algorithm type indication information is SM1. SM1 is a domestic algorithm. In this case, the hardware encryption / decryption component 103 decrypts the ciphertext using SM1. When the algorithm type represented by the second algorithm type indication information does not cover the algorithm type represented by the first algorithm type indication information, the hardware encryption / decryption component 103 can issue an alarm. The hardware encryption / decryption component 103 does not use the algorithm type represented by the first algorithm type indication information to decrypt the ciphertext. For example, the second algorithm type indication information indicates that only domestic algorithms can be used. The algorithm type represented by the first algorithm type indication information is AES. AES is an international cryptographic algorithm. The domestically developed algorithm does not cover AES. Therefore, even if the hardware encryption / decryption component 103 is equipped with the AES encryption / decryption algorithm, it will not use AES to decrypt the ciphertext. Furthermore, the hardware encryption / decryption component 103 can also issue an alarm.

[0073] As described above, the hardware encryption / decryption component 103 can be pre-configured with multiple encryption / decryption algorithms. To save space in the OTP storage area, multiple encryption / decryption algorithms can share the same root key ciphertext. For example, when the hardware encryption / decryption component 103 uses SM1 and SM4 to decrypt different ciphertexts, the hardware encryption / decryption component 103 uses the same root key ciphertext.

[0074] In the foregoing Figures 1 to 4 In the example, the ciphertext can be BIOS, OS, or an application, etc. When the ciphertext is BIOS ciphertext, chip 105 may also include on-chip program. The on-chip program may be part of the hardware encryption / decryption component 103. The on-chip program may also be a logic program independent of the hardware encryption / decryption component 103. Figure 4In this process, the on-chip program reads the second key material from the external memory 102. The on-chip program drives the hardware encryption / decryption component 103. The hardware encryption / decryption component 103 derives a subkey from the root key plaintext. The hardware encryption / decryption component 103 decrypts the BIOS ciphertext using the subkey to obtain the BIOS plaintext. After obtaining the plaintext, the on-chip program loads and boots the BIOS. Subsequent ciphertexts of the BIOS, such as the OS and applications, no longer need to be driven by the on-chip program. Specifically, when the ciphertext is OS ciphertext, the BIOS drives the hardware encryption / decryption component 103 to decrypt the OS ciphertext to obtain the corresponding OS plaintext. Then, the BIOS loads the OS plaintext. When the ciphertext is application ciphertext, the OS drives the hardware encryption / decryption component 103 to decrypt the application ciphertext to obtain the corresponding application plaintext. Then, the OS loads the application plaintext.

[0075] The network device provided in this application has been described above; the encryption device provided in this application will be described below. Figure 5 This is the first structural schematic diagram of the encryption device provided in this application. (See attached diagram.) Figure 5 As shown, the encryption device 500 includes a processor 501 and a transceiver 502. For a description of the processor 501 and the transceiver 502, please refer to the foregoing. Figure 1 The description of the processor and transceiver of network devices.

[0076] Processor 501 is used to encrypt ciphertext based on the root key plaintext to obtain ciphertext. Transceiver 502 is used to send a file to be decrypted to the network device. The file to be decrypted includes ciphertext. The network device includes a chip and a receiver. The chip includes hardware encryption / decryption components and an OTP memory area. The OTP memory area stores information related to the root key plaintext. The ciphertext is used by the hardware encryption / decryption components to decrypt the ciphertext using the root key plaintext to obtain plaintext. It should be understood that for related descriptions of the network device, please refer to the foregoing. Figures 1 to 4 Description of network devices.

[0077] For example, the root key plaintext is obtained by processor 501 based on the root key ciphertext, the first key material, and the key. The file to be decrypted sent by transceiver 502 also includes the first key material and the key. At this time, the root key ciphertext is stored in the OTP storage area. The first key material and the key are used by the network device to obtain the root key plaintext based on the root key ciphertext, the first key material, and the key. The network device decrypts the ciphertext using the root key plaintext to obtain the plaintext.

[0078] For example, processor 501 is used to encrypt ciphertext according to a subkey to obtain plaintext. The subkey is obtained by processor 501 based on the root key plaintext and the second key material. At this time, the file to be decrypted also includes the second key material. The second key material is used by the hardware encryption / decryption component to derive the root key plaintext to obtain the subkey. The subkey is used by the hardware encryption / decryption component to decrypt the ciphertext to obtain plaintext.

[0079] For example, the file to be decrypted also includes first encryption indication information. This first encryption indication information is used by the hardware encryption / decryption component to determine whether to decrypt the ciphertext. If the first encryption indication information indicates that decryption is not required, this indicates that the file to be decrypted contains plaintext, and the network device does not need to decrypt the plaintext. If the first encryption indication information indicates that decryption is required, this indicates that the file to be decrypted contains ciphertext, and the network device needs to decrypt the ciphertext.

[0080] For example, the file to be decrypted also includes first algorithm type indication information. This first algorithm type indication information is used by the hardware encryption / decryption component to determine the target encryption / decryption algorithm within the hardware encryption / decryption component. The ciphertext is used by the hardware encryption / decryption component to decrypt the ciphertext using the target encryption / decryption algorithm and the root key plaintext, obtaining the plaintext. For example, if the algorithm type indicated by the first algorithm type indication information is SM1, then the hardware encryption / decryption component decrypts the ciphertext using SM1 to obtain the plaintext.

[0081] In practical applications, the encryption device 500 may also include a memory 503. A description of the memory 503 can be found above. Figure 1 The text describes the external memory. Memory 503 can be used to store files to be sent and decrypted. Memory 503 can also be used to store root key ciphertext, first key material, and keys, etc.

[0082] In practical applications, the encryption device 500 may include multiple modules. These modules may be different executable programs running on the processor 501. Alternatively, the encryption device 500 may include multiple devices. Each device corresponds one-to-one with a module. Each device is used to execute the function of its corresponding module. The following description uses the example of multiple modules being different executable programs running on the processor 501 to illustrate the functions of the multiple modules. For example, Figure 6 This is a second structural diagram of the encryption device provided in this application. (See diagram below.) Figure 6 As shown, the encryption device 600 includes a manufacturing module 601, a derived module 602, an encryption module 603, and a generation module 605.

[0083] The generation module 605 is used to generate the first key material and the key. The first key material and the key can be random numbers generated using a random number generator. The generation module 605 is used to send the first key material and the key to the derived module 602. The generation module 605 is also used to specify the encryption / decryption algorithm type to the derived module 602. The encryption / decryption algorithm type can be SM1, SM4, AES, etc., as mentioned above. Different encryption / decryption algorithm types can use the same first key material and the key, or they can use different first key materials and the key. When different algorithm types use different first key materials and the key, the derived module 602 can receive multiple sets of key parameters. Each set of key parameters includes the first key material and the key. Multiple sets of key parameters correspond one-to-one with multiple algorithm types.

[0084] The derived module 602 includes a random number generator 604. The derived module 602 can generate second key material and root key ciphertext based on the first request from the encryption module 603. Upon receiving the first request, the random number generator 604 generates the second key material and root key ciphertext. The first request may carry first algorithm type indication information. The first algorithm type indication information can be used to characterize the target encryption / decryption algorithm. Alternatively, the first algorithm type indication information may simply characterize a domestic algorithm or an international encryption algorithm. For example, when the first algorithm type indication information characterizes a domestic algorithm, the derived module 602 can select one or more encryption / decryption algorithms from the domestic algorithms as the target encryption / decryption algorithm.

[0085] After determining the target encryption / decryption algorithm, the derived module 602 is used to obtain the root key plaintext based on the target encryption / decryption algorithm, the root key ciphertext, the first key material, and the key. Figure 6 In this architecture, the derived module 602 uses the random number generated by the random number generator 604 as the root key ciphertext. Therefore, regardless of the target encryption / decryption algorithm, the derived module 602 can use the same root key ciphertext. For example, when the target encryption / decryption algorithm is a domestic algorithm or an international encryption algorithm, the derived module 602 uses the same root key ciphertext. Thus, during the manufacturing process of network equipment, there is no need to burn different root key ciphertexts, which would cause differences within the hardware, thereby reducing the manufacturing cost of the network equipment.

[0086] The derived module 602 is also used to obtain the root key ciphertext identifier (ID) based on the root key ciphertext. The derived module 602 is used to send the root key ciphertext ID to the manufacturing module 601.

[0087] Manufacturing module 601 is used to receive the root key ciphertext ID from derived module 602. Manufacturing module 601 is also used to request the root key ciphertext, first key material, and key from derived module 602 based on the root key ciphertext ID. After receiving the root key ciphertext, first key material, and key, manufacturing module 601 can write the root key ciphertext, first key material, and key to the OTP storage area of ​​the network device. In practical applications, manufacturing module 601 can also write second algorithm type indication information and / or second encryption indication information to the OTP storage area of ​​the network device. For a description of the second algorithm type indication information and the second encryption indication information, please refer to the foregoing description of the network device.

[0088] The derivation module 602 is further configured to derive the root key plaintext from the second key material to obtain a subkey. The derivation module 602 is also configured to generate a subkey ID based on the subkey. The derivation module 602 is further configured to send the subkey ID to the encryption module 603.

[0089] Encryption module 603 sends a subkey ID and plaintext to derived module 602. Derivative module 602 encrypts the plaintext using the subkey corresponding to the subkey ID to obtain ciphertext. Derivative module 602 then sends the ciphertext to encryption module 603. Derivative module 602 also sends a second key material to encryption module 603. Encryption module 603 obtains the file to be decrypted based on the second key material and the ciphertext. In practical applications, the file to be decrypted may also include first algorithm type indication information and / or first encryption indication information. For a description of the first algorithm type indication information and the first encryption indication information, refer to the foregoing description of the network device. Encryption module 603 can store the file to be decrypted in a memory (not shown in the figure). Encryption device 600 may also include a transceiver (not shown in the figure). The transceiver is used to send the file to be decrypted to the network device.

[0090] In the foregoing Figure 6 In the description, derived module 602 uses the random number generated by random number generator 604 as the root key ciphertext. In practical applications, derived module 602 can also use the random number generated by random number generator 604 as the root key plaintext. For example, Figure 7 This is the third structural diagram of the encryption device provided in this application. (See diagram below.) Figure 7 As shown, the encryption device includes a manufacturing module 601, a derived module 602, an encryption module 603, and a generation module 605. Figure 7 In this module, derived module 602 uses the random number generated by random number generator 604 as the root key plaintext. After determining the target encryption / decryption algorithm, derived module 602 obtains the root key ciphertext using the root key plaintext, the target encryption / decryption algorithm, the first key material, and the key. For further descriptions of the various modules, please refer to the foregoing. Figure 6The relevant description in the document.

[0091] It should be understood that Figure 6 and Figure 7 Just with Figure 4 Taking network devices as an example, this section describes encryption devices. In practical applications, regarding... Figure 6 and Figure 7 The description in the previous section can be found in the above. Figures 1 to 5 The relevant description in the document.

[0092] For example, in Figure 6 and Figure 7 In this process, the derivation module 602 derives the root key plaintext from the second key material to obtain the subkey. In practical applications, when the network device directly decrypts the ciphertext using the root key plaintext, the derivation module 602 does not need to generate the second key material. In this case, the derivation module 602 directly encrypts the plaintext using the root key plaintext.

[0093] For example, in Figure 6 and Figure 7 In this process, the manufacturing module 601 receives the root key ciphertext, the first key material, and the key from the derived module 602. In practical applications, when the file to be decrypted carries the first key material and the key, the derived module 602 can send the first key material and the key to the encryption module 603. The encryption module 603 is used to obtain the file to be decrypted based on the first key material, the key, and the ciphertext.

[0094] The network devices and encryption devices provided in this application have been described above. The encryption system provided in this application will be described below. Figure 8 This is a schematic diagram of the encryption system provided in this application. Figure 8 As shown, the encryption system 800 includes an encryption device 801 and a network device 802. The encryption device 801 encrypts ciphertext using the plaintext root key to obtain ciphertext. The encryption device 801 also sends a file to be decrypted to the network device 802. The file to be decrypted includes the ciphertext. The network device 802 includes a chip and a receiver. The chip includes hardware encryption / decryption components and an OTP storage area. The OTP storage area stores information related to the plaintext root key. The network device 802 retrieves the plaintext root key from the OTP storage area. The network device 802 also decrypts the ciphertext using the hardware encryption / decryption components and the plaintext root key to obtain plaintext. It should be understood that the description of the network device 802 can be found in the foregoing description. Figures 1 to 4 The description of network devices is provided above. For a description of the 801 encryption device, please refer to the aforementioned section. Figures 5 to 7 Description of encryption devices in the text.

[0095] The encryption system provided in this application has been described above; the data decryption method provided in this application will be described below. Figure 9 This is a flowchart illustrating the data decryption method provided in this application. Figure 9 As shown, the data decryption method in this application includes the following steps.

[0096] In step 901, the network device receives a file to be decrypted, including ciphertext, via a receiver. The network device includes a receiver, an OTP storage area, and hardware encryption / decryption components. The network device may also include external memory. The external memory is used to store the file to be decrypted.

[0097] In step 902, the network device retrieves the root key plaintext from the OTP storage area. The OTP storage area and hardware encryption / decryption components can be integrated on the chip. The OTP storage area stores information related to the root key plaintext. This information can be written to the network device before it leaves the factory. The information can be either the root key plaintext or root key ciphertext, etc. The OTP storage area is protected by the chip. Data in the OTP storage area cannot be modified or read by applications outside the chip.

[0098] In step 903, the network device decrypts the ciphertext using the chip's hardware encryption / decryption components and the root key plaintext to obtain the plaintext. When the root key plaintext is stored in the OTP storage area, the network device retrieves the root key plaintext from the OTP storage area using the hardware encryption / decryption components. The network device retrieves the ciphertext from the chip's external memory using the hardware encryption / decryption components. The network device decrypts the ciphertext using the hardware encryption / decryption components and the root key plaintext to obtain the plaintext.

[0099] It should be understood that the relevant descriptions of network equipment can be found in the foregoing. Figure 1-4 The description of the network device is as follows. For example, the file to be decrypted also includes first encryption indication information. The network device determines whether to decrypt the ciphertext in the file to be decrypted based on the first encryption indication information. For example, the file to be decrypted also includes first algorithm type indication information. The first algorithm type indication information is used to characterize the encryption / decryption algorithm type of the ciphertext. The network device determines the target encryption / decryption algorithm based on the first algorithm type indication information. For example, the OTP storage area stores the root key ciphertext. The file to be decrypted also includes first key material and a key. The network device obtains the root key plaintext using hardware encryption / decryption components, the root key ciphertext, the first key material, and the key.

[0100] The data decryption method provided in this application has been described above; the data encryption method provided in this application will be described below. Figure 10 This is a flowchart illustrating the data encryption method provided in this application. Figure 10 As shown, the data encryption method in this application includes the following steps.

[0101] In step 1001, the encryption device encrypts the ciphertext based on the plaintext root key to obtain the ciphertext. It should be understood that a description of the encryption device can be found in the foregoing. Figures 5 to 7 The relevant description of encryption devices.

[0102] In step 1002, the encryption device sends a file to be decrypted to the network device. The file to be decrypted includes ciphertext. The network device includes a chip and a receiver. The chip includes a hardware encryption / decryption component and an OTP storage area. The OTP storage area stores information related to the root key plaintext. The ciphertext is used by the hardware encryption / decryption component to decrypt the ciphertext using the root key plaintext to obtain the plaintext. It should be understood that a description of the network device can be found in the foregoing. Figures 1 to 4 The relevant description of network devices.

[0103] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A network device, characterized in that, Includes a receiver and a chip, wherein: The chip includes hardware encryption / decryption components and a one-time programmable OTP memory area; The receiver is used to receive a file to be decrypted, the file to be decrypted including ciphertext; The hardware encryption / decryption component is used to obtain the root key plaintext from the OTP storage area, and decrypt the ciphertext using the root key plaintext to obtain the plaintext; The hardware encryption / decryption component for obtaining the root key plaintext from the OTP storage area includes: the hardware encryption / decryption component for obtaining the root key ciphertext from the OTP storage area, and decrypting the root key ciphertext using the first key material and the key to obtain the root key plaintext; The hardware encryption / decryption component is also used to obtain the key, the first key material, and the second key material from the file to be decrypted; The hardware encryption / decryption component is used to decrypt the ciphertext using the root key plaintext to obtain the plaintext, including: the hardware encryption / decryption component is used to derive the root key plaintext using the second key material to obtain a subkey, and decrypt the ciphertext using the subkey to obtain the plaintext.

2. The network device according to claim 1, characterized in that, The file to be decrypted also includes first encryption indication information; The hardware encryption / decryption component is also used to determine whether to decrypt the ciphertext based on the first encryption indication information.

3. The network device according to claim 2, characterized in that, The OTP storage area stores second encrypted indication information; The hardware encryption / decryption component is further configured to determine whether to decrypt the ciphertext based on the first encryption indication information, including: the hardware encryption / decryption component is configured to determine whether to decrypt the ciphertext based on the first encryption indication information and the second encryption indication information, wherein, when the second encryption indication information and the first encryption indication information indicate that decryption is required, the hardware encryption / decryption component determines to decrypt the ciphertext; when the second encryption indication information indicates that decryption is required and the first encryption indication information indicates that decryption is not required, the hardware encryption / decryption component issues an alarm; when the second encryption indication information and the first encryption indication information indicate that decryption is not required, the hardware encryption / decryption component determines not to decrypt the ciphertext; when the second encryption indication information indicates that decryption is not required and the first encryption indication information indicates that decryption is required, the hardware encryption / decryption component issues an alarm.

4. The network device according to any one of claims 1 to 3, characterized in that, The file to be decrypted also includes first algorithm type indication information; The hardware encryption / decryption component is further configured to determine the target encryption / decryption algorithm in the hardware encryption / decryption component based on the first algorithm type indication information; The hardware encryption / decryption component is used to decrypt the ciphertext using the root key plaintext to obtain the plaintext, including: the hardware encryption / decryption component is used to decrypt the ciphertext using the target encryption / decryption algorithm and the root key plaintext to obtain the plaintext.

5. The network device according to claim 4, characterized in that, The OTP storage area includes second algorithm type indication information, and the algorithm type represented by the second algorithm type indication information covers the algorithm type represented by the first algorithm type indication information. The hardware encryption / decryption component is further configured to determine the target encryption / decryption algorithm in the hardware encryption / decryption component based on the first algorithm type indication information, including: the hardware encryption / decryption component is configured to determine the target encryption / decryption algorithm in the hardware encryption / decryption component based on the first algorithm type indication information and the second algorithm type indication information.

6. The network device according to claim 1, characterized in that, The multiple encryption and decryption algorithms in the hardware encryption and decryption component share the root key ciphertext.

7. The network device according to any one of claims 1 to 3, characterized in that, The ciphertext is a Basic Input / Output System (BIOS), an Operating System (OS), or an application program.

8. A data decryption method, applied to network devices, characterized in that, The network device includes a chip and a receiver. The chip includes hardware encryption / decryption components and a one-time programmable OTP storage area. The data decryption method includes: The network device receives a file to be decrypted via the receiver, the file to be decrypted including ciphertext; The network device obtains the root key plaintext from the OTP storage area; The network device decrypts the ciphertext using the hardware encryption / decryption component and the root key plaintext to obtain the plaintext. The process of the network device obtaining the root key plaintext from the OTP storage area includes: the network device obtaining the root key ciphertext from the OTP storage area, obtaining the key, the first key material and the second key material from the file to be decrypted, and decrypting the root key ciphertext through the hardware encryption and decryption component, the first key material and the key to obtain the root key plaintext; The network device decrypts the ciphertext using the hardware encryption / decryption component and the root key plaintext to obtain plaintext, including: the network device derives the root key plaintext using the hardware encryption / decryption component and the second key material to obtain a subkey, and the network device decrypts the ciphertext using the hardware encryption / decryption component and the subkey to obtain the plaintext.

9. The data decryption method according to claim 8, characterized in that, The file to be decrypted also includes first encryption indication information; Before the network device decrypts the ciphertext using the hardware encryption / decryption component and the root key plaintext to obtain the plaintext, the method further includes: The network device determines whether to decrypt the ciphertext based on the first encryption instruction information.

10. The data decryption method according to claim 9, characterized in that, The OTP storage area includes second encryption indication information; The network device determines whether to decrypt the ciphertext based on the first encryption indication information, including: the network device determines whether to decrypt the ciphertext based on the first encryption indication information and the second encryption indication information, wherein, when the second encryption indication information and the first encryption indication information indicate that decryption is required, the network device determines to decrypt the ciphertext; when the second encryption indication information indicates that decryption is required but the first encryption indication information indicates that decryption is not required, the network device issues an alarm; when the second encryption indication information and the first encryption indication information indicate that decryption is not required, the network device determines not to decrypt the ciphertext; when the second encryption indication information indicates that decryption is not required but the first encryption indication information indicates that decryption is required, the network device issues an alarm.

11. The data decryption method according to any one of claims 8 to 10, characterized in that, The file to be decrypted also includes first algorithm type indication information; Before the network device decrypts the ciphertext using the hardware encryption / decryption component and the root key plaintext to obtain the plaintext, the method further includes: The network device determines the target encryption / decryption algorithm in the hardware encryption / decryption component based on the first algorithm type indication information; The network device decrypts the ciphertext using the hardware encryption / decryption component and the root key plaintext to obtain plaintext, including: the network device decrypts the ciphertext according to the target encryption / decryption algorithm and the root key plaintext to obtain the plaintext.

12. The data decryption method according to claim 11, characterized in that, The OTP storage area includes second algorithm type indication information, and the algorithm type represented by the second algorithm type indication information covers the algorithm type represented by the first algorithm type indication information. The network device determines the target encryption / decryption algorithm in the encryption / decryption engine based on the first algorithm type indication information, including: the network device determines the target encryption / decryption algorithm in the hardware encryption / decryption component based on the first algorithm type indication information and the second algorithm type indication information.

Images