An Android environment key segmentation processing method and device

Abstract

The application discloses an Android environment key segmentation processing method and device. The processing method comprises key storage and key extraction. The key storage comprises inputting an initial key into a white-box key module to generate a target storage key; generating a key operation factor according to a device unique identifier; generating a to-be-segmented key according to the target storage key and the key operation factor, performing a segmentation operation, and storing segmented sub-keys into corresponding so libraries. The key extraction comprises acquiring the segmented sub-keys from the so libraries and assembling the segmented sub-keys into ciphertext; decrypting the assembled ciphertext by using the key operation factor, and decomposing a decryption result into a key and a key hash value; if the hash value of the key is consistent with the decomposed key hash value, inputting the key into the white-box key module to decrypt the initial key, and the key extraction is successful. The application adopts a strategy of storing the key in multiple so libraries to protect the key data, is suitable for all Android system devices, and is beneficial to the promotion of security applications.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of key storage, in particular to an Android environment key segmentation processing method and device. BACKGROUND

[0002] For an android mobile phone system, the key stored in the mobile phone is currently completed by TEE and SE. TA is an application of TEE, and key data is stored in TA and located in TEE. TEE is isolated from REE (such as an android system). Multiple TAs are parallel to TEE and do not interfere with each other. This ensures the security of the key stored in TA and the data generated in the intermediate process. SE requires the support of secure hardware in the mobile phone, and the key can be stored in the applet of SE.

[0003] For an Android system, although the mainstream mobile phones currently launched by mobile phone manufacturers all contain TEE systems and SE, and can run TA applications and install applets, in third and fourth-tier cities and remote areas, mobile phones are relatively low-end, and most mobile phones are below 1000 yuan. Due to cost problems, TEE environment and SE are not included, and the key cannot be stored. In the direction of mobile phone security application, the limited mobile phone model cannot be widely promoted.

[0004] In addition, for an Android system, because the CPU chip model used is different for different mobile phone brands, the TEE system and SE used are also different. For example, Huawei uses its own TEE environment, and Qualcomm also has its own TEE environment. The same TA application cannot be simultaneously adapted to mobile phones with Huawei Kirin chips and Qualcomm chips. Mobile phone security applications are limited by mobile phone brands and mobile phone chips, and the development cost is high and cannot be widely promoted. SUMMARY

[0005] The present application provides an Android environment key segmentation processing method, comprising:

[0006] inputting an initial key into a white box key module to generate a target storage key;

[0007] generating a key operation factor according to a device unique identifier of a current device;

[0008] generating a to-be-segmented key according to the target storage key and the key operation factor;

[0009] performing a segmentation operation on the to-be-segmented key, and storing the obtained segmented sub-keys into corresponding so libraries respectively.

[0010] The Android environment key segmentation processing method described above, wherein the key operation factor is generated according to the device unique identifier of the current device, and specifically comprises the following sub-steps:

[0011] Since each device has a unique identifier, and the last half byte of the unique identifier is different, the random number of the starting position is ensured, and therefore the value of the last half byte of the device unique identifier is read as the starting position to the last byte according to the device unique identifier of the current device;

[0012] Hashing the read data, and taking the data of a preset length before the hash operation result as the first data;

[0013] Generating a random number of a preset length as the second data, performing XOR operation on the first data and the second data, and then taking the data of a preset length before the hash operation result after the hash operation on the XOR result as the key operation factor.

[0014] The Android environment key segmentation processing method as described above, wherein the to-be-segmented key is generated according to the target storage key and the key operation factor, and specifically includes the following sub-steps:

[0015] Hashing the target storage key to obtain a hash value;

[0016] Splicing the target storage key and the hash value, and then performing encryption operation on the spliced value using the key operation factor to obtain the to-be-segmented key; the splicing of the target storage key and the hash value facilitates verification of whether the target storage key is tampered with and whether it is legal.

[0017] The Android environment key segmentation processing method as described above, wherein the segmentation operation is performed on the to-be-segmented key, and the obtained segmented sub-keys are respectively stored in corresponding so libraries, and specifically includes the following sub-steps:

[0018] Segmenting the to-be-segmented key according to the number of so libraries;

[0019] Performing modulo operation on the first byte of the to-be-segmented key according to the number of so libraries, and storing the segmented sub-key in the global variable of the corresponding so library in tlv format according to the operation result.

[0020] The Android environment key segmentation processing method as described above, wherein the tlv format is segment identification + to-be-segmented key length / so library number + segmented sub-key.

[0021] The Android environment key segmentation processing method as described above, wherein the segmented sub-key in the so library is stored locally in the Android device.

[0022] The Android environment key segmentation processing method as described above, wherein, in response to receiving a key extraction instruction, the segmented sub-key is obtained from the so library, and the segmented sub-key is assembled into ciphertext;

[0023] The assembled ciphertext is decrypted using the key operation factor, and the decryption result is decomposed into a key and a key hash value;

[0024] If the hash value of the key is consistent with the decomposed key hash value, the key is input into the white box key module for decryption operation to obtain an initial key, and the key extraction is successful; the white box key module is used for encryption and decryption operation, and even if the encryption and decryption key is known, the correct initial key cannot be decrypted, and the security of key storage is increased.

[0025] The Android environment key segmentation processing method as described above, wherein the so library includes a function so library and one or more segmented key storage so libraries;

[0026] The function so library stores main function interfaces, provides key generation, storage, read-write, and verification functions, and is used for encryption and decryption data and instruction processing;

[0027] The segmented key storage so library is used for segmented storage of keys and provides read-write interfaces;

[0028] The so library further includes a verification so library, which is loaded before the segmented key storage so library and is used for presetting a verification value of the segmented key storage so library to verify whether the library file is tampered with; wherein the libcheck.so library for verifying whether the library file is tampered with can be selected not to be loaded, and the application preferably adopts the manner of loading the libcheck.so library to increase the security of key storage and prevent the so library from being modified in code logic after being decompiled.

[0029] The Android environment key segmentation processing method as described above, wherein the segmented sub-keys are obtained from the so library, and the segmented sub-keys are assembled into ciphertext, and specifically:

[0030] In response to receiving a key extraction instruction, the interface sends a key extraction instruction to the function so library, and the function so library extracts the corresponding stored segmented sub-keys from the segmented key storage so library;

[0031] According to the segmentation identifiers of the segmented sub-keys, the assembly order is determined, and the corresponding data is assembled into ciphertext according to the assembly order.

[0032] The application also provides an Android environment key segmentation processing device, which executes the Android environment key segmentation processing method of any one of the above.

[0033] The application has the following beneficial effects: the application adopts the strategy of segmented storage of keys by multiple so libraries to protect key data, is suitable for all Android system devices, and is conducive to the promotion of security applications. BRIEF DESCRIPTION OF DRAWINGS

[0034] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art based on these drawings.

[0035] Figure 1 is a kind of Android environment key segment storage method flow chart provided by the first embodiment of the present application;

[0036] Figure 2 is a kind of Android environment key segment extraction method flow chart provided by the second embodiment of the present application; DETAILED DESCRIPTION

[0037] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0038] The first embodiment of the present application provides a kind of Android environment key segment processing method, including the key segment storage method shown in embodiment one and the key segment extraction method shown in embodiment two.

[0039] Embodiment one

[0040] The first embodiment of the present application provides a kind of Android environment key segment storage method, as shown in Figure 1 , including:

[0041] Step 110, input initial key into white-box key module to generate table, and the table is used as target storage key;

[0042] In the embodiment of the present application, white-box key module is used to generate table by white-box encryption calculation on input initial key pkey, and the table is used as target storage key key;

[0043] Since white-box encryption and decryption algorithm cannot decrypt the correct initial key according to encryption and decryption key, white-box encryption and decryption calculation is used as more secure encryption and decryption algorithm in the present application to increase the security of key storage.

[0044] Step 120, generate key operation factor according to the device unique identifier of current device;

[0045] Since each device has a unique identifier, similar to the UUID (Universal Unique Identifier), and the last half byte of the unique identifier of each device is different, the randomness of the starting position is ensured, so according to the device unique identifier deviceID (the identifier is 32 bytes of unique data issued by the server) of the current device, the value of the last half byte of the device unique identifier is taken as the starting position to the last byte, for example, the value of the last half byte of deviceID is 4, and the reading starts from the 4th byte to the last byte, then the data read is hashed (such as sha256 algorithm), and the data of the preset length (such as 24 bytes) in front of the hash operation result is taken as the first data mR1, and the random number of the corresponding length is generated as the second data mR2, and the first data mR1 and the second data mR2 are XORed to obtain the third data, and then the third data is hashed to obtain the data of the preset length in front of the hash operation result as the key operation factor mmkey;

[0046] Among them, the second data mR2 can be composed by extracting a predetermined byte (such as 6 bytes to form 24 bytes of second data) from the server data + control random number + signature data + so library each generated random number and then combining them;

[0047] In addition, the application needs to store the generated key operation factor mmkey locally to facilitate the extraction of the key; in addition, only the second data mR2 generated randomly can be stored, and the same calculation method as step 120 is used to obtain the key operation factor when extracting the key subsequently.

[0048] Step 130, generating a to-be-segmented key according to the target storage key and the key operation factor;

[0049] Specifically, the to-be-segmented key is generated, specifically including the following sub-steps:

[0050] Step 131, hashing the target storage key key to obtain a hash value;

[0051] Step 132, concatenating the target storage key key and its hash value, and then using the key operation factor mmkey to encrypt the concatenated value to obtain the to-be-segmented key;

[0052] Specifically, the target storage key key and its hash value can be concatenated in multiple ways, for example, the target storage key key + hash value, or the hash value + target storage key key, or the target storage key key and the hash value can be concatenated according to the byte interval, etc., which is not limited here.

[0053] Among them, the encryption algorithm can use 3Des-CBC algorithm.

[0054] Step 140, performing segmentation operation on the key to be segmented, and storing the segmented sub-keys into corresponding so libraries respectively;

[0055] In the embodiments of the present application, in order to ensure the security of the key data, the segmented keys are stored into so libraries, the so libraries including a functional so library and one or more segmented key storage so libraries; the functional so library stores main function interfaces, provides key generation, storage, read-write, verification functions, and is used for processing encrypted data and instructions; the segmented key storage so libraries are used for storing segmented keys and providing read-write interfaces;

[0056] Preferably, the so libraries further include a verification so library, which is loaded before the segmented key storage so libraries, and is used for presetting verification values of the segmented key storage so libraries to verify whether the library files are tampered.

[0057] The number of so libraries can be set according to requirements, the more the segments, the greater the storage and extraction workload, and the lower the efficiency, but the security is improved; considering the security and efficiency comprehensively, one functional so library and three segmented key storage so libraries are preferably allocated; for example, the so libraries include libmainFunc.so library, libsecurity1.so library, libsecurity2.so library and libsecurity3.so library; the libmainFunc.so library is a functional so library, stores main function interfaces, provides key generation, storage, read-write, verification functions, and is used for processing encrypted data and instructions; the libsecurity1.so library, the libsecurity2.so library and the libsecurity3.so library are used for storing segmented keys and providing read-write interfaces, and the security of the keys is enhanced.

[0058] In addition, in order to increase the security of key storage and prevent the so libraries from being modified in code logic after being disassembled, the libcheck.so library is loaded before the libmainFunc.so library, the libsecurity1.so library, the libsecurity2.so library and the libsecurity3.so library, and the verification values (MD5 values) of the libmainFunc.so library, the libsecurity1.so library, the libsecurity2.so library and the libsecurity3.so library are preset in the libcheck.so library, which is used for verifying whether the library files are tampered;

[0059] The segmentation operation on the key to be segmented can be average segmentation, or can be segmented according to an agreed manner, and then stored into the so libraries respectively; the segmented keys are extracted in the same agreed manner, for example, the number of bytes of the segmented keys stored in each so library during storage is corresponding to the extraction;

[0060] For example, taking the average segmentation as an example, the to-be-segmented key is first segmented in average according to the number of so libraries, for example, the to-be-segmented key is segmented in average in sequence, for example, the to-be-segmented data is divided into four data, i.e., four segmented sub-keys: data0, data1, data2, data3; then the first byte of the to-be-segmented key is operated according to the number of so libraries, for example, the first byte of the to-be-segmented key is operated according to the number 4, according to the operation result, the segmented sub-key is stored in the global variable of the corresponding so library in the tlv format (segmented identifier + to-be-segmented key length / so library number + segmented sub-key), and all the segmented sub-keys in the so library are stored locally;

[0061] For example, if the first byte of the to-be-segmented key is operated according to the number 4 and the result is 0, then the segmented sub-key is stored in the libmainFunc.so library, the libsecurity1.so library, the libsecurity2.so library and the libsecurity3.so library in the order of (0, 1, 2, 3) according to the tlv format, i.e., data0 is stored in the global variable of the libmainFunc.so library in the tlv format (00+len / 4+data0), data1 is stored in the global variable of the libsecurity1.so library in the tlv format (01+len / 4+data1), data2 is stored in the global variable of the libsecurity2.so library in the tlv format (02+len / 4+data2), and data3 is stored in the global variable of the libsecurity3.so library in the tlv format (03+len / 4+data3); if the first byte of the to-be-segmented key is operated according to the number 4 and the result is 1, then the segmented sub-key is stored in the libsecurity1.so library, the libsecurity2.so library, the libsecurity3.so library and the libmainFunc.so library in the order of (1, 2, 3, 0); similarly, if the first byte of the to-be-segmented key is operated according to the number 4 and the result is 2, then the segmented sub-key is stored in the libsecurity2.so library, the libsecurity3.so library, the libmainFunc.so library and the libsecurity1.so library in the order of (2, 3, 0, 1), and so on;

[0062] In addition, in order to facilitate subsequent acquisition of the corresponding segmented sub-key, preferably, after the segmented sub-key is stored in the corresponding so library, the associated index capable of acquiring the corresponding segmented sub-key in the libsecurity1.so library, the libsecurity2.so library and the libsecurity3.so library is recorded in the libmainFunc.so library.

[0063] Embodiment Two

[0064] Embodiment Two of the present application provides an Android environment key segment extraction method, as shown in the following table, comprising: Figure 2

[0065] Step 210, obtaining a segment sub-key from the so library, and assembling the segment sub-key into ciphertext;

[0066] Specifically, when key extraction is needed, in response to receiving a key extraction instruction, an interface is called to send a key extraction instruction to the function so library, and the function so library extracts the corresponding stored segment sub-key from the segment key storage so library, for example, after the libmainFunc.so library receives the key extraction instruction of the Android device, it extracts the corresponding stored segment sub-key from the libsecurity1.so library, the libsecurity2.so library and the libsecurity3.so library, then determines the assembly order according to the segment identifier (i.e. the first byte of the data storage format) of each segment sub-key, and then assembles the corresponding data into ciphertext according to the assembly order;

[0067] Further, in response to receiving the key extraction instruction, first, according to the preset check value of the libmainFunc.so library, the libsecurity1.so library, the libsecurity2.so library and the libsecurity3.so library in the libcheck.so library, verify whether the data in the libmainFunc.so library, the libsecurity1.so library, the libsecurity2.so library and the libsecurity3.so library is tampered, and after determining that the so library data is not tampered, the libmainFunc.so library obtains the corresponding segment sub-key in the libsecurity1.so library, the libsecurity2.so library and the libsecurity3.so library according to the recorded association index of other so libraries.

[0068] Step 220, decrypting the assembled ciphertext using a key operation factor, and decomposing the decryption result into a key and a key hash value;

[0069] Specifically, if the hash value of the target storage key key calculated in the method used by the present application in Embodiment One is 32 bytes, then the last 32 bytes of the decryption result obtained after decrypting the assembled ciphertext in Embodiment Two is the key hash value, and the remaining data is the key.

[0070] ​Step 230, calculate the hash value of the key and whether the hash value of the decomposed key is consistent, if yes, execute step 240, otherwise the key is not legal;

[0071] If the hash value obtained by performing hash operation on the key decomposed in the previous step is consistent with the hash value of the decomposed key, the data remaining after discarding the last 32 bytes of the assembled key decryption result is the extracted legal key.

[0072] Step 240, input the key into the white box key module for decryption operation to obtain the initial key;

[0073] The key extracted after the above operation is the white box key table, which needs to be input into the white box key module to perform decryption operation on the input data by using the white box key algorithm to obtain the initial legal key, and thus the key extraction is successful.

[0074] Embodiment three

[0075] The embodiment three of the application provides an Android environment key segmentation processing device, which comprises:

[0076] The key segmentation storage module executes the Android environment key segmentation storage method as described in the embodiment one;

[0077] The key segmentation extraction module executes the Android environment key segmentation extraction method as described in the embodiment two.

[0078] The technical solution of the application can achieve the following effects:

[0079] 1. The development cost is saved, the mobile phone manufacturers and the chip models used are not distinguished, the pure Android environment key segmentation storage scheme can be used on all Android system mobile phones, and the promotion of the security application is facilitated;

[0080] 2. The TEE environment is not needed, the key processing sensitive data can be used on the low-end mobile phones on the basis of relatively ensuring the data security, and the promotion of the security application is facilitated.

[0081] The above-described embodiments are merely specific implementations of the present application, and are used to illustrate the technical solutions of the present application, rather than limit the same. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the foregoing embodiments, it should be understood by those skilled in the art that any person skilled in the art can make modifications or easily think of changes to the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some of the technical features, within the technical scope disclosed by the present application. The modifications, changes or replacements do not cause the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application. All should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. An Android environment key segmentation processing method, characterized by, The method comprises the following steps: An initial key is input into a white-box key module to generate a target storage key; A key operation factor is generated according to a device unique identifier of a current device; Specifically, the value of the last half byte of the device unique identifier is read as a starting position to the last byte, a hash operation is performed on the read data, the first preset length of data of the hash operation result is intercepted as first data mR1, and a random number of a corresponding length is generated as second data mR2, the first data mR1 and the second data mR2 are subjected to an exclusive or operation to obtain third data, and the third data is subjected to a hash operation, and the first preset length of data of the hash operation result is intercepted as the key operation factor; The second data mR2 is composed of server data, control random number, signature data, and each generated random number of the so library after a predetermined byte is extracted and combined; A to-be-segmented key is generated according to the target storage key and the key operation factor; Segmented sub-keys obtained by performing a segmentation operation on the to-be-segmented key are stored in corresponding so libraries respectively; The to-be-segmented key is generated according to the target storage key and the key operation factor, and the method comprises the following sub-steps: A hash value is obtained by performing a hash operation on the target storage key; The target storage key and the hash value are spliced, and an encryption operation is performed on the spliced value by using the key operation factor to obtain the to-be-segmented key; The to-be-segmented key is subjected to a segmentation operation, and the segmented sub-keys obtained are stored in corresponding so libraries respectively, and the method comprises the following sub-steps: The to-be-segmented key is segmented according to the number of so libraries; The first byte of the to-be-segmented key is subjected to a modulo operation according to the number of so libraries, and the segmented sub-keys are stored in the global variables of the corresponding so libraries in a tlv format according to the operation result.

2. The Android environment key segmentation processing method of claim 1, wherein, The tlv format is a segment identifier + to-be-segmented key length / so library number + segmented sub-key.

3. The Android environment key segmentation processing method of claim 1, wherein, The segmented sub-key in the so library is stored locally in an Android device.

4. The Android environment key segmentation processing method of claim 1, wherein In response to receiving a key extraction instruction, the segmented sub-key is obtained from the so library, and the segmented sub-key is assembled into ciphertext; The ciphertext obtained by assembly is decrypted by using the key operation factor, and the decryption result is decomposed into a key and a key hash value; If the hash value of the calculated key is consistent with the key hash value obtained by decomposition, the key is input into the white-box key module for decryption operation to obtain the initial key, and the key extraction is successful.

5. The method of claim 1-4, wherein the Android environment key segmentation process is characterized by, The so library comprises a functional so library and one or more segmented key storage so libraries; The functional so library stores main function interfaces, provides key generation, storage, read-write, and verification functions, and is used for processing encrypted data and instructions; The segmented key storage so library is used for storing segmented keys and provides read-write interfaces; The so library further comprises a verification so library, which is loaded before the segmented key storage so library, and is used for presetting a verification value of the segmented key storage so library to verify whether the library file is tampered with.

6. The Android environment key segmentation processing method of claim 5, wherein, The segmented sub-key is obtained from the so library, and the segmented sub-key is assembled into ciphertext, and the method comprises the following steps: In response to receiving the key extraction instruction, the calling interface sends a key extraction instruction to the function so library, and the function so library extracts the corresponding stored segment sub-keys from the segment key storage so library respectively; According to the segment identifiers of the segment sub-keys, a assembling order is determined, and the corresponding data is assembled into ciphertext according to the assembling order.

Images