White-box encryption method, device and electronic equipment based on aes128

Abstract

The application provides an AES128-based white-box encryption method and device and electronic equipment, relates to the technical field of vehicle digital key encryption, and comprises the following steps: performing first encryption operation on an original transaction key according to an encryption table function to obtain a plurality of multi-dimensional arrays; performing second encryption operation on a user equipment ID and the numerical values in each multi-dimensional array to splice and generate a target string; performing compression processing based on the target string to obtain a white-box key table; and performing third encryption operation on the white-box key table to determine a target encryption table, an MD5 value and a target random key, so that the technical problem of the limitation of the application of the vehicle digital key in the prior art is alleviated.

Description

Technical Field

[0001] This invention relates to the technical field of vehicle digital key encryption, and in particular to a white-box encryption method, apparatus and electronic device based on AES128. Background Technology

[0002] With the rapid development of vehicle-to-everything (V2X) technology, its security has received widespread attention and importance from the industry. As the key to identity authentication and data encryption, the key plays a crucial role in V2X security. The vehicle digital key, as an important component of V2X, relies heavily on its key, as almost all transactions depend on it.

[0003] Currently, vehicle digital keys primarily use mobile phones and watches as carriers. In such mobile application environments, hardware and system-level security protection can generally be achieved through secure elements or trusted execution environments, enclosing key-related security operations within an independent software / hardware security environment. However, due to device cost considerations, not all devices possess the hardware conditions strongly related to security chips, such as secure elements or trusted execution environments, which hinders the widespread application of vehicle digital keys. Summary of the Invention

[0004] The purpose of this invention is to provide a white-box encryption method, device, and electronic device based on AES128, so as to alleviate the technical problem of the limitations of vehicle digital key applications in the prior art.

[0005] In a first aspect, embodiments of the present invention provide a white-box encryption method based on AES128, comprising:

[0006] The original transaction key is encrypted using the encryption table function to obtain multiple multidimensional arrays.

[0007] Perform a second encryption operation on the user device ID and the values ​​in each of the multidimensional arrays, and then concatenate them to generate the target string;

[0008] The target string is compressed to obtain a white-box key table.

[0009] A third encryption operation is performed on the white-box key table to determine the target encryption table, MD5 value, and target random key.

[0010] In conjunction with the first aspect, embodiments of the present invention provide a first possible implementation of the first aspect, wherein the step of performing a first encryption operation on the original transaction key according to the encryption table function to obtain multiple multidimensional arrays includes:

[0011] A circular key is generated based on the encryption table function and the original transaction key. The circular key is then subjected to a first encryption operation to obtain TboxesTable and Tyboxes.

[0012] Perform a first encryption operation on the loop key and the TboxesTable to obtain TboxesLastTable.

[0013] In conjunction with the first aspect, embodiments of the present invention provide a second possible implementation of the first aspect, wherein the step of performing a second encryption operation on the user device ID and the values ​​in each of the multidimensional arrays, and concatenating them to generate the target string, includes:

[0014] The equipment labels are processed cyclically to obtain an equipment table;

[0015] Loop through TboxesTable, perform XOR encryption on the values ​​in TboxesTable and the values ​​in the device table, obtain the encryption result, and convert the encryption result into a first string.

[0016] Loop through Tyboxes, encrypt the values ​​in Tyboxes and the values ​​in the device table, and convert the encrypted values ​​into a second string.

[0017] Loop through TboxesLastTable, encrypt the values ​​in TboxesLastTable and the values ​​in the device table, and convert the encrypted values ​​into a third string.

[0018] The first string organization, the second string organization, and the third string organization are concatenated according to a preset format to obtain the target string.

[0019] In conjunction with the first aspect, embodiments of the present invention provide a third possible implementation of the first aspect, wherein the method further includes:

[0020] The values ​​in TboxesTable, TboxesLastTable, and TboxesLastTable that match the values ​​in the device table are decrypted.

[0021] In conjunction with the first aspect, this embodiment of the invention provides a fourth possible implementation of the first aspect, wherein the step of compressing the target string to obtain a white-box key table includes:

[0022] The compressValue is obtained by compressing the target string.

[0023] The white-box key table is determined by base encoding the compressValue.

[0024] In conjunction with the first aspect, this invention provides a fifth possible implementation of the first aspect, wherein the step of performing a third encryption operation on the white-box key table to determine the target encryption table, the MD5 value, and the target random key includes:

[0025] The MD5 value is obtained by calculating the white-box key table using the MD5 algorithm;

[0026] The AES random key is determined from a preset byte random number generated from the white-box key table;

[0027] The white-box key table is encrypted using the AES random key and the AES-128ECB encryption algorithm to obtain the target encrypted table;

[0028] The AES random key is encrypted using the RSA algorithm to obtain the target random key.

[0029] In conjunction with the first aspect, embodiments of the present invention provide a sixth possible implementation of the first aspect, wherein the method further includes:

[0030] The target encryption table, the MD5 value, and the target random key are sent to the client so that the client can use the MD5 algorithm to calculate the MD5 value of the white-box key table. Then, it is determined whether the MD5 value returned by the server is equal to the MD5 value calculated by the client. If they are not equal, an error is reported. If they are equal, the white-box key table is saved to a local file.

[0031] Secondly, embodiments of the present invention also provide a white-box encryption device based on AES128, comprising:

[0032] The first encryption module performs a first encryption operation on the original transaction key according to the encryption table function to obtain multiple multidimensional arrays;

[0033] The concatenation module performs a second encryption operation on the user device ID and the values ​​in each of the multidimensional arrays, and concatenates them to generate the target string.

[0034] The compression module performs compression processing on the target string to obtain a white-box key table;

[0035] The second encryption module performs a third encryption operation on the white-box key table to determine the target encryption table, MD5 value, and target random key.

[0036] Thirdly, an embodiment provides an electronic device including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor executes the computer program, it implements the steps of the method described in any of the foregoing embodiments.

[0037] Fourthly, an embodiment provides a machine-readable storage medium storing machine-executable instructions, which, when invoked and executed by a processor, cause the processor to perform the steps of the method described in any of the foregoing embodiments.

[0038] This invention provides a white-box encryption method, device, and electronic device based on AES-128. To enable vehicle digital keys to function on all devices while ensuring security, a purely software-based approach is required. Based on Chow's white-box encryption theory, an AES-128 white-box encryption scheme is designed using a table lookup approach to meet this requirement. The inventive point of this application lies in the fact that the server-side white-boxes the original transaction key and then further processes the key table, making the encryption table more complex and difficult to crack. After obtaining the white-box key table, the client uses the corresponding AES-128 white-box encryption algorithm to calculate and obtain a standard result. Since no plaintext key is revealed during the calculation process, the risk of key leakage is reduced.

[0039] Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention are realized and obtained through the structures particularly pointed out in the description and the drawings.

[0040] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0041] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0042] Figure 1 A flowchart of a white-box encryption method based on AES128 provided for embodiments of the present invention;

[0043] Figure 2 A schematic diagram of another white-box encryption method based on AES128 provided in an embodiment of the present invention;

[0044] Figure 3 A schematic diagram of another white-box encryption method based on AES128 provided in an embodiment of the present invention;

[0045] Figure 4 A schematic diagram of the functional modules of a white-box encryption device based on AES128 provided for an embodiment of the present invention;

[0046] Figure 5 This is a schematic diagram of the hardware architecture of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0048] The Advanced Encryption Standard (AES) is a block cipher with a typical substitution network structure. Its data block length is 128 bits, and the key length comes in three forms: 128 bits, 192 bits, and 256 bits. Among AES block cipher systems, the 128-bit AES-128 algorithm is the most widely used. It consists of three parts: an encryption algorithm, a decryption algorithm, and a key expansion algorithm. The encryption and decryption algorithms have the same structure, only the order of the subkeys is reversed.

[0049] White-box encryption refers to a special encryption method that can resist attacks in a white-box environment. Chow-based white-box encryption theory is a popular method. This method can resist attack techniques, including DCA and splitting attacks, and is suitable for scenarios with high key security requirements.

[0050] Currently, because car digital keys require identity authentication when interacting with vehicles, the authentication process uses the AES-128 algorithm. The transaction key used needs to be saved on the key carrier when the key is activated. Most car digital keys currently use mobile phones or watches as carriers. However, some low-end devices do not have the hardware conditions related to security chips, and even devices with the relevant hardware conditions require cooperation with relevant brand equipment manufacturers to have permission to use them. In order to enable the activation and operation of vehicle digital keys on devices that do not meet these conditions, and to ensure the security of transaction keys and reduce the risk of leakage, it is necessary to obfuscate and encrypt the transaction keys to ensure that the plaintext of the key does not appear on the client side.

[0051] Existing solutions typically use ordered encryption tables, which attackers can analyze to reverse-engineer the key, making the encryption algorithm vulnerable to attack.

[0052] Based on this, the present invention provides a white-box encryption method, apparatus and electronic device based on AES128, which can further obfuscate and encrypt and check the ordered secret table, making it more complex and difficult to analyze, thereby enhancing the security of the algorithm.

[0053] To facilitate understanding of this embodiment, a white-box encryption method based on AES128 disclosed in this embodiment of the invention will first be described in detail. This method is applied to the server side.

[0054] Figure 1 A flowchart of a white-box encryption method based on AES128 is provided for an embodiment of the present invention.

[0055] Reference Figure 1 The method includes the following steps:

[0056] Step S102: Perform the first encryption operation on the original transaction key according to the encryption table function to obtain multiple multidimensional arrays.

[0057] The process involves generating a circular key `roundKeys` based on the encryption table function and the original transaction key `dKey`. The circular key and the substitution box (S-box) undergo a first encryption operation to obtain an 11*16 two-dimensional array `TboxesTable` and a 9*16*255 three-dimensional array `Tyboxes`. The circular key and `TboxesTable` undergo another first encryption operation to obtain a 16*255 two-dimensional array `TboxesLastTable`. For example, `dKey` can be a 16-byte hexadecimal string, such as `B0DA831AA458014A9B622CD94A5D98FE`.

[0058] It should be noted that the S-box can be understood as a permutation box or substitution box. The S-box is an important concept in cryptography, used in block cipher algorithms. It accepts a certain number of input bits and maps them to the same number of output bits, increasing the non-linearity and security of the cryptographic algorithm by substituting or permuting the input bits. S-boxes typically employ complex designs and operations to increase the strength of cryptographic algorithms and prevent cipher cracking and attacks. In the AES-128 algorithm used in this embodiment of the invention, the S-box is a 16x16 permutation table consisting of 56 bytes, mapping the 8-bit input bytes to the 8-bit output bytes.

[0059] In white-box encryption applications, Tyboxes are three-dimensional arrays consisting of a first dimension of 9 elements, a second dimension of 16 elements, and a third dimension of 255 elements. This three-dimensional array can be viewed as a container for storing data related to white-box encryption. Each element can be a number, byte, bit, or other suitable data type.

[0060] Specifically, this three-dimensional array `Tyboxes` might be used to store data structures such as S-boxes (Substitution Boxes) or T-boxes (Transformation Boxes) used in white-box encryption algorithms. S-boxes are used to replace parts of the input data, while T-boxes are used to perform a series of transformation operations. The three dimensions of the `Tyboxes` array can represent different meanings. For example, in a white-box implementation of the Advanced Encryption Standard (AES), the first dimension might represent the round number, the second dimension the position of the input bytes, and the third dimension the specific element within the S-box or T-box.

[0061] In practical applications, by providing a specific index, the corresponding element value in the Tyboxes array can be retrieved or modified. These element values ​​will be used in the computation and transformation steps of the white-box encryption algorithm to achieve the purpose of encrypting data.

[0062] In summary, Tyboxes are three-dimensional arrays used in white-box encryption to store relevant target data. This target data can represent S-boxes, T-boxes, or other data structures related to the encryption algorithm, and the element values ​​corresponding to this target data can be retrieved and modified through indices.

[0063] In white-box encryption, a T-box (TboxesTable, T-Box) refers to a table that stores and performs non-linear transformations. A T-box is essentially a specific lookup table that maps parts of the input bits to parts of the output bits. T-boxes in white-box encryption are used to increase the non-linearity and security of cryptographic algorithms. T-boxes are implemented using a lookup table structure, where each input is associated with a unique output. By using T-boxes, the original key and algorithm logic are mixed together, making reverse engineering and attacks on the algorithm more difficult. The role of T-boxes in white-box encryption is similar to that of S-boxes. Different white-box encryption schemes may have different implementations and internal structures for T-boxes. The design of T-boxes must ensure that there is no obvious linear relationship between the input and output to increase the security of the cryptographic algorithm. The term TboxesTable is a description or naming convention for T-boxes, indicating their tabular form or corresponding data table. Specifically, a TboxesTable refers to a data structure that stores multiple T-boxes used to perform non-linear transformation operations in white-box encryption algorithms.

[0064] TboxesLastTable refers to the T-box table used in the final round. The final round of a white-box encryption algorithm is typically differentiated from the initial rounds to increase the algorithm's complexity and security. This final round can be understood as the last round of encryption operations.

[0065] Step S104: Perform a second encryption operation on the user device ID and the values ​​in each multidimensional array, and concatenate them to generate the target string.

[0066] For example, the device identifiers are iterated through to obtain a 255-character device table, which is a character array. The `TboxesTable` is iterated through, and the values ​​in `TboxesTable` and the values ​​in the device table are XORed to obtain an encrypted result, which is then converted into a first string structure `TboxesString`. XOR encryption is simpler and more efficient; the decryptor needs the same `deviceId` to decrypt and restore `TboxesTable`, increasing security and reducing the risk of leakage. The encrypted result is then converted into a hexadecimal string and concatenated to obtain `TboxesString`. Based on this, the `Tyboxes` array is iterated through, and the values ​​in `Tyboxes` and the values ​​in the device table are encrypted, resulting in a second string structure `TyboxesStrng`. The `TboxesLastTable` array is iterated through, and the values ​​in `TboxesLastTable` and the values ​​in the device table are encrypted, resulting in a third string structure `TboxesLastString`. Finally, the first string structure (tag:01, length:00000001, value: ...) is... The first, second, and third string organizations (tag:02, length:00000001, value: TyboxesStrng) and the third string organization (tag:03, length:00000001, value: TboxesLastString) are concatenated according to a preset format to obtain the target string tablString. All three string organizations are hexadecimal strings. The user device ID (deviceId) can be a 16-byte hexadecimal string, e.g., 719ac602fca94204a6b2e5e9400a4805. The preset format can be TLV, a data format frequently used in computer science, consisting of a type field, a length field, and a value field. This scheme organizes and concatenates four multidimensional arrays using TLV format, resulting in a clear organizational structure and reducing the possibility of errors.

[0067] Step S106: Compress the target string to obtain a white-box key table.

[0068] For example, the target string is compressed using the miniz library to obtain the bytecode result compressedValue; the compressedValue is then Base64 encoded to determine the white-box key table WhiteEncryptedString. Miniz is a lightweight compression library known for its speed and small size. This library effectively compresses the white-box key table, reducing the cost and risk of input, transmission, and storage.

[0069] Base64 is an encoding scheme used to convert binary data into printable characters. The Base64 character table consists of 64 characters: uppercase letters A to Z, lowercase letters a to z, digits 0 to 9, and two additional characters + and / . It is widely used in data transmission, storage, and representation. In Base64 encoding, binary data is processed in units of 3 bytes. First, each 3 bytes is divided into four groups of 6 bits, and then these four groups of 6 bits are mapped to the corresponding characters in the Base64 character table. In practical applications, if the input binary data is not a multiple of 3, padding characters = are used to make it full. This usually happens in the last group, adding one or two padding characters as needed. This ensures that the Base64 encoded output is always a multiple of 4 characters.

[0070] Step S108: Perform a third encryption operation on the white-box key table to determine the target encryption table, MD5 value, and target random key.

[0071] For example, the white-box key table is calculated using the MD5 algorithm to obtain the MD5 value; to ensure the security of the white-box key table during network transmission, a preset byte random number (16-byte random number) is generated from the white-box key table to determine the AES random key; the white-box key table is encrypted using the AES random key and the AES-128ECB encryption algorithm to obtain the target encrypted table; the AES random key is encrypted using the asymmetric encryption algorithm (Rivest-Shamir-Adleman, RSA) to obtain the target random key.

[0072] RSA is an asymmetric encryption algorithm widely used in data encryption and digital signatures. The core principle of RSA is to use the product of two large prime numbers as the public key, while the two large prime numbers themselves serve as the private key. RSA's security relies on the difficulty of factoring large numbers.

[0073] In encryption, the sender encrypts the message using the recipient's public key, and only the recipient with the corresponding private key can decrypt the message. This encryption method is called public-key encryption. During decryption, the recipient uses their own private key to decrypt the encrypted message, thus obtaining the original plaintext message. The private key is kept secret and can only be accessed by its holder.

[0074] In addition, RSA can also be used for digital signatures. The sender can use their private key to sign a message, ensuring the receiver can verify its authenticity and integrity. The receiver can then use the sender's public key to verify the digital signature. In practical applications, RSA is primarily used for encrypting smaller amounts of data, such as symmetric-key encryption and key exchange scenarios.

[0075] In a preferred embodiment of practical application, to enable vehicle digital keys to function on all devices while ensuring security, a purely software-based approach is required. Based on Chow's white-box encryption theory, an AES-128 white-box encryption scheme is designed using a table lookup approach to meet this requirement. The inventive point of this application lies in the fact that the server-side white-boxes the original transaction key and then further processes the key table, making the encryption table more complex and difficult to crack. After obtaining the white-box encryption table, the client uses the corresponding AES-128 white-box encryption algorithm to calculate and obtain a standard result. Since no plaintext key is revealed during the calculation process, the risk of key leakage is reduced.

[0076] In some embodiments, the method further includes:

[0077] The target encryption table, MD5 value, and target random key are sent to the client via HTTPS. The client then uses the MD5 algorithm to calculate the MD5 value of the white-box key table. The server then compares the MD5 value returned by the server with the MD5 value calculated by the client. If they are not equal, an error is reported. If they are equal, the white-box key table is saved to a local file.

[0078] like Figure 2 As shown, this method can achieve white-box encryption of AES128 through cooperation between the client and the server. When applied to the client, the client receives the result returned by the server, decrypts the AES random key using the server's pre-set RSA public key, and then decrypts the encrypted white-box key table using the decrypted AES random key to obtain WhiteEncryptedString. An MD5 value is calculated on WhiteEncryptedString using the MD5 algorithm, and then it is compared with the MD5 value calculated by the client. If they are not equal, an error is reported; if they are equal, WhiteEncryptedString is saved to a local file.

[0079] As an optional implementation, when the client device transacts with the vehicle card reader, mutual authentication is required. This authentication requires a matching client-side white-box encryption module, and the specific process is as follows:

[0080] The client-side white-box encryption module receives two parameters (device ID: deviceId and white-box cryptographic table: WhiteEncryptedString). First, it base64 decodes WhiteEncryptedString to obtain a hexadecimal string. Then, it parses the hexadecimal string using TLV. If the tag does not match the server-defined tag, an error is thrown. The parsing process yields TboxesString, TyboxesStrng, and TboxesLastString. TboxesString is parsed, and the data is XORed with deviceId to obtain TboxesTable. TyboxesStrng is parsed, and the data is XORed with deviceId to obtain Tyboxes. TboxesLastString is parsed, and the data is XORed with deviceId to obtain TboxesLastTable. Following Chow's white-box encryption theory, TboxesTable, Tyboxes, and TboxesLastTable are used to calculate the standard AES-128. The CBC encryption result is used to extract the last 32 characters of the encryption result as an AES temporary session key. This temporary session key can be applied to any vehicle digital key, breaking the limitations.

[0081] Figure 3 This is a schematic diagram of another white-box encryption method based on AES128 provided in an embodiment of the present invention.

[0082] Reference Figure 3The client first configures the server's RSA public key certificate to initialize; it then activates the digital key and obtains the transaction key, which is a 16-byte key used for AES-128 encryption; the server obtains the digital key information and generates the original transaction key in plaintext; based on the received parameters, such as the user device ID, key card number, and original transaction key, it generates a white-box key table; the white-box key table is compressed, and the compression result is processed using base64, returning the final processed result, WhiteEncryptedString; the MD5 value is calculated using the MD5 algorithm on WhiteEncryptedString; to ensure the security of transmitting the white-box key table over the network, a 16-byte random number is generated as the key, using AES-128... The ECB encryption algorithm is used to encrypt the WhiteEncryptedString once; the RSA algorithm is used to encrypt the AES random key; the encrypted key table, its MD5 hash, and the encrypted AES random key are then transmitted back to the client using HTTPS; after receiving the result from the server, the client decrypts the AES random key using the server's pre-configured RSA public key, encrypts the white-box key table with the decrypted AES random key, and obtains the WhiteEncryptedString; the MD5 hash of the WhiteEncryptedString is then calculated; and the server's encryption is then checked. The system checks if the MD5 value returned by the terminal is equal to the MD5 value calculated by the client. If they are not equal, an error is reported. If they are equal, the WhiteEncryptedString is saved to a local file. The client and vehicle transact, the vehicle selects the corresponding car key, the client queries the local key and responds, and the vehicle sends card reader information to establish a connection between the vehicle and the client. The client obtains the white-box key table and the parameters to be encrypted for the selected car key. The vehicle performs white-box AES-128 encryption and returns the encryption result to the client. The client obtains the last 16 bytes as the session key and uses the session key as the AES-128 key to encrypt the transaction data.

[0083] The embodiments of the present invention cleverly make the key representation flexible by converting the original transaction key into a multi-dimensional array, while also making encryption convenient.

[0084] like Figure 4 As shown, this embodiment of the invention provides a white-box encryption device based on AES128, comprising:

[0085] The first encryption module performs a first encryption operation on the original transaction key according to the encryption table function to obtain multiple multidimensional arrays;

[0086] The concatenation module performs a second encryption operation on the user device ID and the values ​​in each of the multidimensional arrays, and concatenates them to generate the target string.

[0087] The compression module performs compression processing on the target string to obtain a white-box key table;

[0088] The second encryption module performs a third encryption operation on the white-box key table to determine the target encryption table, MD5 value, and target random key.

[0089] In some embodiments, the first encryption module is further specifically configured to: generate a circular key based on the encryption table function and the original transaction key; perform a first encryption operation on the circular key to obtain TboxesTable and Tyboxes; and perform a first encryption operation on the circular key and the TboxesTable to obtain TboxesLastTable.

[0090] In some embodiments, the concatenation module is further specifically configured to: perform loop processing on the device labels to obtain a device table; loop through TboxesTable, perform XOR encryption on the values ​​in TboxesTable and the values ​​in the device table to obtain an encryption result, and convert the encryption result into a first string organization; loop through Tyboxes, perform encryption on the values ​​in Tyboxes and the values ​​in the device table, and convert the encrypted result into a second string organization; loop through TboxesLastTable, perform encryption on the values ​​in TboxesLastTable and the values ​​in the device table, and convert the encrypted result into a third string organization; and concatenate the first string organization, the first string organization, and the first string organization according to a preset format to obtain a target string.

[0091] In some embodiments, the apparatus is further configured to decrypt the values ​​in the TboxesTable, the TboxesTable, and the TboxesLastTable that correspond to the values ​​in the device table.

[0092] In some embodiments, the compression module is further specifically used to obtain compressValue by compressing the target string; and to determine a white-box key table by base encoding compressValue.

[0093] In some embodiments, the second encryption module is further configured to: calculate the MD5 value of the white-box key table using the MD5 algorithm; determine the AES random key from a preset byte random number generated from the white-box key table; encrypt the white-box key table using the AES random key and the AES-128ECB encryption algorithm to obtain the target encryption table; and encrypt the AES random key using the RSA algorithm to obtain the target random key.

[0094] In some embodiments, the apparatus is further configured to send the target encryption table, the MD5 value, and the target random key to the client, so that the client uses the MD5 algorithm to calculate the white-box key table to obtain the MD5 value, and then determines whether the MD5 value returned by the server is equal to the MD5 value calculated by the client; if they are not equal, an error is reported; if they are equal, the white-box key table is saved to a local file.

[0095] The present invention provides an embodiment for implementing an electronic device. In this embodiment, the electronic device may be, but is not limited to, a personal computer (PC), a laptop computer, a monitoring device, a server, or other computer device with analysis and processing capabilities.

[0096] As an exemplary embodiment, see [link to example]. Figure 5 The electronic device 110 includes a communication interface 111, a processor 112, a memory 113, and a bus 114. The processor 112, the communication interface 111, and the memory 113 are connected via the bus 114. The memory 113 is used to store a computer program that supports the processor 112 in executing the above-described method. The processor 112 is configured to execute the program stored in the memory 113.

[0097] The machine-readable storage medium mentioned in this article can be any electronic, magnetic, optical, or other physical storage device that can contain or store information such as executable instructions, data, etc. For example, machine-readable storage media can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or combinations thereof.

[0098] Non-volatile media can be non-volatile memory, flash memory, storage drives (such as hard disk drives), any type of storage disk (such as optical discs, DVDs, etc.), or similar non-volatile storage media, or combinations thereof.

[0099] It is understood that the specific operation methods of each functional module in this embodiment can be referred to the detailed description of the corresponding steps in the above method embodiment, and will not be repeated here.

[0100] The computer-readable storage medium provided in the embodiments of the present invention stores a computer program. When the computer program code is executed, it can implement the method described in any of the above embodiments. For specific implementation, please refer to the method embodiments, which will not be repeated here.

[0101] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system and apparatus described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0102] Furthermore, in the description of the embodiments of the present invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in the present invention based on the specific circumstances.

[0103] In the description of this invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0104] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the scope of the technology disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention.

Claims

1. A white-box encryption method based on AES128, characterized in that, include: The original transaction key is encrypted using the encryption table function to obtain multiple multidimensional arrays. Perform a second encryption operation on the user device ID and the values ​​in each of the multidimensional arrays, and then concatenate them to generate the target string; The target string is compressed to obtain a white-box key table. Perform a third encryption operation on the white-box key table to determine the target encryption table, MD5 value, and target random key, including: The white-box key table is calculated using the MD5 algorithm to obtain the MD5 value; a preset byte random number is generated from the white-box key table to determine the AES random key; the white-box key table is encrypted using the AES random key and the AES-128ECB encryption algorithm to obtain the target encryption table; the AES random key is encrypted using the RSA algorithm to obtain the target random key.

2. The method according to claim 1, characterized in that, The steps involved in performing a first encryption operation on the original transaction key using the encryption table function to obtain multiple multidimensional arrays include: A circular key is generated based on the encryption table function and the original transaction key. The circular key is then subjected to a first encryption operation to obtain TboxesTable and Tyboxes. Perform a first encryption operation on the loop key and the TboxesTable to obtain TboxesLastTable.

3. The method according to claim 1, characterized in that, The step of performing a second encryption operation on the user device ID and the values ​​in each of the multidimensional arrays, and concatenating them to generate the target string, includes: The user equipment IDs are processed in a loop to obtain a device table; Loop through TboxesTable, perform XOR encryption on the values ​​in TboxesTable and the values ​​in the device table, obtain the encryption result, and convert the encryption result into a first string. Loop through Tyboxes, encrypt the values ​​in Tyboxes and the values ​​in the device table, and convert the encrypted values ​​into a second string. Loop through TboxesLastTable, encrypt the values ​​in TboxesLastTable and the values ​​in the device table, and convert the encrypted values ​​into a third string. The first string organization, the second string organization, and the third string organization are concatenated according to a preset format to obtain the target string.

4. The method according to claim 3, characterized in that, The method further includes: The values ​​in TboxesTable, TboxesLastTable, and TboxesLastTable that match the values ​​in the device table are decrypted.

5. The method according to claim 1, characterized in that, The steps of compressing the target string to obtain a white-box key table include: The compressValue is obtained by compressing the target string. The white-box key table is determined by base encoding the compressValue.

6. The method according to claim 1, characterized in that, The method further includes: The target encryption table, the MD5 value, and the target random key are sent to the client so that the client can use the MD5 algorithm to calculate the MD5 value of the white-box key table. Then, it is determined whether the MD5 value returned by the server is equal to the MD5 value calculated by the client. If they are not equal, an error is reported. If they are equal, the white-box key table is saved to a local file.

7. A white-box encryption device based on AES128, characterized in that, include: The first encryption module performs a first encryption operation on the original transaction key according to the encryption table function to obtain multiple multidimensional arrays; The concatenation module performs a second encryption operation on the user device ID and the values ​​in each of the multidimensional arrays, and concatenates them to generate the target string. The compression module performs compression processing on the target string to obtain a white-box key table; The second encryption module performs a third encryption operation on the white-box key table to determine the target encryption table, the MD5 value, and the target random key. The second encryption module is also used to calculate the MD5 value of the white-box key table using the MD5 algorithm; determine the AES random key from the preset byte random number generated from the white-box key table; encrypt the white-box key table using the AES random key and the AES-128ECB encryption algorithm to obtain the target encryption table; and encrypt the AES random key according to the RSA algorithm to obtain the target random key.

8. An electronic device, characterized in that, It includes a memory, a processor, and a program stored in the memory and capable of running on the processor, wherein the processor executes the program to implement the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The readable storage medium stores a computer program that, when executed, implements the method described in any one of claims 1-6.

Images