A method, apparatus, storage medium, and electronic device for key recovery.

Abstract

This specification discloses a method, apparatus, storage medium, and electronic device for key recovery. In the key recovery process, the embodiments of this specification employ a reinforcement learning approach to train a key recognition neural network in a step-by-step manner, enabling the finally trained key recognition neural network to achieve good recognition performance for keys of any 1-bit quantity.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and in particular to a method, apparatus, storage medium, and electronic device for key recovery. Background Technology

[0002] Nowadays, in order to ensure information and network security, various encryption methods are often used to encrypt plaintext to determine the encryption password. People can use encryption passwords to protect their property and privacy, which promotes the development of modern society and the progress of human society.

[0003] Block encryption is currently the most commonly used encryption method. However, in practical applications, due to reasons such as users forgetting their passwords or in order to generate protective measures for block ciphers, it is necessary to recover the key used to determine the block cipher.

[0004] Existing block cipher key recovery methods mainly include differential analysis or linear analysis methods, which obtain the most probable key by analyzing the impact of a specific plaintext difference on the resulting ciphertext difference. Both methods require a huge amount of plaintext and the ciphertext encrypted with the key to be identified, and their computational efficiency is low.

[0005] Therefore, how to accurately and efficiently recover block cipher keys is an urgent problem to be solved. Summary of the Invention

[0006] This specification provides a method, apparatus, storage medium, and electronic device for key recovery, in order to partially solve the aforementioned problems existing in the prior art.

[0007] The following technical solution is adopted in this specification:

[0008] This manual provides a method for key recovery, including:

[0009] Obtain sample data, which includes sample plaintext pairs and label ciphertext pairs of the plaintext pairs under the actual key. The sample plaintext pairs contain two sample plaintexts, and the label ciphertext pairs contain label ciphertexts that are encrypted separately using the actual key for the two sample plaintexts contained in the sample plaintext pairs.

[0010] Determine an initial guessing key, and based on the initial guessing key, encrypt the two sample plaintexts contained in the sample plaintext pair respectively to obtain the ciphertext pair to be verified;

[0011] The input data is determined based on the ciphertext pair to be verified, the initial guess key, and the tag ciphertext pair;

[0012] The input data is fed into a key recognition neural network, so that the key recognition neural network updates the initial guess key based on the probability that the key obtained by flipping each bit of the initial guess key can obtain the tag ciphertext pair, and obtains the updated key.

[0013] Determine the reward value corresponding to the updated key, and train the key recognition neural network based on the reward value;

[0014] The trained key recognition neural network is deployed in a preset key recovery system so that, upon receiving a key recovery request, the trained key recognition neural network can perform key recovery based on the plaintext pair carried in the key recovery request.

[0015] Optionally, the actual key includes N keys, wherein the Nth key is a key containing N bits, where N is a positive integer not less than 1;

[0016] Based on the ciphertext pair to be verified, the initial guess key, and the tag ciphertext pair, the input data is determined, specifically including:

[0017] During the Nth round of model training, the input data for the Nth round is determined based on the ciphertext pair to be verified, the initial guess key, and the Nth label ciphertext pair obtained by encrypting the sample plaintext pair using the Nth key.

[0018] The input data is fed into a key recognition neural network, which updates the initial guess key based on the probability that each bit of the initial guess key, after being flipped, can yield the tag ciphertext pair, thus obtaining an updated key. Specifically, this includes:

[0019] The input data of the Nth round is input into the key recognition neural network trained in the N-1th round, so that the key recognition neural network trained in the N-1th round updates the initial guess key based on the probability that the key obtained by flipping each bit of the initial guess key can obtain the Nth tag ciphertext pair, and obtains the updated key in the Nth round.

[0020] Determine the reward value corresponding to the updated key, and train the key recognition neural network based on the reward value, specifically including:

[0021] Determine the reward value corresponding to the updated key in the Nth round, and perform the Nth round of training based on the reward value corresponding to the updated key in the Nth round to obtain the key recognition neural network obtained after the Nth round of training. Then, perform the N+1th round of training on the key recognition neural network obtained after the Nth round of training based on the determined input data of the N+1th round, until the preset training conditions are met.

[0022] Optionally, the input data is determined based on the ciphertext pair to be verified, the initial guessing key, and the tag ciphertext pair, specifically including:

[0023] The data obtained by XORing the two ciphertexts of the ciphertext pair to be verified is determined as the first data.

[0024] The data obtained by XORing the two ciphertexts of the ciphertext pair is determined as the second data.

[0025] The input data is determined based on the ciphertext pair to be verified, the initial guessing key, the first data, the second data, and the tag ciphertext pair.

[0026] Optionally, determining the reward value corresponding to the updated key specifically includes:

[0027] The reward value corresponding to the updated key is determined based on the distance between the updated key and the actual key, wherein the distance is used to describe the degree of closeness between the updated key and the actual key.

[0028] Optionally, the input data is fed into a key recognition neural network, so that the key recognition neural network updates the initial guess key based on the probability that the key obtained by flipping each bit of the initial guess key can obtain the tag ciphertext pair, specifically including:

[0029] The input data is fed into the encoder in the key recognition neural network to obtain encoded input data through the encoder.

[0030] The encoded input data is input into the predictor in the key recognition neural network. Based on the ciphertext pair to be verified, the predictor determines the flipping strategy and the value of the flipping strategy according to the probability that the key obtained after flipping each bit of the initial guess key can obtain the ciphertext pair. The flipping strategy is used to identify the character bits to be flipped in the initial guess key. The value of the flipping strategy is determined based on the probability that the key obtained after flipping each bit of the initial guess key can obtain the ciphertext pair and the reward value corresponding to the key obtained after flipping each bit of the initial guess key.

[0031] The flipping strategy is input into the generator in the key recognition neural network so that the generator updates the initial guessed key according to the flipping strategy to obtain the updated key.

[0032] Optionally, after updating the initial guess key according to the flipping strategy using the generator to obtain the updated key, the method further includes:

[0033] The flipping strategy is input into the generator in the key recognition neural network so that the generator can obtain input data based on the ciphertext pair to be verified, the updated key, and the label ciphertext pair.

[0034] The input data obtained by the generator is input into the encoder in the key recognition neural network to obtain encoded input data through the encoder.

[0035] This specification provides a key recovery apparatus, comprising:

[0036] The acquisition module is used to acquire sample data, which includes sample plaintext pairs and label ciphertext pairs of the plaintext pairs under the actual key. The sample plaintext pairs contain two sample plaintexts, and the label ciphertext pairs contain label ciphertexts that are encrypted separately using the actual key for the two sample plaintexts contained in the sample plaintext pairs.

[0037] The first determining module is used to determine the initial guessing key and, based on the initial guessing key, encrypt the two sample plaintexts contained in the sample plaintext pair respectively to obtain the ciphertext pair to be verified.

[0038] The second determining module is used to determine the input data based on the ciphertext pair to be verified, the initial guessing key, and the tag ciphertext pair;

[0039] An update module is used to input the input data into a key recognition neural network, so that the key recognition neural network updates the initial guess key based on the probability that the key obtained by flipping each bit of the initial guess key can obtain the tag ciphertext pair, and obtains the updated key.

[0040] The training module is used to determine the reward value corresponding to the updated key and train the key recognition neural network based on the reward value.

[0041] The recovery module is used to deploy the trained key recognition neural network in a preset key recovery system so that, upon receiving a key recovery request, it can perform key recovery based on the plaintext pair carried in the key recovery request through the trained key recognition neural network.

[0042] Optionally, the second determining module is specifically used to: determine the data obtained by XORing the two ciphertexts to be verified in the ciphertext pair as the first data; determine the data obtained by XORing the two tag ciphertexts in the tag ciphertext pair as the second data; and determine the input data based on the ciphertext pair to be verified, the initial guessing key, the first data, the second data, and the tag ciphertext pair.

[0043] This specification provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described key recovery method.

[0044] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the above-described key recovery method.

[0045] The above-mentioned technical solutions adopted in this specification can achieve the following beneficial effects:

[0046] The key recovery method provided in this specification involves acquiring sample data, which includes a sample plaintext pair and a ciphertext tag pair under an actual key. Each sample plaintext pair contains two sample plaintexts, and the ciphertext tag pair contains ciphertext tags obtained by encrypting the two sample plaintexts separately using the actual key. An initial guessing key is determined, and based on this initial guessing key, the two sample plaintexts in the sample plaintext pair are encrypted separately to obtain a ciphertext pair to be verified. Based on the ciphertext pair to be verified, the initial guessing key, and the ciphertext tag pair, input data is determined and input into the system. The key recognition neural network is used to update the initial guess key based on the probability that the key obtained by flipping each bit of the initial guess key can obtain the ciphertext pair. The updated key is obtained, the reward value corresponding to the updated key is determined, and the key recognition neural network is trained based on the reward value. The trained key recognition neural network is deployed in a preset key recovery system so that when a key recovery request is received, the trained key recognition neural network can perform key recovery based on the plaintext pair carried in the key recovery request.

[0047] As can be seen from the above method, in the process of key recovery, the key recognition neural network is trained in a stepwise manner based on reinforcement learning, so that the finally trained key recognition neural network can have a good recognition effect for keys with any number of 1 bits. Attached Figure Description

[0048] The accompanying drawings, which are included to provide a further understanding of this specification and form part of this specification, illustrate exemplary embodiments and are used to explain this specification, but do not constitute an undue limitation thereof. In the drawings:

[0049] Figure 1 This is a flowchart illustrating a key recovery method provided in this specification;

[0050] Figure 2 This is a schematic diagram of the structure of a key recognition neural network provided in this specification;

[0051] Figure 3 This is a schematic diagram of the training process of a key recognition neural network provided in this specification;

[0052] Figure 4 This is a schematic diagram of the step training process for a key recognition neural network provided in this specification;

[0053] Figure 5 This is a schematic diagram of the structure of a key recovery device provided in this specification;

[0054] Figure 6 The corresponding information provided in this specification Figure 1 A schematic diagram of the structure of an electronic device. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0056] The technical solutions provided in the various embodiments of this specification are described in detail below with reference to the accompanying drawings.

[0057] Figure 1 This is a flowchart illustrating a key recovery method provided in this specification, including the following steps:

[0058] S101: Obtain sample data, the sample data including sample plaintext pairs and label ciphertext pairs of the plaintext pairs under the actual key, the sample plaintext pairs contain two sample plaintexts, and the label ciphertext pairs contain label ciphertexts after encrypting the two sample plaintexts contained in the sample plaintext pairs using the actual key.

[0059] S102: Determine the initial guessing key, and encrypt the two sample plaintexts contained in the sample plaintext pair according to the initial guessing key to obtain the ciphertext pair to be verified.

[0060] S103: Determine the input data based on the ciphertext pair to be verified, the initial guessing key, and the tag ciphertext pair.

[0061] The execution subject of the key recovery method involved in this specification can be a terminal device such as a desktop computer or a laptop computer, or a server. The following description uses a terminal device as the execution subject as an example to illustrate the key recovery method in the embodiments of this specification.

[0062] In the specific implementation of this specification, the terminal device can first obtain sample data, which includes sample plaintext pairs and tag ciphertext pairs of the plaintext pairs under the actual key. The sample plaintext pairs contain two sample plaintexts, and the tag ciphertext pairs contain tag ciphertexts that are encrypted separately using the actual key for the two sample plaintexts contained in the sample plaintext pairs.

[0063] The two plaintext samples mentioned above refer to two plaintext samples with good differential characteristics. The actual key here is the key that the key recognition neural network in this specification ultimately needs to recognize.

[0064] The actual key mentioned above can specifically include N keys, where the Nth key is a key containing N 1-bit values, where N is a positive integer not less than 1. Here, a key containing N 1-bit values ​​means that the key contains N "1"s.

[0065] Once the sample data is acquired, the terminal device can determine the initial guessing key and, based on the initial guessing key, encrypt the two sample plaintexts contained in the sample plaintext pair to obtain the ciphertext pair to be verified. Here, the initial guessing key can be a key with all zeros (that is, the value corresponding to all bits of the initial guessing key can be 0).

[0066] The terminal device can determine the input data based on the ciphertext pair to be verified, the initial guess key, and the tag ciphertext pair.

[0067] Specifically, the terminal device can determine the first data by XORing the two ciphertexts of the ciphertext pair to be verified, and then determine the second data by XORing the two tag ciphertexts of the tag ciphertext pair. The terminal device can determine the input data based on the ciphertext pair to be verified, the initial guessing key, the first data, the second data, and the tag ciphertext pair.

[0068] Since the actual key mentioned above can include N keys, when determining the input data based on the ciphertext pair to be verified, the initial guess key, and the label ciphertext pair, the terminal device can determine the input data for the Nth round by using the ciphertext pair to be verified, the initial guess key, and the Nth label ciphertext pair obtained by encrypting the sample plaintext pair with the Nth key during the Nth round of model training.

[0069] S104: Input the input data into the key recognition neural network so that the key recognition neural network updates the initial guess key based on the probability that the key obtained by flipping each bit of the initial guess key can obtain the tag ciphertext pair, and obtains the updated key.

[0070] S105: Determine the reward value corresponding to the updated key, and train the key recognition neural network based on the reward value.

[0071] S106: Deploy the trained key recognition neural network in a preset key recovery system so that, upon receiving a key recovery request, the trained key recognition neural network performs key recovery based on the plaintext pair carried in the key recovery request.

[0072] After determining the input data, the terminal device can input the input data into the key recognition neural network, so that the key recognition neural network updates the initial guess key based on the probability that the key obtained by flipping each bit of the initial guess key can obtain the tag ciphertext pair, and obtains the updated key.

[0073] Since the actual key mentioned above can include N keys, the process of determining the updated key can be as follows: the input data of the Nth round is input into the key recognition neural network trained in the (N-1)th round, so that the key recognition neural network trained in the (N-1)th round updates the initial guess key based on the probability that the key obtained by flipping each bit of the initial guess key can obtain the Nth tag ciphertext pair, and obtains the updated key of the Nth round.

[0074] Once the updated key is determined, the terminal device can determine the reward value corresponding to the updated key and train the key recognition neural network based on the reward value.

[0075] The specific method for determining the reward value corresponding to the updated key can be as follows: the terminal device determines the reward value corresponding to the updated key based on the distance between the updated key and the actual key. Here, distance describes the degree of closeness between the updated key and the actual key. Specifically, the closer the updated key is to the actual key, the higher the reward value corresponding to the updated key; conversely, the farther apart they are, the lower the reward value corresponding to the updated key.

[0076] The aforementioned key recognition neural network may include at least: an encoder, a predictor, and a generator.

[0077] The process by which the aforementioned key recognition neural network determines the updated key based on the input data fed into the network can specifically be as follows:

[0078] The terminal device first inputs the input data into the encoder in the key recognition neural network so that the encoded input data can be obtained through the encoder.

[0079] Then, the encoded input data is fed into the predictor in the key recognition neural network. Based on the ciphertext pair to be verified, the predictor determines the flipping strategy and its value according to the probability that the key obtained after flipping each bit of the initial guess key can obtain the ciphertext pair. The flipping strategy is used to identify the character bits to be flipped in the initial guess key. The value of the flipping strategy is determined based on the probability that the key obtained after flipping each bit of the initial guess key can obtain the ciphertext pair and the reward value corresponding to the key obtained after flipping each bit of the initial guess key.

[0080] Subsequently, the terminal device can input the flipping strategy into the generator in the key recognition neural network, so that the generator can update the initial guessed key according to the flipping strategy to obtain the updated key.

[0081] It should be noted that after the generator updates the initial guess key according to the flipping strategy to obtain the updated key, the terminal device can also input the flipping strategy into the generator in the key recognition neural network, so that the generator can obtain input data based on the ciphertext pair to be verified, the updated key, and the tag ciphertext pair; and input the input data obtained by the generator into the encoder in the key recognition neural network, so that the encoder can obtain the encoded input data.

[0082] Figure 2 This is a schematic diagram of the structure of a key recognition neural network provided in this specification.

[0083] like Figure 2 As shown, the terminal device can first input the input data at time T into the encoder in the key recognition neural network, so as to obtain the encoded input data through the encoder. The encoded input data can be stored in the hidden state space T.

[0084] Subsequently, the terminal device can input the encoded input data in the hidden state space T into the predictor in the key recognition neural network. Based on the ciphertext pair to be verified, the predictor determines the flipping strategy and the value of the flipping strategy according to the probability that the key obtained after flipping each bit of the initial guess key can obtain the ciphertext pair.

[0085] Then, the terminal device can directly update the initial guessed key according to the flipping strategy to obtain the updated key. Based on the ciphertext pair to be verified, the updated key, and the tag ciphertext pair, it determines the new input data at time T+1 and inputs the input data at time T+1 into the encoder in the key recognition neural network. The encoder obtains the encoded input data at time T+1, which can be stored in the hidden state space T+1. Afterward, the terminal device can continue to input the encoded input data at time T+1 from the hidden state space T+1 into the predictor in the key recognition neural network. Based on the ciphertext pair to be verified, the predictor determines the flipping strategy and its value according to the probability that the key obtained after flipping each bit of the updated key can obtain the tag ciphertext pair.

[0086] Of course, in practical applications, directly updating the initial guess key according to the flip strategy might involve a large amount of computation and high costs. Therefore, the terminal device can avoid directly updating the initial guess key according to the flip strategy. Instead, it can input the flip strategy into the generator in the key recognition neural network, so that the generator can update the initial guess key according to the flip strategy to obtain the updated key. Furthermore, after updating the initial guess key using the generator according to the flip strategy, the terminal device can also input the flip strategy into the generator in the key recognition neural network. The generator can then obtain input data based on the ciphertext pair to be verified, the updated key, and the tag ciphertext pair. The terminal device can then input the input data obtained by the generator into the encoder in the key recognition neural network to obtain the encoded input data. Subsequent steps are the same as above and will not be repeated here.

[0087] Subsequently, the terminal device can determine the reward value corresponding to the updated key, and train the key recognition neural network based on the reward value.

[0088] Specifically, since the actual key mentioned above can include N keys, the terminal device can first determine the reward value corresponding to the updated key in the Nth round, and perform the Nth round of training based on the reward value corresponding to the updated key in the Nth round to obtain the key recognition neural network obtained after the Nth round of training. Then, based on the determined input data of the N+1th round, the key recognition neural network obtained after the Nth round of training is trained for the N+1th round until the preset training conditions are met.

[0089] Figure 3 This is a schematic diagram of the training process of a key recognition neural network provided in this specification.

[0090] like Figure 3 As shown, when training the key recognition neural network, the terminal device first initializes the key recognition neural network and initializes n to 0. Then, it saves the initialized key recognition neural network and updates n to the value of n+1. It then determines whether n satisfies n>N.

[0091] If n>N, then the training of the key recognition neural network ends, and the current key recognition neural network is output.

[0092] If n > N is not satisfied, a random 1-bit key of length n is used as the initial key for training until the key recognition neural network converges. Then, the key recognition neural network can be tested; that is, the terminal device can replace it with another random 1-bit key of length n and use the previously trained neural network to recover the key. If the key recognition neural network fails to recognize the other random 1-bit key of length n, another random 1-bit key of length n is used as the initial key for training until the key recognition neural network converges. Then, the key recognition neural network is tested again until the test is successful. Conversely, if the test is successful (the key recognition neural network successfully recognizes the other random 1-bit key of length n), the key recognition neural network is saved (a copy of the key recognition neural network is saved in the database), and n is updated to the value of n+1 (i.e., the current key recognition neural network is trained to test its ability to recognize keys of length n (=n+1). The training continues until n > N (meaning the trained key recognition neural network can recognize keys with any number of bits), at which point the training ends and the current key recognition neural network is output.

[0093] It is easy to see that the training process of the key recognition neural network described above can be regarded as a kind of step training.

[0094] The reinforcement learning training framework used in this specification for training the key recognition neural network employs Monte Carlo Tree Search (MCTS) as the decision tree search algorithm. The strategy selection algorithm is the Upper Confidence Bound (UCB) algorithm. Therefore, the fewer bits that need to be flipped to reach the true key from the initial key, i.e., the fewer operation steps to reach the optimal solution, the shallower the search tree depth, and the less time the model wastes in the search, thus resulting in higher efficiency.

[0095] Monte Carlo Tree Search (MCS) is a computer algorithm used to search large decision trees and estimate the potential value of each node. Starting from the root node, the algorithm randomly selects a path among the unexplored nodes in the tree and explores until it reaches a previously visited node. Upon reaching a node, the algorithm uses an evaluation function to estimate its potential value and returns it to the root node. As the search progresses, the algorithm updates the value and visit count of each node, allowing it to select the optimal policy path based on this information.

[0096] The UCB algorithm estimates the expected reward for each arm using confidence intervals and selects the next action based on the reward and the size of the confidence interval. The confidence interval includes a mean estimate and a confidence metric describing the accuracy of the mean estimate. The algorithm optimizes the trade-off between exploration and exploitation by balancing these two factors, enabling efficient exploration of unknown policies through continuous trial and error while maximizing the cumulative reward.

[0097] The UCB formula is the core of the UCB algorithm, and the corresponding expression for the UCB formula can be:

[0098]

[0099] Q t (a) is the average reward calculated by the flip strategy a at time t, where time t is equivalent to the total number of searches, and c is a hyperparameter controlling the exploration, which can be 1.25. N t (a) represents the number of times the flip strategy a was tested. This formula puts the trade-off between exploration and exploitation into a mathematical formula, which can be used to select the next action, and the parameters can be tuned in different application scenarios to optimize the performance of the algorithm.

[0100] Figure 4 This is a schematic diagram of the step training process for a key recognition neural network provided in this specification.

[0101] like Figure 4 As shown, Figure 4 The initial guess key corresponding to the node in the first row is 000……0. In the 16 rounds of encryption output of plaintext 1 under the initial guess key: the first round's encryption result is "010……1", the second round's encryption result is "011……1", ..., and the 16th round's encryption result is "101……1". Plaintext 2 also has 16 rounds of encryption output. These 16 rounds of encryption output from plaintext 1 can then be XORed with the 16 rounds of encryption output from plaintext 2 to obtain the XOR result.

[0102] Figure 4The leftmost node in the second row corresponds to the guessed key of 100...0. In the 16 rounds of encryption output of plaintext 1 under the guessed key encryption system: the first round's encryption result is "100...1", the second round's encryption result is "011...0", ..., and the 16th round's encryption result is "001...1". Plaintext 2 also has 16 rounds of encryption output. These 16 rounds of encryption output from plaintext 1 can then be XORed with the 16 rounds of encryption output from plaintext 2 to obtain the XOR result.

[0103] Figure 4 The rightmost node in the last row corresponds to the guessed key 010……1 (the correct real key). In the 16 rounds of encryption of plaintext 1 using the guessed key, the first round's result is "010……1", the second round's result is "001……1", ..., and the 16th round's result is "100……1". Plaintext 2 also has 16 rounds of encryption output. These 16 rounds of encryption output from plaintext 1 can then be XORed with the 16 rounds of encryption output from plaintext 2 to obtain the XOR result.

[0104] Figure 4 Each connection between nodes in the key guessing process changes the value of one bit.

[0105] Subsequently, the terminal device can deploy the trained key recognition neural network in a preset key recovery system so that, upon receiving a key recovery request, it can perform key recovery based on the plaintext pair carried in the key recovery request using the trained key recognition neural network.

[0106] As can be seen from the above method, in the process of key recovery, the key recognition neural network is trained in a stepwise manner based on reinforcement learning, so that the finally trained key recognition neural network can have a good recognition effect for keys with any number of 1 bits.

[0107] The above describes one or more implementations of the methods described in this specification. Based on the same approach, this specification also provides corresponding key recovery devices, such as... Figure 5 As shown.

[0108] Figure 5 This specification provides a schematic diagram of a key recovery device structure, including:

[0109] The acquisition module 501 is used to acquire sample data, which includes sample plaintext pairs and label ciphertext pairs of the plaintext pairs under the actual key. The sample plaintext pairs contain two sample plaintexts, and the label ciphertext pairs contain label ciphertexts that are encrypted separately using the actual key for the two sample plaintexts contained in the sample plaintext pairs.

[0110] The first determining module 502 is used to determine the initial guessing key and, based on the initial guessing key, encrypt the two sample plaintexts contained in the sample plaintext pair respectively to obtain the ciphertext pair to be verified.

[0111] The second determining module 503 is used to determine input data based on the ciphertext pair to be verified, the initial guessing key, and the tag ciphertext pair;

[0112] The update module 504 is used to input the input data into the key recognition neural network, so that the key recognition neural network updates the initial guess key based on the probability that the key obtained by flipping each bit of the initial guess key can obtain the tag ciphertext pair, and obtains the updated key.

[0113] The training module 505 is used to determine the reward value corresponding to the updated key and train the key recognition neural network based on the reward value.

[0114] The recovery module 506 is used to deploy the trained key recognition neural network in a preset key recovery system so that, upon receiving a key recovery request, it can perform key recovery based on the plaintext pair carried in the key recovery request through the trained key recognition neural network.

[0115] Optionally, the actual key includes N keys, wherein the Nth key is a key containing N bits, where N is a positive integer not less than 1; the second determining module 503 is specifically used to determine the input data for the Nth round during the Nth round of model training based on the ciphertext pair to be verified, the initial guessing key, and the Nth tag ciphertext pair obtained by encrypting the sample plaintext pair using the Nth key; the updating module 504 is specifically used to input the input data for the Nth round into the key recognition neural network trained in the (N-1)th round, so that the key recognition neural network trained in the (N-1)th round is used in the model training of the Nth round. Based on the ciphertext pair, the initial guessing key is updated according to the probability that the key obtained by flipping each bit of the initial guessing key can obtain the Nth tag ciphertext pair, resulting in the updated key for the Nth round. The training module 505 is specifically used to determine the reward value corresponding to the updated key for the Nth round, and to perform the Nth round of training according to the reward value corresponding to the updated key for the Nth round, to obtain the key recognition neural network obtained after the Nth round of training, and to perform the N+1th round of training on the key recognition neural network obtained after the Nth round of training according to the determined input data for the N+1th round, until the preset training conditions are met.

[0116] Optionally, the second determining module 503 is specifically used to: determine the data obtained by XORing the two ciphertexts to be verified of the ciphertext pair as first data; determine the data obtained by XORing the two tag ciphertexts of the tag ciphertext pair as second data; and determine input data based on the ciphertext pair to be verified, the initial guessing key, the first data, the second data, and the tag ciphertext pair.

[0117] Optionally, the training module 505 is specifically used to determine the reward value corresponding to the updated key based on the distance between the updated key and the actual key, wherein the distance is used to describe the closeness between the updated key and the actual key.

[0118] Optionally, the update module 504 is specifically configured to: input the input data into the encoder in the key recognition neural network to obtain encoded input data; input the encoded input data into the predictor in the key recognition neural network to determine a flipping strategy and its value based on the probability that the key obtained after flipping each bit of the initial guess key can obtain the tag ciphertext pair, wherein the flipping strategy is used to identify the character bits to be flipped in the initial guess key, and the value of the flipping strategy is determined based on the probability that the key obtained after flipping each bit of the initial guess key can obtain the tag ciphertext pair and the reward value corresponding to the key obtained after flipping each bit of the initial guess key; and input the flipping strategy into the generator in the key recognition neural network to update the initial guess key according to the flipping strategy to obtain an updated key.

[0119] Optionally, the device further includes:

[0120] The generation module 507 is used to update the initial guess key according to the flipping strategy through the generator to obtain the updated key, and then input the flipping strategy into the generator in the key recognition neural network so that the generator can obtain input data based on the ciphertext pair to be verified, the updated key, and the label ciphertext pair; and input the input data obtained by the generator into the encoder in the key recognition neural network so that the encoder can obtain the encoded input data.

[0121] This specification also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described... Figure 1 A method for key recovery is provided.

[0122] This instruction manual also provides Figure 6 One of the corresponding Figure 1 A schematic diagram of the structure of an electronic device. (e.g.) Figure 6 As shown, at the hardware level, this electronic device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to achieve the above. Figure 1 The method for key recovery.

[0123] Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of hardware and software. In other words, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0124] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0125] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0126] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0127] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware components.

[0128] Those skilled in the art will understand that embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0129] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0130] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0131] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0132] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0133] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0134] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0135] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0136] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0137] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0138] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0139] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A method for key recovery, characterized in that, include: Obtain sample data, which includes sample plaintext pairs and label ciphertext pairs of the plaintext pairs under the actual key. The sample plaintext pairs contain two sample plaintexts, and the label ciphertext pairs contain label ciphertexts that are encrypted separately using the actual key for the two sample plaintexts contained in the sample plaintext pairs. Determine an initial guessing key, and based on the initial guessing key, encrypt the two sample plaintexts contained in the sample plaintext pair respectively to obtain the ciphertext pair to be verified; The input data is determined based on the ciphertext pair to be verified, the initial guess key, and the tag ciphertext pair; The input data is fed into a key recognition neural network, so that the key recognition neural network updates the initial guess key based on the probability that the key obtained by flipping each bit of the initial guess key can obtain the tag ciphertext pair, and obtains the updated key. Determine the reward value corresponding to the updated key, and train the key recognition neural network based on the reward value; The trained key recognition neural network is deployed in a preset key recovery system so that, upon receiving a key recovery request, the trained key recognition neural network can perform key recovery based on the plaintext pair carried in the key recovery request.

2. The method as described in claim 1, characterized in that, The actual key includes N keys, where the Nth key is a key containing N bits, where N is a positive integer not less than 1; Based on the ciphertext pair to be verified, the initial guess key, and the tag ciphertext pair, the input data is determined, specifically including: During the Nth round of model training, the input data for the Nth round is determined based on the ciphertext pair to be verified, the initial guess key, and the Nth label ciphertext pair obtained by encrypting the sample plaintext pair using the Nth key. The input data is fed into a key recognition neural network, which updates the initial guess key based on the probability that each bit of the initial guess key, after being flipped, can yield the tag ciphertext pair, thus obtaining an updated key. Specifically, this includes: The input data of the Nth round is input into the key recognition neural network trained in the N-1th round, so that the key recognition neural network trained in the N-1th round updates the initial guess key based on the probability that the key obtained by flipping each bit of the initial guess key can obtain the Nth tag ciphertext pair, and obtains the updated key in the Nth round. Determine the reward value corresponding to the updated key, and train the key recognition neural network based on the reward value, specifically including: Determine the reward value corresponding to the updated key in the Nth round, and perform the Nth round of training based on the reward value corresponding to the updated key in the Nth round to obtain the key recognition neural network obtained after the Nth round of training. Then, perform the N+1th round of training on the key recognition neural network obtained after the Nth round of training based on the determined input data of the N+1th round, until the preset training conditions are met.

3. The method as described in claim 1, characterized in that, Based on the ciphertext pair to be verified, the initial guess key, and the tag ciphertext pair, the input data is determined, specifically including: The data obtained by XORing the two ciphertexts of the ciphertext pair to be verified is determined as the first data. The data obtained by XORing the two ciphertexts of the ciphertext pair is determined as the second data. The input data is determined based on the ciphertext pair to be verified, the initial guessing key, the first data, the second data, and the tag ciphertext pair.

4. The method as described in claim 1, characterized in that, Determining the reward value corresponding to the updated key specifically includes: The reward value corresponding to the updated key is determined based on the distance between the updated key and the actual key, wherein the distance is used to describe the degree of closeness between the updated key and the actual key.

5. The method according to any one of claims 1 to 4, characterized in that, The input data is fed into a key recognition neural network, which updates the initial guess key based on the probability that each bit of the initial guess key, after being flipped, can yield the tag ciphertext pair, thus obtaining an updated key. Specifically, this includes: The input data is fed into the encoder in the key recognition neural network to obtain encoded input data through the encoder. The encoded input data is input into the predictor in the key recognition neural network. Based on the ciphertext pair to be verified, the predictor determines the flipping strategy and the value of the flipping strategy according to the probability that the key obtained after flipping each bit of the initial guess key can obtain the ciphertext pair. The flipping strategy is used to identify the character bits to be flipped in the initial guess key. The value of the flipping strategy is determined based on the probability that the key obtained after flipping each bit of the initial guess key can obtain the ciphertext pair and the reward value corresponding to the key obtained after flipping each bit of the initial guess key. The flipping strategy is input into the generator in the key recognition neural network so that the generator updates the initial guessed key according to the flipping strategy to obtain the updated key.

6. The method as described in claim 5, characterized in that, After updating the initial guess key using the generator according to the flipping strategy to obtain the updated key, the method further includes: The flipping strategy is input into the generator in the key recognition neural network so that the generator can obtain input data based on the ciphertext pair to be verified, the updated key, and the label ciphertext pair. The input data obtained by the generator is input into the encoder in the key recognition neural network to obtain encoded input data through the encoder.

7. A key recovery device, characterized in that, include: The acquisition module is used to acquire sample data, which includes sample plaintext pairs and label ciphertext pairs of the plaintext pairs under the actual key. The sample plaintext pairs contain two sample plaintexts, and the label ciphertext pairs contain label ciphertexts that are encrypted separately using the actual key for the two sample plaintexts contained in the sample plaintext pairs. The first determining module is used to determine the initial guessing key and, based on the initial guessing key, encrypt the two sample plaintexts contained in the sample plaintext pair respectively to obtain the ciphertext pair to be verified. The second determining module is used to determine the input data based on the ciphertext pair to be verified, the initial guessing key, and the tag ciphertext pair; An update module is used to input the input data into a key recognition neural network, so that the key recognition neural network updates the initial guess key based on the probability that the key obtained by flipping each bit of the initial guess key can obtain the tag ciphertext pair, and obtains the updated key. The training module is used to determine the reward value corresponding to the updated key and train the key recognition neural network based on the reward value. The recovery module is used to deploy the trained key recognition neural network in a preset key recovery system so that, upon receiving a key recovery request, it can perform key recovery based on the plaintext pair carried in the key recovery request through the trained key recognition neural network.

8. The apparatus as claimed in claim 7, characterized in that, The second determining module is specifically used to: determine the data obtained by XORing the two ciphertexts of the ciphertext pair to be verified as the first data; determine the data obtained by XORing the two tag ciphertexts of the tag ciphertext pair as the second data; and determine the input data based on the ciphertext pair to be verified, the initial guessing key, the first data, the second data, and the tag ciphertext pair.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the method described in any one of claims 1 to 6.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method described in any one of claims 1 to 6.

Images