Method of generating a key, method of data encryption and method of data decryption
By generating derived keys through a preset key derivation algorithm and verifying them with message authentication codes, the problem of low security in key storage and use is solved, thereby improving the security of the encryption and decryption process.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- 欧摩威汽车电子(芜湖)有限公司
- Filing Date
- 2024-08-15
- Publication Date
- 2026-07-24
AI Technical Summary
Existing technologies for storing and using keys have low security and pose a risk of leakage. Therefore, improving key security is an important issue.
The original key in the preset key pair is calculated using a preset key derivation algorithm to generate a derived key. The derived key is then used for data encryption and decryption. The consistency of the key is verified by combining the message authentication code to ensure the security of the key.
It enhances key security during encryption and decryption processes, avoids the risk of direct key use and leakage, and improves the security of data transmission.
Smart Images
Figure CN118827042B_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to the field of computer technology, and in particular to methods for generating keys, methods for encrypting data, and methods for decrypting data. Background Technology
[0002] When software upgrades are needed on the product side, the relevant software packages must be encrypted and decrypted on the product side to ensure the authenticity and integrity of the packages. This encryption and decryption process requires corresponding encryption and decryption keys. Current key storage and usage methods have relatively low security, and direct use of keys carries the risk of leakage. Therefore, ensuring the security of the keys themselves is a crucial issue. Summary of the Invention
[0003] This disclosure provides a method for generating a key, a method for encrypting data, and a method for decrypting data, to solve or alleviate one or more technical problems in the prior art.
[0004] On the one hand, this disclosure provides a method for generating a key, including:
[0005] The first original key in the preset key pair is calculated using a preset key derivation algorithm to generate a first derived key for data encryption.
[0006] The second derived key is generated by calculating the second original key in the preset key pair using a preset key derivation algorithm.
[0007] The preset data is encrypted using a first derived key and an encryption algorithm to generate the first data; and
[0008] The first data is calculated using the second derived key to generate the first message authentication code.
[0009] On the other hand, this disclosure provides a method for generating a key, including:
[0010] The first original key in the preset key pair is calculated using a preset key derivation algorithm to generate the third derived key;
[0011] The second original key in the preset key pair is calculated using a preset key derivation algorithm to generate the fourth derived key;
[0012] The preset data is encrypted using a third derived key and an encryption algorithm to generate the second data;
[0013] The second data is calculated using the fourth derived key to generate a second message authentication code; and
[0014] If the second message authentication code is determined to be consistent with the first message authentication code, the third derived key is determined as the fifth derived key for data decryption, wherein the first message authentication code is generated according to the method of any embodiment of this disclosure.
[0015] On the other hand, this disclosure provides a method for data encryption, including:
[0016] The target data is encrypted using a first derived key generated by the method of any embodiment of this disclosure to obtain encrypted data.
[0017] On the other hand, this disclosure provides a method for data decryption, including:
[0018] The target data is decrypted using a fifth derived key generated by the method of any embodiment of this disclosure.
[0019] On the other hand, this disclosure provides an apparatus for generating a key, comprising:
[0020] The first generation module is used to calculate the first original key in the preset key pair using a preset key derivation algorithm to generate a first derived key for data encryption.
[0021] The second generation module is used to calculate the second original key in the preset key pair using a preset key derivation algorithm to generate the second derived key.
[0022] The third generation module is used to encrypt preset data using the first derived key and encryption algorithm to generate the first data; and
[0023] The fourth generation module is used to calculate the first data using the second derived key to generate the first message authentication code.
[0024] On the other hand, this disclosure provides an apparatus for generating a key, comprising:
[0025] The fifth generation module is used to calculate the first original key in the preset key pair using a preset key derivation algorithm to generate the third derived key.
[0026] The sixth generation module is used to calculate the second original key in the preset key pair using a preset key derivation algorithm to generate the fourth derived key.
[0027] The seventh generation module is used to encrypt the preset data using the third derived key and encryption algorithm to generate the second data;
[0028] The eighth generation module is used to calculate the second data using the fourth derived key to generate the second message authentication code; and
[0029] The determining module is configured to determine the third derived key as the fifth derived key for data decryption when it is determined that the second message authentication code is consistent with the first message authentication code, wherein the first message authentication code is generated according to the method of any embodiment of the present disclosure.
[0030] On the other hand, this disclosure provides a data encryption apparatus, comprising:
[0031] An encryption module is used to encrypt target data using a first derived key generated by the method of any embodiment of the present disclosure, thereby obtaining encrypted data.
[0032] On the other hand, this disclosure provides a data decryption apparatus, comprising:
[0033] The decryption module is used to decrypt encrypted data using a fifth derived key generated by the method of any embodiment of this disclosure.
[0034] On the other hand, this disclosure provides an electronic device, including:
[0035] At least one processor. And
[0036] A memory that is communicatively connected to the at least one processor. Wherein,
[0037] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the methods of any embodiment of the present disclosure.
[0038] On the other hand, this disclosure provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to perform a method according to any embodiment of this disclosure.
[0039] On the other hand, this disclosure provides a computer program product including a computer program that, when executed by a processor, implements a method according to any embodiment of this disclosure.
[0040] According to the scheme disclosed herein, the security of the encryption and decryption keys used in the data encryption and decryption process can be improved, thereby further enhancing the security of the encryption and decryption process.
[0041] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description
[0042] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the various drawings denote the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings depict only some embodiments provided according to this disclosure and should not be construed as limiting the scope of this disclosure.
[0043] Figure 1 This is a flowchart illustrating a method for generating a key according to an embodiment of the present disclosure.
[0044] Figure 2 This is a flowchart illustrating a method for generating a key according to an embodiment of the present disclosure.
[0045] Figure 3 This is a schematic flowchart of a data processing method according to an embodiment of the present disclosure.
[0046] Figure 4 This is a schematic diagram illustrating the application of a data processing method according to an embodiment of the present disclosure.
[0047] Figure 5 This is a schematic diagram of an apparatus for generating a key according to an embodiment of the present disclosure.
[0048] Figure 6 This is a schematic diagram of an apparatus for generating a key according to an embodiment of the present disclosure.
[0049] Figure 7 This is a block diagram of an electronic device used to implement the key generation method and / or data processing method of the embodiments of this disclosure. Detailed Implementation
[0050] The present disclosure will now be described in further detail with reference to the accompanying drawings. The same reference numerals in the drawings denote elements that have the same or similar functions. Although various aspects of embodiments are shown in the drawings, they are not necessarily drawn to scale unless specifically indicated otherwise.
[0051] Furthermore, to better illustrate this disclosure, numerous specific details are set forth in the following detailed description. Those skilled in the art will understand that this disclosure can be practiced without certain specific details. In some instances, methods, means, components, and circuits well known to those skilled in the art have not been described in detail in order to highlight the main points of this disclosure.
[0052] like Figure 1 As shown, this disclosure provides a method for generating a key, including:
[0053] Step S101: Calculate the first original key in the preset key pair using the preset key derivation algorithm to generate the first derived key for data encryption.
[0054] Step S102: Calculate the second original key in the preset key pair using the preset key derivation algorithm to generate the second derived key.
[0055] Step S103: Encrypt the preset data using the first derived key and encryption algorithm to generate the first data.
[0056] Step S104: Calculate the first data using the second derived key to generate the first message authentication code (MAC).
[0057] According to the embodiments of this disclosure, it should be noted that:
[0058] The key generation method of this disclosure can be applied to a device that encrypts target data. The device can use the method of this disclosure to encrypt the target data (data packets, software packages) required for product upgrades.
[0059] The first derived key is used to encrypt the target data required for product upgrades.
[0060] The first message authentication code is used as verification information during the generation of the key to decrypt encrypted data.
[0061] The preset key pair includes a first original key and a second original key, both of which have the same data type and length. The preset key pair can be stored in a remote trust center, a preset server, etc. The first original key can be used as the key to encrypt data, and the second original key can be used as the key to decrypt encrypted data.
[0062] The preset key derivation algorithm can be any existing algorithm, and no specific limitation is made here. For example, the preset key derivation algorithm can be PBKDF2 (Password-Based Key Derivation Function 2), Bcrypt (a cross-platform file encryption tool), Scrypt (an internet backup service), Argon2, etc.
[0063] The preset key derivation algorithm used to generate the first and second derived keys is the same.
[0064] The preset data can be a fixed number of bytes.
[0065] The encryption algorithm can be either a symmetric encryption algorithm or an asymmetric encryption algorithm; no specific limitation is made here.
[0066] According to the technology of this disclosure, by performing key derivation processing on the first original key originally used for encrypting data, and using the first derived key obtained by key derivation as the encryption key to encrypt the target data, the complexity of the first derived key and the security of the key itself can be improved, avoiding the risk of the first original key being directly used and leaked. Furthermore, the method of this disclosure does not require additional hardware implementation, thus not increasing hardware costs.
[0067] In one example, the preset key pair is stored in a remote trust center (OTC), and the first original key PSK1 and the second original key PSK2 are obtained from the remote trust center. The preset key derivation algorithm is used to derive PSK1 and PSK2 respectively to obtain the new first derived key SK1 and the second derived key SK2. The preset key derivation algorithm is PBKDF2 algorithm, with 1024 iterations and a salt value of 48 bytes of random number. SK2 is used as the key for integrity verification of SK1. The verification method is to encrypt a preset data (Plain
[16] = 0x00, 0x11…0xFF) with SK1 to obtain a 16-byte ciphertext array Cipher1
[16] (first data). The encryption algorithm can be AES-CBC algorithm, and the initial vector data is a 16-byte all-zero array IV
[16] = {0x00}. The 16-byte first message authentication code (MAC) is calculated using SK2 on the encrypted first data.
[0068] In one embodiment, the method for generating a key according to this disclosure includes steps S101 to S104, wherein step S101: calculating the first original key in the preset key pair using a preset key derivation algorithm to generate a first derived key for data encryption, including:
[0069] Based on a preset random value and a preset number of iterations, a preset key derivation algorithm is used to calculate the first original key in the preset key pair to generate the first derived key.
[0070] According to the embodiments of this disclosure, it should be noted that:
[0071] The preset random value can be understood as the salt value.
[0072] The preset random value and preset number of iterations can be selected and adjusted as needed, and no specific limitations are made here.
[0073] According to the technology of the embodiments of this disclosure, by setting random values and preset iteration numbers, the complexity of the key derivation algorithm can be increased, thereby improving the security of the first derived key.
[0074] In one embodiment, the method for generating a key according to this disclosure includes steps S101 to S104, wherein step S102: calculating the second original key in the preset key pair using a preset key derivation algorithm to generate a second derived key, including:
[0075] Based on a preset random value and a preset number of iterations, a preset key derivation algorithm is used to calculate the second original key in the preset key pair to generate a second derived key.
[0076] According to the embodiments of this disclosure, it should be noted that:
[0077] The preset random value and preset number of iterations are the same when generating the first and second derived keys.
[0078] In one embodiment, the method for generating a key according to this disclosure includes steps S101 to S104, wherein step S104: encrypting preset data using a first derived key and an encryption algorithm to generate first data, including:
[0079] Determine the preset data and initial vector.
[0080] Using the first derived key, encryption algorithm, and initial vector, the preset data is encrypted to generate the first data.
[0081] According to the embodiments of this disclosure, it should be noted that:
[0082] The initial vector and the preset data can have the same byte size.
[0083] The encryption algorithm can be any existing data encryption algorithm, and no limitation is made here.
[0084] According to the technology of the present disclosure embodiments, by encrypting preset data with a first derived key to obtain first data, the security of the first message authentication code calculated using the first data can be improved, and it will not be easily obtained or tampered with, thereby improving the security of security verification using the first message authentication code in the subsequent data decryption process.
[0085] like Figure 2 As shown, this disclosure provides a method for generating a key, including:
[0086] Step S201: Calculate the first original key in the preset key pair using the preset key derivation algorithm to generate the third derived key.
[0087] Step S202: Calculate the second original key in the preset key pair using the preset key derivation algorithm to generate the fourth derived key.
[0088] Step S203: Encrypt the preset data using the third derived key and encryption algorithm to generate the second data.
[0089] Step S204: Calculate the second data using the fourth derived key to generate the second message authentication code.
[0090] Step S205: If it is determined that the second message authentication code is consistent with the first message authentication code, the third derived key is determined as the fifth derived key for data decryption, wherein the first message authentication code is generated according to the method of steps S101 to S104 in the key generation method of this disclosure embodiment.
[0091] According to the embodiments of this disclosure, it should be noted that:
[0092] The key generation method of this disclosure can be applied to a product terminal that decrypts encrypted data. The product terminal can use the method of this disclosure to decrypt the target data (data packet, software package) required for product terminal upgrade, thereby realizing the upgrade of the product terminal's own software using the target data.
[0093] The fifth derived key is used to decrypt the target data required for product upgrades.
[0094] If the first and second original keys in the preset key pair have not been tampered with, then the first and third derived keys should be consistent, the second and fourth derived keys should be consistent, the first data and the second data should be consistent, and the first message authentication code and the second message authentication code should be consistent. Otherwise, they will not be consistent, and the third derived key cannot be used as the fifth derived key for decrypting encrypted data.
[0095] The preset key derivation algorithm can be any existing algorithm, without specific limitations, but it must be consistent with the preset key derivation algorithm used to generate the first derived key. For example, the preset key derivation algorithm can be PBKDF2 (Password-Based Key Derivation Function 2), Bcrypt (a cross-platform file encryption tool), Scrypt (an internet backup service), Argon2, etc.
[0096] The preset key derivation algorithm used to generate the third and fourth derived keys is the same.
[0097] The preset data can be a fixed number of bytes.
[0098] The encryption algorithm can be either a symmetric encryption algorithm or an asymmetric encryption algorithm; no specific limitation is made here.
[0099] The preset data and encryption algorithm used to generate the first and second data are the same.
[0100] The first message authentication code can be obtained proactively by the product from the device, or it can be proactively sent from the device to the product.
[0101] According to the technology of this disclosure, since both the first and second message authentication codes are generated based on a preset key pair, matching the first and second message authentication codes can determine whether the preset key pair used to generate the encryption key (first derived key) and the decryption key (fifth derived key) is consistent. Furthermore, it can be determined whether the third derived key generated based on the preset key pair can be used as the fifth derived key for decrypting encrypted data, because, assuming the preset key pair has not been tampered with, the resulting first and fifth derived keys are consistent. Simultaneously, by performing key derivation processing on the first original key originally used for decrypting encrypted data, and using the fifth derived key obtained as the decryption key to decrypt the target data, the complexity of the fifth derived key can be increased. Furthermore, matching the first and second message authentication codes can enhance the security of the key itself, avoiding the risk of the first original key being directly used and leaked.
[0102] In one example, the preset key pair is stored in a remote trust center (OTC), and the first original key PSK1 and the second original key PSK2 are obtained from the remote trust center. The preset key derivation algorithm is used to derive PSK1 and PSK2 respectively to obtain a new third derivation key SK3 and a fourth derivation key SK4. The preset key derivation algorithm is PBKDF2 algorithm, with 1024 iterations and a salt value of 48 bytes of random number. SK4 is used as the key for integrity verification of SK3. The verification method is to encrypt a preset data (Plain
[16] = 0x00, 0x11…0xFF) using SK3 to obtain a 16-byte ciphertext array Cipher1
[16] (second data). The encryption algorithm can be AES-CBC algorithm, and the initial vector data is a 16-byte all-zero array IV
[16] = {0x00}. The 16-byte second message authentication code (MAC) is calculated using SK4 on the encrypted second data. The second message authentication code and the first message authentication code are used for verification. If they match, SK3 is used as the fifth derived key for decrypting the encrypted data. In other words, the first derived key and the fifth derived key are used as the key pair for encrypting and decrypting the encrypted data.
[0103] In one embodiment, the method for generating a key according to this disclosure includes steps S201 to S205, wherein step S201: calculating a third derived key by using a preset key derivation algorithm on a first original key in a preset key pair, including:
[0104] Based on a preset random value and a preset number of iterations, a preset key derivation algorithm is used to calculate the first original key in the preset key pair to generate a third derived key.
[0105] The preset random value can be understood as the salt value.
[0106] The preset random value and preset number of iterations can be selected and adjusted as needed, and are not specifically limited here. The preset random value and preset number of iterations used to generate the third derived key are the same as those used to generate the first derived key.
[0107] Preset random values and preset iteration counts can be stored in advance on the product side.
[0108] According to the technology of the embodiments of this disclosure, by setting random values and preset iteration numbers, the complexity of the key derivation algorithm can be increased, thereby improving the security of the third derivation key, and further improving the security when the third derivation key is used as the fifth derivation key for decrypting encrypted data.
[0109] In one embodiment, the method for generating a key according to this disclosure includes steps S201 to S205, wherein step S202: calculating the second original key in the preset key pair using a preset key derivation algorithm to generate a fourth derived key, including:
[0110] Based on a preset random value and a preset number of iterations, a preset key derivation algorithm is used to calculate the second original key in the preset key pair to generate a fourth derived key.
[0111] According to the embodiments of this disclosure, it should be noted that:
[0112] The preset random value and preset number of iterations used to generate the third and fourth derived keys are the same.
[0113] In one embodiment, the method for generating a key according to this disclosure includes steps S201 to S205, wherein step S203: encrypting preset data using a third derived key and an encryption algorithm to generate second data, including:
[0114] Determine the preset data and initial vector;
[0115] Using a third derived key, an encryption algorithm, and an initialization vector, the preset data is encrypted to generate the second data.
[0116] According to the embodiments of this disclosure, it should be noted that:
[0117] The initial vector and the preset data can have the same byte size.
[0118] The encryption algorithm can be any existing data encryption algorithm, and no limitation is made here.
[0119] The initial vectors, preset data, and encryption algorithms used to generate the first and second data are the same.
[0120] The initial vector can be pre-stored on the product side.
[0121] According to the technology of the present disclosure, by encrypting the preset data with the third derived key to obtain the second data, the security of the second message authentication code calculated using the second data can be improved, and it will not be easily obtained or tampered with, thereby improving the security of security verification using the first message authentication code and the second message authentication code.
[0122] This disclosure provides a data encryption method applied to a device, including:
[0123] The target data is encrypted using the first derived key generated by steps S101 to S104 of the key generation method in this embodiment of the present disclosure, to obtain encrypted data.
[0124] According to the technology of the embodiments of this disclosure, by performing key derivation processing on the first original key originally used to encrypt data, and using the first derived key obtained by key derivation as the encryption key to encrypt the target data, the complexity of the first derived key and the security of the key itself can be improved, avoiding the risk of the first original key being directly used and leaked, thereby improving the encryption security of the target data.
[0125] This disclosure provides a data decryption method, applied to a product, including:
[0126] The fifth derived key generated by steps S201 to S205 of the key generation method in this embodiment of the present disclosure is used to decrypt the encrypted data to obtain the target data.
[0127] The device can package the initial authentication code and encrypted data together and send them to the product. The product can also retrieve the initial authentication code and encrypted data from the device.
[0128] According to the technology of this disclosure, since both the first and second message authentication codes are generated based on a preset key pair, matching the first and second message authentication codes can determine whether the preset key pair used to generate the encryption key (first derived key) and the decryption key (fifth derived key) is consistent. Furthermore, it can be determined whether the third derived key generated based on the preset key pair can be used as the fifth derived key for decrypting encrypted data, because, assuming the preset key pair has not been tampered with, the resulting first and fifth derived keys are consistent. Simultaneously, by performing key derivation processing on the first original key originally used for decrypting encrypted data, and using the fifth derived key as the decryption key to decrypt the target data, the complexity of the fifth derived key can be increased. Furthermore, matching the first and second message authentication codes can enhance the security of the key itself, avoiding the risk of the first original key being directly used and leaked, thereby improving the decryption security of the target data. Using the first and fifth derived keys, which are derived and verified by the message authentication code, to encrypt and decrypt the target data significantly improves security compared to using the stored first and second original keys.
[0129] like Figure 3 As shown in the embodiments of this disclosure, a data processing method is provided, including:
[0130] Step S301: Calculate the first original key in the preset key pair using the preset key derivation algorithm to generate the first derived key for data encryption.
[0131] Step S302: Calculate the second original key in the preset key pair using the preset key derivation algorithm to generate the second derived key.
[0132] Step S303: Encrypt the preset data using the first derived key and encryption algorithm to generate the first data.
[0133] Step S304: Calculate the first data using the second derived key to generate the first message authentication code.
[0134] Step S305: Encrypt the target data using the first derived key to obtain encrypted data.
[0135] Step S306: Calculate the first original key in the preset key pair using the preset key derivation algorithm to generate the third derived key.
[0136] Step S307: Calculate the second original key in the preset key pair using the preset key derivation algorithm to generate the fourth derived key.
[0137] Step S308: Encrypt the preset data using the third derived key and encryption algorithm to generate the second data.
[0138] Step S309: Calculate the second data using the fourth derived key to generate the second message authentication code.
[0139] Step S310: Match the first message authentication code with the second message authentication code.
[0140] Step S311: If the second message authentication code is consistent with the first message authentication code, the third derived key is determined as the fifth derived key for data decryption.
[0141] Step S312: Decrypt the encrypted data using the fifth derived key to obtain the target data.
[0142] According to the technology of this disclosure, the target data is encrypted and decrypted using a first derived key and a fifth derived key, which are derived from the key and verified by a message authentication code. Compared with using a stored first original key and a second original key, the security is significantly improved. By performing key derivation processing on the first original key originally used to encrypt data, and using the first derived key obtained by key derivation as the encryption key to encrypt the target data, the complexity of the first derived key and the security of the key itself can be improved, avoiding the risk of the first original key being directly used and leaked. At the same time, the method of this disclosure does not require additional hardware implementation, thus not increasing hardware costs. Since both the first message authentication code and the second message authentication code are generated based on a preset key pair, matching the first message authentication code and the second message authentication code can determine whether the preset key pair used to generate the encryption key (first derived key) and the decryption key (fifth derived key) is consistent. Furthermore, it can be determined whether the third derived key generated based on the preset key pair can be used as the fifth derived key to decrypt encrypted data, because, if the preset key pair has not been tampered with, the obtained first derived key and fifth derived key are consistent. Meanwhile, by performing key derivation processing on the first original key originally used to decrypt encrypted data, and using the fifth derived key obtained from the key derivation as the decryption key to decrypt the target data, the complexity of the fifth derived key can be increased. Furthermore, by matching the first message authentication code and the second message authentication code, the security of the key itself can be improved, avoiding the risk of the first original key being directly used and leaked.
[0143] In one implementation, step S301: Calculating using the first original key in the preset key pair to generate a first derived key for data encryption includes:
[0144] Based on a preset random value and a preset number of iterations, a preset key derivation algorithm is used to calculate the first original key in the preset key pair to generate the first derived key.
[0145] In one implementation, step S302: Calculating the second original key in the preset key pair using a preset key derivation algorithm to generate a second derived key, including:
[0146] Based on a preset random value and a preset number of iterations, a preset key derivation algorithm is used to calculate the second original key in the preset key pair to generate a second derived key.
[0147] In one implementation, step S303: encrypting preset data using a first derived key and an encryption algorithm to generate first data includes:
[0148] Determine the preset data and initial vector.
[0149] Using the first derived key, encryption algorithm, and initial vector, the preset data is encrypted to generate the first data.
[0150] In one implementation, step S306: Calculating the first original key in the preset key pair using a preset key derivation algorithm to generate a third derived key, including:
[0151] Based on a preset random value and a preset number of iterations, a preset key derivation algorithm is used to calculate the first original key in the preset key pair to generate a third derived key.
[0152] In one implementation, step S307: Calculating the second original key in the preset key pair using a preset key derivation algorithm to generate a fourth derived key, including:
[0153] Based on a preset random value and a preset number of iterations, a preset key derivation algorithm is used to calculate the second original key in the preset key pair to generate a fourth derived key.
[0154] In one implementation, step S308: encrypting preset data using a third derived key and an encryption algorithm to generate second data includes:
[0155] Determine the preset data and initial vector;
[0156] Using a third derived key, an encryption algorithm, and an initialization vector, the preset data is encrypted to generate the second data.
[0157] In one example, such as Figure 4 As shown, the preset key pair is stored in a remote trust center (OTC). The first original key PSK1 and the second original key PSK2 are obtained from the remote trust center. (Device side)offline The offline encryption script uses a preset key derivation algorithm to derive PSK1 and PSK2 respectively, to obtain a new first derivation key SK1 and a second derivation key SK2. The preset key derivation algorithm is PBKDF2 algorithm, with 1024 iterations and a salt value of 48 bytes of random number. SK2 is used as the key for integrity verification of SK1. The verification method is to encrypt a preset data (Plain
[16] = 0x00, 0x11…0xFF) using SK1 to obtain a 16-byte ciphertext array Cipher1
[16] (first data). The encryption algorithm can be AES-CBC algorithm, and the initial vector data is a 16-byte all-zero array IV
[16] = {0x00}. The 16-byte first message authentication code (MAC) is calculated using SK2 on the encrypted first data. The target data and the first message authentication code are encrypted using the first derivation key SK1 to obtain encrypted data. Furthermore, the product side uses a preset key derivation algorithm to derive PSK1 and PSK2 respectively, to obtain a new third derivation key SK3 and a fourth derivation key SK4. Among them, the preset key derivation algorithm is selected as PBKDF2 algorithm, the number of iterations is 1024, and the salt value is a random number of 48 bytes. Among them, SK4 is used as the key for integrity verification of SK3. The verification method is to use SK3 to encrypt a preset data (Plain
[16] = 0x00, 0x11…0xFF) to obtain a 16-byte ciphertext array Cipher1
[16] (second data), where the encryption algorithm can be selected as AES-CBC algorithm, and the initial vector data is a 16-byte all-zero array IV
[16] = {0x00}. SK4 is used to calculate a 16-byte second message authentication code (MAC) on the encrypted second data. The second message authentication code and the first message authentication code are used for verification. If the two are consistent, SK3 is used as the fifth derivation key for decrypting the encrypted data, that is, the first derivation key and the fifth derivation key are used as the key pair for encrypting and decrypting the encrypted data. The fifth derived key is used to decrypt the encrypted data obtained from the device to obtain the target data.
[0158] like Figure 5 As shown, this disclosure provides an apparatus for generating a key, including:
[0159] The first generation module 510 is used to calculate the first original key in the preset key pair using a preset key derivation algorithm to generate a first derived key for data encryption.
[0160] The second generation module 520 is used to calculate the second original key in the preset key pair using a preset key derivation algorithm to generate a second derived key.
[0161] The third generation module 530 is used to encrypt preset data using the first derived key and an encryption algorithm to generate the first data.
[0162] The fourth generation module 540 is used to calculate the first data using the second derived key to generate the first message authentication code.
[0163] In one implementation, the first generation module 510 is used to:
[0164] Based on a preset random value and a preset number of iterations, a preset key derivation algorithm is used to calculate the first original key in the preset key pair to generate the first derived key.
[0165] In one implementation, the second generation module 520 is used for:
[0166] Based on a preset random value and a preset number of iterations, a preset key derivation algorithm is used to calculate the second original key in the preset key pair to generate a second derived key.
[0167] In one implementation, the third generation module 530 is used for:
[0168] Determine the preset data and initial vector.
[0169] Using the first derived key, encryption algorithm, and initial vector, the preset data is encrypted to generate the first data.
[0170] like Figure 6 As shown, this disclosure provides an apparatus for generating a key, including:
[0171] The fifth generation module 610 is used to calculate the first original key in the preset key pair using a preset key derivation algorithm to generate the third derived key.
[0172] The sixth generation module 620 is used to calculate the second original key in the preset key pair using a preset key derivation algorithm to generate the fourth derived key.
[0173] The seventh generation module 630 is used to encrypt the preset data using the third derived key and encryption algorithm to generate the second data.
[0174] The eighth generation module 640 is used to calculate the second data using the fourth derived key to generate a second message authentication code.
[0175] The determining module 650 is used to determine the third derived key as the fifth derived key for data decryption when the second message authentication code is consistent with the first message authentication code. The first message authentication code is generated according to steps S101 to S104 in the key generation method of any embodiment of the present disclosure.
[0176] In one implementation, the fifth generation module 610 is used to:
[0177] Based on a preset random value and a preset number of iterations, a preset key derivation algorithm is used to calculate the first original key in the preset key pair to generate a third derived key.
[0178] In one implementation, the sixth generation module 620 is used for:
[0179] Based on a preset random value and a preset number of iterations, a preset key derivation algorithm is used to calculate the second original key in the preset key pair to generate a fourth derived key.
[0180] In one implementation, the seventh generation module 630 is used for:
[0181] Determine the preset data and initial vector;
[0182] Using a third derived key, an encryption algorithm, and an initialization vector, the preset data is encrypted to generate the second data.
[0183] This disclosure provides an apparatus for generating a key, comprising:
[0184] The encryption module is used to encrypt the target data using the first derived key generated by the method in steps S101 to S104 of the key generation method of the present disclosure, so as to obtain encrypted data.
[0185] This disclosure provides an apparatus for generating a key, comprising:
[0186] The decryption module is used to decrypt encrypted data using the fifth derived key generated by the method in steps S201 to S205 of the key generation method in the embodiments of this disclosure.
[0187] This disclosure provides a data processing apparatus, including:
[0188] The first key derivation module is used to calculate the first original key in the preset key pair using a preset key derivation algorithm to generate a first derived key for data encryption.
[0189] The second key derivation module is used to calculate the second original key in the preset key pair using a preset key derivation algorithm to generate the second derived key.
[0190] The first encryption module is used to encrypt preset data using a first derived key and an encryption algorithm to generate the first data.
[0191] The first calculation module is used to calculate the first data using the second derived key to generate the first message authentication code.
[0192] The second encryption module is used to encrypt the target data using the first derived key to obtain encrypted data.
[0193] The third key derivation module is used to calculate the first original key in the preset key pair using a preset key derivation algorithm to generate the third derived key.
[0194] The fourth key derivation module is used to calculate the second original key in the preset key pair using a preset key derivation algorithm to generate the fourth derived key.
[0195] The second encryption module is used to encrypt the preset data using the third derived key and encryption algorithm to generate the second data.
[0196] The second calculation module is used to calculate the second data using the fourth derived key to generate the second message authentication code.
[0197] The matching module is used to match the first message authentication code with the second message authentication code.
[0198] The determination module is used to determine the third derived key as the fifth derived key for data decryption when the second message authentication code is consistent with the first message authentication code.
[0199] The decryption module is used to decrypt encrypted data using the fifth derived key to obtain the target data.
[0200] For a description of the specific functions and examples of each module and submodule of the apparatus in the embodiments of this disclosure, please refer to the relevant descriptions of the corresponding steps in the above method embodiments, which will not be repeated here.
[0201] The acquisition, storage, and application of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.
[0202] Figure 7 This is a structural block diagram of an electronic device according to an embodiment of the present disclosure. Figure 7 As shown, the electronic device includes a memory 710 and a processor 720. The memory 710 stores a computer program that can run on the processor 720. The number of memories 710 and processors 720 can be one or more. The memory 710 can store one or more computer programs, which, when executed by the electronic device, cause the electronic device to perform the methods provided in the above-described method embodiments. The electronic device may also include a communication interface 30 for communicating with external devices and performing data exchange and transmission.
[0203] If the memory 710, processor 720, and communication interface 730 are implemented independently, they can be interconnected via a bus to communicate with each other. This bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 7 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.
[0204] Optionally, in a specific implementation, if the memory 710, processor 720, and communication interface 730 are integrated on a single chip, then the memory 710, processor 720, and communication interface 730 can communicate with each other through an internal interface.
[0205] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field-Programmable Gate Arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. General-purpose processors can be microprocessors or any conventional processor. It is worth noting that the processor can be a processor supporting Advanced Reduced Instruction Set Machines (ARM) architecture.
[0206] Further, optionally, the aforementioned memory may include read-only memory and random access memory, and may also include non-volatile random access memory. The memory may be volatile or non-volatile, or may include both. Non-volatile memory may include read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may include random access memory (RAM), which serves as an external cache. Many forms of RAM are available by way of example, but not limitation. Examples include Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate Synchronous DRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct RAMBUS RAM (DR RAM).
[0207] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this disclosure is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line, DSL) or wireless (e.g., infrared, Bluetooth, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access, or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., Digital Versatile Discs (DVDs)), or semiconductor media (e.g., Solid State Disks (SSDs)). It is worth noting that the computer-readable storage media mentioned in this disclosure can be non-volatile storage media; in other words, they can be non-transient storage media.
[0208] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.
[0209] In the description of the embodiments of this disclosure, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this disclosure. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of those different embodiments or examples.
[0210] In the description of the embodiments disclosed herein, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. The "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone.
[0211] In the description of embodiments of this disclosure, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of embodiments of this disclosure, unless otherwise stated, "a plurality of" means two or more.
[0212] The above description is merely an exemplary embodiment of this disclosure and is not intended to limit this disclosure. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the protection scope of this disclosure.
Claims
1. A method for generating a key, comprising: The first original key in the preset key pair is calculated using a preset key derivation algorithm to generate the third derived key; The second original key in the preset key pair is calculated using the preset key derivation algorithm to generate a fourth derived key; The preset data is encrypted using the third derived key and encryption algorithm to generate the second data, wherein the preset data is a fixed number of bytes of preset fixed data; The second data is calculated using the fourth derived key to generate a second message authentication code; and If it is determined that the second message authentication code is consistent with the first message authentication code, the third derived key is determined as the fifth derived key used for data decryption; The method for generating the first message authentication code includes: The first original key in the preset key pair is calculated using the preset key derivation algorithm to generate a first derived key, which is used to encrypt the target data. The second derived key is generated by calculating the second original key in the preset key pair using the preset key derivation algorithm. The preset data is encrypted using the first derived key and the encryption algorithm to generate first data; and The first data is calculated using the second derived key to generate the first message authentication code.
2. The method according to claim 1, wherein, The third derived key is generated by calculating the first original key in the preset key pair using a preset key derivation algorithm, including: Based on a preset random value and a preset number of iterations, a preset key derivation algorithm is used to calculate the first original key in the preset key pair to generate a third derived key. and / or Specifically, the fourth derived key is generated by calculating the second original key in the preset key pair using the preset key derivation algorithm, including: Based on a preset random value and a preset number of iterations, the preset key derivation algorithm is used to calculate the second original key in the preset key pair to generate a fourth derived key.
3. The method according to claim 1, wherein, The preset data is encrypted using the third derived key and encryption algorithm to generate second data, including: Determine the preset data and initial vector; The preset data is encrypted using the third derived key, the encryption algorithm, and the initial vector to generate the second data.
4. A data decryption method, comprising: Using the fifth derived key generated by the method described in any one of claims 1 to 3, the encrypted data is decrypted to obtain the target data.
5. A data processing method, comprising: A first derived key is generated by calculating the first original key in the preset key pair using a preset key derivation algorithm. The first derived key is used to encrypt the target data. The second derived key is generated by calculating the second original key in the preset key pair using the preset key derivation algorithm. The first derived key and encryption algorithm are used to encrypt the preset data to generate the first data, wherein the preset data is a fixed number of bytes of preset fixed data; The first data is calculated using the second derived key to generate a first message authentication code; The target data is encrypted using the first derived key to obtain encrypted data; The first original key in the preset key pair is calculated using the preset key derivation algorithm to generate a third derived key; The second original key in the preset key pair is calculated using the preset key derivation algorithm to generate a fourth derived key; The preset data is encrypted using the third derived key and the encryption algorithm to generate second data; The second data is calculated using the fourth derived key to generate a second message authentication code; Match the first message authentication code with the second message authentication code; If the second message authentication code is determined to be consistent with the first message authentication code, the third derived key is determined as the fifth derived key used for data decryption; and The encrypted data is decrypted using the fifth derived key to obtain the target data.
6. An apparatus for generating a key, comprising: The fifth generation module is used to calculate the first original key in the preset key pair using a preset key derivation algorithm to generate the third derived key. The sixth generation module is used to calculate the second original key in the preset key pair using the preset key derivation algorithm to generate the fourth derived key; The seventh generation module is used to encrypt the preset data using the third derived key and encryption algorithm to generate the second data, wherein the preset data is a fixed number of bytes of preset fixed data; The eighth generation module is used to calculate the second data using the fourth derived key to generate a second message authentication code; and The determining module is used to determine the third derived key as the fifth derived key for data decryption when it is determined that the second message authentication code is consistent with the first message authentication code; The method for generating the first message authentication code includes: The first original key in the preset key pair is calculated using the preset key derivation algorithm to generate a first derived key, which is used to encrypt the target data. The second derived key is generated by calculating the second original key in the preset key pair using the preset key derivation algorithm. The preset data is encrypted using the first derived key and the encryption algorithm to generate first data; and The first data is calculated using the second derived key to generate the first message authentication code.
7. A data decryption apparatus, comprising: The decryption module is used to decrypt encrypted data using the fifth derived key generated by the device described in claim 6 to obtain the target data.
8. An electronic device, comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 5.
9. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1 to 5.
10. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 5.