Method and device for realizing online encryption of three-dimensional model software based on AES-GCM

Abstract

The invention discloses a method and a device for realizing online encryption of three-dimensional model software based on AES-GCM. The method comprises the following steps: firstly, acquiring front-end three-dimensional model software data, then formatting, and generating an initial fingerprint code; then, the initial fingerprint code is encrypted by using an AES key based on AES-GCM and the initialization vector IV, and an encrypted fingerprint code and an authentication tag are generated; the AES secret key is obtained through a crypto.subtle.generateKey packaging function, and the AES secret key is obtained through the crypto.subtle.generateKey packaging function; the AES key, the initialization vector IV and the authentication tag are all stored in a local file at the front end; calling an AES key, an initialization vector IV and an authentication tag from a local file, and decrypting the encrypted fingerprint code to obtain a decrypted fingerprint code; and finally, comparing the decrypted fingerprint code with the initial fingerprint code to obtain authorization of the front-end three-dimensional model software data. According to the method, safe AES-GCM encryption and decryption can be carried out completely based on a front end without a rear end, and the data security of three-dimensional model software is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a method and device for implementing online encryption of three-dimensional model software based on AES-GCM. Background Art

[0002] With the widespread use of encryption technology and the increase in data privacy and security requirements, encrypted traffic has exploded. According to Google's latest transparency report, 100% of the top 100 websites on the Internet support HTTPS encryption, and 97% of them use HTTPS encryption by default. Although encryption technology protects user privacy, the abuse of technology has also profoundly changed the landscape of network security, making it easier for online fraud and illegal online transactions, while also making it easier for hackers to evade detection of ransomware, phishing and data leaks. According to an Internet research report by WatchGuard, 91.5% of malware was detected using the HTTPS protocol for encrypted transmission. This means that companies that do not have a detection system to decrypt and scan malware in HTTPS traffic will ignore more than 90% of malware threats. Another research report recently released by Zscaler Security Threat Lab also claimed that as of October 2023, the number of global ransomware attacks increased by 37.75% year-on-year, and the effective attack load of ransomware surged by 57.50%.

[0003] However, in the prior art, an encryption algorithm is used in combination with back-end encryption.

[0004] On the one hand, the encryption algorithm used in the prior art has the following shortcomings:

[0005] 1. Lower security: Some older encryption algorithms, such as DES, are no longer considered secure and are vulnerable to various attacks, such as exhaustive and differential attacks. Other algorithms may also have security weaknesses.

[0006] 2. Slow encryption speed: Some encryption algorithms, such as RSA, take a long time for encryption and decryption operations, especially for encryption operations on large amounts of data. This may affect the performance and response time of the system.

[0007] 3. Longer key length: Some encryption algorithms, such as RSA, require longer key lengths to provide adequate security. This may lead to complexities in key management and transmission.

[0008] 4. Not applicable to specific application scenarios: Some encryption algorithms may not be applicable in specific application scenarios. For example, for scenarios that require high-speed data transmission and real-time encryption, stream cipher algorithms may be more suitable, while asymmetric encryption algorithms may be more suitable for scenarios such as authentication and key exchange.

[0009] 5. Lack of standardization and broad support: Some encryption algorithms currently lack broad standardization and support. This may lead to problems in interoperability and compatibility between different systems and platforms.

[0010] On the other hand, the backend encryption used in the prior art has the following disadvantages:

[0011] 1. The back-end encryption will need to be stored in the database for preservation, and the database attack by hackers can easily lead to data loss.

[0012] 2. Backend encryption often takes more time, and the encryption time for the backend is too long and is often difficult to optimize. There are often fewer encryption methods for online users. Summary of the invention

[0013] The technical problem to be solved by the present invention is to address the above-mentioned deficiencies in the prior art and propose a method and device for implementing online encryption of 3D model software based on AES-GCM. The method can perform secure AES-GCM encryption and decryption completely based on the front end without the back end, thereby ensuring the data security of the 3D model software.

[0014] In a first aspect, the present invention provides a method for implementing online encryption of three-dimensional model software based on AES-GCM, the method comprising the following steps:

[0015] Step S1: Acquire 3D point cloud data or 3D data information in the front-end 3D model software data;

[0016] Step S2: obtaining front-end data to be encrypted according to the three-dimensional point cloud data or three-dimensional data information;

[0017] Step S3: generating an initial fingerprint code according to the front-end data to be encrypted; the initial fingerprint code is a unique identifier corresponding to the front-end data to be encrypted;

[0018] Step S4: using an AES key and an initialization vector IV based on AES-GCM to encrypt the initial fingerprint code, generate an encrypted fingerprint code and an authentication tag, thereby completing the online encryption of the three-dimensional model software based on AES-GCM;

[0019] The AES key is obtained by encapsulating the crypto.subtle.generateKey function.

[0020] Further, the AES key, the initialization vector IV, and the authentication tag are all stored in a local file of the front end;

[0021] After step S4, the method further includes:

[0022] Step S5: calling the AES key, the initialization vector IV, and the authentication tag from the local file, decrypting the encrypted fingerprint code to obtain a decrypted fingerprint code;

[0023] Step S6: Compare the decrypted fingerprint code with the initial fingerprint code to obtain the authorization of the front-end 3D model software data, thereby completing the online decryption of the 3D model software based on AES-GCM.

[0024] Furthermore, the AES key, the process of obtaining it specifically includes the following steps:

[0025] Set the key length of AES-GCM to 256 bits;

[0026] Call the crypto.subtle.generateKey encapsulation function to generate an AES key;

[0027] The initialization vector IV is obtained by the following steps:

[0028] Set the initialization vector IV length;

[0029] Call the crypto.getRandomValues ​​function to generate the initialization vector IV.

[0030] Furthermore, the step S2 specifically includes the following steps:

[0031] Performing data cleaning on the three-dimensional point cloud data or three-dimensional data information;

[0032] Normalizing the cleaned 3D point cloud data or 3D data information to the same coordinate system to obtain coordinate data;

[0033] Determine the storage format of the front-end 3D model software data;

[0034] The coordinate data is formatted and stored according to the storage format, thereby obtaining the front-end data to be encrypted.

[0035] Furthermore, in step S6, the decrypted fingerprint code is compared with the initial fingerprint code to obtain the authorization of the front-end 3D model software data, which specifically includes the following steps:

[0036] Compare the decrypted fingerprint code with the original initial fingerprint code by string or hash value;

[0037] If the decrypted fingerprint code string is the same as the original initial fingerprint code string, or the decrypted fingerprint code hash code is the same as the original initial fingerprint code hash code, the authorization is successful, that is, the permission to access or operate the front-end three-dimensional model data is obtained; if not, the authorization fails, that is, the permission to access or operate the front-end three-dimensional model data cannot be obtained.

[0038] In a second aspect, the present invention provides a device for implementing online encryption of three-dimensional model software based on AES-GCM, the device comprising:

[0039] An acquisition unit, used to acquire 3D point cloud data or 3D data information in the front-end 3D model software data;

[0040] A first processing unit, connected to the acquisition unit, for formatting the three-dimensional point cloud data or three-dimensional data information to obtain front-end data to be encrypted;

[0041] a second processing unit, connected to the first processing unit, and configured to generate an initial fingerprint code, wherein the initial fingerprint code is a unique identifier corresponding to the front-end data to be encrypted;

[0042] An encryption unit connected to the second processing unit, used to encrypt the initial fingerprint code using an AES key and an initialization vector IV based on AES-GCM, generate an encrypted fingerprint code and an authentication tag, thereby completing the online encryption of the three-dimensional model software based on AES-GCM;

[0043] The AES key is obtained by encapsulating the crypto.subtle.generateKey function.

[0044] The device also includes:

[0045] A storage unit, connected to the encryption unit, for storing the AES key, the initialization vector IV, and the authentication tag in a local file of the front end;

[0046] A decryption unit connected to the storage unit, used to call the AES key, the initialization vector IV, and the authentication tag from the local file, decrypt the encrypted fingerprint code, and obtain a decrypted fingerprint code;

[0047] The comparison unit is connected to the decryption unit and is used to compare the decrypted fingerprint code with the initial fingerprint code to obtain the authorization of the front-end 3D model software data, thereby completing the online decryption of the 3D model software based on AES-GCM.

[0048] Further, the device also includes a first generating unit and a second generating unit;

[0049] The first generating unit is connected to the encryption unit and is used to generate an AES key;

[0050] The first generating unit comprises:

[0051] The first setting module is used to set the key length of AES-GCM to 256 bits;

[0052] A first generating module, connected to the first setting module, for calling the crypto.subtle.generateKey encapsulation function to generate an AES key;

[0053] The second generating unit is connected to the encryption unit and is used to generate an initialization vector IV;

[0054] The second generating unit comprises:

[0055] The second setting module is used to set the length of the initialization vector IV;

[0056] The second generating module is connected to the second setting module and is used to call the crypto.getRandomValues ​​function to generate an initialization vector IV.

[0057] Furthermore, the first processing unit includes:

[0058] A cleaning module, used for cleaning the three-dimensional point cloud data or three-dimensional data information;

[0059] A normalization module, connected to the cleaning module, for normalizing the cleaned three-dimensional point cloud data or three-dimensional data information to the same coordinate system to obtain coordinate data;

[0060] A determination module, used to determine the storage format of the front-end 3D model software data;

[0061] The storage module is connected to the normalization module and the determination module respectively, and is used to format and store the coordinate data according to the storage format, that is, to obtain the front-end data to be encrypted.

[0062] Furthermore, the comparison unit comprises:

[0063] A comparison module, used for comparing the decrypted fingerprint code with the original initial fingerprint code by character string or hash value;

[0064] An authorization module, connected to the comparison module, and configured to perform authorization according to the comparison result of the comparison module;

[0065] If the decrypted fingerprint string is the same as the original initial fingerprint string, or the decrypted fingerprint hash code is the same as the original initial fingerprint hash code, the authorization is successful, that is, the permission to access or operate the front-end 3D model data is obtained; if not,

[0066] The authorization fails, that is, the permission to access or operate the front-end 3D model data cannot be obtained.

[0067] Beneficial effects of the present invention:

[0068] 1. The AES key of the present invention is obtained through the crypto.subtle.generateKey encapsulation function, and can perform secure AES-GCM encryption and decryption completely based on the front end without the back end, thereby ensuring the data security of the three-dimensional model software.

[0069] 2. The present invention adopts AES-GCM encryption mode, which combines encryption and integrity verification of data and can effectively prevent data from being tampered with.

[0070] 3. The encryption method of the present invention is completely based on the front end and does not need to rely on the back end server, thus reducing the complexity of the system architecture.

[0071] 4. The 3D model software data in the present invention will not be sent to the server for processing, which can protect user privacy and sensitive data to a certain extent.

[0072] 5. All calculations of the present invention are performed on local devices, which reduces the delay of data transmission, makes the encryption and decryption process very fast, and improves the user experience.

[0073] 6. The encryption and decryption process in the present invention does not require the deployment of a complex backend architecture, which reduces the requirements for server performance and improves the portability of the three-dimensional model software. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Figure 1 A schematic diagram of a method for implementing online encryption and decryption of three-dimensional model software based on AES-GCM in an embodiment of the present invention;

[0075] Figure 2 AES encryption algorithm schematic diagram in an embodiment of the present invention;

[0076] Figure 3 3D model software system architecture diagram in an embodiment of the present invention;

[0077] Figure 4 Schematic diagram of the specific encryption process of AES-GCM in an embodiment of the present invention;

[0078] Figure 5Schematic diagram of a device for implementing online encryption and decryption of three-dimensional model software based on AES-GCM in an embodiment of the present invention;

[0079] Among them, the figure numbers are: 10, acquisition unit, 20, first processing unit, 30, second processing unit, 40, encryption unit, 50, storage unit, 60, decryption unit, 70, comparison unit. DETAILED DESCRIPTION

[0080] In order to enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0081] It should be understood that the specific embodiments and drawings described herein are only used to explain the present invention rather than to limit the present invention.

[0082] It can be understood that, in the absence of conflict, the various embodiments of the present invention and the various features in the embodiments can be combined with each other.

[0083] It can be understood that, for the convenience of description, the drawings of the present invention only show the parts related to the present invention, while the parts irrelevant to the present invention are not shown in the drawings.

[0084] It can be understood that each unit and module involved in the embodiments of the present invention may correspond to only one physical structure, or may be composed of multiple physical structures, or multiple units and modules may be integrated into one physical structure.

[0085] It can be understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of the present invention may occur in an order different from that marked in the drawings.

[0086] It is understood that the flowcharts and block diagrams of the present invention illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to the embodiments of the present invention. Each box in the flowchart or block diagram may represent a unit, module, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented by a hardware-based system that implements the specified functions, or by a combination of hardware and computer instructions.

[0087] It can be understood that the units and modules involved in the embodiments of the present invention can be implemented by software or hardware. For example, the units and modules can be located in a processor.

[0088] Embodiment 1:

[0089] like Figure 1As shown, this embodiment provides a method for implementing online encryption of three-dimensional model software based on AES-GCM, and the method includes the following steps:

[0090] Step S1: Obtain three-dimensional point cloud data or three-dimensional data information in the front-end three-dimensional model software data.

[0091] like Figure 3 As shown, the 3D model encryption software in this embodiment includes encryption and decryption functions and system introduction functions, specifically including:

[0092] A. Software Overview

[0093] The 3D model encryption software is designed to protect the user's 3D model data from unauthorized access or theft. By providing encryption and decryption functions, any user can safely store and transfer 3D model files. In addition, the software also provides relevant system introductions to help users understand the software's functions and usage methods.

[0094] B. Functional modules

[0095] B.1. Encryption and decryption functions

[0096] B.1.1 Cryptographic Module

[0097] Function: Users can select the 3D model file to be encrypted and encrypt the file using the specified encryption algorithm.

[0098] Implementation ideas:

[0099] Supports multiple encryption algorithms (such as AES, RSA).

[0100] Provides a user-friendly interface that allows users to select a file and enter a key.

[0101] After the file is encrypted, a new encrypted file is generated and saved to the specified location.

[0102] B.1.2 Decryption Module

[0103] Function: Users can select the encrypted 3D model file and enter the correct password to decrypt it.

[0104] Implementation ideas:

[0105] Through the file selection function, users can select the files that need to be decrypted.

[0106] After entering the password, the system verifies the password and decrypts the file, returning the original 3D model.

[0107] B.1.3 Upload Module

[0108] Function: Support users to upload encrypted files to the cloud or designated server.

[0109] Implementation ideas:

[0110] Provides file upload function to send encrypted files to the server via the network.

[0111] Shows the upload progress and ensures that the file is transferred correctly.

[0112] B.1.4 Password Generation

[0113] Functionality: Users can generate strong passwords for encryption.

[0114] Implementation ideas:

[0115] Provides a password generator that uses a random algorithm to generate strong passwords; you can set the password length and character combination (letters, numbers, symbols).

[0116] The generated password can be copied to the clipboard for easy use.

[0117] B.1.5 Password Display

[0118] Function: Safely display the password entered by the user for easy confirmation and copying.

[0119] Implementation ideas:

[0120] Use the Show / Hide button to visualize the passwords entered by users, ensuring users can manage their passwords securely and conveniently.

[0121] C. System Introduction Function

[0122] C.1 Software Model

[0123] Function: Display the overall architecture and functional modules of the software.

[0124] Implementation ideas:

[0125] Use UML diagrams or flow charts to display the various functional modules of the system and their relationships.

[0126] Brief text introduces the functions of each module to enhance user understanding.

[0127] C.2 Related Projects

[0128] Function: Introduce other projects or products related to the software.

[0129] Implementation ideas:

[0130] Lists open source projects, commercial solutions, and community resources related to 3D model encryption.

[0131] Provide links and brief descriptions to help users learn more.

[0132] C.3 Open Source Introduction

[0133] Function: Explain the open source background and relevant licensing information of the software.

[0134] Implementation ideas:

[0135] Briefly introduce the open source license of the software (such as MIT, GPL, etc.) and how to obtain the source code.

[0136] Encourage developers to contribute and provide ways to participate and contact information.

[0137] C.4 Encryption Algorithm

[0138] Function: List the encryption algorithms used by the software and their basic introduction.

[0139] Implementation ideas:

[0140] Provides detailed information about supported encryption algorithms such as AES, RSA, ChaCha20, etc.

[0141] Explain the advantages and disadvantages of each algorithm and its applicable scenarios to enhance users' understanding of encryption methods.

[0142] D. User interface design

[0143] D.1 Main interface: Contains the navigation bar, where users can access the encryption and decryption module and the system introduction module.

[0144] D.2 Encryption and decryption interface: concise and clear, including file selection, password input and operation buttons, using clear prompt information.

[0145] D.3 System Introduction Interface: It has clear sub-items, allowing users to quickly find the information they need, and is equipped with icons and visual elements to improve readability.

[0146] Step S2: formatting the three-dimensional point cloud data or three-dimensional data information to obtain front-end data to be encrypted.

[0147] The step S2 specifically includes the following steps:

[0148] Performing data cleaning on the three-dimensional point cloud data or three-dimensional data information;

[0149] Normalizing the cleaned 3D point cloud data or 3D data information to the same coordinate system to obtain coordinate data;

[0150] Determine the storage format of the front-end 3D model software data;

[0151] The coordinate data is formatted and stored according to the storage format, thereby obtaining the front-end data to be encrypted.

[0152] Step S3: Generate an initial fingerprint code, where the initial fingerprint code is a unique identifier corresponding to the front-end data to be encrypted.

[0153] Step S4: Use the AES key and initialization vector IV based on AES-GCM to encrypt the initial fingerprint code to generate an encrypted fingerprint code and an authentication tag. The AES key is obtained through the crypto.subtle.generateKey encapsulation function; the AES key, the initialization vector IV, and the authentication tag are all stored in the local file of the front end.

[0154] crypto.subtle.generateKey is part of the WebCryptoAPI.

[0155] WebCryptoAPI is a JavaScript API for performing encryption and decryption operations in web browsers. It provides a feature-rich set of cryptographic primitives, including symmetric encryption, asymmetric encryption, hash functions, message authentication codes, and random number generation. The main goal of WebCryptoAPI is to provide a standardized way to perform secure cryptographic operations to protect sensitive data in web applications. Its design goal is to provide high performance and security in a browser environment, and allow developers to use modern cryptographic algorithms to protect data. By using WebCryptoAPI, developers can perform a variety of cryptographic operations in web browsers without relying on third-party libraries or plug-ins. This enables developers to more easily build secure web applications and protect users' sensitive data.

[0156] AES stands for Advanced Encryption Standard, also known as Rijndael encryption, and is a block encryption standard adopted by the U.S. federal government. This standard is used to replace the original DES, has been analyzed by many parties and is widely used around the world. After a five-year selection process, the Advanced Encryption Standard was published by the National Institute of Standards and Technology (NIST) in FIPS PUB 197 on November 26, 2001, and became an effective standard on May 26, 2002. In 2006, the Advanced Encryption Standard has become one of the most popular algorithms in symmetric key encryption.

[0157] AES supports three key lengths: 128 bits, 192 bits, and 256 bits. This embodiment uses 256 bits.

[0158] As a specific implementation method, Figure 2 As shown, the AES key, the process of obtaining it specifically includes the following steps:

[0159] Set the key length of AES-GCM to 256 bits;

[0160] Call the crypto.subtle.generateKey encapsulation function to generate an AES key.

[0161] The AES algorithm mainly has four operations, namely the key addition layer (also called round key addition, English Add RoundKey), byte substitution layer (SubByte), row shift layer (Shift Rows), and column mixing layer (Mix Column). The plaintext x and key k are both composed of 16 bytes of data. The key also supports 192 bits and 256 bits in length. It is arranged from top to bottom and from left to right in the order of bytes. The encrypted ciphertext is also read in this order, which is equivalent to restoring the array to the appearance of a string, and then decrypting it as a 4*4 array. The AES algorithm also performs a separate round key addition process before the round processing begins.

[0162] As a specific implementation, the initialization vector IV is obtained by the following steps:

[0163] Set the initialization vector IV length;

[0164] Call the crypto.getRandomValues ​​function to generate the initialization vector IV.

[0165] The front end of this embodiment is implemented based on HTML, CSS and JavaScript. HTML, CSS and JavaScript are referred to as the three major components of the front end and are the basic technologies for front-end development. These three technologies work together to enable web pages to display rich content, beautiful styles and good interactive experience. HTML provides the structure and content of the web page, CSS is responsible for the layout and appearance of the web page, and JavaScript is responsible for realizing the interaction and dynamic effects of the web page. By flexibly using these three technologies, powerful and user-friendly web applications can be created.

[0166] in:

[0167] (1) HTML: HTML (Hypertext Markup Language) is a markup language used to describe the structure and content of a web page. It consists of a series of tags that can be used to define elements such as the title, paragraphs, images, and links of a web page.

[0168] (2) CSS: CSS (Cascading Style Sheets) is a style sheet language used to describe the layout and appearance of a web page. Through CSS, you can control the style of each element in a web page, such as font, color, size, margin, background, etc.

[0169] (3) JavaScript: JavaScript is a scripting language used to implement interactive and dynamic effects on web pages. It can operate elements in a web page, respond to user operations, change the content and style of the page, and implement some complex functions such as form validation, animation effects, data interaction, etc.

[0170] The specific encryption process is as follows:

[0171] (1) Divide the plaintext of the point cloud block into blocks of fixed length (128 bits);

[0172] (2) Encrypt each point cloud block;

[0173] (3) Use the key and IV as input and encrypt using the AES-256 algorithm;

[0174] (4) Perform an XOR operation on the encryption result and the serial number of the point cloud block to prevent replay attacks;

[0175] (5) XOR the XOR result with the GCM authentication tag to ensure data integrity and output the encrypted block and authentication tag.

[0176] Step S5: calling the AES key, the initialization vector IV, and the authentication tag from the local file, decrypting the encrypted fingerprint code, and obtaining a decrypted fingerprint code.

[0177] The decryption process is as follows:

[0178] (1) Divide the ciphertext into blocks of fixed length (128 bits);

[0179] (2) Decrypt each block;

[0180] (3) Using the key and IV as input, decrypt through the AES-256 algorithm;

[0181] (4) Perform an XOR operation on the decryption result and the block number to restore the original data;

[0182] (5) XOR the XOR result with the GCM authentication tag to verify the integrity of the data. If the authentication tag is verified, the decrypted block is output.

[0183] Step S6: Compare the decrypted fingerprint code with the initial fingerprint code to obtain the authorization of the front-end 3D model software data, thereby completing the online encryption and decryption of the 3D model software based on AES-GCM.

[0184] In step S6, the decrypted fingerprint code is compared with the initial fingerprint code to obtain the authorization of the front-end 3D model software data, which specifically includes the following steps:

[0185] Compare the decrypted fingerprint code with the original initial fingerprint code by string or hash value;

[0186] If the decrypted fingerprint code string is the same as the original initial fingerprint code string, or the decrypted fingerprint code hash code is the same as the original initial fingerprint code hash code, the authorization is successful, that is, the permission to access or operate the front-end three-dimensional model data is obtained; if not, the authorization fails, that is, the permission to access or operate the front-end three-dimensional model data cannot be obtained.

[0187] Step S7: display the web page.

[0188] The web page display specifically includes the following steps:

[0189] The point cloud blocks are stitched and connected.

[0190] Transmit it on a web page to show its effect.

[0191] like Figure 4 As shown in Figure 1, AES-GCM (AES-Galois / Counter Mode) is an encryption mode that combines symmetric encryption and message authentication. Figure 4 As shown, the process includes:

[0192] 1. Key Expansion

[0193] Unexpanded Key: The base key length of the AES algorithm can be 128, 192 or 256 bits. We first have an unexpanded key.

[0194] Key Expander: Use a key expansion algorithm (Key Schedule) to expand the key into multiple round keys (Round Keys), and use one round key for each round in the encryption process. This process is usually achieved by dividing the original key into several parts and then using transformations (such as circular left shift and S-Box substitution) to generate new keys.

[0195] Expanded Key: An expanded key set, including multiple round keys.

[0196] 2. Initial State

[0197] AddRoundKey: XOR the first round key of the extended key with the plaintext to obtain the initial state value. The specific operation is as follows:

[0198] State=Plaintext⊕Round Key

[0199] 3. Main Encryption Rounds

[0200] The main encryption process of AES consists of multiple rounds (the number of rounds depends on the key length). For a 128-bit key, there are usually 10 rounds; 192-bit is 12 rounds, and 256-bit is 14 rounds. Each round of processing includes the following steps:

[0201] Round Operations

[0202] SubBytes: Use S-Box for byte replacement. Each byte is replaced by a lookup table to enhance nonlinear characteristics.

[0203] ShiftRows: Circularly shift the rows of the state matrix, leaving the first row unchanged, shifting the second row left by 1 unit, the third row left by 2 units, and the fourth row left by 3 units to change the arrangement of bytes.

[0204] MixColumns: Linearly transform each column of the state to enhance diffusion. The four bytes of each column are combined through a specific polynomial, relying on the mathematical properties of GF(2^8).

[0205] AddRoundKey: XOR the current state with the corresponding round key.

[0206] 4. Final Round

[0207] In the final round, only the first three steps are performed:

[0208] SubBytes: Byte replacement.

[0209] ShiftRows: Row shift.

[0210] AddRoundKey: XOR operation with the last round key.

[0211] In this way, the final output state becomes ciphertext.

[0212] 5. Counter Mode and Authentication Data

[0213] GCM-specific steps:

[0214] AES-GCM also uses the counter mode (CTR) to generate a key stream for encryption. The counter mode generates a pseudo-random number stream by combining a set of increasing counter values ​​with the key. The specific steps are as follows:

[0215] Generate a counter (Counter): Generate a unique counter value (Nonce + Counter). Nonce is a non-repeating, random value.

[0216] Encrypt counter: Use AES to encrypt the counter and generate a key stream. This key stream will be used to XOR with the plaintext to produce the ciphertext.

[0217] Authentication tag generation: During the encryption process, the data to be authenticated (plaintext, header data, IV, etc.) is processed simultaneously, and the tag is generated using Galois multiplication to ensure the integrity and authentication of the data.

[0218] 6. Decryption process

[0219] The decryption process is similar to the encryption process. Since a symmetric key is used, the same AES operations can be performed for decryption. When the ciphertext is XORed with the generated keystream, the plaintext can be recovered. The authentication tag is also verified during the decryption process to ensure that the data has not been tampered with.

[0220] Embodiment 2:

[0221] like Figure 5 As shown, this embodiment provides a device for implementing online encryption of three-dimensional model software based on AES-GCM, and the device includes:

[0222] An acquisition unit 10 is used to acquire 3D point cloud data or 3D data information in the front-end 3D model software data;

[0223] A first processing unit 20, connected to the acquisition unit 10, is used to format the three-dimensional point cloud data or three-dimensional data information to obtain front-end data to be encrypted;

[0224] The second processing unit 30 is connected to the first processing unit 20 and is used to generate an initial fingerprint code, where the initial fingerprint code is a unique identifier corresponding to the front-end data to be encrypted;

[0225] The encryption unit 40 is connected to the second processing unit 30 and is used to encrypt the initial fingerprint code using an AES key and an initialization vector IV based on AES-GCM to generate an encrypted fingerprint code and an authentication tag;

[0226] Wherein, the AES key is obtained by the crypto.subtle.generateKey encapsulation function;

[0227] The storage unit 50 is connected to the encryption unit 40 and is used to store the AES key, the initialization vector IV, and the authentication tag in a local file of the front end;

[0228] The decryption unit 60 is connected to the storage unit 50 and is used to call the AES key, the initialization vector IV, and the authentication tag from the local file, decrypt the encrypted fingerprint code, and obtain the decrypted fingerprint code;

[0229] The comparison unit 70 is connected to the decryption unit 60 and is used to compare the decrypted fingerprint code with the initial fingerprint code to obtain the authorization of the front-end 3D model software data, thereby completing the online encryption and decryption of the 3D model software based on AES-GCM.

[0230] As a specific implementation, the device further includes a first generating unit, which is connected to the encryption unit and is used to generate an AES key;

[0231] The first generating unit comprises:

[0232] The first setting module is used to set the key length of AES-GCM to 256 bits;

[0233] The first generating module is connected to the first setting module and is used to call the crypto.subtle.generateKey encapsulation function to generate an AES key.

[0234] As a specific implementation, the device includes a second generation unit, which is connected to the encryption unit and is used to generate an initialization vector IV;

[0235] The second generating unit comprises:

[0236] The second setting module is used to set the length of the initialization vector IV;

[0237] The second generating module is connected to the second setting module and is used to call the crypto.getRandomValues ​​function to generate an initialization vector IV.

[0238] As a specific implementation, the first processing unit includes:

[0239] A cleaning module, used for cleaning the three-dimensional point cloud data or three-dimensional data information;

[0240] A normalization module, connected to the cleaning module, for normalizing the cleaned three-dimensional point cloud data or three-dimensional data information to the same coordinate system to obtain coordinate data;

[0241] A determination module, used to determine the storage format of the front-end 3D model software data;

[0242] The storage module is connected to the normalization module and the determination module respectively, and is used to format and store the coordinate data according to the storage format, that is, to obtain the front-end data to be encrypted.

[0243] As a specific implementation, the comparison unit includes:

[0244] A comparison module, used for comparing the decrypted fingerprint code with the original initial fingerprint code by character string or hash value;

[0245] An authorization module, connected to the comparison module, and configured to perform authorization according to the comparison result of the comparison module;

[0246] If the decrypted fingerprint code string is the same as the original initial fingerprint code string, or the decrypted fingerprint code hash code is the same as the original initial fingerprint code hash code, the authorization is successful, that is, the permission to access or operate the front-end three-dimensional model data is obtained; if not, the authorization fails, that is, the permission to access or operate the front-end three-dimensional model data cannot be obtained.

[0247] The encryption generated by this device is a packaged API (i.e., our encapsulated application programming interface) that performs encryption and decryption in a web browser. First, the AES-256-GCM algorithm is encapsulated through crypto.subtle.O.generateKey. Then the inventor uses a key management mechanism (Web Storage) and a secure transmission protocol (Https) to protect the key. For the encryption algorithm and encryption mode, the inventor selected the encapsulated AES-256 and GCM modes, and developed the software services through the system design method and placed them in this device.

[0248] The algorithm generation of crypto.subtle.O.generateKey by the inventor is not considered by others.

[0249] The basic principle of AES encryption is to input the 3D point cloud data or 3D data information into a hash function in a certain format and obtain a unique fingerprint code. After the fingerprint code is encrypted by the AES algorithm, it is combined with the public key in a certain format for digital signature encryption to obtain the final ciphertext data. In this process, the key, hash function and public key remain confidential to ensure the security and integrity of the aerial triangulation data. When decrypting, the user uses the local private key to decrypt the digital signature, and then uses the key to decrypt the AES encrypted data to finally obtain the original 3D information data.

[0250] The specific process of AES encryption can be divided into the following steps: (1) Data formatting: Standardize and format the three-dimensional point cloud data in a certain format for subsequent processing and encryption operations. (2) Hash function generates fingerprint code: Input the formatted data into the hash function, and calculate a unique fingerprint code through the hash algorithm. The hash function has the characteristic of converting data of any length into a fixed-length hash value. (3) AES encryption: Input the generated fingerprint code into the AES encryption algorithm and use the pre-set key for encryption operation. AES is a symmetric encryption algorithm that encrypts and decrypts data based on the key. Digital signature encryption: Merge the AES-encrypted point cloud data with the public key in a certain format, and then encrypt the point cloud digital signature. Point cloud digital signature is a technology used to verify data integrity and identity authentication. By encrypting the data to generate a signature, only users with private keys can decrypt and verify the signature. (4) Ciphertext data generation: Finally, the data encrypted by the point cloud digital signature is used as ciphertext data for transmission or storage.

[0251] The decryption process is the opposite of the encryption process: use the private key to decrypt the point cloud digital signature to verify the integrity and identity of the data. Use the key to decrypt the AES encrypted data to restore the original fingerprint code. Reversely derive the original 3D point cloud data based on the fingerprint code. During the aerotriangulation encryption process, the key, hash function, and public-private key pair need to remain confidential, and only legitimate users can perform encryption and decryption operations correctly. At the same time, the use of hash functions and digital signatures can ensure the integrity and identity of the data and prevent data from being tampered with during transmission.

[0252] When choosing an encryption algorithm, AES is a commonly used symmetric encryption algorithm with the advantages of fast data processing speed, high computing intensity, and high security. It is widely used in air triangulation encryption. At the same time, it is also important to choose a suitable key length. A longer key length can improve encryption strength.

[0253] By combining with GCM mode, additional data integrity verification and identity authentication can be provided to prevent data from being tampered with or forged during transmission. At the same time, GCM mode also provides efficient encryption and decryption operations, which can speed up the encryption and decryption process.

[0254] In this embodiment, when the GCM mode is selected, the key length is selected as needed and a random initialization vector is used to increase the security of encryption. In addition, the confidentiality of the key, hash function and public-private key pair needs to be ensured to protect the security and integrity of AES data.

[0255] The device in this embodiment can execute the method in embodiment 1.

[0256] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present invention, but the present invention is not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A method for implementing online encryption of three-dimensional model software based on AES-GCM, characterized in that: The method comprises the following steps: Step S1: Acquire 3D point cloud data or 3D data information in the front-end 3D model software data; Step S2: obtaining front-end data to be encrypted according to the three-dimensional point cloud data or three-dimensional data information; Step S3: generating an initial fingerprint code according to the front-end data to be encrypted; the initial fingerprint code is a unique identifier corresponding to the front-end data to be encrypted; Step S4: using an AES key and an initialization vector IV based on AES-GCM to encrypt the initial fingerprint code, generate an encrypted fingerprint code and an authentication tag, thereby completing the online encryption of the three-dimensional model software based on AES-GCM; The AES key is obtained by encapsulating the crypto.subtle.generateKey function.

2. The method for realizing online encryption of three-dimensional model software based on AES-GCM according to claim 1, characterized in that: The AES key, the initialization vector IV, and the authentication tag are all stored in a local file of the front end; After step S4, the method further includes: Step S5: calling the AES key, the initialization vector IV, and the authentication tag from the local file, decrypting the encrypted fingerprint code to obtain a decrypted fingerprint code; Step S6: Compare the decrypted fingerprint code with the initial fingerprint code to obtain the authorization of the front-end 3D model software data, thereby completing the online decryption of the 3D model software based on AES-GCM.

3. The method for realizing online encryption of three-dimensional model software based on AES-GCM according to claim 1, characterized in that: The AES key, the process of obtaining it specifically includes the following steps: Set the key length of AES-GCM to 256 bits; Call the crypto.subtle.generateKey encapsulation function to generate an AES key; The initialization vector IV is obtained by the following steps: Set the initialization vector IV length; Call the crypto.getRandomValues ​​function to generate the initialization vector IV.

4. The method for realizing online encryption of three-dimensional model software based on AES-GCM according to claim 1, characterized in that: The step S2 specifically includes the following steps: Performing data cleaning on the three-dimensional point cloud data or three-dimensional data information; Normalizing the cleaned 3D point cloud data or 3D data information to the same coordinate system to obtain coordinate data; Determine the storage format of the front-end 3D model software data; The coordinate data is formatted and stored according to the storage format, thereby obtaining the front-end data to be encrypted.

5. The method for realizing online encryption of three-dimensional model software based on AES-GCM according to any one of claims 2 to 4, characterized in that: In step S6, the decrypted fingerprint code is compared with the initial fingerprint code to obtain the authorization of the front-end 3D model software data, which specifically includes the following steps: Compare the decrypted fingerprint code with the original initial fingerprint code by string or hash value; If the decrypted fingerprint code string is the same as the original initial fingerprint code string, or the decrypted fingerprint code hash code is the same as the original initial fingerprint code hash code, the authorization is successful, that is, the permission to access or operate the front-end three-dimensional model data is obtained; if not, the authorization fails, that is, the permission to access or operate the front-end three-dimensional model data cannot be obtained.

6. A device for implementing online encryption of three-dimensional model software based on AES-GCM, characterized in that: The device comprises: An acquisition unit, used to acquire 3D point cloud data or 3D data information in the front-end 3D model software data; A first processing unit, connected to the acquisition unit, for formatting the three-dimensional point cloud data or three-dimensional data information to obtain front-end data to be encrypted; a second processing unit, connected to the first processing unit, and configured to generate an initial fingerprint code, wherein the initial fingerprint code is a unique identifier corresponding to the front-end data to be encrypted; An encryption unit connected to the second processing unit, used to encrypt the initial fingerprint code using an AES key and an initialization vector IV based on AES-GCM, generate an encrypted fingerprint code and an authentication tag, thereby completing the online encryption of the three-dimensional model software based on AES-GCM; The AES key is obtained by encapsulating the crypto.subtle.generateKey function.

7. The device for realizing online encryption of three-dimensional model software based on AES-GCM according to claim 6, characterized in that: The device also includes: A storage unit, connected to the encryption unit, for storing the AES key, the initialization vector IV, and the authentication tag in a local file of the front end; A decryption unit connected to the storage unit, used to call the AES key, the initialization vector IV, and the authentication tag from the local file, decrypt the encrypted fingerprint code, and obtain a decrypted fingerprint code; The comparison unit is connected to the decryption unit and is used to compare the decrypted fingerprint code with the initial fingerprint code to obtain the authorization of the front-end 3D model software data, thereby completing the online decryption of the 3D model software based on AES-GCM.

8. The device for realizing online encryption of three-dimensional model software based on AES-GCM according to claim 6, characterized in that: The apparatus further comprises a first generating unit and a second generating unit; The first generating unit is connected to the encryption unit and is used to generate an AES key; The first generating unit comprises: The first setting module is used to set the key length of AES-GCM to 256 bits; A first generating module, connected to the first setting module, for calling the crypto.subtle.generateKey encapsulation function to generate an AES key; The second generating unit is connected to the encryption unit and is used to generate an initialization vector IV; The second generating unit comprises: The second setting module is used to set the length of the initialization vector IV; The second generating module is connected to the second setting module and is used to call the crypto.getRandomValues ​​function to generate an initialization vector IV.

9. The device for realizing online encryption of three-dimensional model software based on AES-GCM according to claim 6, characterized in that: The first processing unit comprises: A cleaning module, used for cleaning the three-dimensional point cloud data or three-dimensional data information; A normalization module, connected to the cleaning module, for normalizing the cleaned three-dimensional point cloud data or three-dimensional data information to the same coordinate system to obtain coordinate data; A determination module, used to determine the storage format of the front-end 3D model software data; The storage module is connected to the normalization module and the determination module respectively, and is used to format and store the coordinate data according to the storage format, that is, to obtain the front-end data to be encrypted.

10. The device for implementing online encryption of three-dimensional model software based on AES-GCM according to any one of claims 7 to 9, characterized in that: The comparison unit comprises: A comparison module, used for comparing the decrypted fingerprint code with the original initial fingerprint code by character string or hash value; An authorization module, connected to the comparison module, and configured to perform authorization according to the comparison result of the comparison module; If the decrypted fingerprint code string is the same as the original initial fingerprint code string, or the decrypted fingerprint code hash code is the same as the original initial fingerprint code hash code, the authorization is successful, that is, the permission to access or operate the front-end three-dimensional model data is obtained; if not, the authorization fails, that is, the permission to access or operate the front-end three-dimensional model data cannot be obtained.

Images