Data encryption method and device and data verification method and device

Abstract

The embodiment of the invention provides a data encryption method and device and a data verification method and device. The data encryption method comprises the steps that original firmware of battery equipment is acquired; dividing the original firmware into a plurality of data blocks, and determining a first number of specified data blocks from the plurality of data blocks; for each specified data block, calculating an abstract of the specified data block; performing target operation on the abstract of each specified data block to obtain a corresponding operation result as the abstract of the original firmware; and based on the abstract of the original firmware and the first number, encrypting the original firmware to obtain target firmware. The safety and the starting speed of the battery equipment can be ensured at the same time, and the safety and the starting speed of the battery equipment are balanced.

Description

Technical Field

[0001] The present application relates to the technical field of embedded devices, and in particular to a data encryption method, a data verification method and a device. Background Art

[0002] Embedded devices are composed of hardware and software. Hardware includes embedded processors, storage devices, peripherals, etc.; software includes software programs (which can be called firmware) used to control the operation of embedded devices, and the firmware is stored in storage devices. Battery devices refer to embedded devices that are powered by batteries, such as battery cameras, battery doorbells, smart locks, etc.

[0003] Battery devices are characterized by low power consumption and fast startup. Since battery devices are powered by batteries, they are usually in a low-power standby state. When the working conditions of the battery device are triggered, the firmware can be quickly started, and then the battery device is controlled by the firmware to work, that is, the battery device is quickly started. For example, the battery device can be a battery camera. Compared with the traditional IPC (Internet Protocol Camera) surveillance camera, when a pedestrian is detected passing through the shooting area of ​​the battery camera, the battery camera can be quickly started and record.

[0004] In the related art, when manufacturing battery equipment, in order to ensure the safety of the battery equipment, protect the firmware from illegal theft, tampering or implantation, and to prevent the firmware from being reverse analyzed, the firmware can be encrypted. Subsequently, when starting the battery camera, the encrypted firmware can be decrypted, and when it is determined that the firmware has not been tampered with, the firmware is started again, and the battery camera is controlled to work through the firmware.

[0005] However, when the security of the battery device is made higher, for example, the entire firmware of the battery device is encrypted, the security of the battery device can be improved, but when decrypting the encrypted firmware, it takes more time, which reduces the startup speed of the battery device. When the startup speed of the battery device is made higher, for example, the firmware of the battery device is not encrypted, the firmware will not be decrypted, and the battery device can be started directly, which improves the startup speed of the battery device, but reduces the security of the battery device. Summary of the invention

[0006] The purpose of the embodiments of the present application is to provide a data encryption method, a data verification method and a device to simultaneously ensure the safety and startup speed of the battery device and to strike a balance between the safety and startup speed of the battery device. The specific technical solution is as follows:

[0007] In a first aspect of an embodiment of the present application, a data encryption method is first provided, the method comprising:

[0008] Get the original firmware of the battery device;

[0009] Dividing the original firmware into a plurality of data blocks, and determining a first number of designated data blocks from the plurality of data blocks;

[0010] For each specified data block, calculate a summary of the specified data block;

[0011] Performing a target operation on the digest of each designated data block to obtain a corresponding operation result as the digest of the original firmware;

[0012] The original firmware is encrypted based on the digest of the original firmware and the first number to obtain the target firmware.

[0013] Optionally, dividing the original firmware into a plurality of data blocks, and determining a first number of designated data blocks from the plurality of data blocks includes:

[0014] Dividing the original firmware into a first number of data groups, and for each data group, dividing the data group into a second number of data blocks;

[0015] For each data group, a designated data block is determined from the data group.

[0016] Optionally, for each data group, determining a specified data block from the data group includes:

[0017] Obtaining a plurality of random numbers; wherein the plurality of random numbers correspond one-to-one to each data group;

[0018] For each data group, a data block indicated by a random number corresponding to the data group is determined from among the data blocks in the data group as a designated data block in the data group.

[0019] Optionally, encrypting the original firmware based on the digest of the original firmware and the first number to obtain the target firmware includes:

[0020] concatenating the digest of the original firmware, the multiple random numbers, the first number, and the second number to obtain a concatenated result;

[0021] Signing the splicing result based on a preset signature algorithm to obtain signature data;

[0022] Encrypting the signature data based on a first encryption algorithm to obtain encrypted data;

[0023] The original firmware is encrypted based on the encrypted data to obtain the target firmware.

[0024] Optionally, encrypting the original firmware based on the encrypted data to obtain the target firmware includes:

[0025] The original firmware and the encrypted data are concatenated to obtain the target firmware.

[0026] Optionally, encrypting the original firmware based on the encrypted data to obtain the target firmware includes:

[0027] For each data group, encrypting a designated data block in the data group based on a second encryption algorithm to obtain an encrypted designated data block;

[0028] Replacing each designated data block in the original firmware with the corresponding encrypted designated data block to obtain the firmware to be processed;

[0029] The firmware to be processed and the encrypted data are concatenated to obtain the target firmware.

[0030] In a second aspect of an embodiment of the present application, a data verification method is provided, the method comprising:

[0031] Obtain target firmware; wherein the target firmware is obtained based on any data encryption method described in the first aspect above;

[0032] Decrypting the target firmware to obtain the digest to be verified, the first number and the firmware to be verified;

[0033] Dividing the firmware to be verified into a plurality of data blocks, and determining a first number of designated data blocks from the plurality of data blocks;

[0034] For each specified data block, calculate a summary of the specified data block;

[0035] Performing a target operation on the digest of each designated data block to obtain a corresponding operation result as the digest of the firmware to be verified;

[0036] If the digest of the firmware to be verified is the same as the digest to be verified, the original firmware is determined based on the firmware to be verified.

[0037] Optionally, decrypting the target firmware number to obtain the digest to be verified, the first number and the firmware to be verified includes:

[0038] Splitting the target firmware to obtain encrypted data and firmware to be verified;

[0039] Decrypting the encrypted data to obtain the data to be verified and the first signature;

[0040] Signing the data to be verified based on a preset signature algorithm to obtain a second signature;

[0041] If the first signature is identical to the second signature, determining the data to be verified as the decrypted data;

[0042] The decrypted data is split to obtain a summary to be verified, multiple random numbers, a first number, and a second number.

[0043] Optionally, dividing the firmware to be verified into a plurality of data blocks, and determining a first number of designated data blocks from the plurality of data blocks includes:

[0044] Dividing the firmware to be verified into a first number of data groups, and for each data group, dividing the data group into a second number of data blocks;

[0045] For each data group, a designated data block is determined from the data group.

[0046] Optionally, the multiple random numbers correspond one-to-one to each data group;

[0047] The step of determining a designated data block from each data group includes:

[0048] For each data group, the data block indicated by the random number corresponding to the data group is determined from each data block in the data group to obtain the designated data block in the data group.

[0049] Optionally, the multiple random numbers correspond one-to-one to each data group;

[0050] The step of determining a designated data block from each data group includes:

[0051] For each data group, determine, from each data block in the data group, a data block indicated by a random number corresponding to the data group as an encrypted data block in the data group;

[0052] The encrypted data block in the data group is decrypted to obtain the specified data block in the data group.

[0053] Optionally, determining the original firmware based on the firmware to be verified includes:

[0054] Each encrypted data block in the firmware to be verified is replaced with a corresponding designated data block to obtain the original firmware.

[0055] In a third aspect of an embodiment of the present application, a data encryption device is provided, the device comprising:

[0056] An original firmware acquisition module is used to acquire the original firmware of the battery device;

[0057] a partitioning module, configured to partition the original firmware into a plurality of data blocks, and determine a first number of designated data blocks from the plurality of data blocks;

[0058] A summary calculation module, used for calculating the summary of each specified data block;

[0059] A summary processing module, used for performing a target operation on the summary of each designated data block to obtain a corresponding operation result as the summary of the original firmware;

[0060] The encryption module is used to encrypt the original firmware based on the digest of the original firmware and the first number to obtain the target firmware.

[0061] Optionally, the division module is specifically used to:

[0062] Dividing the original firmware into a first number of data groups, and for each data group, dividing the data group into a second number of data blocks;

[0063] For each data group, a designated data block is determined from the data group.

[0064] Optionally, the division module is specifically used to:

[0065] Obtaining a plurality of random numbers; wherein the plurality of random numbers correspond one-to-one to each data group;

[0066] For each data group, a data block indicated by a random number corresponding to the data group is determined from among the data blocks in the data group as a designated data block in the data group.

[0067] Optionally, the encryption module is specifically used to:

[0068] concatenating the digest of the original firmware, the multiple random numbers, the first number, and the second number to obtain a concatenated result;

[0069] Signing the splicing result based on a preset signature algorithm to obtain signature data;

[0070] Encrypting the signature data based on a first encryption algorithm to obtain encrypted data;

[0071] The original firmware is encrypted based on the encrypted data to obtain the target firmware.

[0072] Optionally, the encryption module is specifically used to:

[0073] The original firmware and the encrypted data are concatenated to obtain the target firmware.

[0074] Optionally, the encryption module is specifically used to:

[0075] For each data group, encrypting a designated data block in the data group based on a second encryption algorithm to obtain an encrypted designated data block;

[0076] Replacing each designated data block in the original firmware with the corresponding encrypted designated data block to obtain the firmware to be processed;

[0077] The firmware to be processed and the encrypted data are concatenated to obtain the target firmware.

[0078] In a fourth aspect of the embodiments of the present application, a data verification device is provided, the device comprising:

[0079] A target firmware acquisition module, used to acquire target firmware; wherein the target firmware is obtained based on any data encryption method described in the first aspect above;

[0080] A decryption module, used to decrypt the target firmware to obtain the summary to be verified, the first number and the firmware to be verified;

[0081] A division module, used for dividing the firmware to be verified into a plurality of data blocks, and determining a first number of designated data blocks from the plurality of data blocks;

[0082] A summary calculation module, used for calculating the summary of each specified data block;

[0083] A summary processing module, used for performing a target operation on the summary of each designated data block to obtain a corresponding operation result as the summary of the firmware to be verified;

[0084] The original firmware determining module is used to determine the original firmware based on the firmware to be verified if the digest of the firmware to be verified is the same as the digest to be verified.

[0085] Optionally, the decryption module is specifically used to:

[0086] Splitting the target firmware to obtain encrypted data and firmware to be verified;

[0087] Decrypting the encrypted data to obtain the data to be verified and the first signature;

[0088] Signing the data to be verified based on a preset signature algorithm to obtain a second signature;

[0089] If the first signature is identical to the second signature, determining the data to be verified as the decrypted data;

[0090] The decrypted data is split to obtain a summary to be verified, multiple random numbers, a first number, and a second number.

[0091] Optionally, the division module is specifically used to:

[0092] Dividing the firmware to be verified into a first number of data groups, and for each data group, dividing the data group into a second number of data blocks;

[0093] For each data group, a designated data block is determined from the data group.

[0094] Optionally, the multiple random numbers correspond one-to-one to each data group;

[0095] The division module is specifically used for:

[0096] For each data group, the data block indicated by the random number corresponding to the data group is determined from each data block in the data group to obtain the designated data block in the data group.

[0097] Optionally, the multiple random numbers correspond one-to-one to each data group;

[0098] The division module is specifically used for:

[0099] For each data group, determine, from each data block in the data group, a data block indicated by a random number corresponding to the data group as an encrypted data block in the data group;

[0100] The encrypted data block in the data group is decrypted to obtain the specified data block in the data group.

[0101] Optionally, the original firmware determination module is specifically used to:

[0102] Each encrypted data block in the firmware to be verified is replaced with a corresponding designated data block to obtain the original firmware.

[0103] In a fifth aspect of the embodiments of the present application, an electronic device is provided, including:

[0104] Memory, used to store computer programs;

[0105] The processor is used to implement any data encryption method described in the first aspect when executing a program stored in the memory.

[0106] In a sixth aspect of the embodiments of the present application, a battery device is provided, including:

[0107] Memory, used to store computer programs;

[0108] The processor is used to implement any data verification method described in the second aspect when executing the program stored in the memory.

[0109] In a seventh aspect of an embodiment of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the data encryption method described in any one of the first aspects is implemented.

[0110] In an eighth aspect of an embodiment of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the data verification method described in any one of the second aspects is implemented.

[0111] An embodiment of the present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute any of the steps of the data encryption method described in the first aspect above.

[0112] An embodiment of the present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute any of the steps of the data verification method described in the second aspect.

[0113] A data encryption method provided in an embodiment of the present application obtains the original firmware of a battery device; divides the original firmware into multiple data blocks, and determines a first number of specified data blocks from the multiple data blocks; for each specified data block, calculates the summary of the specified data block; performs a target operation on the summary of each specified data block to obtain a corresponding operation result as the summary of the original firmware; and encrypts the original firmware based on the summary of the original firmware and the first number to obtain the target firmware.

[0114] Based on the above processing, the target firmware is obtained by encrypting the original firmware based on the summary of the specified data block in the original firmware, which can prevent the target firmware from being reverse analyzed and improve the safety of the battery device. In addition, the specified data block is a partial data block among the multiple data blocks in the original firmware. When verifying the target firmware later, it is only necessary to verify based on the partial data block in the target firmware, and there is no need to verify based on the entire target firmware, which can improve the startup speed of the battery device, that is, it can ensure the safety and startup speed of the battery device at the same time, and strike a balance between the safety and startup speed of the battery device.

[0115] Of course, implementing any product or method of the present application does not necessarily require achieving all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0116] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0117] Figure 1 A first flow chart of a data encryption method provided in an embodiment of the present application;

[0118] Figure 2 A second flow chart of the data encryption method provided in the embodiment of the present application;

[0119] Figure 3 A third flow chart of the data encryption method provided in the embodiment of the present application;

[0120] Figure 4 A fourth flow chart of the data encryption method provided in an embodiment of the present application;

[0121] Figure 5 A fifth flow chart of the data encryption method provided in the embodiment of the present application;

[0122] Figure 6 A first schematic diagram of a data encryption method provided in an embodiment of the present application;

[0123] Figure 7 In accordance with Figure 6 A flowchart of a method for performing data encryption according to the schematic diagram shown;

[0124] Figure 8 A second schematic diagram of the data encryption method provided in an embodiment of the present application;

[0125] Fig. 9 In accordance with Figure 8 A flowchart of a method for performing data encryption according to the schematic diagram shown;

[0126] Fig.10 A first flow chart of a data verification method provided in an embodiment of the present application;

[0127] Fig.11 A second flow chart of the data verification method provided in the embodiment of the present application;

[0128] Fig.12 A third flow chart of the data verification method provided in the embodiment of the present application;

[0129] Fig.13 A fourth flow chart of the data verification method provided in an embodiment of the present application;

[0130] Fig.14A fifth flow chart of the data verification method provided in the embodiment of the present application;

[0131] Fig.15 A schematic diagram of a data verification method provided in an embodiment of the present application;

[0132] Fig.16 In accordance with Fig.15 A flowchart of a method for performing data verification according to the schematic diagram shown;

[0133] Fig.17 A structural diagram of a data encryption device provided in an embodiment of the present application;

[0134] Fig.18 A structural diagram of a data verification device provided in an embodiment of the present application;

[0135] Fig.19 A structural diagram of an electronic device provided in an embodiment of the present application;

[0136] Fig. 20 A structural diagram of a battery device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0137] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field based on the present application belong to the scope of protection of the present application.

[0138] In the related art, when the security of the battery device is made higher, for example, the entire firmware of the battery device is encrypted, which can improve the security of the battery device, but it takes more time to decrypt the encrypted firmware, which reduces the startup speed of the battery device. When the startup speed of the battery device is made higher, for example, the firmware of the battery device is not encrypted, the firmware will not be decrypted, and the battery device can be started directly, which improves the startup speed of the battery device, but reduces the security of the battery device. That is, it is impossible to ensure the security and startup speed of the battery device at the same time.

[0139] In order to solve the above problems, an embodiment of the present application provides a data encryption method, which can be applied to an electronic device, and the electronic device is communicatively connected with a battery device. The electronic device can be a device for developing a software program for controlling the operation of a battery device. The electronic device obtains a software program for controlling the operation of a battery device, and mirrors the obtained software program to obtain the original firmware of the battery device, and the original firmware is also: a software program that can be used to control the operation of a battery device. Furthermore, the electronic device can encrypt the original firmware according to the data encryption method provided in the embodiment of the present application to obtain the target firmware. The target firmware is then stored in a memory in the battery device.

[0140] Subsequently, when the battery device needs to be started, the battery device can verify the target firmware in the memory according to the data verification method provided in the embodiment of the present application, that is, verify whether the target firmware has been tampered with. When it is determined that the target firmware has not been tampered with, the original firmware of the battery device can be determined based on the target firmware, and the original firmware can be started, and then the battery device can be controlled to work through the original firmware; when it is determined that the target firmware has been tampered with, it means that the original firmware may also be tampered with, and the original firmware may not be able to control the normal operation of the battery device, so the battery device is not started, which can improve the safety of the battery device. In addition, based on the data encryption method provided in the embodiment of the present application, the original firmware is encrypted based on part of the data blocks in the original firmware to obtain the target firmware. Based on the data verification method provided in the embodiment of the present application, when the battery device verifies the target firmware, it only needs to verify based on part of the data blocks of the target firmware, and does not need to verify based on the entire target firmware, which can also improve the startup speed of the battery device. That is, the safety and startup speed of the battery device can be guaranteed at the same time, and a balance can be achieved between the safety and startup speed of the battery device.

[0141] See also Figure 1 , Figure 1 The first flow chart of the data encryption method provided in the embodiment of the present application may include the following steps:

[0142] S101: Acquire the original firmware of the battery device.

[0143] S102: Divide the original firmware into a plurality of data blocks, and determine a first number of designated data blocks from the plurality of data blocks.

[0144] S103: For each designated data block, calculate a digest of the designated data block.

[0145] S104: Perform a target operation on the digest of each designated data block to obtain a corresponding operation result as the digest of the original firmware.

[0146] S105: Encrypt the original firmware based on the digest of the original firmware and the first number to obtain the target firmware.

[0147] Based on the above processing, the target firmware is obtained by encrypting the original firmware based on the summary of the specified data block in the original firmware, which can prevent the target firmware from being reverse analyzed and improve the safety of the battery device. In addition, the specified data block is a partial data block among the multiple data blocks in the original firmware. When verifying the target firmware later, it is only necessary to verify based on the partial data block in the target firmware, and there is no need to verify based on the entire target firmware, which can improve the startup speed of the battery device, that is, it can ensure the safety and startup speed of the battery device at the same time, and strike a balance between the safety and startup speed of the battery device.

[0148] With respect to step S101, the electronic device is connected to the battery device for communication, and the electronic device may be a device for developing a software program for controlling the operation of the battery device. The battery device is an embedded device powered by a battery, such as a battery camera, a battery doorbell, a smart lock, etc. The electronic device obtains a software program for controlling the operation of the battery device, and obtains the original firmware of the battery device based on the obtained software program. For example, the electronic device may mirror the obtained software program and use the image of the software program as the original firmware of the battery device; or, after obtaining the image of the software program, the electronic device may compress the image and use the compressed result as the original firmware of the battery device.

[0149] For step S102, the designated data block is the data block required to be used when encrypting the original firmware. The more designated data blocks there are, the more data blocks need to be verified when verifying the target firmware, the higher the security of the battery device, and the slower the startup speed of the battery device. The fewer designated data blocks there are, the fewer data blocks need to be verified when verifying the target firmware, the lower the security of the battery device, and the faster the startup speed of the battery device.

[0150] The first number can be set according to the requirements. When the battery device needs to have higher safety, the first number can be set to a larger value, such as 5; when the battery device needs to have a faster startup speed, the first number can be set to a smaller value, such as 1. This is not specifically limited in the embodiments of the present application.

[0151] After the electronic device divides the original firmware into multiple data blocks, the designated data block can be determined from the multiple data blocks. For example, the electronic device can designate the first data block and the last data block in the multiple data blocks as designated data blocks. Alternatively, the electronic device can divide the original firmware into a first number of data groups, and then for each data group, determine the designated data block from the data group.

[0152] Accordingly, in some embodiments, Figure 1 Based on Figure 2 , step S102 may include the following steps:

[0153] S1021: Divide the original firmware into a first number of data groups, and for each data group, divide the data group into a second number of data blocks.

[0154] S1022: For each data group, determine a designated data block from the data group.

[0155] The first number may be recorded as M, and the second number may be recorded as N. For example, the value of M may be 2. m , the value of N can be 2 n . m and n are integers greater than 0.

[0156] When the first number M is large, the original firmware is divided into a larger number of data groups. When the target firmware is subsequently generated, it is necessary to determine the designated data block in each data group. When the number of data groups is large, the number of designated data blocks determined is large, and more data blocks are used to encrypt the original firmware to obtain the target firmware. The target firmware is more difficult to be reverse analyzed, and the safety of the battery device is higher. Therefore, if the safety of the battery device is to be improved, the first number M can be set larger, that is, the value of m is larger.

[0157] Since the second number N is large, for each data group, the data group is divided into a larger number of data blocks. When the number of designated data blocks determined from each data group is limited, and the number of data blocks in each data group is large, the proportion of designated data blocks in all data blocks included in the original firmware is low, that is, fewer data blocks are used to encrypt the original firmware to obtain the target firmware. Subsequently, when verifying the target firmware, fewer data blocks need to be verified, so the battery device spends less time in the verification process, and the startup speed of the battery device is faster. Therefore, if you want to increase the startup speed of the battery device, you can set the second number N to be larger, that is, the value of n is larger.

[0158] Exemplarily, the original firmware is 2048 bytes. To improve the safety of the battery device, the first number M can be set larger, such as 64; to increase the startup speed of the battery device, the second number N can be set larger, such as 32.

[0159] Furthermore, for each data group, the electronic device may determine a designated data block from the data group.

[0160] In one implementation, for each data group, the designated data block may be any data block in the data group. For example, the designated data block may be the first data block in each data group.

[0161] In another implementation, in order to increase the difficulty of reverse analysis of the target firmware and improve the safety of the battery device, the designated data blocks in each data group can also be randomly determined. Figure 2 Based on Figure 3 , step S1022 may include the following steps:

[0162] S10221: Obtain multiple random numbers.

[0163] Among them, multiple random numbers correspond to each data group one by one.

[0164] S10222: For each data group, determine, from the data blocks in the data group, a data block indicated by a random number corresponding to the data group as a designated data block in the data group.

[0165] The electronic device can obtain a random number table that records multiple random numbers, and each random number in the random number table corresponds to each data group one by one, that is, the random number table contains a first number of random numbers. For each data group, the random number corresponding to the data group is used to indicate a specified data block in the data group. The data group contains a second number of data blocks, and each random number in the random number table is an integer not less than 1 and not greater than the second number.

[0166] After the electronic device obtains the random number table, it can determine the corresponding relationship between the data group and the random number in the random number table. For each data group, according to the arrangement order of each data group, the position of the data group in each data group (which can be called the first position) can be determined; for each random number in the random number table, according to the arrangement order of each random number in the random number table, the position of the random number in the random number table (which can be called the second position) can be determined. When the first position and the second position are the same, the data group at the first position corresponds to the random number at the second position.

[0167] For each data group, the data group includes a second number of data blocks. According to the arrangement order of each data block in the data group, the position of each data block in the data group can be determined. Then, the electronic device determines the position indicated by the random number corresponding to the data group in each data block, and determines the data block at the position as the designated data block from the data blocks in the data group.

[0168] Based on the above processing, by dividing the original firmware into a first number of data groups and then determining the designated data blocks from each data group, the designated data blocks can be distributed more evenly in the original firmware. Subsequently, the original firmware can be encrypted by combining the various parts of the original firmware data, thereby increasing the difficulty of reverse analysis of the target firmware. By determining the designated data blocks in each data group through multiple random numbers, the designated data blocks in each data group are random, which can further increase the difficulty of reverse analysis of the target firmware and improve the safety of the battery device.

[0169] For step S103, for each designated data block, the electronic device may use a digest algorithm to calculate a digest of the designated data block, wherein the digest algorithm may be SHA-256 (Security Hash Algorithm-256), MD5 (Message-Digest Algorithm 5), SM3 (National Commercial Cryptographic Hash Algorithm 3), etc.

[0170] For step S104, after the electronic device obtains the digest of each designated data block, it can perform a target operation on the digest of each designated data block to obtain a final operation result, and use the operation result as the digest of the original firmware. The target operation can be an exclusive OR operation, an exclusive OR operation, a negation operation, etc.

[0171] Exemplarily, the electronic device performs an XOR operation on the digest of the first specified data block and the digest of the second specified data block to obtain a first operation result; performs an XOR operation on the first operation result and the digest of the third specified data block to obtain a second operation result; performs an XOR operation on the second operation result and the digest of the fourth specified data block, and so on, until an XOR operation is performed on the digests of each specified data block to obtain a final operation result, and the final operation result is used as the summary of the original firmware.

[0172] With respect to step S105, in one implementation, the electronic device may splice the digest of the original firmware and the first number in the order of the digest of the original firmware first and the first number second to obtain a corresponding splicing result (which may be referred to as a first splicing result). Then, in the order of the original firmware first and the first splicing result second, the original firmware and the first splicing result are spliced ​​to obtain the target firmware.

[0173] In another implementation, after the electronic device concatenates the digest of the original firmware and the first number to obtain a first concatenation result, it can calculate the signature of the first concatenation result by a preset signature algorithm, and concatenate the first concatenation result and the signature of the first concatenation result in the order of the first concatenation result first and the signature of the first concatenation result second to obtain signature data. The signature data is encrypted based on the first encryption algorithm to obtain encrypted data. The original firmware and the encrypted data are concatenated in the order of the original firmware first and the encrypted data second to obtain the target firmware.

[0174] Among them, the preset signature algorithm can be RSA2048 (Ron Rivest, Adi Shamir, LeonardAdleman2048) algorithm, DSA (Digital Signature Algorithm), ECC (Elliptic Curve Cryptography) algorithm, etc.

[0175] The first encryption algorithm may be an AES (Advanced Encryption Standard) algorithm, an IDEA (International Data Encryption Algorithm), a PBE (PasswordBased Encryption) algorithm, or the like.

[0176] In another implementation, the electronic device may also encrypt the original firmware using multiple random numbers and second numbers. Figure 3 Based on Figure 4 , step S105 comprises the following steps:

[0177] S1051: Concatenate the digest of the original firmware, multiple random numbers, the first number, and the second number to obtain a concatenation result.

[0178] S1052: Sign the concatenated result based on a preset signature algorithm to obtain signature data.

[0179] S1053: Encrypt the signature data based on the first encryption algorithm to obtain encrypted data.

[0180] S1054: Encrypt the original firmware based on the encrypted data to obtain the target firmware.

[0181] The electronic device can splice the summary of the original firmware, the multiple random numbers, the first number and the second number in the order of the summary of the original firmware in front, the multiple random numbers in the middle, and the first number and the second number in the back to obtain a splicing result (which can be called a second splicing result). Then, the second splicing result is signed based on a preset signature algorithm to obtain a signature of the second splicing result, and the second splicing result and the signature of the second splicing result are spliced ​​to obtain signature data; the signature data is encrypted based on the first encryption algorithm to obtain encrypted data. Among them, the preset signature algorithm can be RSA2048 algorithm, DSA, ECC algorithm, etc. The first encryption algorithm can be AES algorithm, IDEA, PBE algorithm, etc.

[0182] In some embodiments, step S1054 may include the following steps: splicing the original firmware and the encrypted data to obtain the target firmware.

[0183] After the electronic device obtains the encrypted data, it can splice the original firmware and the encrypted data in the order of the original firmware first and the encrypted data later, and use the spliced ​​result as the target firmware to encrypt the original firmware. In this case, the target firmware can be called the one obtained based on the signature method.

[0184] In some embodiments, Figure 4 Based on Figure 5 , step S1054 may include the following steps:

[0185] S10541: For each data group, encrypt a designated data block in the data group based on a second encryption algorithm to obtain an encrypted designated data block.

[0186] S10542: Replace each designated data block in the original firmware with the corresponding encrypted designated data block to obtain the firmware to be processed.

[0187] S10543: The firmware to be processed is combined with the encrypted data to obtain the target firmware.

[0188] For each data group, after the electronic device determines the designated data block in the data group, it can encrypt the designated data block in the data group based on the second encryption algorithm to obtain the encrypted designated data block. The second encryption algorithm can be AES algorithm, IDEA algorithm, PBE algorithm, etc.

[0189] Furthermore, the electronic device can use the encrypted designated data block to replace the designated data block in the data group, and encrypt the data group based on the second encryption algorithm and the designated data block in the data group. After the electronic device replaces each designated data block in the original firmware with the corresponding encrypted designated data block, it can also encrypt the original firmware based on some of the multiple data blocks in the original firmware to obtain the firmware to be processed.

[0190] Exemplarily, the electronic device divides the original firmware into: data group A and data group B. Each data group includes 2 data blocks. The data blocks in data group A include: data block A1 and data block A2. The data blocks in data group B include: data block B1 and data block B2. That is, the original firmware can be expressed as: data block A1, data block A2, data block B1, data block B2. The random number corresponding to data group A is 2, that is, the designated data block in data group A is data block A2, and data block A2 is encrypted to obtain the encrypted designated data block A2, which is recorded as data block A20; the random number corresponding to data group B is 1, and the encrypted designated data block in data group B is data block B10. Furthermore, each designated data block in the original firmware is replaced with the corresponding encrypted designated data block, and the firmware to be processed can be expressed as: data block A1, data block A20, data block B10, data block B2.

[0191] Subsequently, the electronic device can splice the firmware to be processed and the encrypted data in the order of the firmware to be processed first and the encrypted data later to obtain the target firmware. At this time, the target firmware can be said to be obtained based on the encryption and signing method.

[0192] Based on the above processing, the electronic device obtains a splicing result according to multiple random numbers and a second number, and signs and encrypts the splicing result to obtain encrypted data; determines a specified data block in the original firmware according to the random number, and then encrypts the specified data block to obtain the firmware to be processed. The target firmware obtained by splicing the firmware to be processed and the encrypted data is obtained based on multiple encryptions, which can increase the difficulty of reverse analysis of the target firmware and improve the safety of the battery device.

[0193] After obtaining the target firmware, the electronic device can store the target firmware in the memory of the battery device. Later, when the battery device needs to be started, the battery device can obtain the target firmware from the memory and verify the target firmware to determine whether the target firmware has been tampered with, and start the target firmware when it is determined that the target firmware has not been tampered with, and then control the battery device to work through the target firmware. For example, if the battery device is a battery camera, after the target firmware is started, the battery camera is controlled by the target firmware to record video, which can improve the safety of the battery device.

[0194] See also Figure 6, Figure 6 This is a first schematic diagram of the data encryption method provided in the embodiment of the present application. Figure 7 , Figure 7 In accordance with Figure 6 The schematic diagram shown is a flow chart of a method for data encryption, the method comprising the following steps:

[0195] S701: Divide the original image into M groups.

[0196] In this step, the original image is the original firmware in the above embodiment, and the original firmware is divided to obtain multiple data groups. For example, Figure 6 As shown, the original firmware is divided to obtain a total of M data groups numbered 1 to M, where M is the first number in the aforementioned embodiment. Figure 6 In the figure, 1 represents the first data group, 2 represents the second data group, and so on, M-1 represents the M-1th data group, and M represents the Mth data group.

[0197] S702: Divide each group into N blocks.

[0198] In this step, blocks refers to the data blocks in the above-mentioned embodiment. For each data group, the data group is divided into multiple data blocks. For example, Figure 6 As shown, each data group is divided to obtain N data blocks numbered 1 to N, where N is the second number in the aforementioned embodiment. Figure 6 In the figure, Group1 represents the first data group, and GroupM represents the Mth data group. For each data group, 1 represents the first data block in the data group, 2 represents the second data block in the data group, and so on, N-1 represents the N-1th data block in the data group, and N represents the Nth data block in the data group.

[0199] S703: Generate a random number table, which includes M random numbers, each of which represents the random number of blocks in each group that need to be protected (this block is defined as a secure block).

[0200] In this step, the security block is the designated data block in the above-mentioned embodiment. The electronic device generates a random number table including a first number of random numbers, and each random number in the random data table corresponds to each data group one by one. Then, for each data group, the electronic device determines, from each data block in the data group, a data block indicated by the random number corresponding to the data group as the designated data block in the data group.

[0201] For example, Figure 6In the Secure Block Random Table, a random number table is included, wherein the random number table includes multiple rand_nums (random numbers), rand_num1 is a random number corresponding to the first data group, i.e., the rand_num1-th data block in the first data group is a secure block in the first data group; rand_num2 is a random number corresponding to the second data group, i.e., the rand_num2-th data block in the second data group is a secure block in the second data group; rand_num3 is a random number corresponding to the third data group, i.e., the rand_num3-th data block in the third data group is a secure block in the third data group; and so on, rand_numM-1 is a random number corresponding to the M-1-th data group, i.e., the rand_numM-1-th data block in the M-1-th data group is a secure block in the M-1-th data group; and rand_numM is a random number corresponding to the M-th data group, i.e., the rand_numM-th data block in the M-th data group is a secure block in the M-1-th data group.

[0202] S704: Calculate a digest of the data in the security block using a digest algorithm.

[0203] In this step, for each data group, after the electronic device determines the specified data block in the data group, it can use a digest algorithm to calculate the digest of the specified data block in the data group. The digest algorithm can be SHA-256, MD5, SM3, etc. For example, Figure 6 As shown, the electronic device calculates the Digest of the rand_num1th data block in the first data group, recorded as Digest1; calculates the Digest of the rand_num2th data block in the second data group, recorded as Digest2, and so on, calculates the Digest of the rand_numMth data block in the Mth data group, recorded as DigestM.

[0204] S705: Perform XOR processing on the digests of the security blocks in all groups to obtain a final digest.

[0205] In this step, the final summary is the summary of the original firmware in the above embodiment. After the electronic device obtains the summary of the specified data block in each data group, it performs an XOR operation on the summary of the specified data block to obtain the summary of the original firmware. For example, Figure 6The XOR (exclusive OR) in the figure represents an exclusive OR process, and Digest' is the final digest in this step, that is, the digest of the original firmware in the above-mentioned embodiment. Digest1 and Digest2 are subjected to an exclusive OR operation to obtain the first operation result, and then the first operation result is subjected to an exclusive OR operation with Digest3, and so on, until the M-1th operation result is subjected to an exclusive OR operation with DigestM to obtain the digest of the original firmware.

[0206] S706: Use the signature algorithm and encryption algorithm to sign and encrypt the final summary, random number table, and M and N values ​​as a whole to obtain signature encrypted data.

[0207] In this step, the signature algorithm is the signature algorithm preset in the above embodiment, which can be RSA2048 algorithm, DSA, ECC algorithm; the encryption algorithm is the first encryption algorithm in the above embodiment, which can be AES algorithm, IDEA, PBE algorithm. The signature encrypted data is the encrypted data in the above embodiment, which can also be called tail data.

[0208] The electronic device may concatenate the summary of the original firmware, the multiple random numbers, the first number, and the second number in the order of the summary of the original firmware first, the multiple random numbers in the middle, and the first number and the second number last, to obtain a second concatenation result. Then, the second concatenation result is signed based on a preset signature algorithm to obtain signature data; and the signature data is encrypted based on the first encryption algorithm to obtain encrypted data.

[0209] For example, Figure 6 In Indicates the splicing operation in this step, Figure 6 In the process, the final summary, random number table, M and N are concatenated to obtain the concatenated result, and then the concatenated result is signed and encrypted to sign the encrypted data. Figure 6 The table.sig.crypto (table.signature file.encryption) indicates the signature encrypted data.

[0210] S707: Splice the signature encrypted data to the end of the original image to obtain an image with signature encrypted information at the end.

[0211] In this step, the image with the signature encryption information at the end is the target firmware in the above embodiment, and the signature encryption information carried at the end is the encrypted data in the above embodiment. After the electronic device obtains the encrypted data, it splices the encrypted data to the original firmware to obtain the target firmware. For example, Figure 6After the signature encrypted data is spliced ​​to the original image, the image.sec (image.encrypted) file is obtained, that is, the image with signature encrypted information at the end. The image.sec file includes two parts: Original Image and table.sec (table.encrypted). Table.sec represents the tail data of the target firmware, that is, the encrypted data in the above embodiment.

[0212] Based on the above processing, the target firmware is obtained by encrypting the original firmware based on the summary of the specified data block in the original firmware, which can prevent the target firmware from being reverse analyzed and improve the safety of the battery device. In addition, the specified data block is a partial data block among the multiple data blocks in the original firmware. When verifying the target firmware later, it is only necessary to verify based on the partial data block in the target firmware, and there is no need to verify based on the entire target firmware, which can improve the startup speed of the battery device, that is, it can ensure the safety and startup speed of the battery device at the same time, and strike a balance between the safety and startup speed of the battery device.

[0213] Furthermore, since the values ​​of the first number M and the second number N can be set according to actual needs, the larger the first number is, the higher the safety of the battery device is; the larger the second number is, the faster the startup speed of the battery device is. Therefore, the values ​​of the first number M and the second number N can be adjusted according to actual needs to achieve a balance between the safety and startup speed of the battery device based on actual needs.

[0214] In addition, if the original firmware is obtained by compressing the image of the standard firmware, the target firmware of the battery device is more difficult to be reverse analyzed, which can improve the safety of the battery device. When the designated data block accounts for 18% of the data blocks in the original firmware, the security of the target firmware is the highest, which is close to the security of the method of determining each data block in the original firmware as a designated data block.

[0215] See also Figure 8 , Figure 8 This is a second schematic diagram of the data encryption method provided in the embodiment of the present application. Fig. 9 , Fig. 9 In accordance with Figure 8 The schematic diagram shown is a flow chart of a method for data encryption, the method comprising the following steps:

[0216] S901: Divide the original image into M groups.

[0217] In this step, the original image is the original firmware in the above embodiment, and the original firmware is divided to obtain multiple data groups. For example, Figure 8As shown, the original firmware is divided to obtain a total of M data groups numbered 1 to M, where M is the first number in the aforementioned embodiment. Figure 8 In the figure, 1 represents the first data group, 2 represents the second data group, and so on, M-1 represents the M-1th data group, and M represents the Mth data group.

[0218] S902: Divide each group into N blocks.

[0219] In this step, blocks refers to the data blocks in the above-mentioned embodiment. For each data group, the data group is divided into multiple data blocks. For example, Figure 8 As shown, each data group is divided to obtain N data blocks numbered 1 to N, where N is the second number in the aforementioned embodiment. Figure 8 In the figure, Group1 represents the first data group, and GroupM represents the Mth data group. For each data group, 1 represents the first data block in the data group, 2 represents the second data block in the data group, and so on, N-1 represents the N-1th data block in the data group, and N represents the Nth data block in the data group.

[0220] S903: Generate a random number table, which includes M random numbers, each of which represents the random number of blocks in each group that need to be protected (this block is defined as a secure block).

[0221] In this step, the security block is the designated data block in the above-mentioned embodiment. The electronic device generates a random number table including a first number of random numbers, and each random number in the random data table corresponds to each data group one by one. Then, for each data group, the electronic device determines, from each data block in the data group, a data block indicated by the random number corresponding to the data group as the designated data block in the data group.

[0222] For example, Figure 8In the Secure Block Random Table, a random number table is included, wherein the random number table includes multiple rand_nums (random numbers), rand_num1 is a random number corresponding to the first data group, i.e., the rand_num1-th data block in the first data group is a secure block in the first data group; rand_num2 is a random number corresponding to the second data group, i.e., the rand_num2-th data block in the second data group is a secure block in the second data group; rand_num3 is a random number corresponding to the third data group, i.e., the rand_num3-th data block in the third data group is a secure block in the third data group; and so on, rand_numM-1 is a random number corresponding to the M-1-th data group, i.e., the rand_numM-1-th data block in the M-1-th data group is a secure block in the M-1-th data group; and rand_numM is a random number corresponding to the M-th data group, i.e., the rand_numM-th data block in the M-th data group is a secure block in the M-1-th data group.

[0223] S904: Calculate a digest of the data in the security block using a digest algorithm.

[0224] In this step, for each data group, after the electronic device determines the specified data block in the data group, it can use a digest algorithm to calculate the digest of the specified data block in the data group. The digest algorithm can be SHA-256, MD5, SM3, etc. For example, Figure 8 As shown, the electronic device calculates the Digest of the rand_num1th data block in the first data group, recorded as Digest1; calculates the Digest of the rand_num2th data block in the second data group, recorded as Digest2, and so on, calculates the Digest of the rand_numMth data block in the Mth data group, recorded as DigestM.

[0225] S905: Encrypt and protect the data of the security block, and finally obtain an encrypted image of the random block.

[0226] In this step, the image of the random block being encrypted is the firmware to be processed in the above-mentioned embodiment. For each data group, after the electronic device determines the designated data block in the data group, it encrypts the designated data block in the data group based on the second encryption algorithm to obtain the encrypted designated data block; then, each designated data block in the original firmware is replaced with the corresponding encrypted designated data block to obtain the firmware to be processed.

[0227] For example, Figure 8In the step, the electronic device obtains image.crypto according to the security blocks in each data group. Image.crypto is the encrypted image of the random block in this step, that is, the firmware to be processed.

[0228] S906: Perform XOR processing on the digests of the security blocks in all groups to obtain a final digest.

[0229] In this step, the final summary is the summary of the original firmware in the above embodiment. After the electronic device obtains the summary of the specified data block in each data group, it performs an XOR operation on the summary of the specified data block to obtain the summary of the original firmware. For example, Figure 8 The XOR (exclusive OR) in the table represents an exclusive OR process, and Digest' is the final digest in this step, that is, the digest of the original firmware in the aforementioned embodiment. Digest1 and Digest2 are subjected to an exclusive OR operation to obtain a first operation result, and then the first operation result is subjected to an exclusive OR operation with Digest3, and so on, until the M-1th operation result is subjected to an exclusive OR operation with DigestM to obtain a digest of the original firmware.

[0230] S907: Use the signature algorithm and encryption algorithm to sign and encrypt the final summary, random number table, and M and N values ​​as a whole to obtain signature encrypted data.

[0231] In this step, the signature algorithm is the signature algorithm preset in the above embodiment, which can be RSA2048 algorithm, DSA, ECC algorithm; the encryption algorithm is the first encryption algorithm in the above embodiment, which can be AES algorithm, IDEA, PBE algorithm. The signature encrypted data is the encrypted data in the above embodiment, which can also be called tail data.

[0232] The electronic device may concatenate the summary of the original firmware, the multiple random numbers, the first number, and the second number in the order of the summary of the original firmware first, the multiple random numbers in the middle, and the first number and the second number last, to obtain a second concatenation result. Then, the second concatenation result is signed based on a preset signature algorithm to obtain signature data; and the signature data is encrypted based on the first encryption algorithm to obtain encrypted data.

[0233] For example, Figure 8 In Indicates the splicing operation in this step, Figure 8 In the process, the final summary, random number table, M and N are concatenated to obtain the concatenated result, and then the concatenated result is signed and encrypted to sign the encrypted data. Figure 8 The table.sig.crypto (table.signature file.encryption) indicates the signature encrypted data.

[0234] S908: Splice the signature encrypted data to the end of the image where the random block is encrypted, to obtain an image with signature encrypted information at the end.

[0235] In this step, the image with the signature encryption information at the end is the target firmware in the above embodiment, and the signature encryption information carried at the end is the encrypted data in the above embodiment. After the electronic device obtains the encrypted data, it splices the encrypted data to the original firmware to obtain the target firmware. For example, Figure 8 As shown, after the signature encrypted data is spliced ​​to the image where the random block is encrypted, the image.sec (image.encryption) file is obtained, that is, the image with signature encryption information at the end. The image.sec file includes two parts: image.sig.crypto (image.signature.encryption) and table.sec (table.encryption). Image.sig.crypto represents the image where the random block in the target firmware is encrypted, that is, the firmware to be processed in the aforementioned embodiment, and table.sec represents the tail data of the target firmware, that is, the encrypted data in the aforementioned embodiment.

[0236] Based on the above processing, the target firmware is obtained by encrypting the original firmware based on the summary of the specified data block in the original firmware, which can prevent the target firmware from being reverse analyzed and improve the safety of the battery device. In addition, the specified data block is a partial data block among the multiple data blocks in the original firmware. When verifying the target firmware later, it is only necessary to verify based on the partial data block in the target firmware, and there is no need to verify based on the entire target firmware, which can improve the startup speed of the battery device, that is, it can ensure the safety and startup speed of the battery device at the same time, and strike a balance between the safety and startup speed of the battery device.

[0237] Furthermore, since the values ​​of the first number M and the second number N can be set according to actual needs, the larger the first number is, the higher the safety of the battery device is; the larger the second number is, the faster the startup speed of the battery device is. Therefore, the values ​​of the first number M and the second number N can be adjusted according to actual needs to achieve a balance between the safety and startup speed of the battery device based on actual needs.

[0238] In addition, if the original firmware is obtained by compressing the image of the standard firmware, the target firmware of the battery device is more difficult to be reverse analyzed, which can improve the safety of the battery device. When the designated data block accounts for 18% of the data blocks in the original firmware, the security of the target firmware is the highest, which is close to the security of the method of determining each data block in the original firmware as a designated data block.

[0239] and Figure 1Corresponding to the data encryption method shown, the embodiment of the present application also provides a data verification method, which can be applied to battery equipment. The battery equipment can obtain the target firmware obtained based on the data encryption method in the aforementioned embodiment, and then verify whether the target firmware has been tampered with according to the data verification method provided in the embodiment of the present application. When it is determined that the target firmware has not been tampered with, the original firmware of the battery device can be determined based on the target firmware, and the original firmware can be started, and then the battery device can be controlled to work through the original firmware; when it is determined that the target firmware has been tampered with, it means that the original firmware may also be tampered with, and the original firmware may not be able to control the normal operation of the battery device, so the battery device is not started, which can improve the safety of the battery device. In addition, based on the data encryption method provided in the embodiment of the present application, the original firmware is encrypted based on part of the data blocks in the original firmware to obtain the target firmware. Based on the data verification method provided in the embodiment of the present application, when the battery device verifies the target firmware, it only needs to verify based on part of the data blocks of the target firmware, and does not need to verify based on the entire target firmware, which can also improve the startup speed of the battery device. That is, the safety and startup speed of the battery device can be guaranteed at the same time, and a balance can be achieved between the safety and startup speed of the battery device.

[0240] See also Fig.10 , Fig.10 The first flow chart of the data verification method provided in the embodiment of the present application may include the following steps:

[0241] S1001: Obtain target firmware.

[0242] The target firmware is obtained based on the data encryption method in the aforementioned embodiment.

[0243] S1002: Decrypt the target firmware to obtain the digest to be verified, the first number, and the firmware to be verified.

[0244] S1003: Divide the firmware to be verified into a plurality of data blocks, and determine a first number of designated data blocks from the plurality of data blocks.

[0245] S1004: For each designated data block, calculate a digest of the designated data block.

[0246] S1005: Perform a target operation on the digest of each designated data block to obtain a corresponding operation result as the digest of the firmware to be verified.

[0247] S1006: If the digest of the firmware to be verified is the same as the digest to be verified, determine the original firmware based on the firmware to be verified.

[0248] Based on the data verification method provided in the embodiment of the present application, the target firmware is obtained by encrypting the original firmware based on the summary of the specified data block in the original firmware, which can prevent the target firmware from being reverse analyzed and improve the safety of the battery device. In addition, when verifying the target firmware, the specified data block in the firmware to be verified obtained by decrypting the target firmware is obtained, and the target firmware is verified based on the specified data block, that is, only part of the data block in the target firmware needs to be verified, and verification is not required based on the entire target firmware, which can improve the startup speed of the battery device, that is, the safety and startup speed of the battery device can be guaranteed at the same time, and a balance can be achieved between the safety and startup speed of the battery device.

[0249] For step S1001 and step S1002, the target firmware is obtained based on the data encryption method in the above-mentioned embodiment. The target firmware is stored in the memory of the battery device and can be a software program for controlling the battery device to work. The battery device also includes a processor, and a software program for starting the target firmware runs in the processor. Accordingly, the data verification method provided in the embodiment of the present application can be executed by the processor of the battery device.

[0250] After the battery device obtains the target firmware, it can verify the target firmware. When it is determined that the target firmware has not been tampered with, the original firmware of the battery device is determined based on the target firmware, and the original firmware is started to control the battery device to work through the original firmware. Therefore, after obtaining the target firmware, the battery device needs to decrypt the target firmware to obtain the summary to be verified, the first number, and the firmware to be verified, so as to verify whether the target firmware has been tampered with according to the firmware to be verified.

[0251] In one implementation, if the electronic device concatenates the digest and the first number of the original firmware, and concatenates the concatenated result with the original firmware to obtain the target firmware. Accordingly, when the battery device verifies the target firmware, it directly splits the target firmware to obtain the digest to be verified, the first number, and the firmware to be verified. For example, the battery device extracts data from a designated field at the end of the target firmware, and the extracted data includes the digest to be verified and the first number, and the data in the target firmware other than the extracted data is the firmware to be verified.

[0252] In another implementation, after the electronic device obtains the concatenation result of the summary of the original firmware and the first number, it signs and encrypts the concatenation result to obtain encrypted data, and then uses the encrypted data to encrypt the original firmware to obtain the target firmware. Correspondingly, when the battery device verifies the target firmware, it first decrypts the target firmware to obtain the encrypted data and the firmware to be verified. Then the encrypted data is decrypted to obtain the first signature and the data to be verified, and the data to be verified is signed based on a preset signature algorithm to obtain a second signature. If the first signature is the same as the second signature, the verification of the data to be verified is passed, and the battery device obtains the summary to be verified and the first number from the encrypted data.

[0253] In another implementation, if the target firmware is obtained based on the summary of the original firmware, multiple random numbers, the first number, and the second number. When verifying the target firmware, if the target firmware has not been tampered with, the battery device decrypts the target firmware and can obtain the summary of the original firmware, multiple random numbers, the first number, the second number, and the original firmware; if the target firmware has been tampered with, the battery device decrypts the target firmware and may not be able to obtain the summary of the original firmware, multiple random numbers, the first number, the second number, and the original firmware. Therefore, the battery device can decrypt the target firmware and determine that the decrypted summary is the summary to be verified, and determine that the decrypted firmware is the firmware to be verified. Subsequently, based on the summary to be verified and the firmware to be verified, it is determined whether the target firmware has been tampered with.

[0254] Accordingly, in Fig.10 Based on Fig.11 , step S1002 may include the following steps:

[0255] S10021: Split the target firmware to obtain encrypted data and firmware to be verified.

[0256] S10022: Decrypt the encrypted data to obtain the data to be verified and the first signature.

[0257] S10023: Sign the data to be verified based on a preset signature algorithm to obtain a second signature.

[0258] S10024: If the first signature is identical to the second signature, determine the data to be verified as the decrypted data.

[0259] S10025: Split the decrypted data to obtain a summary to be verified, multiple random numbers, a first number, and a second number.

[0260] The battery device extracts data from the designated field at the tail of the target firmware to obtain encrypted data, and the data in the target firmware other than the extracted data is the firmware to be verified. Exemplarily, the target firmware is 100 bytes, and the battery device can determine to extract the data of the tail 25 bytes of the 100 bytes to obtain encrypted data. Accordingly, the data in the 75 bytes other than the tail 25 bytes of the target firmware is the firmware to be verified.

[0261] Then, the battery device can decrypt and verify the encrypted data. It can be understood that the algorithm used by the battery device to decrypt the encrypted data is the same as the algorithm used by the electronic device to encrypt the signature data obtained based on the summary of the original firmware, multiple random numbers, the first number and the second number; the algorithm used by the battery device to verify the encrypted data is the same as the algorithm used by the electronic device to sign the splicing result of the summary of the original firmware, multiple random numbers, the first number and the second number. Exemplarily, if the electronic device encrypts the splicing result based on the AES algorithm, the battery device will also decrypt the encrypted data based on the AES algorithm. If the first signature is the same as the second signature, the verification of the signature data to be verified is passed, and the battery device can determine the decryption data from the encrypted data, and split the decryption data to obtain the summary to be verified, multiple random numbers, the first number and the second number.

[0262] Based on the above processing, since the encrypted data of the target firmware is obtained based on multiple random numbers and second numbers, that is, the encrypted data of the target firmware is obtained based on more data, the difficulty of cracking the encrypted data of the target firmware can be increased, and the security of the encrypted data of the target firmware can be improved; and, since the encrypted data of the target firmware is obtained by signing and encryption, that is, the target firmware is obtained by multiple encryption, the difficulty of reverse analysis of the target firmware can be further increased, and the security of the battery equipment can be improved.

[0263] For step S1003, the electronic device may divide the firmware to be verified into multiple data blocks, and determine a first number of designated data blocks from the multiple data blocks. For example, the electronic device may determine the first data block and the last data block in the multiple data blocks as designated data blocks. Alternatively, the electronic device may divide the firmware to be verified into a first number of data groups, and then determine a designated data block from each data group.

[0264] Accordingly, in some embodiments, Fig.11 Based on Fig.12 , step S1003 may include the following steps:

[0265] S10031: Divide the firmware to be verified into a first number of data groups, and for each data group, divide the data group into a second number of data blocks.

[0266] S10032: For each data group, determine a designated data block from the data group.

[0267] The battery device divides the firmware to be verified into a first number of data groups according to the first number and the second number obtained by decryption; and then divides each data group into a second number of data blocks.

[0268] Since the electronic device divides the original firmware into a first number of data groups and divides each data group into a second number of data blocks when encrypting the original firmware, when the battery device verifies the target firmware to verify whether the target firmware has been tampered with, it is necessary to calculate the digest of the firmware to be verified in the target firmware in the same way as the electronic device calculates the digest of the original firmware, that is, the battery device also needs to divide the firmware to be verified into the first number of data groups and divide each data group into the second number of data blocks.

[0269] In some embodiments, after the battery device obtains the encrypted data, it can obtain the description information carried in the encrypted data, and the description information is used to indicate whether the data block in the firmware to be verified is an encrypted data block. If the description information carried in the encrypted data indicates that the data block in the firmware to be verified is not an encrypted data block, each designated data block in the firmware to be processed can be directly determined based on multiple random numbers. Multiple random numbers correspond to each data group one by one. Fig.12 Based on Fig.13 , step S10032 may include the following steps:

[0270] S100321: For each data group, determine the data block indicated by the random number corresponding to the data group from each data block in the data group, and obtain the designated data block in the data group.

[0271] The multiple random numbers obtained by the electronic device may be a random number table recording multiple random numbers, and each random number in the random number table corresponds to each data group one by one. For each data group, according to the arrangement order of each data group, the position of the data group in each data group (which may be called the third position) may be determined; for each random number in the random number table, according to the arrangement order of each random number in the random number table, the position of the random number in the random number table (which may be called the fourth position) may be determined. When the third position and the fourth position are the same, the data group located at the third position corresponds to the random number located at the fourth position. That is, the battery device may determine the random number corresponding to each data group. Furthermore, for each data group, the data group includes a second number of data blocks. According to the arrangement order of each data block in the data group, the position of each data block in the data group may be determined. Furthermore, the battery device determines the position indicated by the random number corresponding to the data group in each data block, and determines the data block at the position as the designated data block from each data block in the data group.

[0272] Based on the above processing, the designated data blocks in each data group are determined by multiple random numbers. For each data group, the designated data blocks in the data group are random, which can increase the difficulty of reverse analysis of the target firmware and improve the safety of the battery device.

[0273] In some embodiments, if the description information carried in the encrypted data indicates that the data block in the firmware to be verified is an encrypted data block, the battery device obtains multiple random numbers corresponding to each data group from the encrypted data, determines each encrypted data block in the firmware to be verified according to the multiple random numbers, and then determines each designated data block in the firmware to be verified according to each encrypted data block. Multiple random numbers correspond to each data group one by one. Accordingly, Fig.12 Based on Fig.14 , step S10032 may include the following steps:

[0274] S100322: For each data group, determine, from each data block in the data group, a data block indicated by a random number corresponding to the data group as an encrypted data block in the data group.

[0275] S100323: Decrypt the encrypted data block in the data group to obtain the specified data block in the data group.

[0276] Since the data blocks in the firmware to be verified are encrypted data blocks, the battery device needs to determine each encrypted data block in the firmware to be verified, and decrypt each encrypted data block to obtain each designated data block in the firmware to be verified.

[0277] The multiple random numbers obtained by the electronic device may be a random number table that records multiple random numbers, and each random number in the random number table corresponds to each data group one by one. For each data group, according to the arrangement order of each data group, the third position of the data group in each data group can be determined; for each random number in the random number table, according to the arrangement order of each random number in the random number table, the fourth position of the random number in the random number table can be determined. When the third position and the fourth position are the same, the data group at the third position corresponds to the random number at the fourth position. That is, the battery device can determine the random number corresponding to each data group.

[0278] For each data group, the data group includes a second number of data blocks. According to the arrangement order of each data block in the data group, the position of each data block in the data group can be determined. Then, the battery device determines the position indicated by the random number corresponding to the data group in each data block, and determines the data block at the position as an encrypted data block from the data blocks in the data group, that is, determines the encrypted data block in the data group.

[0279] For each data group in the firmware to be verified, the battery device can decrypt the encrypted data block in the data group to obtain the specified data block in the data group. And it can be understood that the algorithm used by the battery device to decrypt the encrypted data block is the same as the algorithm used by the electronic device to encrypt the specified data block.

[0280] Exemplarily, if the electronic device encrypts a specified data block in the first data group of the original firmware based on the AES algorithm, the battery device also decrypts the encrypted data block in the first data group of the firmware to be verified based on the AES algorithm.

[0281] Based on the above processing, each designated data block in the target firmware is: determined based on multiple random numbers, which can increase the difficulty of reverse analysis of the target firmware and improve the safety of the battery device. In addition, when verifying the target firmware, it is only necessary to decrypt based on part of the encrypted data blocks in the target firmware, without decrypting based on the entire target firmware, that is, it is not necessary to verify based on the entire target firmware, which can increase the startup speed of the battery device, that is, it can simultaneously ensure the safety and startup speed of the battery device, and strike a balance between the safety and startup speed of the battery device.

[0282] With respect to step S1004, after the battery device determines each designated data block, a digest algorithm may be used to calculate a digest of each designated data block, wherein the digest algorithm may be SHA-256, MD5, SM3, etc.

[0283] Furthermore, the digest algorithm used by the battery device when calculating the digest of the specified data block is the same as the digest algorithm used by the electronic device when calculating the digest of the specified data block. For example, if the electronic device uses SM3 to calculate the digest of the specified data block, the battery device also uses SM3 to calculate the digest of the specified data block.

[0284] With respect to step S1005, after the battery device calculates the digest of each designated data block, in order to verify whether the original firmware has been tampered with based on the digest of each designated data block, it is necessary to calculate the digest of the firmware to be verified in the same manner as the electronic device calculates the digest of the original firmware. That is, the way in which the battery device performs a target operation on the digest of each designated data block is the same as the way in which the electronic device performs a target operation on the digest of each designated data block in the original firmware. Exemplarily, if the electronic device uses an XOR operation to determine the digest of the original firmware, the battery device also uses an XOR operation to determine the digest of the firmware to be verified.

[0285] For step S1006, if the digest of the firmware to be verified is different from the digest to be verified, the firmware to be verified may not be the original firmware, or the digest to be verified is not the digest of the original firmware, that is, the target firmware has been tampered with, then the original firmware may also be tampered with, and the original firmware may not be able to control the normal operation of the battery device. At this time, the battery device may not be started.

[0286] If the digest of the firmware to be verified is the same as the digest to be verified, it indicates that the target firmware has not been tampered with, and the battery device determines the original firmware based on the target firmware. At this time, if the description information carried in the encrypted data indicates that the data block in the firmware to be verified is not an encrypted data block, it indicates that the data to be verified does not include an encrypted data block, and the battery device can directly determine that the firmware to be verified is the original firmware.

[0287] In some embodiments, if the descriptive information carried in the encrypted data indicates that the data block in the firmware to be verified is an encrypted data block, step S1006 includes the following steps: if the summary of the firmware to be verified is the same as the summary to be verified, replace each encrypted data block in the firmware to be verified with the corresponding specified data block to obtain the original firmware.

[0288] Since the description information carried in the encrypted data indicates that the data block in the firmware to be verified is an encrypted data block, the firmware to be verified is obtained by encrypting some data blocks in the original firmware. Therefore, in order to obtain the original firmware, the battery device replaces each encrypted data block in the firmware to be verified with a corresponding designated data block, and the designated data block is obtained by decrypting the encrypted data block. Then, the original firmware can be obtained.

[0289] Subsequently, the battery device can be controlled to work through the original firmware, that is, the battery device is safely started.

[0290] See also Fig.15 , Fig.15 This is a schematic diagram of the data verification method provided in the embodiment of the present application. Fig.16 , Fig.16 In accordance with Fig.15 The method for data verification is a flowchart of the schematic diagram shown in the figure, and the method comprises the following steps:

[0291] S1601: Extract the tail data and the image, where the tail data is the final summary, random number table, and M and N values ​​encrypted using the signature algorithm and encryption algorithm. Then decrypt and unsign the tail data. After the signature verification is passed, enter S1602, otherwise the verification fails.

[0292] In this step, the tail data is the encrypted data in the aforementioned embodiment, the image is the firmware to be verified in the aforementioned embodiment, the final summary is the summary to be verified in the aforementioned embodiment, M is the first number in the aforementioned embodiment, and N is the second number in the aforementioned embodiment. The battery device extracts the data of the specified field in the tail of the target firmware to obtain encrypted data, and the encrypted data includes the summary to be verified, multiple random numbers, the first number, and the second number. The battery device decrypts the encrypted data to obtain the data to be verified and the first signature; and signs the data to be verified based on a preset signature algorithm to obtain the second signature. If the first signature is the same as the second signature, the verification of the data to be verified passes, and the battery device can determine the summary to be verified, the multiple random numbers, the first number, and the second number from the encrypted data.

[0293] For example, Fig.15 In the figure, image.sec (image.encryption) is an image with signature encryption information at the end, that is, the target firmware in the aforementioned embodiment; cipher_table.bin (encryption_table.binary file) is the tail data, that is, the encrypted data in the aforementioned embodiment; image.sig.crypto (image.signature.encryption) is the firmware to be verified in the aforementioned embodiment. Fig.15The Digest' in is the final digest in this step, i.e., the digest to be verified in the above embodiment; the Secure Block Random Table is a random number table, and the security block is the designated data block in the above embodiment. The random number table includes multiple rand_nums (random numbers). rand_num1 is the random number corresponding to the first data group, that is, the rand_num1th data block in the first data group is the security block in the first data group; rand_num2 is the random number corresponding to the second data group, that is, the rand_num2th data block in the second data group is the security block in the second data group; rand_num3 is the random number corresponding to the third data group, that is, the rand_num3th data block in the third data group is the security block in the third data group; and so on, rand_numM-1 is the random number corresponding to the M-1th data group, that is, the rand_num M-1th data block in the M-1th data group is the security block in the M-1th data group; rand_numM is the random number corresponding to the Mth data group, that is, the rand_numMth data block in the Mth data group is the security block in the Mth data group.

[0294] The battery device splits image.sec (i.e., the target firmware) into cipher_table.bin (i.e., encrypted data) and image.sig.crypto (i.e., the firmware to be verified), and decrypts cipher_table.bin to obtain the data to be verified and the first signature; the data to be verified is signed based on a preset signature algorithm to obtain a second signature. If the first signature is the same as the second signature, the verification of the data to be verified passes. Furthermore, the battery device can obtain Digest' (i.e., the summary to be verified), Secure Block Random Table (i.e., multiple random numbers), M (i.e., the first number), and N (i.e., the second number) carried in cipher_table.bin.

[0295] S1602: According to the random number table and the M and N information, each grouped security block in the image is processed as follows: if the image is randomly divided into blocks and encrypted and signed, first use the corresponding decryption algorithm to decrypt it, and then directly calculate the summary of the security block; if the image is randomly divided into blocks and signed, then directly calculate the summary of the security block.

[0296] In this step, the battery device divides the firmware to be verified into multiple data groups, each of which includes multiple data blocks. For each data group, the security block in the data group is the data block indicated by the random number corresponding to the data group in the aforementioned embodiment. If the data block in the firmware to be verified is an encrypted data block, then for each data group, the battery device determines the encrypted data block in the data group according to the random number table, and then decrypts the encrypted data block to obtain the corresponding designated data block. Then, a digest algorithm is used to calculate the digest of the designated data block in the data group. The digest algorithm can be SHA-256, MD5, SM3, etc.

[0297] If the data block in the firmware to be verified is not an encrypted data block, the battery device directly determines the designated data block in each data group according to the random number table, and then calculates the digest of each designated data block.

[0298] For example, Fig.15 In the embodiment, the battery device divides image.sig.crypto (ie, the firmware to be verified) to obtain a total of M data groups numbered 1 to M, where M is the first number in the aforementioned embodiment. Fig.15 In the figure, 1 represents the first data group, 2 represents the second data group, and so on, M-1 represents the M-1th data group, and M represents the Mth data group.

[0299] If the security block in the firmware to be verified is an encrypted data block, the battery device decrypts the encrypted data block in the first data group to obtain the specified data block corresponding to the first data group; decrypts the encrypted data block in the second data group to obtain the specified data block corresponding to the second data group, and so on, decrypts the encrypted data block in the Mth data group to obtain the specified data block corresponding to the Mth data group. Then, the battery device uses each specified data block to replace the corresponding encrypted data block in image.sig.crypto (i.e., the firmware to be verified) to obtain the Original Image.

[0300] If the security block in the firmware to be verified is not an encrypted data block, the battery device directly determines that image.sig.crypto is the Original Image.

[0301] Furthermore, the battery device can calculate the digest of each specified data block in the original image.

[0302] S1603: XOR the digests of all the groups to obtain a final digest.

[0303] In this step, the final summary is the summary of the firmware to be verified in the above embodiment. After the battery device obtains the summary of the specified data block in each data group, it performs an XOR operation on the summary of the specified data block to obtain the summary of the firmware to be verified. For example, Fig.15 The XOR (exclusive OR) in the expression represents exclusive OR processing, and "Digest" is the final digest in this step, that is, the digest of the firmware to be verified in the aforementioned embodiment. Digest1 and Digest2 are subjected to an exclusive OR operation to obtain a first operation result, and then the first operation result and Digest3 are subjected to an exclusive OR operation, and so on, until the M-1th operation result is subjected to an exclusive OR operation with DigestM to obtain the digest "Digest" of the firmware to be verified.

[0304] S1604: The final digest is consistent with the digest obtained in S1601, and the verification is passed. If the original firmware is randomly encrypted, the decrypted image can be obtained at this time; otherwise, the verification fails.

[0305] In this step, the battery device determines whether the digest of the firmware to be verified is the same as the digest to be verified.

[0306] If the digest of the firmware to be verified is different from the digest to be verified, it indicates that the target firmware has been tampered with, and the original firmware may also be tampered with. The original firmware may not be able to control the normal operation of the battery device. In this case, the battery device may not be started.

[0307] If the digest of the firmware to be verified is the same as the digest to be verified, it indicates that the target firmware has not been tampered with, and the battery device determines the original firmware based on the target firmware. At this time, if the data block in the firmware to be verified is not an encrypted data block, it indicates that the data to be verified does not include an encrypted data block, and the battery device can directly determine that the firmware to be verified is the original firmware.

[0308] Furthermore, if the data block in the firmware to be verified is an encrypted data block, at this time, since the battery device replaces the corresponding encrypted data block with each designated data block, the battery device can obtain the original firmware. Subsequently, the battery device is controlled to work according to the original firmware, that is, the battery device is safely started.

[0309] Fig.15In the process, the battery device determines whether Digest' (i.e., the digest to be verified) and Digest" (i.e., the digest of the firmware to be verified) are the same. If Digest' and Digest" are the same, it indicates that the target firmware has not been tampered with. The battery device determines that the data verification is passed, then the battery device determines the original firmware based on the target firmware, and controls the battery device to work according to the original firmware, that is, the battery device starts safely; if Digest' and Digest" are different, it indicates that the target firmware has been tampered with, then the original firmware may also be tampered with, and the original firmware may not be able to control the normal operation of the battery device. At this time, the battery device may not be started.

[0310] Based on the above processing, the target firmware is obtained by encrypting the original firmware based on the summary of the specified data block in the original firmware, which can prevent the target firmware from being reverse analyzed and improve the safety of the battery device. In addition, when verifying the target firmware, the specified data block in the firmware to be verified obtained by decrypting the target firmware is obtained, and the target firmware is verified based on the specified data block, that is, only part of the data block in the target firmware needs to be verified, and verification based on the entire target firmware is not required, which can improve the startup speed of the battery device, that is, the safety and startup speed of the battery device can be guaranteed at the same time, and a balance can be achieved between the safety and startup speed of the battery device.

[0311] Based on the same inventive concept as the above-mentioned data encryption method, the embodiment of the present application also provides a data encryption device. Fig.17 , Fig.17 A structural diagram of a data encryption device provided in an embodiment of the present application, the device includes:

[0312] The original firmware acquisition module 1701 is used to acquire the original firmware of the battery device;

[0313] A division module 1702 is used to divide the original firmware into a plurality of data blocks, and determine a first number of designated data blocks from the plurality of data blocks;

[0314] A digest calculation module 1703, used for calculating the digest of each designated data block;

[0315] A digest processing module 1704 is used to perform a target operation on the digest of each designated data block to obtain a corresponding operation result as the digest of the original firmware;

[0316] The encryption module 1705 is used to encrypt the original firmware based on the digest of the original firmware and the first number to obtain the target firmware.

[0317] Optionally, the division module 1702 is specifically configured to:

[0318] Dividing the original firmware into a first number of data groups, and for each data group, dividing the data group into a second number of data blocks;

[0319] For each data group, a designated data block is determined from the data group.

[0320] Optionally, the division module 1702 is specifically configured to:

[0321] Obtaining a plurality of random numbers; wherein the plurality of random numbers correspond one-to-one to each data group;

[0322] For each data group, a data block indicated by a random number corresponding to the data group is determined from among the data blocks in the data group as a designated data block in the data group.

[0323] Optionally, the encryption module 1705 is specifically used for:

[0324] concatenating the digest of the original firmware, the multiple random numbers, the first number, and the second number to obtain a concatenated result;

[0325] Signing the splicing result based on a preset signature algorithm to obtain signature data;

[0326] Encrypting the signature data based on a first encryption algorithm to obtain encrypted data;

[0327] The original firmware is encrypted based on the encrypted data to obtain the target firmware.

[0328] Optionally, the encryption module 1705 is specifically used for:

[0329] The original firmware and the encrypted data are concatenated to obtain the target firmware.

[0330] Optionally, the encryption module 1705 is specifically used for:

[0331] For each data group, encrypting a designated data block in the data group based on a second encryption algorithm to obtain an encrypted designated data block;

[0332] A replacement module, used to replace each designated data block in the original firmware with a corresponding encrypted designated data block to obtain a firmware to be processed;

[0333] The firmware to be processed and the encrypted data are concatenated to obtain the target firmware.

[0334] Based on the data encryption device provided in the embodiment of the present application, the target firmware is obtained by encrypting the original firmware based on the summary of the specified data block in the original firmware, which can prevent the target firmware from being reverse analyzed and improve the safety of the battery device. In addition, the specified data block is a partial data block among the multiple data blocks in the original firmware. When the target firmware is subsequently verified, it is only necessary to verify based on the partial data block in the target firmware, and there is no need to verify based on the entire target firmware, which can improve the startup speed of the battery device, that is, it can simultaneously ensure the safety and startup speed of the battery device, and strike a balance between the safety and startup speed of the battery device.

[0335] Based on the same inventive concept as the above data verification method, the present application embodiment also provides a data verification device. Fig.18 , Fig.18 A structural diagram of a data verification device provided in an embodiment of the present application, the device includes:

[0336] A target firmware acquisition module 1801 is used to acquire target firmware; wherein the target firmware is obtained based on any data encryption method described in the first aspect above;

[0337] A decryption module 1802, configured to decrypt the target firmware to obtain a summary to be verified, a first number, and the firmware to be verified;

[0338] A division module 1803 is used to divide the firmware to be verified into multiple data blocks, and determine a first number of designated data blocks from the multiple data blocks;

[0339] A digest calculation module 1804 is used to calculate the digest of each designated data block;

[0340] The digest processing module 1805 is used to perform a target operation on the digest of each designated data block to obtain a corresponding operation result as the digest of the firmware to be verified;

[0341] The original firmware determining module 1806 is configured to determine the original firmware based on the firmware to be verified if the digest of the firmware to be verified is the same as the digest to be verified.

[0342] Optionally, the decryption module 1802 is specifically used for:

[0343] Splitting the target firmware to obtain encrypted data and firmware to be verified;

[0344] Decrypting the encrypted data to obtain the data to be verified and the first signature;

[0345] Signing the data to be verified based on a preset signature algorithm to obtain a second signature;

[0346] If the first signature is identical to the second signature, determining the data to be verified as the decrypted data;

[0347] The decrypted data is split to obtain a summary to be verified, multiple random numbers, a first number, and a second number.

[0348] Optionally, the division module 1803 is specifically used to:

[0349] Dividing the firmware to be verified into a first number of data groups, and for each data group, dividing the data group into a second number of data blocks;

[0350] For each data group, a designated data block is determined from the data group.

[0351] Optionally, the multiple random numbers correspond one-to-one to each data group;

[0352] The division module 1803 is specifically used for:

[0353] For each data group, the data block indicated by the random number corresponding to the data group is determined from each data block in the data group to obtain the designated data block in the data group.

[0354] Optionally, the multiple random numbers correspond one-to-one to each data group;

[0355] The division module 1803 is specifically used for:

[0356] For each data group, determine, from each data block in the data group, a data block indicated by a random number corresponding to the data group as an encrypted data block in the data group;

[0357] The encrypted data block in the data group is decrypted to obtain the specified data block in the data group.

[0358] Optionally, the original firmware determination module 1806 is specifically configured to:

[0359] Each encrypted data block in the firmware to be verified is replaced with a corresponding designated data block to obtain the original firmware.

[0360] Based on the data verification device provided in the embodiment of the present application, the target firmware is obtained by encrypting the original firmware based on the summary of the specified data block in the original firmware, which can prevent the target firmware from being reverse analyzed and improve the safety of the battery device. In addition, when verifying the target firmware, the specified data block in the firmware to be verified obtained by decrypting the target firmware is obtained, and the target firmware is verified based on the specified data block, that is, only part of the data block in the target firmware needs to be verified, and verification based on the entire target firmware is not required, which can improve the startup speed of the battery device, that is, the safety and startup speed of the battery device can be guaranteed at the same time, and a balance can be achieved between the safety and startup speed of the battery device.

[0361] The present application also provides an electronic device, such as Fig.19 As shown, including:

[0362] Memory 1901, used for storing computer programs;

[0363] The processor 1902 is used to implement the steps of any data encryption method in the above embodiments when executing the program stored in the memory 1901.

[0364] In addition, the electronic device may further include a communication bus and / or a communication interface, and the processor 1902, the communication interface, and the memory 1901 communicate with each other via the communication bus.

[0365] The present application also provides a battery device, such as Fig. 20 As shown, including:

[0366] Memory 2001, used for storing computer programs;

[0367] The processor 2002 is used to implement the steps of any data verification method in the above embodiments when executing the program stored in the memory 2001.

[0368] Furthermore, the electronic device may further include a communication bus and / or a communication interface, and the processor 2002, the communication interface, and the memory 2001 communicate with each other via the communication bus.

[0369] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0370] The communication interface is used for communication between the above electronic device and other devices.

[0371] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0372] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0373] In another embodiment provided in the present application, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned data encryption methods are implemented.

[0374] In another embodiment provided in the present application, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned data verification methods are implemented.

[0375] In another embodiment provided by the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute any of the data encryption methods in the above embodiments.

[0376] In another embodiment provided in the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute any of the data verification methods in the above embodiments.

[0377] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or other media (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0378] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0379] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, electronic device, battery device, computer-readable storage medium, and computer program product embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0380] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application are included in the protection scope of the present application.

Claims

1. A data encryption method, characterized in that: The method comprises: Get the original firmware of the battery device; Dividing the original firmware into a plurality of data blocks, and determining a first number of designated data blocks from the plurality of data blocks; For each specified data block, calculate a summary of the specified data block; Performing a target operation on the digest of each designated data block to obtain a corresponding operation result as the digest of the original firmware; The original firmware is encrypted based on the digest of the original firmware and the first number to obtain the target firmware.

2. The method according to claim 1, characterized in that The step of dividing the original firmware into a plurality of data blocks and determining a first number of designated data blocks from the plurality of data blocks comprises: Dividing the original firmware into a first number of data groups, and for each data group, dividing the data group into a second number of data blocks; For each data group, a designated data block is determined from the data group.

3. The method according to claim 2, characterized in that The step of determining a designated data block from each data group includes: Obtaining a plurality of random numbers; wherein the plurality of random numbers correspond one-to-one to each data group; For each data group, a data block indicated by a random number corresponding to the data group is determined from among the data blocks in the data group as a designated data block in the data group.

4. The method according to claim 3, characterized in that The step of encrypting the original firmware based on the digest of the original firmware and the first number to obtain the target firmware includes: concatenating the digest of the original firmware, the multiple random numbers, the first number, and the second number to obtain a concatenated result; Signing the splicing result based on a preset signature algorithm to obtain signature data; Encrypting the signature data based on a first encryption algorithm to obtain encrypted data; The original firmware is encrypted based on the encrypted data to obtain the target firmware.

5. The method according to claim 4, characterized in that The step of encrypting the original firmware based on the encrypted data to obtain the target firmware includes: The original firmware and the encrypted data are concatenated to obtain the target firmware.

6. The method according to claim 4, characterized in that The step of encrypting the original firmware based on the encrypted data to obtain the target firmware includes: For each data group, encrypting a designated data block in the data group based on a second encryption algorithm to obtain an encrypted designated data block; Replacing each designated data block in the original firmware with the corresponding encrypted designated data block to obtain the firmware to be processed; The firmware to be processed and the encrypted data are concatenated to obtain the target firmware.

7. A data verification method, characterized in that: The method comprises: Obtain target firmware; wherein the target firmware is obtained based on the data encryption method according to any one of claims 1 to 6; Decrypting the target firmware to obtain the digest to be verified, the first number and the firmware to be verified; Dividing the firmware to be verified into a plurality of data blocks, and determining a first number of designated data blocks from the plurality of data blocks; For each specified data block, calculate a summary of the specified data block; Performing a target operation on the digest of each designated data block to obtain a corresponding operation result as the digest of the firmware to be verified; If the digest of the firmware to be verified is the same as the digest to be verified, the original firmware is determined based on the firmware to be verified.

8. The method according to claim 7, characterized in that The step of decrypting the target firmware number to obtain the summary to be verified, the first number and the firmware to be verified includes: Splitting the target firmware to obtain encrypted data and firmware to be verified; Decrypting the encrypted data to obtain the data to be verified and the first signature; Signing the data to be verified based on a preset signature algorithm to obtain a second signature; If the first signature is identical to the second signature, determining the data to be verified as the decrypted data; The decrypted data is split to obtain a summary to be verified, multiple random numbers, a first number, and a second number.

9. The method according to claim 8, characterized in that The step of dividing the firmware to be verified into a plurality of data blocks and determining a first number of designated data blocks from the plurality of data blocks comprises: Dividing the firmware to be verified into a first number of data groups, and for each data group, dividing the data group into a second number of data blocks; For each data group, a designated data block is determined from the data group.

10. The method according to claim 9, characterized in that The multiple random numbers correspond one-to-one to each data group; The step of determining a designated data block from each data group includes: For each data group, the data block indicated by the random number corresponding to the data group is determined from each data block in the data group to obtain the designated data block in the data group.

11. The method according to claim 9, characterized in that The multiple random numbers correspond one-to-one to each data group; The step of determining a designated data block from each data group includes: For each data group, determine, from each data block in the data group, a data block indicated by a random number corresponding to the data group as an encrypted data block in the data group; The encrypted data block in the data group is decrypted to obtain the specified data block in the data group.

12. The method according to claim 11, characterized in that The determining the original firmware based on the firmware to be verified includes: Each encrypted data block in the firmware to be verified is replaced with a corresponding specified data block to obtain the original firmware.

13. A data encryption device, characterized in that: The device comprises: An original firmware acquisition module is used to acquire the original firmware of the battery device; a partitioning module, configured to partition the original firmware into a plurality of data blocks, and determine a first number of designated data blocks from the plurality of data blocks; A summary calculation module, used for calculating the summary of each specified data block; A summary processing module, used for performing a target operation on the summary of each designated data block to obtain a corresponding operation result as the summary of the original firmware; The encryption module is used to encrypt the original firmware based on the digest of the original firmware and the first number to obtain the target firmware.

14. The device according to claim 13, characterized in that The division module is specifically used for: Dividing the original firmware into a first number of data groups, and for each data group, dividing the data group into a second number of data blocks; For each data group, a designated data block is determined from the data group.

15. The device according to claim 14, characterized in that The division module is specifically used for: Obtaining a plurality of random numbers; wherein the plurality of random numbers correspond one-to-one to each data group; For each data group, a data block indicated by a random number corresponding to the data group is determined from among the data blocks in the data group as a designated data block in the data group.

16. The device according to claim 15, characterized in that The encryption module is specifically used for: concatenating the digest of the original firmware, the multiple random numbers, the first number, and the second number to obtain a concatenated result; Signing the splicing result based on a preset signature algorithm to obtain signature data; Encrypting the signature data based on a first encryption algorithm to obtain encrypted data; The original firmware is encrypted based on the encrypted data to obtain the target firmware.

17. The device according to claim 16, characterized in that The encryption module is specifically used for: The original firmware and the encrypted data are concatenated to obtain the target firmware.

18. The device according to claim 16, characterized in that The encryption module is specifically used for: For each data group, encrypting a designated data block in the data group based on a second encryption algorithm to obtain an encrypted designated data block; Replacing each designated data block in the original firmware with the corresponding encrypted designated data block to obtain the firmware to be processed; The firmware to be processed and the encrypted data are concatenated to obtain the target firmware.

19. A data verification device, characterized in that: The device comprises: A target firmware acquisition module, used to acquire target firmware; wherein the target firmware is obtained based on the data encryption method according to any one of claims 1 to 6; A decryption module, used to decrypt the target firmware to obtain the summary to be verified, the first number and the firmware to be verified; A division module, used for dividing the firmware to be verified into a plurality of data blocks, and determining a first number of designated data blocks from the plurality of data blocks; A summary calculation module, used for calculating the summary of each specified data block; A summary processing module, used for performing a target operation on the summary of each designated data block to obtain a corresponding operation result as the summary of the firmware to be verified; The original firmware determining module is used to determine the original firmware based on the firmware to be verified if the digest of the firmware to be verified is the same as the digest to be verified.

20. The device according to claim 19, characterized in that The decryption module is specifically used for: Splitting the target firmware to obtain encrypted data and firmware to be verified; Decrypting the encrypted data to obtain the data to be verified and the first signature; Signing the data to be verified based on a preset signature algorithm to obtain a second signature; If the first signature is identical to the second signature, determining the data to be verified as the decrypted data; The decrypted data is split to obtain a summary to be verified, multiple random numbers, a first number, and a second number.

21. The device according to claim 20, characterized in that The division module is specifically used for: Dividing the firmware to be verified into a first number of data groups, and for each data group, dividing the data group into a second number of data blocks; For each data group, a designated data block is determined from the data group.

22. The device according to claim 21, characterized in that The multiple random numbers correspond one-to-one to each data group; The division module is specifically used for: For each data group, the data block indicated by the random number corresponding to the data group is determined from each data block in the data group to obtain the designated data block in the data group.

23. The device according to claim 21, characterized in that The multiple random numbers correspond one-to-one to each data group; The division module is specifically used for: For each data group, determine, from each data block in the data group, a data block indicated by a random number corresponding to the data group as an encrypted data block in the data group; The encrypted data block in the data group is decrypted to obtain the specified data block in the data group.

24. The device according to claim 23, characterized in that The original firmware determination module is specifically used for: Each encrypted data block in the firmware to be verified is replaced with a corresponding specified data block to obtain the original firmware.

25. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, for implementing any of the methods described in claims 1-6 when executing a program stored in a memory.

26. A battery device, characterized in that: include: Memory, used to store computer programs; A processor, for implementing any of the methods described in claims 7-12 when executing a program stored in a memory.

27. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

28. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 7 to 12 is implemented.

Images