Enhanced encryption method and device based on white-box encryption algorithm

Abstract

The invention provides an enhanced encryption method based on a white-box encryption algorithm. The method comprises the following steps: acquiring a unique equipment identifier of an application server which deploys the white-box encryption algorithm; generating a permission application file and an auxiliary key according to the equipment unique identifier, and generating a to-be-signed file according to the permission application file; signing according to the permission application file to obtain a signature value; forming a signature permission file through the signature value and the management information; and generating a white-box algorithm library according to the auxiliary key, and writing the signature license file into the white-box algorithm library. According to the method, the device unique identifier of the application server is obtained, the white-box algorithm library is encrypted through the auxiliary key, and the device unique identifier is encrypted in the transmission process, so that the security and availability of the operating environment of the white-box encryption algorithm are greatly enhanced, and the white-box encryption algorithm is effectively prevented from being abused after being tampered in the operating environment.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an enhanced encryption method and device based on a white-box encryption algorithm. Background Art

[0002] White-box cryptography provides a method to perform encryption in a completely transparent environment. Despite being completely transparent, encryption and decryption procedures can protect sensitive data without leaking it.

[0003] The existing technologies in the application of white-box encryption algorithms mainly focus on protecting the algorithms themselves, for example, by increasing the complexity of the algorithms or hiding key information to prevent cracking. However, these technologies have significant deficiencies in preventing the white-box algorithms themselves from being abused.

[0004] White-box cryptographic algorithms deployed on terminal devices or servers, although they may be quite secure at the algorithm level, do not fully consider the security of the operating environment. This means that even if the algorithm itself is difficult to crack, attackers may still abuse the algorithm through other means, such as copying the white-box cryptographic algorithm to run on unauthorized devices, or tampering with the behavior of the algorithm in the operating environment. In addition, the application of existing technologies in virtualized environments such as Docker is also problematic. Due to the abstractness and dynamism of these environments, traditional hardware- or operating system-level protection measures are difficult to apply directly. This makes white-box algorithms running in these environments more vulnerable to the risk of unauthorized copying and abuse. Summary of the invention

[0005] In view of the above problems, the present application is proposed to provide an enhanced encryption method and device based on a white box encryption algorithm to overcome the above problems or at least partially solve the above problems, including: An enhanced encryption method based on a white box encryption algorithm comprises the following steps: Obtain the unique device identifier of the application server that deploys the white-box encryption algorithm; Generate a license application file and an auxiliary key based on the unique identifier of the device, and generate a file to be signed based on the license application file; Sign the file to be signed according to the license application file to obtain a signature value, and form a signed license file through the signature value and management information; A white box algorithm library is generated according to the auxiliary key, and the signed license file is written into the white box algorithm library. Furthermore, the step of generating a license application file and an auxiliary key according to the unique identifier of the device, and generating a file to be signed according to the license application file includes: Generate a license application file and an auxiliary key through the unique identification of the device; Sending the license application document to the corresponding management platform; Obtaining a license application document through the management platform, and generating relevant management information based on the license application document; The relevant management information is encapsulated into a file to be signed.

[0006] Furthermore, the step of generating a license application file and an auxiliary key by using the unique device identifier includes: Sending the unique identifier of the device to the management platform; Acquire, through the management platform, an auxiliary key generated by the unique identifier of the device; A white-box algorithm library encrypted by a white-box key table is generated by the auxiliary key.

[0007] Further, the license application file is a license application file, the management platform is a license management platform, and the step of obtaining the license application file through the management platform and generating relevant management information according to the license application file includes: Generate relevant management information according to the license application document, wherein the relevant management information includes product ID, license validity period and device unique identifier; The management platform signs the license application file as a file to be signed, generates a signature value, and combines the product ID, license validity period, and signature value into a signed license file.

[0008] Furthermore, the step of writing the signed license file into the white box algorithm library further includes: When the white-box algorithm library is loaded, the device unique identifier is obtained, and the signature license file is verified. If it fails, an error is reported and the system exits. An auxiliary key is then generated based on the device unique identifier, and a decryption operation is performed on the white-box key table in the white-box algorithm library. After the decryption is successful, the white-box algorithm library is loaded successfully.

[0009] Furthermore, it also includes: When the white box encryption algorithm is deployed in a docker container or a physical server of an application system, a machine code generated according to the hardware information of the host machine or the physical server of the docker container is obtained, and the machine code is set as a unique device identifier, wherein the machine code is generated by a dedicated server running on the host machine or the physical server of the docker container.

[0010] Furthermore, it also includes: When the docker container or the physical server is started, the device unique identifier is obtained through the network SSL encryption channel of the host machine of the docker container or the physical server.

[0011] An enhanced encryption device based on a white box encryption algorithm, comprising: An acquisition module, used to obtain a unique device identifier of an application server that deploys a white-box encryption algorithm; A conversion module, used to generate a license application file and an auxiliary key according to the unique identifier of the device, and convert the license application file into a to-be-signed file in a signable format; A signature module, used to sign the file to be signed to obtain a signature value; and to form a signature permission file through the signature value and management information; The enhancement module is used to generate a white box algorithm library according to the auxiliary key, and write the signature license file into the algorithm library of the white box encryption algorithm to enhance the application security of the white box encryption algorithm.

[0012] A computer device comprises a processor, a memory and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the enhanced encryption method based on the white box encryption algorithm described in any one of the above is implemented.

[0013] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the enhanced encryption method based on the white-box encryption algorithm described in any one of the above is implemented.

[0014] This application has the following advantages: In the embodiment of the present application, compared with the disadvantage of only protecting the white-box encryption algorithm itself in the prior art without considering the running environment of the white-box encryption algorithm, the present application provides a solution to protect the running environment of the white-box encryption algorithm, specifically an enhanced encryption method based on the white-box encryption algorithm, including the steps of: obtaining the device unique identifier of the application server deploying the white-box encryption algorithm; generating a license application file and an auxiliary key according to the device unique identifier, and generating a file to be signed according to the license application file; signing the file to be signed according to the license application file to obtain a signature value; and forming a signed license file through the signature value and management information; encrypting the white-box key table according to the auxiliary key to generate a white-box algorithm library, and writing the signed license file into the white-box algorithm library. By obtaining the device unique identifier of the application server and encrypting the device unique identifier during transmission, the security and availability of the running environment of the white-box encryption algorithm are greatly enhanced, and the abuse of the white-box encryption algorithm after the running environment is tampered with is effectively prevented. At the same time, it supports dynamic expansion of the white-box algorithm library, that is, it supports the use of external files to expand it, and supports the white-box algorithm call mechanism that requires auxiliary keys, further increasing the difficulty of code lift attacks. Generate an auxiliary key based on the unique device identifier, and use this key to encrypt the white-box key table when generating the white-box encryption algorithm library; when calling the white-box algorithm library, the auxiliary key generated by the unique device identifier must be used to perform a decryption operation to obtain the white-box key data table. That is, when there is no external auxiliary key, the white-box key table and algorithm cannot work properly. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the description of the present application are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative labor. Figure 1 This is a flowchart of a method for enhancing encryption based on a white box encryption algorithm provided by an embodiment of the present application; Figure 2 It is a structural block diagram of an enhanced encryption device based on a white box encryption algorithm provided by an embodiment of the present application; Figure 3 It is a structural schematic diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0016] In order to make the objects, features and advantages of the present application more obvious and understandable, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0017] The inventors have found through analysis of the prior art that although the white-box encryption algorithm deployed on the terminal device or server may be quite secure at the algorithm level, it does not fully consider the security of the operating environment. This means that even if the algorithm itself is difficult to crack, attackers may still abuse the algorithm through other means, such as copying the white-box encryption algorithm to run on unauthorized devices, or tampering with the behavior of the algorithm in the operating environment. In addition, there are problems with the application of the prior art in virtualized environments such as Docker. Due to the abstractness and dynamism of these environments, traditional hardware or operating system-level protection measures are difficult to apply directly. This makes white-box algorithms running in these environments more vulnerable to the risk of unauthorized copying and abuse.

[0018] Reference Figure 1-3 , showing an enhanced encryption method and device based on a white-box encryption algorithm provided by an embodiment of the present application; The method comprises: S110, obtaining a unique device identifier of an application server that deploys a white-box encryption algorithm; S120, generating a license application file and an auxiliary key according to the unique identifier of the device, and generating a file to be signed according to the license application file; S130, signing the file to be signed according to the license application file to obtain a signature value; and forming a signed license file through the signature value and management information; wherein the management information is information such as product ID and license validity period; S140: Generate a white-box algorithm library according to the auxiliary key, and write the signed license file into the white-box algorithm library.

[0019] In the embodiments of the present application, compared with the disadvantage of the prior art that only the white-box encryption algorithm itself is protected without considering the running environment of the white-box encryption algorithm, the present application provides a solution to protect the running environment of the white-box encryption algorithm, specifically an enhanced encryption method based on the white-box encryption algorithm, including the steps of: obtaining the device unique identifier of the application server that deploys the white-box encryption algorithm; generating a license application file based on the device unique identifier, and generating a file to be signed based on the license application file; signing the file to be signed to obtain a signature value; and forming a signed license file through the signature value and other information, and writing the signed license file into the algorithm library of the white-box encryption algorithm. By obtaining the device unique identifier of the application server and encrypting the device unique identifier during transmission, the security and availability of the running environment of the white-box encryption algorithm are greatly enhanced, and the abuse of the white-box encryption algorithm after the running environment is tampered with is effectively prevented. At the same time, it supports dynamic expansion of the white-box algorithm library, that is, it supports the use of external files to expand it, and supports the white-box algorithm call mechanism that requires auxiliary keys, further increasing the difficulty of code lift attacks. An auxiliary key is generated based on the unique identifier of the device, and this key is used to encrypt the white-box key table when generating the white-box encryption algorithm library; when calling the white-box algorithm library, the auxiliary key generated by the backup unique identifier must be used to perform a decryption operation to obtain the white-box key table. That is, when there is no external auxiliary key, the white-box key table and algorithm cannot work properly.

[0020] Next, an enhanced encryption method based on a white box encryption algorithm in this exemplary embodiment will be further described.

[0021] As described in step S110, a unique device identifier of an application server that deploys a white-box encryption algorithm is obtained.

[0022] It should be noted that the unique device identifier of the application server that deploys the white-box encryption algorithm is obtained. When the white-box encryption algorithm is deployed in a virtual environment, such as a Docker container, a dedicated service needs to be run on the host machine to collect hardware information and generate machine code based on the hardware information.

[0023] As described in step S120, a license application file and an auxiliary key are generated according to the unique identifier of the device, and a file to be signed is generated according to the license application file.

[0024] It should be noted that the license application file is generated through the unique device identifier, and the license application file is packaged into a signable format, which is subsequently signed to generate a signature value, and the product ID, license validity period and signature value form a signed license file.

[0025] In an embodiment of the present invention, the specific process of "generating a license application file and an auxiliary key according to the device unique identifier, and generating a file to be signed according to the license application file" in step S120 can be further explained in combination with the following description.

[0026] As described in the following steps, generating a license application file and an auxiliary key through the device unique identifier; As described in the following steps, the license application document is sent to the corresponding management platform; As described in the following steps, obtaining a license application document through the management platform, and generating relevant management information based on the license document; As described in the following steps, the relevant management information is encapsulated into a file to be signed.

[0027] In a specific implementation, the white box encryption algorithm library generates a license application document based on license control through the unique device identifier and submits it to the license management platform. The license management platform encapsulates the product ID, device unique identifier and license validity period into Json format. The Json format string can then be signed with the private key of the license management platform using SM2 to encrypt the unique device identifier. The license request is generated using server or host specific information to improve the uniqueness and difficulty of counterfeiting of the license, and the license content is protected by the SM2 key signature of the license management platform to effectively prevent counterfeiting.

[0028] In an embodiment of the present invention, the specific process of the step of "obtaining a license application document through the management platform, and generating relevant management information according to the license application document" can be further explained in combination with the following description.

[0029] As described in the following steps, the license application file is a license application file, the management platform is a license management platform, and the step of obtaining the license application file through the management platform and generating relevant management information according to the license application file includes: Generate relevant management information according to the license file, wherein the relevant management information includes product ID, license validity period and device unique identifier.

[0030] In an embodiment of the present invention, the specific process of the step of "generating a license application file and an auxiliary key by using the unique identifier of the device" can be further explained in combination with the following description.

[0031] As described in the following steps, the unique identifier of the device is sent to the management platform; As described in the following steps, obtaining, through the management platform, an auxiliary key generated by the unique identifier of the device; As described in the following steps, a white-box algorithm library encrypted by a white-box key table is generated by the auxiliary key.

[0032] It should be noted that a license application file is generated through the unique identifier of the device; the license application file is sent to the corresponding management platform; the platform parses the license application file to obtain the unique identifier of the device; the management platform then derives an auxiliary key through the unique identifier of the device; when generating the white box algorithm library, the auxiliary key is used to encrypt the white box key table; the white box algorithm library stores the ciphertext data of the white box key table.

[0033] As described in step S130, the file to be signed is signed according to the license file to obtain a signature value; and the signature value and management information are combined into a signed license file.

[0034] It should be noted that the signature value is obtained through signing to sign the signature file. The final signed license file includes the product ID, license validity period and signature value.

[0035] As described in step S140, a white box algorithm library is generated according to the auxiliary key, and the signed license file is written into the white box algorithm library.

[0036] In an embodiment of the present invention, the specific process of "generating a white box algorithm library according to the auxiliary key and writing the signed license file into the white box algorithm library" in step S140 can be further explained in combination with the following description.

[0037] As described in the following steps, when the white-box algorithm library is loaded, the device unique identifier is obtained, and the signature license file is verified. If the signature verification fails, an error is reported and the system exits; the white-box algorithm library is decrypted using an auxiliary key, and after the decryption is successful, the white-box algorithm library is loaded.

[0038] It should be noted that when the white box encryption algorithm is loaded, the white box starts self-checking, obtains the unique serial number of the device through a secure channel, and then verifies the signature of the license file to determine whether the content is legal. If the signature verification fails, an error message will be reported and the system will exit. After the verification passes, the white box algorithm library is decrypted through the auxiliary key to obtain the white box key table. In the absence of an external auxiliary key, the white box key table and algorithm cannot work properly, and the white box algorithm library fails to load. After the decryption operation is successful, the white box algorithm library is loaded successfully, and the white box encryption algorithm can be used normally.

[0039] In one embodiment of the present invention, it further includes: When the white box encryption algorithm is deployed in a docker container or a physical server, a machine code generated according to hardware information of the host machine or the physical server is obtained, and the machine code is set as a unique device identifier, wherein the machine code is generated by a dedicated server running on the host machine or the physical server.

[0040] It should be noted that the unique identifier of the device is the machine code. When the white box encryption algorithm needs to be deployed in a docker container, a dedicated service running on the host is responsible for collecting hardware information, such as the CPU serial number, memory size, MAC address of the network interface, etc., and generating a machine code based on this hardware information. When reporting to the license platform, the machine code is encrypted using the platform's SM2 public key, which ensures the uniqueness of the generated machine code and the confidentiality of the machine code during the upload process, ensuring that it is difficult to be copied or simulated in any environment. At the same time, the service provides a network port for the Docker container to access the host machine.

[0041] In one embodiment of the present invention, it further includes: When the docker container or the physical server is started, the device unique identifier is obtained through the network SSL encryption channel of the host machine or the physical server.

[0042] It should be noted that when the docker container or the physical server is started, when the application in the container loads the white-box encryption algorithm module, the white-box algorithm module obtains the machine code (i.e., the unique device identifier) ​​generated by the host based on the hardware information by calling the service port of the host. In order to improve transmission security, this mechanism also includes security measures such as encryption of the machine code (such as network SSL encryption channel). These measures ensure the confidentiality of the machine code, that is, ensure that the machine code is not transmitted in plain text, and the white-box algorithm in the container can only obtain the machine code of its own host by calling the service port, so that unauthorized containers or servers cannot obtain and abuse the machine code and the signature license file generated by it to obtain the right to use the white-box algorithm.

[0043] In one embodiment of the present invention, it also includes: The algorithm library of the white-box encryption algorithm is integrated into the application server where the white-box encryption algorithm needs to be deployed, so as to enhance the application security of the white-box encryption algorithm.

[0044] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0045] Reference Figure 2 , showing an enhanced encryption device based on a white box encryption algorithm provided by an embodiment of the present application; Specifically include: An acquisition module 210 is used to acquire a unique device identifier of an application server that deploys a white-box encryption algorithm; The conversion module 220 is used to generate a license application file and an auxiliary key according to the unique identifier of the device, and to generate a file to be signed according to the license application file; Signature module 230, used to sign the file to be signed according to the license application file to obtain a signature value; and to form a signed license file through the signature value and management information; The enhancement module 240 is configured to generate a white-box algorithm library according to the auxiliary key, and write the signed license file into the white-box algorithm library.

[0046] In one embodiment of the present invention, the conversion module 220 includes: An application file unit, used to generate a license application file and an auxiliary key through the unique identifier of the device; A sending unit, used for sending the license application document to a corresponding management platform; A management information unit, used to obtain a license application document through the management platform and generate relevant management information based on the license document; The encapsulation unit is used to encapsulate the relevant management information into a file to be signed.

[0047] In one embodiment of the present invention, the application document unit includes: A device unique identification obtaining subunit is used to send the device unique identification to a management platform; An auxiliary key acquisition subunit, used to acquire, through the management platform, an auxiliary key generated by the unique identifier of the device; The white-box algorithm library generation subunit is used to generate a white-box algorithm library encrypted by a white-box key table using the auxiliary key.

[0048] In one embodiment of the present invention, the application document unit also includes The license file subunit is used to obtain the license file through the license management platform; The license management information subunit is used to generate relevant management information according to the license file, wherein the relevant management information includes product ID, license validity period and device unique identifier.

[0049] In one embodiment of the present invention, the enhancement module 240 further includes: The verification unit is used to obtain the unique device identifier when loading the white box algorithm library, verify the signature of the signed license file, and report an error and exit if it fails.

[0050] The decryption operation unit, after the above verification is successful, performs a decryption operation on the white box key table in the white box algorithm library through the auxiliary key.

[0051] In one embodiment of the present invention, it also includes: A hardware information unit is used to obtain a machine code generated according to the hardware information of a host machine or a physical server when the white box encryption algorithm is deployed in a docker container or a physical server of an application system, and set the machine code as a unique device identifier, wherein the machine code is generated by a dedicated server running on the host machine or the physical server.

[0052] In one embodiment of the present invention, it also includes: The decryption unit is used to obtain the device unique identifier through the network SSL encryption channel of the host machine or the physical server when the Docker container of the application system or the physical server is started.

[0053] In one embodiment of the present invention, it also includes: A deployment unit is used to integrate the algorithm library of the white-box encryption algorithm into an application server that needs to deploy the white-box encryption algorithm.

[0054] Reference Figure 3 , shows a computer device of an enhanced encryption method based on a white box encryption algorithm of the present invention, which may specifically include the following: The computer device 12 is in the form of a general-purpose computing device, and the components of the computer device 12 may include but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 connecting different system components (including the system memory 28 and the processing unit 16).

[0055] The bus 18 represents one or more of several types of bus 18 structures, including a memory bus 18 or memory controller, a peripheral bus 18, an accelerated graphics port, a processor, or a local bus 18 using any of a variety of bus 18 architectures. These architectures include, by way of example, but are not limited to, an Industry Standard Architecture (ISA) bus 18, a Micro Channel Architecture (MAC) bus 18, an Enhanced ISA bus 18, an Audio Video Electronics Standards Association (VESA) local bus 18, and a Peripheral Component Interconnect (PCI) bus 18.

[0056] The computer device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computer device 12, including volatile and non-volatile media, removable and non-removable media.

[0057] System memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Computer device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 34 may be used to read and write to non-removable, non-volatile magnetic media (commonly referred to as a "hard drive"). Although Figure 3 Not shown, a disk drive for reading and writing to a removable non-volatile disk (such as a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (such as a CD-ROM, DVD-ROM or other optical medium) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The memory may include at least one program product having a set (e.g., at least one) of program modules 42, which are configured to perform the functions of various embodiments of the present invention.

[0058] A program / utility 40 having a set (at least one) of program modules 42 may be stored in, for example, a memory, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules 42, and program data, each of which or some combination may include an implementation of a network environment. The program modules 42 generally perform the functions and / or methods of the embodiments described herein.

[0059] The computer device 12 may also communicate with one or more external devices 14 (e.g., keyboards, pointing devices, displays 24, cameras, etc.), one or more devices that enable a user to interact with the computer device 12, and / or any device that enables the computer device 12 to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed via an input / output (I / O) interface 22. Furthermore, the computer device 12 may also communicate with one or more networks (e.g., local area networks (LANs)), wide area networks (WANs), and / or public networks (e.g., the Internet) via a network adapter 20. As shown, the network adapter 20 communicates with other modules of the computer device 12 via a bus 18. It should be understood that although Figure 3 Not shown, other hardware and / or software modules may be used in conjunction with the computer device 12, including but not limited to: microcode, device drivers, processing unit 16, external disk drive arrays, RAID systems, tape drives, and data backup storage systems 34, etc.

[0060] The processing unit 16 executes various functional applications and data processing by running programs stored in the system memory 28, such as implementing an enhanced encryption method based on a white box encryption algorithm provided in an embodiment of the present invention.

[0061] That is, when the processing unit 16 executes the program, the following is achieved: obtaining the unique device identifier of the application server that deploys the white-box encryption algorithm; Generate a license application file based on the unique identifier of the device, and generate a file to be signed based on the license application file; Signing the file to be signed according to the license application document to obtain a signature value; A signed license file is composed of the product ID, the license validity period and the signature value, and the signed license file is written into the algorithm library of the white box encryption algorithm.

[0062] According to the device unique identifier of the application server, the white box key table in the white box algorithm library is encrypted by the auxiliary key.

[0063] In an embodiment of the present invention, the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, an enhanced encryption method based on a white-box encryption algorithm as provided in all embodiments of the present application is implemented: That is, when the program is executed by the processor, the following is achieved: obtaining the device unique identifier of the application server that deploys the white-box encryption algorithm; Generate a license application file based on the unique identifier of the device, and generate a file to be signed based on the license application file; Signing the file to be signed according to the license application document to obtain a signature value; The signed license file consists of the product ID, license validity period and the signature value. And write the signed license file into the algorithm library of the white box encryption algorithm.

[0064] Any combination of one or more computer-readable media may be used. A computer-readable medium may be a computer readable signal medium or a computer-readable storage medium. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared or semiconductor system, device or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, device or device.

[0065] Computer-readable signal media may include a data signal propagated in baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0066] The computer program code for performing the operation of the present invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet). The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the various embodiments can be referred to each other.

[0067] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0068] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0069] The above is a detailed introduction to an enhanced encryption method and device based on a white-box encryption algorithm provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An enhanced encryption method based on a white box encryption algorithm, characterized in that: Includes steps: Obtain the unique device identifier of the application server that deploys the white-box encryption algorithm; Generate a license application file and an auxiliary key based on the unique identifier of the device, and generate a file to be signed based on the license application file; Sign the file to be signed according to the license application file to obtain a signature value, and form a signed license file through the signature value and management information; A white box algorithm library is generated according to the auxiliary key, and the signed license file is written into the white box algorithm library.

2. The method according to claim 1, characterized in that: The step of generating a license application file and an auxiliary key according to the unique identifier of the device, and generating a file to be signed according to the license application file includes: Generate a license application file and an auxiliary key through the unique identification of the device; Sending the license application document to the corresponding management platform; Obtaining a license application document through the management platform, and generating relevant management information based on the license application document; The relevant management information is encapsulated into a file to be signed.

3. The method according to claim 2, characterized in that The step of generating a license application file and an auxiliary key by using the unique identification of the device includes: Sending the unique identifier of the device to the management platform; Acquire, through the management platform, an auxiliary key generated by the unique identifier of the device; A white-box algorithm library encrypted by a white-box key table is generated by the auxiliary key.

4. The method according to claim 2, characterized in that: The license application file is a license application file, the management platform is a license management platform, and the step of obtaining the license application file through the management platform and generating relevant management information according to the license application file includes: Generate relevant management information according to the license application document, wherein the relevant management information includes product ID, license validity period and device unique identifier; The management platform signs the license application file as a file to be signed, generates a signature value, and combines the product ID, license validity period, and signature value into a signed license file.

5. The method according to claim 1, characterized in that The step of writing the signed license file into the white box algorithm library further includes: When the white-box algorithm library is loaded, the device unique identifier is obtained, and the signature license file is verified. If it fails, an error is reported and the system exits. An auxiliary key is then generated based on the device unique identifier, and a decryption operation is performed on the white-box key table in the white-box algorithm library. After the decryption is successful, the white-box algorithm library is loaded successfully.

6. The method according to claim 1, characterized in that Also includes: When the white box encryption algorithm is deployed in a docker container or a physical server of an application system, a machine code generated according to the hardware information of the host machine or the physical server of the docker container is obtained, and the machine code is set as a unique device identifier, wherein the machine code is generated by a dedicated server running on the host machine or the physical server of the docker container.

7. The method according to claim 6, characterized in that Also includes: When the docker container or the physical server is started, the device unique identifier is obtained through the network SSL encryption channel of the host machine of the docker container or the physical server.

8. An enhanced encryption device based on a white box encryption algorithm, characterized in that: include: An acquisition module, used to obtain a unique device identifier of an application server that deploys a white-box encryption algorithm; A conversion module, used to generate a license application file and an auxiliary key according to the unique identifier of the device, and convert the license application file into a to-be-signed file in a signable format; A signature module, used to sign the file to be signed to obtain a signature value; And form a signed license file through the signature value and management information; The enhancement module is used to generate a white box algorithm library according to the auxiliary key, and write the signature license file into the algorithm library of the white box encryption algorithm to enhance the application security of the white box encryption algorithm.

9. A computer device, characterized in that: The invention comprises a processor, a memory and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the enhanced encryption method based on the white box encryption algorithm as claimed in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the enhanced encryption method based on the white-box encryption algorithm according to any one of claims 1 to 7 is implemented.

Images