Firmware encryption method, firmware decryption method, equipment and storage medium

Abstract

The embodiment of the invention provides a firmware encryption method, a firmware decryption method, equipment and a storage medium, and belongs to the field of information security. The method comprises the steps of generating N random keys under the condition that firmware to be encrypted is acquired, and generating a target encryption key based on the N random keys and a preset equipment key by utilizing a preset key generation algorithm; generating a key differential packet according to the N random keys and a preset device key; and according to the target encryption key, encrypting the to-be-encrypted firmware to obtain encrypted firmware, and packaging the encrypted firmware and the key difference packet to obtain a target firmware packet. According to the technical scheme provided by the embodiment of the invention, the security of the firmware is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a firmware encryption method, a firmware decryption method, a device and a storage medium. Background Art

[0002] At present, for reasons such as product function updates, performance optimization, and problem fixing, it is necessary to upgrade the firmware in the terminal device from time to time, or in scenarios such as field testing or customer laboratory testing, it is necessary to rewrite the firmware to be tested in the terminal device. These firmwares are not encrypted, and anyone can download them on the company's service website. In this way, attackers can reverse analyze the unencrypted firmware and then discover security vulnerabilities, resulting in the increased risk of the device software function being cracked or facing vulnerability attacks. In related technologies, a fixed key is used to encrypt the firmware to improve the security of the firmware, but the fixed key is usually hard-coded in the firmware, or written into the terminal device when the terminal device is produced. The fixed keys of all terminal devices are the same. Once the fixed key is leaked, all firmware will be at risk of being decrypted, and the security is low. Summary of the invention

[0003] The embodiments of the present invention provide a firmware encryption method, a firmware decryption method, a device and a storage medium, aiming to improve the security of firmware.

[0004] In a first aspect, an embodiment of the present invention provides a firmware encryption method, comprising:

[0005] When the firmware to be encrypted is obtained, N random keys are generated, and a target encryption key is generated based on the N random keys and a preset device key using a preset key generation algorithm, where N is an integer greater than or equal to 2;

[0006] Generate a key difference package according to the N random keys and the preset device key;

[0007] The firmware to be encrypted is encrypted according to the target encryption key to obtain encrypted firmware, and the encrypted firmware and the key difference package are packaged to obtain a target firmware package.

[0008] In a second aspect, an embodiment of the present invention further provides a firmware decryption method, comprising:

[0009] Obtain a target firmware package, the target firmware package including an encrypted firmware and a key difference package bound to the encrypted firmware, the target firmware package being generated using the firmware encryption method described in the first aspect;

[0010] Perform differential restoration processing on the preset device key in the terminal device and the key difference package to obtain N random keys, where N is an integer greater than or equal to 2;

[0011] A preset key generation algorithm is used to generate a target decryption key based on the N random keys and the preset device key, and the encrypted firmware is decrypted according to the target decryption key.

[0012] In a third aspect, an embodiment of the present invention further provides a computer device, comprising a processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus for realizing connection and communication between the processor and the memory, wherein when the computer program is executed by the processor, the firmware encryption method as described in the first aspect is implemented.

[0013] In a fourth aspect, an embodiment of the present invention further provides a terminal device, comprising a processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus for realizing connection and communication between the processor and the memory, wherein when the computer program is executed by the processor, the firmware decryption method as described in the second aspect is implemented.

[0014] In the fifth aspect, an embodiment of the present invention also provides a storage medium for computer-readable storage, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the firmware encryption method described in the first aspect or the firmware decryption method described in the second aspect.

[0015] The embodiment of the present invention provides a firmware encryption method, a firmware decryption method, a device and a storage medium. The embodiment of the present invention generates a target encryption key based on N random keys and preset device keys, and generates a key difference package based on the N random keys and the preset device keys, and then encrypts the firmware to be encrypted based on the target encryption key to obtain the encrypted firmware, and packages the encrypted firmware and the key difference package to obtain a target firmware package, so that a user who does not know the decryption key cannot decrypt the encrypted firmware, thereby improving the security of the firmware, and the N random keys are not written into the target firmware package, but the key difference package is written into the target firmware package, which can greatly reduce the possibility of an attacker cracking and obtaining the decryption key, further improving the security of the firmware. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1is a schematic block diagram of the structure of a computer device provided by an embodiment of the present invention;

[0018] Figure 2 It is a flowchart of a firmware encryption method provided by an embodiment of the present invention;

[0019] Figure 3 is a schematic diagram of generating a key difference packet in an embodiment of the present invention;

[0020] Figure 4 It is a flowchart of a firmware decryption method provided by an embodiment of the present invention;

[0021] Figure 5 is a schematic diagram of a scenario for implementing the firmware decryption method provided in this embodiment;

[0022] Figure 6 It is a schematic diagram of performing differential restoration processing on a preset device key and a key differential package in an embodiment of the present invention;

[0023] Figure 7 It is a schematic block diagram of the structure of a terminal device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0026] It should be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0027] At present, for reasons such as product function updates, performance optimization, and problem fixing, it is necessary to upgrade the firmware in the terminal device from time to time, or in scenarios such as field testing or customer laboratory testing, it is necessary to rewrite the firmware to be tested in the terminal device. These firmwares are not encrypted, and anyone can download them on the company's service website. In this way, attackers can reverse analyze the unencrypted firmware and then discover security vulnerabilities, resulting in the increased risk of the device software function being cracked or facing vulnerability attacks. In related technologies, a fixed key is used to encrypt the firmware to improve the security of the firmware, but the fixed key is usually hard-coded in the firmware, or written into the terminal device when the terminal device is produced. The fixed keys of all terminal devices are the same. Once the fixed key is leaked, all firmware will be at risk of being decrypted, and the security is low.

[0028] To solve the above problems, the embodiments of the present invention provide a firmware encryption method, a firmware decryption method, a device and a storage medium. The firmware encryption method generates a target encryption key based on N random keys and preset device keys, and generates a key difference package based on the N random keys and the preset device keys, and then encrypts the firmware to be encrypted based on the target encryption key to obtain the encrypted firmware, and packages the encrypted firmware and the key difference package to obtain the target firmware package, so that users who do not know the decryption key cannot decrypt the encrypted firmware, thereby improving the security of the firmware, and the N random keys are not written into the target firmware package, but the key difference package is written into the target firmware package, which can greatly reduce the possibility of an attacker cracking and obtaining the decryption key, further improving the security of the firmware.

[0029] In the embodiment of the present invention, the firmware encryption method can be applied to computer equipment, and the firmware solution can be applied to terminal equipment. The computer equipment can be a server or a terminal equipment, and the terminal equipment can be a smart phone, a tablet computer, a laptop computer, a desktop computer or a personal digital assistant, etc. The server can be an independent server, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0030] Some embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0031] See also Figure 1 , Figure 1 It is a schematic block diagram of the structure of a computer device provided by an embodiment of the present invention.

[0032] like Figure 1 As shown, the computer device 100 includes a processor 101 and a memory 102 , and the processor 101 and the memory 102 are connected via a bus 103 , such as an I2C (Inter-integrated Circuit) bus.

[0033] Specifically, the processor 101 is used to provide computing and control capabilities to support the operation of the entire computer device. The processor 101 can be a central processing unit (CPU), and the processor 101 can also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0034] Specifically, the memory 102 may be a Flash chip, a read-only memory (ROM) disk, an optical disk, a USB flash drive, or a mobile hard disk.

[0035] Those skilled in the art will understand that Figure 1 The structure shown in the figure is only a block diagram of a part of the structure related to the embodiment of the present invention, and does not constitute a limitation on the computer device to which the embodiment of the present invention is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0036] The processor 101 is used to run the computer program stored in the memory 102, and implement any one of the firmware encryption methods provided by the embodiments of the present invention when executing the computer program.

[0037] In some embodiments, the processor 101 is used to run a computer program stored in the memory, and implements the following steps when executing the computer program:

[0038] When the firmware to be encrypted is obtained, N random keys are generated, and a target encryption key is generated based on the N random keys and a preset device key using a preset key generation algorithm, where N is an integer greater than or equal to 2;

[0039] Generate a key difference package according to the N random keys and the preset device key;

[0040] The firmware to be encrypted is encrypted according to the target encryption key to obtain encrypted firmware, and the encrypted firmware and the key difference package are packaged to obtain a target firmware package.

[0041] In some embodiments, when the processor 101 generates a key difference package according to the N random keys and the preset device key, it is configured to implement:

[0042] Arranging the N random keys to obtain a random key queue;

[0043] According to the arrangement order of each random key in the random key queue, differential processing is performed on two adjacent random keys in the random key queue in turn to obtain N-1 first differential information;

[0044] Perform differential processing on the first or Nth random key in the random key queue and the preset device key to obtain second differential information, and generate a key differential package according to the second differential information and N-1 first differential information.

[0045] In some embodiments, when the processor 101 generates a key difference package according to the N random keys and the preset device key, it is configured to implement:

[0046] Each of the N random keys is subjected to differential processing with the preset device key to obtain N differential information, and a key differential package is generated according to the N differential information.

[0047] In some embodiments, the preset key generation algorithm includes any one of a secure hash algorithm and a PBKDF algorithm.

[0048] In some embodiments, when the processor 101 generates the target encryption key based on the N random keys and the preset device key using the preset key generation algorithm, it is configured to implement:

[0049] Concatenate the N random keys and the preset device key to obtain a first key;

[0050] The information digest of the first key is calculated using the secure hash algorithm, and the information digest of the first key is determined as a target encryption key.

[0051] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the computer device described above can refer to the corresponding process in the following firmware encryption method embodiment, which will not be repeated here.

[0052] The following will be combined Figure 1 The firmware encryption method provided by the embodiment of the present invention is described in detail in the scenario in FIG. Figure 1 The scenario is only used to explain the firmware encryption method provided in the embodiment of the present invention, but does not constitute a limitation on the application scenario of the firmware encryption method provided in the embodiment of the present invention.

[0053] See also Figure 2 , Figure 2 The present invention provides a flow chart of a firmware encryption method provided in an embodiment of the present invention. The firmware encryption method can be applied to computer equipment to improve the security of firmware.

[0054] like Figure 2 As shown, the firmware encryption method includes steps S101 to S103.

[0055] Step S101: when the firmware to be encrypted is obtained, N random keys are generated, and a target encryption key is generated based on the N random keys and a preset device key using a preset key generation algorithm.

[0056] In this embodiment, each of the N random keys is different, and N is an integer greater than or equal to 2. The preset device key is a device key pre-stored in a computer device, which is the same as the preset device key in the terminal device, and the preset device key in the terminal device can be written when the terminal device is produced, or can be configured in other ways. Among them, the preset device keys in the terminal devices of the same model are the same, and the preset device keys in the terminal devices of different models are different.

[0057] In some embodiments, the random key may be a random string including n characters, and the preset device key may be a random string including m characters, where the characters may include at least one of numbers, lowercase English letters, and uppercase English letters, n is an integer greater than or equal to 8 or 16, and m is an integer greater than or equal to 8 or 16. Exemplarily, a preset random string generation program is run to generate N random strings, and the generated N random strings are used as N random keys. It is understandable that the random string generation program can be written based on actual conditions, and the embodiments of the present invention do not specifically limit this.

[0058] In some embodiments, the preset key generation algorithm includes any one of a secure hash algorithm and a PBKDF algorithm. Using the preset key generation algorithm, generating a target encryption key based on N random keys and preset device keys includes: concatenating the N random keys and the preset device key to obtain a first key; calculating the information summary of the first key using a secure hash algorithm, and determining the information summary of the first key as the target encryption key. Among them, the secure hash algorithm includes any one of the SHA-1 algorithm, the SHA-224 algorithm, the SHA-256 algorithm, the SHA-384 algorithm, and the SHA-512 algorithm. The target encryption key can be accurately calculated using the secure hash algorithm.

[0059] Step S102: Generate a key difference package according to N random keys and the preset device key.

[0060] In this embodiment, a key differential package can be generated based on different differential package generation algorithms, using N random keys and a preset device key. During decryption, the terminal device uses a differential package restoration algorithm that matches the differential package generation algorithm, and uses the preset device key and the key differential package to restore and generate N random keys. As for which differential package generation algorithm and differential package restoration algorithm to use, they can be set based on actual conditions, and the embodiment of the present invention does not specifically limit this.

[0061] In some embodiments, generating a key difference package based on N random keys and preset device keys may include: arranging the N random keys to obtain a random key queue; performing differential processing on two adjacent random keys in the random key queue in turn according to the arrangement order of each random key in the random key queue to obtain N-1 first differential information; performing differential processing on the first or Nth random key in the random key queue and the preset device key to obtain second differential information, and generating a key difference package based on the second differential information and the N-1 first differential information. This embodiment generates a key difference package by a step-by-step differential method, thereby realizing the encryption of N random keys and improving the security of the N random keys.

[0062] For example, the random key queue is [random key 1, random key 2, random key 3, ..., random key N-1, random key N], such as Figure 3As shown, the random key 1 (the first random key) in the above random key queue is differentially processed with the preset device key to obtain the second differential information, the random key 1 is differentially processed with the random key 2 to obtain the first differential information 1, the random key 2 is differentially processed with the random key 3 to obtain the first differential information 2, the random key 3 is differentially processed with the random key 4 to obtain the first differential information 3, and the two adjacent random keys are differentially processed in the same manner until the differential processing between the random key N-1 and the random key N is completed to obtain the first differential information N-1, and a total of N-1 first differential information are obtained, and then the N-1 first differential information and the second differential information are packaged to obtain a key differential package.

[0063] In some embodiments, generating a key difference package according to N random keys and a preset device key may include: performing differential processing on each of the N random keys and the preset device key to obtain N differential information, and generating a key difference package according to the N differential information. For example, the N random keys include random key 1, random key 2, random key 3, ..., random key N-1 and random key N, then the random key 1, random key 2, random key 3, ..., random key N-1 and random key N may be differentially processed with the preset device key respectively to obtain N differential information. This embodiment can perform differential processing on each of the N random keys and the preset device key at the same time, thereby improving the efficiency of differential processing, realizing the encryption of the N random keys, and also improving the security of the N random keys.

[0064] Step S103: Encrypt the firmware to be encrypted according to the target encryption key to obtain the encrypted firmware, and package the encrypted firmware and the key difference package to obtain the target firmware package.

[0065] In this embodiment, the preset encryption algorithm can be used to encrypt the firmware to be encrypted based on the target encryption key to obtain the encrypted firmware. The preset encryption algorithm may include any one of the DES (Data Encryption Standard) algorithm, the 3DES (Triple DES) algorithm, the TDEA (Triple Data Encryption Algorithm), the RC2 algorithm, the RC4 algorithm, the RC5 algorithm, the AES (Advanced Encryption Standard) algorithm, the IDEA (International Data Encryption Algorithm) and the SKIPJACK algorithm.

[0066] In some embodiments, according to the target encryption key, encrypting the firmware to be encrypted to obtain the encrypted firmware may include: according to the target encryption key, encrypting the key content in the firmware to be encrypted to obtain the encrypted firmware. In this embodiment, only the key content in the firmware to be encrypted is encrypted, which can reduce the time spent on encryption and improve the encryption efficiency. At the same time, when the terminal device decrypts the encrypted firmware, it can also reduce the firmware decryption time and improve the decryption efficiency, which greatly improves the user experience.

[0067] In some embodiments, the key content in the firmware to be encrypted includes at least one of the root file system (rootfs) and the header content of the file system in the firmware to be encrypted. For example, the key content in the firmware to be encrypted is the root file system in the firmware to be encrypted, and for another example, the key content in the firmware to be encrypted is the header content (superblock) of the file system in the firmware to be encrypted, and for another example, the key content in the firmware to be encrypted includes the root file system and the header content (superblock) of the file system in the firmware to be encrypted.

[0068] In some embodiments, the target encryption key used to encrypt the same version of the firmware to be encrypted is the same, and the target encryption key used to encrypt different versions of the firmware to be encrypted is different. In this way, it can be ensured that the target encryption key used by each version of the firmware is unique, and the leakage of the target encryption key of a certain version of the firmware will not affect the security of the other versions of the firmware, thereby improving the security of the firmware.

[0069] In some embodiments, when the firmware to be encrypted is a source program, the firmware to be encrypted is compiled, and the firmware to be encrypted includes multiple sub-firmware to be encrypted; during the compilation of the firmware to be encrypted, the target sub-firmware is obtained, and the target sub-firmware is encrypted according to the target encryption key to obtain the encrypted sub-firmware; the encrypted sub-firmware corresponding to each of the multiple sub-firmware to be encrypted is packaged to obtain the encrypted firmware corresponding to the firmware to be encrypted. This embodiment can further improve the security of the firmware by encrypting the firmware to be encrypted during the compilation of the firmware to be encrypted.

[0070] The firmware encryption method provided in the above embodiment generates a target encryption key based on N random keys and preset device keys, and generates a key difference package based on the N random keys and preset device keys, and then encrypts the firmware to be encrypted based on the target encryption key to obtain encrypted firmware, and packages the encrypted firmware and the key difference package to obtain a target firmware package, so that users who do not know the decryption key cannot decrypt the encrypted firmware, thereby improving the security of the firmware, and the N random keys are not written into the target firmware package, but the key difference package is written into the target firmware package, which can greatly reduce the possibility of an attacker cracking and obtaining the decryption key, further improving the security of the firmware.

[0071] See also Figure 4 , Figure 4 The present invention provides a flow chart of a firmware decryption method provided in an embodiment of the present invention. The firmware decryption method can be applied to a terminal device to improve the security of the firmware.

[0072] like Figure 4 As shown, the firmware encryption method includes steps S201 to S203.

[0073] Step S201: Obtain a target firmware package.

[0074] In this embodiment, the target firmware package includes encrypted firmware and a key differential package bound to the encrypted firmware. The key differential package may include N-1 first differential information and 1 second differential information, or the key differential package may include differential information between each random key of N random keys and a preset device key. The encrypted firmware package is generated using the firmware encryption method provided in the above embodiment.

[0075] In some embodiments, obtaining the target firmware package may include: downloading the target firmware package from a computer device. Figure 5 As shown, the computer device 100 is communicatively connected with the terminal device 200, wherein the communication connection between the computer device 100 and the terminal device 200 may be a wired connection or a wireless connection. For example, the terminal device 200 communicates with the computer device 100 via a mobile network. The mobile network may be a 3G network, a 4G network, a 5G network, or the like. After the computer device 100 generates a target firmware package using a firmware encryption method, the target firmware package is stored. When the terminal device 200 determines that the version of its own firmware is different from the version of the target firmware package stored in the computer device 100, the terminal device 200 sends a firmware download request to the computer device 100, and the computer device 100 sends the latest version of the target firmware package to the terminal device 200 based on the firmware download request.

[0076] Step S202: Perform differential restoration processing on the preset device key and the key difference package in the terminal device to obtain N random keys.

[0077] In this embodiment, the preset device key in the terminal device can be written when the terminal device is produced, or can be configured in other ways, and N is an integer greater than or equal to 2. Since the key difference package is generated based on the preset device key in the computer device and N random keys, after knowing the preset device key and the key difference package, the N random keys can be obtained by performing differential restoration processing on the preset device key and the key difference package.

[0078] In some embodiments, the key differential package includes a differential information queue, and differential restoration processing is performed on the preset device key and the key differential package in the terminal device to obtain N random keys, which may include: differential restoration processing of the first differential information in the differential information queue and the preset device key to obtain the first random key; according to the arrangement order i of the differential information in the differential information queue except the first differential information, differential restoration processing is performed on the i-th differential information in the differential information queue and the i-1th random key in sequence to obtain the i-th random key, where the value range of i is [2, N].

[0079] For example, Figure 6 As shown, the differential information queue included in the key differential packet is [second differential information, first differential information 1, first differential information 2, ..., first differential information N-2, first differential information N-1], the first differential information in the differential information queue is the second differential information, the second differential information is the first differential information 1, the third differential information is the first differential information 2, ..., the N-1th differential information is the first differential information N-2, and the Nth differential information is the first differential information N-1. The second differential information (the first differential information) in the differential information queue is differentially restored with the preset device key to obtain random key 1 (the first random key), and the first differential information 1 (the second differential information) in the differential information queue is differentially restored with the random key 1 (the first random key) to obtain random key 2 (the second random key). , the first differential information 2 (the third differential information) in the differential information queue is differentially restored with the random key 2 (the second random key) to obtain the random key 3 (the third random key), the first differential information 3 (the third differential information) in the differential information queue is differentially restored with the random key 3 (the fourth random key) to obtain the random key 4 (the fourth random key),..., the first differential information N-2 (the N-1th differential information) in the differential information queue is differentially restored with the random key N-2 (the N-2th random key) to obtain the random key N-1 (the N-1th random key), the first differential information N-1 (the Nth differential information) in the differential information queue is differentially restored with the random key N-1 (the N-1th random key) to obtain the random key N (the Nth random key).

[0080] Step S203: Generate a target decryption key based on N random keys and preset device keys using a preset key generation algorithm, and decrypt the encrypted firmware according to the target decryption key.

[0081] In this embodiment, the preset key generation algorithm includes any one of a secure hash algorithm and a PBKDF algorithm. It is understandable that the key generation algorithm used to generate the encryption key is the same as the key generation algorithm used to generate the decryption key. For example, if the secure hash algorithm is used to generate the target encryption key in the encryption stage, then the secure hash algorithm is also required to generate the target decryption key in the decryption stage, and if the PBKDF algorithm is used to generate the target encryption key in the encryption stage, then the PBKDF algorithm is also required to generate the target decryption key in the decryption stage.

[0082] In some embodiments, using a preset key generation algorithm, generating a target decryption key based on N random keys and a preset device key may include: the terminal device concatenates the N random keys and the preset device key to obtain a second key; using a secure hash algorithm to calculate the information digest of the second key, and determining the information digest of the second key as the target decryption key. The secure hash algorithm includes any one of the SHA-1 algorithm, the SHA-224 algorithm, the SHA-256 algorithm, the SHA-384 algorithm, and the SHA-512 algorithm. The target decryption key can be accurately calculated using the secure hash algorithm.

[0083] In some embodiments, after step S203, the method further includes: upgrading the firmware of the terminal device according to the decrypted firmware. In this embodiment, the encrypted firmware is decrypted, and the firmware of the terminal device is upgraded only after the firmware is successfully decrypted, which can greatly ensure the security of the firmware and the security of the terminal device.

[0084] In the firmware decryption method provided in the above embodiment, since the target firmware package includes the encrypted firmware and the key difference package, for a user who knows the preset device key, the preset device key and the key difference package in the obtained target firmware package are used to perform differential restoration processing to obtain N random keys, and then a preset key generation algorithm is used to generate a target decryption key based on the N random keys and the preset device key, and the encrypted firmware is decrypted according to the target decryption key. For a user who does not know the preset device key, it is impossible to use the key difference package and the preset device key to generate a decryption key, and it is also impossible to decrypt the encrypted firmware, thereby improving the security of the firmware.

[0085] See also Figure 7 , Figure 7 It is a schematic block diagram of the structure of a terminal device provided by an embodiment of the present invention.

[0086] like Figure 7As shown, the terminal device 200 includes a processor 201 and a memory 202, and the processor 201 and the memory 202 are connected via a bus 203, such as an I2C (Inter-integrated Circuit) bus.

[0087] Specifically, the processor 201 is used to provide computing and control capabilities to support the operation of the entire computer device. The processor 201 can be a central processing unit (CPU), and the processor 201 can also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0088] Specifically, the memory 202 may be a Flash chip, a read-only memory (ROM) disk, an optical disk, a USB flash drive, or a mobile hard disk.

[0089] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a partial structure related to the embodiment of the present invention, and does not constitute a limitation on the terminal device to which the embodiment of the present invention is applied. The specific terminal device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0090] The processor 201 is used to run the computer program stored in the memory 202, and implement any one of the firmware decryption methods provided by the embodiments of the present invention when executing the computer program.

[0091] In one embodiment, the processor 201 is used to run a computer program stored in the memory, and implement the following steps when executing the computer program:

[0092] Obtain a target firmware package, wherein the target firmware package includes an encrypted firmware and a key difference package bound to the encrypted firmware;

[0093] Perform differential restoration processing on the preset device key in the terminal device and the key difference package to obtain N random keys, where N is an integer greater than or equal to 2;

[0094] A preset key generation algorithm is used to generate a target decryption key based on the N random keys and the preset device key, and the encrypted firmware is decrypted according to the target decryption key.

[0095] In one embodiment, the key difference package includes a difference information queue, and the difference information queue includes N difference information. When the processor 201 performs a difference restoration process on the preset device key in the terminal device and the key difference package to obtain N random keys, it is used to implement:

[0096] Performing differential restoration processing on the first differential information in the differential information queue and the preset device key to obtain a first random key;

[0097] According to the arrangement order i of the differential information in the differential information queue except the first differential information, the i-th differential information in the differential information queue and the i-1-th random key are differentially restored in turn to obtain the i-th random key, where the value range of i is [2, N].

[0098] In one embodiment, after decrypting the encrypted firmware according to the target decryption key, the processor 201 is further configured to implement:

[0099] The firmware of the terminal device is upgraded according to the decrypted firmware.

[0100] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the terminal device described above can refer to the corresponding process in the aforementioned firmware decryption method embodiment, and will not be repeated here.

[0101] An embodiment of the present invention also provides a storage medium for computer-readable storage, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement any firmware encryption method or firmware decryption method provided in the description of the embodiment of the present invention.

[0102] The storage medium may be an internal storage unit of the computer device or terminal device described in the above embodiments, such as a hard disk or memory of the computer device or terminal device. The storage medium may also be an external storage device of the computer device or terminal device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), etc., equipped on the computer device or terminal device.

[0103] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware embodiment, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0104] It should be understood that the term "and / or" used in the present specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, including these combinations. It should be noted that, in this article, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "including a..." does not exclude the presence of other identical elements in the process, method, article or system including the element.

[0105] The serial numbers of the embodiments of the present invention are only for description and do not represent the advantages and disadvantages of the embodiments. The above description is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A firmware encryption method, characterized in that: include: When the firmware to be encrypted is obtained, N random keys are generated, and a target encryption key is generated based on the N random keys and a preset device key using a preset key generation algorithm, where N is an integer greater than or equal to 2; Generate a key difference package according to the N random keys and the preset device key; The firmware to be encrypted is encrypted according to the target encryption key to obtain encrypted firmware, and the encrypted firmware and the key difference package are packaged to obtain a target firmware package.

2. The firmware encryption method according to claim 1, characterized in that: The generating a key difference package according to the N random keys and the preset device key includes: Arranging the N random keys to obtain a random key queue; According to the arrangement order of each random key in the random key queue, differential processing is performed on two adjacent random keys in the random key queue in turn to obtain N-1 first differential information; Perform differential processing on the first or Nth random key in the random key queue and the preset device key to obtain second differential information, and generate a key differential package according to the second differential information and N-1 first differential information.

3. The firmware encryption method according to claim 1, characterized in that: The generating a key difference package according to the N random keys and the preset device key includes: Each of the N random keys is subjected to differential processing with the preset device key to obtain N differential information, and a key differential package is generated according to the N differential information.

4. The firmware encryption method according to any one of claims 1 to 3, characterized in that: The preset key generation algorithm includes any one of a secure hash algorithm and a PBKDF algorithm.

5. The firmware encryption method according to claim 4, characterized in that: The method of using a preset key generation algorithm to generate a target encryption key based on the N random keys and the preset device key includes: Concatenate the N random keys and the preset device key to obtain a first key; The information digest of the first key is calculated using the secure hash algorithm, and the information digest of the first key is determined as a target encryption key.

6. A firmware decryption method, characterized in that: include: Obtain a target firmware package, the target firmware package including an encrypted firmware and a key difference package bound to the encrypted firmware, the target firmware package being generated using the firmware encryption method according to any one of claims 1 to 5; Perform differential restoration processing on the preset device key in the terminal device and the key difference package to obtain N random keys, where N is an integer greater than or equal to 2; A preset key generation algorithm is used to generate a target decryption key based on the N random keys and the preset device key, and the encrypted firmware is decrypted according to the target decryption key.

7. The firmware decryption method according to claim 6, characterized in that: The key difference packet includes a difference information queue, the difference information queue includes N difference information, and the preset device key in the terminal device and the key difference packet are subjected to difference restoration processing to obtain N random keys, including: Performing differential restoration processing on the first differential information in the differential information queue and the preset device key to obtain a first random key; According to the arrangement order i of the differential information in the differential information queue except the first differential information, the i-th differential information in the differential information queue and the i-1-th random key are differentially restored in turn to obtain the i-th random key, where the value range of i is [2, N].

8. The firmware decryption method according to claim 6, characterized in that: After decrypting the encrypted firmware according to the target decryption key, the method further includes: The firmware of the terminal device is upgraded according to the decrypted firmware.

9. A computer device, characterized in that: The computer device includes a processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus for realizing connection and communication between the processor and the memory, wherein when the computer program is executed by the processor, the firmware encryption method according to any one of claims 1 to 5 is realized.

10. A terminal device, characterized in that: The terminal device includes a processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus for realizing connection and communication between the processor and the memory, wherein when the computer program is executed by the processor, the firmware decryption method as described in any one of claims 6 to 8 is implemented.

11. A storage medium for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the firmware encryption method described in any one of claims 1 to 5 or the firmware decryption method described in any one of claims 6 to 8.

Images