Encryption and decryption method and device of NFC communication link data, transmission equipment and medium

Abstract

The invention relates to an NFC communication link data encryption and decryption method and device, transmission equipment and a medium. The encryption of the NFC communication link data is applied to a sender on an NFC communication link, and the method comprises the following steps: when it is detected that the NFC communication link is established with a receiver and authentication is passed, performing encryption processing on original byte data in original data by using a preset data bit to generate encrypted byte data corresponding to the original byte data, the sender is one of the smart card and the card reader, the receiver is the other one of the smart card and the card reader, and the preset data bit is a pseudo-random bit stream generated based on a stream encryption algorithm; generating encrypted verification data based on the encrypted byte data; and generating encrypted data of the original data according to the encrypted byte data and the encrypted verification data. Thus, the original data is encrypted by using the ZUC algorithm, the method is convenient and safe, and the security of the data on the NFC communication link between the smart card and the card reader is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of NFC technology, and in particular to an encryption and decryption method, device, transmission equipment and medium for NFC communication link data. Background Art

[0002] At present, when a smart card and a card reader establish an NFC (Near Field Communication) communication link and pass authentication, a proprietary stream encryption algorithm (crypto1 algorithm) is usually used to encrypt data on the NFC communication link. However, there are many attack methods on the crypto1 algorithm in the industry, resulting in the encryption of NFC communication link data based on the crypto1 algorithm being no longer safe.

[0003] Therefore, there is an urgent need to provide a secure encryption method for NFC communication link data to improve the security of data on the NFC communication link between the smart card and the card reader. Summary of the invention

[0004] In order to solve the above technical problems, the present disclosure provides a method, device, transmission equipment and medium for encrypting and decrypting NFC communication link data.

[0005] In a first aspect, the present disclosure provides a method for encrypting NFC communication link data, which is applied to a sender on an NFC communication link, and the method includes:

[0006] When it is detected that an NFC communication link is established with a receiving party and the authentication is passed, encrypting the original byte data in the original data using the preset data bits to generate encrypted byte data corresponding to the original byte data, wherein the sender is one of a smart card and a card reader, the receiving party is the other of the smart card and the card reader, and the preset data bits are pseudo-random bit streams generated based on a stream encryption algorithm;

[0007] Based on the encrypted byte data, generate encrypted verification data;

[0008] The encrypted data of the original data is generated according to the encrypted byte data and the encrypted verification data.

[0009] In a second aspect, the present disclosure provides a method for decrypting NFC communication link data, which is applied to a receiving party on an NFC communication link, and the method includes:

[0010] When it is detected that an NFC communication link is established with a sender and authentication is passed, receiving encrypted data of original data transmitted by the sender, wherein the sender is one of a smart card and a card reader, and the receiver is the other of the smart card and the card reader;

[0011] Decrypting the encrypted byte data in the encrypted data using preset data bits to generate original byte data corresponding to the encrypted byte data, wherein the preset data bits are pseudo-random bit streams generated based on a stream encryption algorithm;

[0012] Based on the original byte data, generate decryption verification data;

[0013] The original data is generated based on the original byte data and the decryption verification data.

[0014] In a third aspect, the present disclosure provides an encryption device for NFC communication link data, which is configured at a sender on the NFC communication link, and the device includes:

[0015] An encryption module, configured to, upon detecting that an NFC communication link is established with a receiving party and authentication is passed, encrypt the original byte data in the original data using a preset data bit to generate encrypted byte data corresponding to the original byte data, wherein the sending party is one of a smart card and a card reader, the receiving party is the other of the smart card and the card reader, and the preset data bit is a pseudo-random bit stream generated based on a stream encryption algorithm;

[0016] A first generating module, used for generating encrypted verification data based on the encrypted byte data;

[0017] The second generating module is used to generate the encrypted data of the original data according to the encrypted byte data and the encrypted verification data.

[0018] In a fourth aspect, the present disclosure provides a decryption device for NFC communication link data, which is configured at a receiving side on the NFC communication link, and the device includes:

[0019] A first receiving module, configured to receive encrypted data of original data transmitted by a sender when it is detected that an NFC communication link is established with the sender and authentication is passed, wherein the sender is one of a smart card and a card reader, and the receiver is the other of the smart card and the card reader;

[0020] A decryption module, used for decrypting the encrypted byte data in the encrypted data using preset data bits to generate original byte data corresponding to the encrypted byte data, wherein the preset data bits are pseudo-random bit streams generated based on a stream encryption algorithm;

[0021] A third generating module, used to generate decryption verification data based on the original byte data;

[0022] A fourth generating module is used to generate the original data based on the original byte data and the decryption verification data.

[0023] In a fifth aspect, an embodiment of the present disclosure further provides a transmission device, including:

[0024] processor;

[0025] A memory for storing executable instructions;

[0026] The processor is used to read the executable instructions from the memory and execute the executable instructions to implement the method provided by the first aspect or the second aspect.

[0027] In a sixth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium having a computer program stored thereon, which implements the method provided in the first aspect or the second aspect when executed by a processor.

[0028] Compared with the prior art, the technical solution provided by the embodiments of the present disclosure has the following advantages:

[0029] The present disclosure discloses an encryption and decryption method, device, transmission device and medium for NFC communication link data, wherein the encryption method for NFC communication link data is applied to the sender on the NFC communication link, and the encryption method for NFC communication link data includes: when it is detected that an NFC communication link is established with the receiver and the authentication is passed, the original byte data in the original data is encrypted using the preset data bit to generate encrypted byte data corresponding to the original byte data, wherein the sender is one of the smart card and the card reader, and the receiver is the other of the smart card and the card reader, and the preset data bit is a pseudo-random bit stream generated based on a stream encryption algorithm; based on the encrypted byte data, encryption verification data is generated; based on the encrypted byte data and the encryption verification data, the encrypted data of the original data is generated. In this way, the NFC communication link data is encrypted by the preset data bit, and combined with the encryption verification data, the original data is encrypted based on the stream encryption algorithm (ZUC algorithm), and this encryption method is convenient and safe, thereby improving the security of data on the NFC communication link between the smart card and the card reader. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0032] Figure 1A schematic diagram of a flow chart of a method for encrypting NFC communication link data provided by an embodiment of the present disclosure;

[0033] Figure 2 A schematic diagram of a flow chart of another method for encrypting NFC communication link data provided by an embodiment of the present disclosure;

[0034] Figure 3 A flowchart of a method for decrypting NFC communication link data provided by an embodiment of the present disclosure;

[0035] Figure 4 A schematic diagram of the structure of a device for encrypting NFC communication link data provided by an embodiment of the present disclosure;

[0036] Figure 5 A schematic diagram of the structure of a decryption device for NFC communication link data provided by an embodiment of the present disclosure;

[0037] Figure 6 A schematic diagram of the structure of a transmission device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0038] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0039] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0040] In order to improve the security of data on the NFC communication link between the smart card and the card reader, the following Figure 1 to Figure 2 The encryption method of the NFC communication link data provided in the embodiment of the present disclosure is described. In the embodiment of the present disclosure, the encryption method of the NFC communication link data can be executed by the sender on the NFC communication link. The sender is one of the smart card and the card reader, and the receiver is the other of the smart card and the card reader. Optionally, the smart card includes but is not limited to a physical card that meets the NFC communication and an NFC card simulated by a smart device that meets the NFC device-to-device communication protocol (NFC Forum communication protocol). The card reader includes but is not limited to a point of sale terminal (Point of Sale Terminal, POS) that meets the NFC communication, an access control that meets the NFC communication protocol, and a mobile phone login that meets the NFC communication protocol. Below, an example is given with a smart card as the sender on the NFC communication link and a card reader as the receiver on the NFC communication link.

[0041] Figure 1 A schematic flow chart of an encryption method for NFC communication link data provided by an embodiment of the present disclosure is shown.

[0042] like Figure 1 As shown, the encryption method of the NFC communication link data may include the following steps.

[0043] S110. When it is detected that an NFC communication link is established with the receiving party and authentication is passed, the original byte data in the original data is encrypted using preset data bits to generate encrypted byte data corresponding to the original byte data, wherein the preset data bits are a pseudo-random bit stream generated based on a stream encryption algorithm.

[0044] In this embodiment, before the smart card performs encryption operations, it is necessary to establish an NFC communication link with the card reader and complete authentication to achieve the purpose of data transmission with the card reader. In order to improve the security of data transmission, when the smart card establishes an NFC communication link with the card reader and passes authentication, the smart card uses a stream encryption algorithm (ZUC algorithm) to generate a pseudo-random bit stream and uses the pseudo-random bit stream as the preset data bit.

[0045] Furthermore, the smart card uses the preset data bits to encrypt the original byte data in the original data, and specifically performs XOR processing on the original byte data and the preset data bits to implement encryption processing on the original byte data based on the ZUC algorithm to generate encrypted byte data corresponding to the original byte data.

[0046] Optionally, the encrypted byte data may be determined as follows:

[0047] enc_data_i=data_ixorkey_i

[0048] Among them, enc_data_i is the i-th encrypted byte, data_i is the i-th original byte, key_i is the preset data bit, and xor is the exclusive OR process.

[0049] Among them, the specific implementation method of "using preset data bits to encrypt the original byte data in the original data to generate encrypted byte data corresponding to the original byte data" in S110 includes but is not limited to the following method: when the number of original byte data is not an integer multiple of 4 bytes, byte padding is performed on the original byte data to generate padded original byte data, wherein the number of padded original byte data is an integer multiple of 4 bytes closest to the number of original byte data; encrypting the padded original byte data using preset data bits to generate encrypted byte data.

[0050] It can be understood that, considering that the original byte data input by the ZUC algorithm and the encrypted byte data output (i.e., the key stream) are both 4-byte aligned, if the smart card detects that the number of original byte data is not an integer multiple of 4 bytes, it is necessary to perform byte padding on the original byte data so that the amount of the original byte data after padding is an integer multiple of 4 bytes closest to the number of the original byte data. Then, the smart card performs bitwise XOR on the preset data bits and the original byte data after padding to generate encrypted byte data.

[0051] For example, the number of original byte data is 3 bytes, which is not an integer multiple of 4 bytes. Since 4 bytes is the integer multiple of 4 bytes closest to 3 bytes, the smart card fills 3 bytes to 4 bytes to generate the filled original byte data (i.e., 4 bytes of original byte data). Then, the smart card performs bitwise XOR on the preset data bits and the 4 bytes of original byte data to generate encrypted byte data.

[0052] In this way, when the number of original byte data is not an integer multiple of 4 bytes, the original byte data can be byte-filled first, and then, combined with the ZUC algorithm's requirement that the output key stream is 4 bytes, the preset data bits are used to perform bitwise XOR with the 4-byte original byte data to achieve accurate encryption of the original byte data and obtain encrypted byte data.

[0053] S120: Generate encrypted verification data based on the encrypted byte data.

[0054] It is understandable that, since each encrypted byte in the encrypted byte data must correspond to a check bit, after generating the encrypted byte data, the smart card also needs to determine the encrypted check data based on the encrypted byte data.

[0055] In some embodiments, the specific implementation method of S120 includes but is not limited to the following method: performing odd check on each encrypted byte in the encrypted byte data, generating a check bit for each encrypted byte, and using the check bit of each encrypted byte as encryption check data in the original data.

[0056] Optionally, the encryption verification data may be determined as follows:

[0057] enc_p_i=odd parity(enc_data_i)

[0058] Where enc_p_i is the check bit of the i-th encrypted byte, enc_data_i is the i-th encrypted byte, and oddparity(*) is odd parity.

[0059] S130, generating encrypted data of the original data according to the encrypted byte data and the encrypted verification data.

[0060] In this embodiment, the specific implementation method of S130 includes but is not limited to the following method: generating encrypted data of the original data based on each encrypted byte in the encrypted byte data and the check bit of each encrypted byte in the encrypted check data.

[0061] It is understandable that the smart card performs bit-wise splicing of each encrypted byte in the encrypted byte data and the check bit of each encrypted byte in the encrypted check data, so that each encrypted byte corresponds to a check bit, and finally the encrypted data of the original data is obtained.

[0062] The encryption method of NFC communication link data of the embodiment of the present disclosure is applied to the sender on the NFC communication link, and the method includes: when it is detected that the NFC communication link is established with the receiver and the authentication is passed, the original byte data in the original data is encrypted by using the preset data bit to generate the encrypted byte data corresponding to the original byte data, wherein the sender is one of the smart card and the card reader, and the receiver is the other of the smart card and the card reader, and the preset data bit is a pseudo-random bit stream generated based on the stream encryption algorithm; based on the encrypted byte data, the encrypted verification data is generated; based on the encrypted byte data and the encrypted verification data, the encrypted data of the original data is generated. In this way, the NFC communication link data is encrypted by the preset data bit, and combined with the encrypted verification data, the encryption of the original data based on the stream encryption algorithm (ZUC algorithm) is realized. This encryption method is convenient and safe, and therefore improves the security of the data on the NFC communication link between the smart card and the card reader.

[0063] In another embodiment of the present disclosure, different encryption methods for NFC communication link data are explained as a whole. The encryption method for NFC communication link data is continued to be executed by the sender on the NFC communication link. The sender is one of the smart card and the card reader, and the receiver is the other of the smart card and the card reader. In addition, the smart card is continued to be used as the sender on the NFC communication link, and the card reader is used as the receiver on the NFC communication link.

[0064] Figure 2 A schematic flow chart of another method for encrypting NFC communication link data provided by an embodiment of the present disclosure is shown.

[0065] like Figure 2 As shown, the encryption method of the NFC communication link data may include the following steps.

[0066] S210. When it is detected that an NFC communication link is established with the receiving party and authentication is passed, and the number of original byte data is not an integer multiple of 4 bytes, byte padding is performed on the original byte data to generate padded original byte data, wherein the number of padded original byte data is an integer multiple of 4 bytes closest to the number of original byte data, and the preset data bits are a pseudo-random bit stream generated based on a stream encryption algorithm.

[0067] It is understandable that, considering that the original byte data input by the ZUC algorithm is 4-byte aligned, if the smart card detects that the number of original byte data is not an integer multiple of 4 bytes, the smart card needs to perform byte padding on the original byte data so that the amount of the original byte data after padding is an integer multiple of 4 bytes that is closest to the number of original byte data.

[0068] S220: Encrypt the padded original byte data using preset data bits to generate encrypted byte data.

[0069] It can be understood that when the original byte data input by the ZUC algorithm is 4-byte aligned, the encrypted byte data (i.e., key stream) output by the ZUC algorithm is also required to be 4-byte aligned. The smart card then performs bitwise XOR on the preset data bits and the padded original byte data to generate encrypted byte data.

[0070] S230: Using preset data bits, read the original byte data from the padded original byte data, perform encryption processing, and generate encrypted byte data.

[0071] It can be understood that, when the original byte data input by the ZUC algorithm is 4-byte aligned, the encrypted byte data (i.e., the key stream) output by the ZUC algorithm is not required to be 4-byte aligned. The smart card reads the original byte data from the padded original byte data, and performs bitwise XOR on the preset data bits and the read original byte data to generate encrypted byte data.

[0072] For example, the number of original byte data is 3 bytes, which is not an integer multiple of 4 bytes. Since 4 bytes is the integer multiple of 4 bytes closest to 3 bytes, the smart card fills 3 bytes to 4 bytes to generate filled original byte data (i.e. 4 bytes of original byte data). Then, the smart card reads 3 bytes of original byte data from the 4 bytes of original byte data, and performs bitwise XOR on the preset data bits and the 3 bytes of original byte data to generate encrypted byte data.

[0073] In this way, when the number of original byte data is not an integer multiple of 4 bytes, the original byte data can be byte-filled first, and then, combined with the different byte number requirements of the output key stream of the ZUC algorithm, two different methods are used to determine the encrypted byte data, thereby improving the flexibility and adaptability of the byte encryption process.

[0074] S240, performing odd check on each encrypted byte in the encrypted byte data, generating a check bit for each encrypted byte, and using the check bit for each encrypted byte as encryption check data in the original data.

[0075] It should be noted that this embodiment is explained by taking the example of executing S220 and then executing S240. In other cases, S230 may also be executed before executing S240, which is not specifically limited in this embodiment.

[0076] S250, performing odd check bit by bit on each original byte in the original byte data to generate an original check bit for each original byte.

[0077] Optionally, the raw check digit of each raw byte can be determined as follows:

[0078] p_i = odd parity(data_i)

[0079] Where p_i is the original check bit of the i-th original byte, data_i is the i-th original byte, and odd parity (*) is odd parity.

[0080] It should be noted that this embodiment is explained by taking the example of executing S250 after executing S230. In other cases, S250 may also be executed after executing S220, which is not specifically limited in this embodiment.

[0081] S260, using preset data bits to encrypt the original check bit of each original byte, generate an encrypted check bit of each original byte, and use the encrypted check bit of each original byte as encrypted check data.

[0082] In this embodiment, the smart card performs bitwise XOR on the original check bit of each original byte of the preset data to generate encrypted check data.

[0083] Optionally, the encryption verification data may be determined as follows:

[0084] enc_p_i=(p_ixorkey_i)&0x01

[0085] Among them, enc_p_i is the encryption check bit of the i-th original byte, p_i is the original check bit of the i-th original byte, xor is the exclusive OR processing, key_i is the preset data bit, & is the bitwise AND, and &0x01 means to intercept the lowest bit of the byte.

[0086] S270: Generate encrypted data of the original data based on each encrypted byte in the encrypted byte data and the check bit of each encrypted byte in the encrypted check data.

[0087] In this embodiment, the smart card splices the check bits of each encrypted byte in the encrypted byte data and each encrypted byte in the encrypted check data bit by bit, so that each encrypted byte corresponds to a check bit, and finally obtains the encrypted data of the original data.

[0088] S280: Generate encrypted data of the original data based on the encrypted check bit of each encrypted byte in the encrypted byte data and each original byte in the encrypted check data.

[0089] In this embodiment, the smart card splices the check bits of each encrypted byte in the encrypted byte data and each original byte in the encrypted check data bit by bit, so that each encrypted byte corresponds to a check bit, and finally obtains the encrypted data of the original data.

[0090] Through the above method, when the number of original byte data is not an integer multiple of 4 bytes, the original byte data can be byte-filled first, and then, in combination with the different requirements of the ZUC algorithm for the output key stream, different methods are used to determine the encrypted byte data, and the encrypted byte data determined by different methods are used to adapt to determine the encryption verification data, and then the encrypted byte data and the encryption verification data are used to generate the encrypted data of the original data, so as to realize the encryption of the original data based on the stream encryption algorithm (ZUC algorithm).

[0091] In another embodiment of the present disclosure, different encryption methods for NFC communication link data are explained as a whole. The encryption method for NFC communication link data is continued to be executed by the sender on the NFC communication link. The sender is one of the smart card and the card reader, and the receiver is the other of the smart card and the card reader. In addition, the smart card is continued to be used as the sender on the NFC communication link, and the card reader is used as the receiver on the NFC communication link.

[0092] In order to improve the security of data on the NFC communication link between the smart card and the card reader, the following Figure 3The decryption method of the NFC communication link data provided by the embodiment of the present disclosure is described. In the embodiment of the present disclosure, the decryption method of the NFC communication link data can be executed by the receiver on the NFC communication link. The sender is one of the smart card and the card reader, and the receiver is the other of the smart card and the card reader. Below, the smart card is used as the sender on the NFC communication link, and the card reader is used as the receiver on the NFC communication link for example.

[0093] Figure 3 A schematic flow chart of a method for decrypting NFC communication link data provided by an embodiment of the present disclosure is shown.

[0094] like Figure 3 As shown, the method for decrypting the NFC communication link data may include the following steps.

[0095] S310: When it is detected that an NFC communication link is established with the sender and authentication is passed, receiving encrypted data of the original data transmitted by the sender.

[0096] In this embodiment, when the card reader establishes an NFC communication link with the smart card and passes authentication, the card reader receives the encrypted data of the original data transmitted by the smart card through the NFC communication link to further decrypt the encrypted data to obtain the original data.

[0097] S320. Decrypt the encrypted byte data in the encrypted data using preset data bits to generate original byte data corresponding to the encrypted byte data, wherein the preset data bits are a pseudo-random bit stream generated based on a stream encryption algorithm.

[0098] In this embodiment, the card reader may generate a pseudo-random bit stream using a stream encryption algorithm (ZUC algorithm), and use the pseudo-random bit stream as a preset data bit.

[0099] Furthermore, the card reader uses the preset data bits to encrypt the encrypted byte data in the encrypted data, and specifically performs bitwise XOR on the encrypted byte data and the preset data bits to achieve decryption of the encrypted byte data based on the ZUC algorithm to generate original byte data corresponding to the encrypted byte data.

[0100] Alternatively, the raw byte data can be determined as follows:

[0101] data_i=(enc_data_ixorkey_i)&0x01

[0102] Among them, data_i is the i-th original byte, enc_data_i is the i-th encrypted byte, key_i is the preset data bit, xor is the exclusive or processing, & is the bitwise AND, and &0x01 means to intercept the lowest bit of the byte.

[0103] In some embodiments, the specific implementation method of S320 includes but is not limited to the following methods: S3201. When the number of encrypted byte data is an integer multiple of 4 bytes that is closest to the number of original byte data, and the number of original byte data is not an integer multiple of 4 bytes, the encrypted byte data is decrypted using preset data bits to generate padded original byte data; S3202. The padded byte data is removed from the padded original byte data to obtain the original byte data.

[0104] It is understandable that, considering that the encrypted byte data (i.e., key stream) input by the ZUC algorithm is 4 bytes and the output raw byte data is 4-byte aligned, it can be known from the above encryption method embodiment that the encrypted byte data is obtained by byte padding the raw byte data and then encrypting it. Therefore, in the decryption process, the card reader first performs bitwise XOR on the preset data bits and the encrypted byte data to generate the padded raw byte data, and then removes the padded byte data from the padded raw byte data to obtain the raw byte data.

[0105] In other embodiments, the specific implementation method of S320 includes but is not limited to the following methods: S3203. When the number of encrypted byte data and the number of original byte data are not an integer multiple of 4 bytes, and the number of encrypted byte data and the number of original byte data are equal, byte padding is performed on the encrypted byte data to generate padded encrypted byte data, wherein the number of padded encrypted byte data is an integer multiple of 4 bytes closest to the number of encrypted byte data; S3204. Using preset data bits, the encrypted byte data is read from the padded encrypted byte data for decryption processing to generate original byte data.

[0106] It is understandable that, considering that the encrypted byte data (i.e., key stream) input by the ZUC algorithm is 4-byte aligned, it is not required that the original byte data output by the ZUC algorithm is also 4-byte aligned. Based on the above encryption method embodiment, it can be known that the number of encrypted byte data is equal to the number of original byte data, that is, the encrypted byte data is obtained by byte-filling the original byte data and then reading the original byte data from the filled original byte data for encryption. Therefore, in the decryption process, the card reader first performs byte-filling processing on the encrypted byte data to generate the filled encrypted byte data, so that the filled encrypted byte data is an integer multiple of 4 bytes, and then, using the preset data bits, the encrypted byte data is read from the filled encrypted byte data for decryption processing to generate the original byte data.

[0107] Through the above method, combined with the different requirements of the ZUC algorithm for the output key stream, different methods are used to decrypt the encrypted byte data to accurately determine the original byte data.

[0108] S330: Generate decryption verification data based on the original byte data.

[0109] In this embodiment, the specific implementation method of S330 includes but is not limited to the following method: S3301. Perform odd check on each original byte in the original byte data, generate a check bit for each original byte, and use the check bit of each original byte as decryption check data.

[0110] Optionally, the decryption verification data may be determined as follows:

[0111] p_i = odd parity(data_i)

[0112] Where p_i is the original check bit of the i-th original byte, data_i is the i-th original byte, and odd parity (*) is odd parity.

[0113] Different from S330, after executing S320, the method also includes: S321, performing odd check on each encrypted byte in the encrypted byte data to generate an encryption check bit for each encrypted byte; S322, using preset data bits to decrypt the encryption check bit of each encrypted byte to generate an original check bit for each original byte, and using the original check bit of each original byte as decryption check data.

[0114] Optionally, the decryption verification data may be determined as follows:

[0115] p_i=(enc_p_ixorkey_i)&0x01

[0116] Among them, p_i is the original check bit of the i-th original byte, enc_p_i is the encryption check bit of the i-th original byte, key_i is the preset data bit, & is bitwise AND, and &0x01 means to intercept the lowest bit of the byte.

[0117] It should be noted that after S320 is specifically executed according to S3201 to S3202, S330 is specifically executed according to S3301; after S320 is specifically executed according to S3203 to S3204, S321 to S322 are executed next. In addition, this embodiment does not limit other execution situations.

[0118] S340: Generate original data based on the original byte data and the decryption verification data.

[0119] In some embodiments, when S330 is specifically executed according to S3301, the specific implementation method of S340 includes but is not limited to the following method: generating original data based on the check bit of each original byte in the original byte data and each original byte in the decryption check data.

[0120] In some embodiments, when S330 is specifically executed according to S321 to S322, the specific implementation method of S340 includes but is not limited to the following method: generating original data based on the original check bit of each original byte in the original byte data and each original byte in the decryption check data.

[0121] A decryption method for NFC communication link data of an embodiment of the present disclosure is applied to a receiver on an NFC communication link, and the method includes: receiving encrypted data of original data transmitted by a sender when an NFC communication link is established and authentication is passed, wherein the sender is one of a smart card and a card reader, and the receiver is another of a smart card and a card reader; decrypting encrypted byte data in the encrypted data using preset data bits to generate original byte data corresponding to the encrypted byte data, wherein the preset data bits are pseudo-random bit streams generated based on a stream encryption algorithm; generating decryption verification data based on the original byte data; generating original data based on the original byte data and the decryption verification data. In this way, the NFC communication link data is decrypted by the preset data bits, and combined with the decryption verification data, the encrypted data is decrypted based on the stream encryption algorithm (ZUC algorithm). This decryption method is convenient and safe, and therefore improves the security of data on the NFC communication link between the smart card and the card reader.

[0122] Figure 4 A schematic diagram of the structure of an encryption device for NFC communication link data provided by an embodiment of the present disclosure is shown. The encryption device for NFC communication link data shown in 4 is configured on the sender on the NFC communication link. The sender is one of a smart card and a card reader, and the receiver is the other of the smart card and the card reader. In the following, an example is given with a smart card as the sender on the NFC communication link and a card reader as the receiver on the NFC communication link.

[0123] like Figure 4 As shown, the NFC communication link data encryption device 400 may include:

[0124] The encryption module 410 is used to encrypt the original byte data in the original data using the preset data bits to generate encrypted byte data corresponding to the original byte data when it is detected that the NFC communication link is established with the receiving party and the authentication is passed, wherein the sending party is one of the smart card and the card reader, the receiving party is the other of the smart card and the card reader, and the preset data bits are pseudo-random bit streams generated based on a stream encryption algorithm;

[0125] A first generating module 420, configured to generate encrypted verification data based on the encrypted byte data;

[0126] The second generating module 430 is used to generate the encrypted data of the original data according to the encrypted byte data and the encrypted verification data.

[0127] The present disclosure discloses an encryption device for NFC communication link data. When it is detected that an NFC communication link is established with a receiver and authentication is passed, the device uses preset data bits to encrypt the original byte data in the original data to generate encrypted byte data corresponding to the original byte data, wherein the sender is one of a smart card and a card reader, and the receiver is another of a smart card and a card reader. The preset data bits are pseudo-random bit streams generated based on a stream encryption algorithm; based on the encrypted byte data, encryption verification data is generated; based on the encrypted byte data and the encryption verification data, encrypted data of the original data is generated. In this way, the NFC communication link data is encrypted by the preset data bits, and combined with the encryption verification data, the encryption of the original data based on the stream encryption algorithm (ZUC algorithm) is realized. This encryption method is convenient and safe, and therefore improves the security of data on the NFC communication link between the smart card and the card reader.

[0128] In some embodiments of the present disclosure, the encryption module 410 includes:

[0129] a byte padding unit, configured to perform byte padding processing on the original byte data to generate padded original byte data when the number of the original byte data is not an integer multiple of 4 bytes, wherein the number of the padded original byte data is an integer multiple of 4 bytes closest to the number of the original byte data;

[0130] The first encryption unit is used to encrypt the padded original byte data using the preset data bits to generate the encrypted byte data.

[0131] In some embodiments of the present disclosure, the encryption module 410 further includes:

[0132] The second encryption unit is used to use the preset data bits to read the original byte data from the padded original byte data for encryption processing to generate the encrypted byte data.

[0133] In some embodiments of the present disclosure, the first generating module 420 is specifically configured to:

[0134] Performing odd check on each encrypted byte in the encrypted byte data to generate a check bit for each encrypted byte, and using the check bit for each encrypted byte as encryption check data in the original data;

[0135] Accordingly, the second generating module 430 is specifically configured to:

[0136] The encrypted data of the original data is generated based on each encrypted byte in the encrypted byte data and the check bit of each encrypted byte in the encrypted check data.

[0137] In some embodiments of the present disclosure, the device further includes:

[0138] A first odd check module, used for performing odd check on each original byte in the original byte data to generate an original check bit of each original byte;

[0139] An encryption check bit generation module is used to encrypt the original check bit of each original byte using the preset data bit to generate an encryption check bit of each original byte, and use the encryption check bit of each original byte as the encryption check data;

[0140] Accordingly, the second generating module 430 is specifically configured to:

[0141] The encrypted data of the original data is generated based on each encrypted byte in the encrypted byte data and the encrypted check bit of each original byte in the encrypted check data.

[0142] It should be noted that Figure 4 The NFC communication link data encryption device 400 shown can perform Figure 1 to Figure 2 The various steps in the method embodiment shown in the figure are implemented Figure 1 to Figure 2 The various processes and effects in the method embodiment shown are not described in detail here.

[0143] Figure 5The schematic diagram of the structure of a decryption device for NFC communication link data provided by an embodiment of the present disclosure is shown. The decryption device for NFC communication link data shown in Figure 5 is configured on the receiving side of the NFC communication link. The sender is one of a smart card and a card reader, and the receiver is the other of the smart card and the card reader. In the following, the smart card is used as the sender on the NFC communication link, and the card reader is used as the receiver on the NFC communication link for example.

[0144] like Figure 5 As shown, the decryption device 500 of NFC communication link data may include:

[0145] A first receiving module 510 is used to receive encrypted data of original data transmitted by a sender when it is detected that an NFC communication link is established with the sender and the authentication is passed, wherein the sender is one of a smart card and a card reader, and the receiver is the other of the smart card and the card reader;

[0146] A decryption module 520, configured to decrypt the encrypted byte data in the encrypted data using a preset data bit to generate original byte data corresponding to the encrypted byte data, wherein the preset data bit is a pseudo-random bit stream generated based on a stream encryption algorithm;

[0147] A third generating module 530, configured to generate decryption verification data based on the original byte data;

[0148] The fourth generating module 540 is used to generate the original data based on the original byte data and the decryption verification data.

[0149] The decryption device of the NFC communication link data of the embodiment of the present disclosure, when detecting that the NFC communication link is established with the sender and the authentication is passed, receives the encrypted data of the original data transmitted by the sender, wherein the sender is one of the smart card and the card reader, and the receiver is the other of the smart card and the card reader; uses the preset data bits to decrypt the encrypted byte data in the encrypted data, and generates the original byte data corresponding to the encrypted byte data, wherein the preset data bits are pseudo-random bit streams generated based on the stream encryption algorithm; based on the original byte data, generates decryption verification data; based on the original byte data and the decryption verification data, generates the original data. In this way, the NFC communication link data is decrypted by the preset data bits, and combined with the decryption verification data, the encrypted data is decrypted based on the stream encryption algorithm (ZUC algorithm). This decryption method is convenient and safe, and therefore improves the security of the data on the NFC communication link between the smart card and the card reader.

[0150] In some embodiments of the present disclosure, the decryption module 520 includes:

[0151] A first decryption unit is used for, when the number of the encrypted byte data is an integer multiple of 4 bytes closest to the number of the original byte data, and when the number of the original byte data is not an integer multiple of 4 bytes, decrypting the encrypted byte data using the preset data bits to generate padded original byte data;

[0152] The defilling unit is used to remove the filled byte data from the filled original byte data to obtain the original byte data.

[0153] In some embodiments of the present disclosure, the decryption module 520 includes:

[0154] a padding unit, configured to perform byte padding processing on the encrypted byte data to generate padded encrypted byte data when the number of the encrypted byte data and the number of the original byte data are not an integer multiple of 4 bytes and the number of the encrypted byte data and the number of the original byte data are equal, wherein the number of the padded encrypted byte data is an integer multiple of 4 bytes that is closest to the number of the encrypted byte data;

[0155] The first decryption unit is used to use the preset data bits to read the encrypted byte data from the padded encrypted byte data for decryption processing to generate the original byte data.

[0156] In some embodiments of the present disclosure, the third generation module 530 is specifically configured to:

[0157] Performing odd check on each original byte in the original byte data, generating a check bit for each original byte, and using the check bit for each original byte as the decryption check data;

[0158] Accordingly, the fourth generating module 540 is specifically configured to:

[0159] The original data is generated based on each original byte in the original byte data and the check bit of each original byte in the decrypted check data.

[0160] In some embodiments of the present disclosure, the device further includes:

[0161] A second odd check module, used for performing an odd check on each encrypted byte in the encrypted byte data to generate an encryption check bit for each encrypted byte;

[0162] An original check bit generation module, used for decrypting the encrypted check bit of each encrypted byte using the preset data bit, generating an original check bit of each original byte, and using the original check bit of each original byte as the decrypted check data;

[0163] Accordingly, the fourth generating module 540 is specifically configured to:

[0164] The original data is generated based on each original byte in the original byte data and an original check bit of each original byte in the decrypted check data.

[0165] It should be noted that Figure 5 The NFC communication link data decryption device 500 shown can perform Figure 3 The various steps in the method embodiment shown in the figure are implemented Figure 3 The various processes and effects in the method embodiment shown are not described in detail here.

[0166] Figure 6 A schematic diagram of the structure of a transmission device provided by an embodiment of the present disclosure is shown, wherein the transmission device is one of a sender and a receiver on an NFC communication link.

[0167] like Figure 6 As shown, the transmission device may include a processor 601 and a memory 602 storing computer program instructions.

[0168] Specifically, the processor 601 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0169] The memory 602 may include a large capacity memory for information or instructions. By way of example and not limitation, the memory 602 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a tape, or a universal serial bus (USB) drive or a combination of two or more of these. Where appropriate, the memory 602 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 602 may be inside or outside the integrated gateway device. In a particular embodiment, the memory 602 is a non-volatile solid-state memory. In a particular embodiment, the memory 602 includes a read-only memory (ROM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (Electrically Erasable Programmable ROM, EEPROM), an electrically rewritable ROM (EAROM) or a flash memory, or a combination of two or more of these.

[0170] The processor 601 reads and executes the computer program instructions stored in the memory 602 to perform the steps of the capability data management method provided in the embodiment of the present disclosure.

[0171] In one example, the transmission device may further include a transceiver 603 and a bus 604. Figure 6 As shown, the processor 601, the memory 602 and the transceiver 603 are connected via a bus 604 and communicate with each other.

[0172] The bus 604 includes hardware, software, or both. For example, but not limitation, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industrial Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a MicroChannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses or a combination of two or more of these. Where appropriate, the bus 604 may include one or more buses. Although embodiments of the present application describe and illustrate a particular bus, the present application contemplates any suitable bus or interconnect.

[0173] The following is an embodiment of a computer-readable storage medium provided in an embodiment of the present disclosure. The computer-readable storage medium and the capability data management method of the above-mentioned embodiments belong to the same inventive concept. For details not described in detail in the embodiment of the computer-readable storage medium, reference may be made to the embodiment of the above-mentioned NFC communication link data encryption method or the above-mentioned NFC communication link data decryption method.

[0174] This embodiment provides a storage medium containing computer executable instructions. When the computer executable instructions are executed by a computer processor, they are used to execute a method for encrypting NFC communication link data, which is applied to a sender on an NFC communication link. The method includes:

[0175] When it is detected that an NFC communication link is established with a receiving party and the authentication is passed, encrypting the original byte data in the original data using the preset data bits to generate encrypted byte data corresponding to the original byte data, wherein the sender is one of a smart card and a card reader, the receiving party is the other of the smart card and the card reader, and the preset data bits are pseudo-random bit streams generated based on a stream encryption algorithm;

[0176] Based on the encrypted byte data, generate encrypted verification data;

[0177] The encrypted data of the original data is generated according to the encrypted byte data and the encrypted verification data.

[0178] This embodiment provides a storage medium containing computer executable instructions. When the computer executable instructions are executed by a computer processor, they are used to execute a method for decrypting NFC communication link data, which is applied to a receiving party on the NFC communication link. The method includes:

[0179] When it is detected that an NFC communication link is established with a sender and authentication is passed, receiving encrypted data of original data transmitted by the sender, wherein the sender is one of a smart card and a card reader, and the receiver is the other of the smart card and the card reader;

[0180] Decrypting the encrypted byte data in the encrypted data using preset data bits to generate original byte data corresponding to the encrypted byte data, wherein the preset data bits are pseudo-random bit streams generated based on a stream encryption algorithm;

[0181] Based on the original byte data, generate decryption verification data;

[0182] The original data is generated based on the original byte data and the decryption verification data.

[0183] Of course, the storage medium containing computer executable instructions provided in an embodiment of the present disclosure is not limited to the above method operations, and the computer executable instructions can also execute related operations in the encryption method of NFC communication link data or the decryption method of NFC communication link data provided in any embodiment of the present disclosure.

[0184] Through the above description of the implementation methods, the technical personnel in the relevant field can clearly understand that the present disclosure can be implemented with the help of software and necessary general hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present disclosure can be essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for a computer cloud platform (which can be a personal computer, a server, or a network cloud platform, etc.) to execute the encryption method of NFC communication link data or the decryption method of NFC communication link data provided in each embodiment of the present disclosure.

[0185] Note that the above are only preferred embodiments of the present disclosure and the technical principles used. Those skilled in the art will understand that the present disclosure is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present disclosure. Therefore, although the present disclosure is described in more detail through the above embodiments, the present disclosure is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present disclosure, and the scope of the present disclosure is determined by the scope of the appended claims.

Claims

1. A method for encrypting NFC communication link data, characterized in that: Applied to a sender on an NFC communication link, the method comprises: When it is detected that an NFC communication link is established with a receiving party and the authentication is passed, encrypting the original byte data in the original data using the preset data bits to generate encrypted byte data corresponding to the original byte data, wherein the sender is one of a smart card and a card reader, the receiving party is the other of the smart card and the card reader, and the preset data bits are pseudo-random bit streams generated based on a stream encryption algorithm; Based on the encrypted byte data, generate encrypted verification data; The encrypted data of the original data is generated according to the encrypted byte data and the encrypted verification data.

2. The method according to claim 1, characterized in that The method of encrypting the original byte data in the original data by using the preset data bits to generate encrypted byte data corresponding to the original byte data includes: In the case where the number of the original byte data is not an integer multiple of 4 bytes, performing byte padding processing on the original byte data to generate padded original byte data, wherein the number of the padded original byte data is an integer multiple of 4 bytes closest to the number of the original byte data; The padded original byte data is encrypted using the preset data bits to generate the encrypted byte data.

3. The method according to claim 2, characterized in that After performing byte filling processing on the original byte data to generate filled original byte data, the method further includes: The preset data bits are used to read the original byte data from the padded original byte data for encryption processing to generate the encrypted byte data.

4. The method according to claim 1, characterized in that: The step of generating encrypted verification data based on the encrypted byte data comprises: Performing odd check on each encrypted byte in the encrypted byte data, generating a check bit for each encrypted byte, and using the check bit for each encrypted byte as encryption check data in the original data; Correspondingly, generating the encrypted data of the original data according to the encrypted byte data and the encrypted verification data includes: The encrypted data of the original data is generated based on each encrypted byte in the encrypted byte data and the check bit of each encrypted byte in the encrypted check data.

5. The method according to claim 1, characterized in that Also includes: Performing odd check on each original byte in the original byte data to generate an original check bit for each original byte; Using the preset data bit to encrypt the original check bit of each original byte, generate an encrypted check bit of each original byte, and use the encrypted check bit of each original byte as the encrypted check data; Correspondingly, generating the encrypted data of the original data according to the encrypted byte data and the encrypted verification data includes: The encrypted data of the original data is generated based on each encrypted byte in the encrypted byte data and the encrypted check bit of each original byte in the encrypted check data.

6. A method for decrypting NFC communication link data, characterized in that: Applied to a receiver on an NFC communication link, the method comprises: When it is detected that an NFC communication link is established with a sender and authentication is passed, receiving encrypted data of original data transmitted by the sender, wherein the sender is one of a smart card and a card reader, and the receiver is the other of the smart card and the card reader; Decrypting the encrypted byte data in the encrypted data using preset data bits to generate original byte data corresponding to the encrypted byte data, wherein the preset data bits are pseudo-random bit streams generated based on a stream encryption algorithm; Based on the original byte data, generate decryption verification data; The original data is generated based on the original byte data and the decryption verification data.

7. The method according to claim 6, characterized in that The method of decrypting the encrypted byte data in the encrypted data by using the preset data bits to generate the original byte data corresponding to the encrypted byte data includes: When the number of the encrypted byte data is an integer multiple of 4 bytes that is closest to the number of the original byte data, and when the number of the original byte data is not an integer multiple of 4 bytes, decrypting the encrypted byte data using the preset data bits to generate padded original byte data; The padded byte data is removed from the padded original byte data to obtain the original byte data.

8. The method according to claim 6, characterized in that The method of decrypting the encrypted byte data in the encrypted data by using the preset data bits to generate the original byte data corresponding to the encrypted byte data includes: When the number of the encrypted byte data and the number of the original byte data are not an integer multiple of 4 bytes, and the number of the encrypted byte data is equal to the number of the original byte data, performing byte padding processing on the encrypted byte data to generate padded encrypted byte data, wherein the number of the padded encrypted byte data is an integer multiple of 4 bytes that is closest to the number of the encrypted byte data; The encrypted byte data is read from the padded encrypted byte data using the preset data bits to perform decryption processing to generate the original byte data.

9. The method according to claim 6, characterized in that The step of generating decryption verification data based on the original byte data comprises: Performing odd check on each original byte in the original byte data, generating a check bit for each original byte, and using the check bit for each original byte as the decryption check data; Accordingly, generating the original data based on the original byte data and the decryption verification data includes: The original data is generated based on each original byte in the original byte data and the check bit of each original byte in the decrypted check data.

10. The method according to claim 6, characterized in that Also includes: Performing odd check on each encrypted byte in the encrypted byte data to generate an encryption check bit for each encrypted byte; Decrypting the encrypted check bit of each encrypted byte using the preset data bit to generate an original check bit of each original byte, and using the original check bit of each original byte as the decrypted check data; Accordingly, generating the original data based on the original byte data and the decryption verification data includes: The original data is generated based on each original byte in the original byte data and an original check bit of each original byte in the decrypted check data.

11. A device for encrypting NFC communication link data, characterized in that: A sender configured on an NFC communication link, the device comprising: An encryption module, configured to, when detecting that an NFC communication link is established with a receiving party and authentication is passed, encrypt the original byte data in the original data using preset data bits to generate encrypted byte data corresponding to the original byte data, wherein the sending party is one of a smart card and a card reader, the receiving party is the other of the smart card and the card reader, and the preset data bits are pseudo-random bit streams generated based on a stream encryption algorithm; A first generating module, used for generating encrypted verification data based on the encrypted byte data; The second generating module is used to generate the encrypted data of the original data according to the encrypted byte data and the encrypted verification data.

12. A decryption device for NFC communication link data, characterized in that: A receiving party configured on an NFC communication link, the device comprising: A first receiving module, configured to receive encrypted data of original data transmitted by a sender when it is detected that an NFC communication link is established with the sender and authentication is passed, wherein the sender is one of a smart card and a card reader, and the receiver is the other of the smart card and the card reader; A decryption module, used to decrypt the encrypted byte data in the encrypted data using preset data bits to generate original byte data corresponding to the encrypted byte data, wherein the preset data bits are pseudo-random bit streams generated based on a stream encryption algorithm; A third generating module, used to generate decryption verification data based on the original byte data; A fourth generating module is used to generate the original data based on the original byte data and the decryption verification data.

13. A transmission device, characterized in that: include: processor; A memory for storing executable instructions; The processor is used to read the executable instructions from the memory and execute the executable instructions to implement the method described in any one of claims 1 to 10.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the processor implements the method according to any one of claims 1 to 10.

Images