A single-byte Feistel encryption storage method and device based on storage structure

Abstract

The present invention provides a single-byte Feistel encryption storage algorithm and device based on a storage structure, which is applied to the field of data storage security, including randomly generating a MasterKey that meets a preset security standard when a MasterKey area is detected to be a default value; each time the storage device is powered on, the actual storage space is divided into N areas, and the address of each area is input into a security area; in the security area, the regional key is calculated; the storage address of the data to be encrypted is obtained, and the round key of the data to be encrypted is derived; and the single-byte data is encrypted using a Feistel structure. The present invention flexibly uses the storage structure of the device, randomly generates an encryption key in the security area, and integrates the storage address to perform regional key expansion and round key derivation, which greatly enhances the reliability of the key. At the same time, single-byte encryption is not limited by length, making the device more flexible and suitable for the storage of communication data in various industries.

Description

Technical Field

[0001] The present invention relates to the field of encryption algorithms, and in particular to a single-byte Feistel encryption storage algorithm and a device based on a storage structure. Background Art

[0002] In the field of data storage security, how to ensure high security while achieving efficient encrypted storage has always been a difficult technical problem to balance.

[0003] The existing security algorithm directly encrypts the stored data by inputting the encryption key, so the security of the original key directly input cannot be guaranteed. Summary of the invention

[0004] The purpose of the present invention is to solve the problem that the security of the original key cannot be guaranteed in the existing security algorithm, and to propose a single-byte Feistel encryption storage method and device based on a storage structure. This patent generates the original key in the security area of ​​the device, and performs key expansion and round key export on the original key, thereby enhancing the complexity of the password and making the password more secure.

[0005] The technical solution of the present invention is:

[0006] The present invention provides a single-byte Feistel encryption storage method based on a storage structure, comprising the following steps:

[0007] S1. Check the MasterKey area. If the MasterKey is the default value, randomly generate a MasterKey that meets the preset security standards.

[0008] S2. Each time the storage device is powered on, the actual storage space size of the storage device is obtained, the number of regions N is determined according to the storage space size, the storage space is divided into N regions, and the address of each region is input into the security zone; in the security zone, the region key RegionKey corresponding to each region is calculated using the MasterKey and the address of each region;

[0009] S3, obtaining the storage address of the data to be encrypted, determining the corresponding region key RegionKey according to the high bits of the storage address; and deriving the round key RoundKey for m rounds of encryption of the data to be encrypted according to the storage address and the region key;

[0010] S4. Use the round key RoundKey to perform m rounds of encryption on the encrypted data using the Feistel encryption structure to obtain an encryption result; perform Sbox nonlinear permutation on the encryption result to obtain the final encrypted data.

[0011] Furthermore, the S1 specifically includes:

[0012] When the storage device is powered on for the first time, the value of the MasterKey storage area is checked;

[0013] If the value of the MasterKey storage area is the default value, the random number generator is triggered to generate a random number that complies with the NIST800-57 security standard as the MasterKey;

[0014] The generated MasterKey is stored in the MasterKey storage area of ​​the security zone.

[0015] Furthermore, the S2 specifically includes:

[0016] S21, obtaining the size of the actual storage space of the device, selecting an appropriate N according to the size of the storage space of the device, and dividing the storage space into N areas;

[0017] S22, send the region address of each space to the security zone, and use the MasterKey and the region address in the security zone to calculate the region key RegionKey using the following formula x ;

[0018] RegionKey x =

[0019] (((IVx^MasterKey) / 0xFFFF)×((IVx^MasterKey)%0xFFFF)) a

[0020] Where: x∈[0,N-1], N is the number of regions, IV x is the region address of the xth storage space of the storage device, and calculates the region key RegionKey x When 0xFFFF is used, the number of FFs in it is equal to half the number of bytes of IV XOR MasterKey value, and the value of a is the same as the number of FFs.

[0021] S23. Temporarily store the calculated N region keys RegionKey in the RAM of the device.

[0022] Furthermore, the calculation process of the regional key RegionKey is carried out in the security area of ​​the device. During the calculation process, the MasterKey does not leave the security area. Only the regional key RegionKey is stored in the RAM area of ​​the device. When the device loses power, the regional key RegionKey is destroyed.

[0023] Furthermore, the S3 specifically includes:

[0024] S31, when it is necessary to encrypt a single byte of data to be encrypted in a certain storage area, determine the storage area to which the byte belongs according to the high bit of the storage address of the byte;

[0025] S32, read the region key RegionKey corresponding to the storage area from RAM x , using the region key RegionKey x Calculate the encryption key SubKey;

[0026] S33. According to the number of encryption rounds m, m bytes are obtained from the encryption key SubKey as the round key RoundKey for m rounds of encryption.

[0027] Furthermore, in the above S32, the encryption key SubKey is calculated using the following formula: SubKey = (((RegionKey x / 0xFFFF)^(RegionKey x %0xFFFF))< <L4)|(RegionKey x %0xFFFF)

[0028] Among them, the length of 0xFFFF should be RegionKey x Half the length, the value of L4 is RegionKey x Half the number of bits.

[0029] Furthermore, before performing m rounds of encryption in S4, the plaintext data to be encrypted is obtained, and Sbox nonlinear permutation is performed on the plaintext data.

[0030] Furthermore, in S4, the round key RoundKey is used to perform m-round encryption on the encrypted data using the Feistel encryption structure, using the following formula:

[0031] Ct m =R m-1 |L m-1 ^F(R m-1 ,RoundKey m-1 )

[0032] F(R m-1 ,RoundKey m-1 )=((R m-1 ^RoundKey Lm-1 ))^((R m-1 ^RoundKey Rm-1 ))

[0033] Where: Ct m is the result after one round of encryption, Rm-1 It is the lower four bits of the input data to be encrypted. m-1 The upper four bits of the input data to be encrypted, RoundKey m-1 RoundKey Lm-1 The high four bits of the single-byte encryption key used in this round, RoundKey Rm-1 It is the lower four bits of the single-byte encryption key used in this round, and m is the number of the current encryption round.

[0034] A single-byte Feistel encrypted storage device based on a storage structure, using the method according to any one of claims 1 to 8, characterized in that the device comprises:

[0035] The security zone module is used to randomly generate the MasterKey;

[0036] A region key calculation module, used to derive N groups of region keys RegionKey;

[0037] A round key calculation module, used to derive the round key RoundKey in the encryption process;

[0038] The encryption module is used to encrypt the input single-byte data to be encrypted.

[0039] Beneficial effects of the present invention:

[0040] The method of the present invention operates the key and the address of the data to be stored, so that in the same device, even if the plaintext data to be stored is the same, the ciphertext data actually stored in the storage space is different. At the same time, due to the randomness of the MasterKey of the security zone, the present device can realize the function of having different ciphertext data in different devices even if the same data and the same storage location are in different devices, thereby further improving the security of device data storage.

[0041] The present invention discloses a single-byte Feistel encryption storage method based on a storage structure. In order to solve the problems of storage space security and encryption efficiency, the present invention divides the storage space into multiple areas and generates a unique area key for each area. By combining the storage address of the single-byte data with the area key to generate a round key, differentiated encryption for different storage locations is achieved. Multi-round encryption using Sbox permutation and Feistel structure improves encryption efficiency while ensuring security. The present invention achieves fine-grained protection of the storage space and effectively improves the security of data storage by closely combining the encryption process with the storage structure. At the same time, the encryption operation at the single-byte level also ensures the high efficiency of the encryption and decryption process, and is suitable for storage scenarios with high requirements for both security and efficiency.

[0042] Other features and advantages of the present invention will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The above and other objects, features and advantages of the present invention will become more apparent through a more detailed description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, wherein like reference numerals generally represent like components throughout the exemplary embodiments of the present invention.

[0044] Figure 1 A flow chart of a single-byte Feistel encryption storage method based on a storage structure according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0045] The preferred embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the preferred embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0046] Example 1

[0047] Figure 1 A flow chart of a single-byte Feistel encryption storage method based on a storage structure according to an embodiment of the present invention is shown.

[0048] like Figure 1 As shown, the present invention provides a single-byte Feistel encryption storage method based on a storage structure, comprising the following steps:

[0049] Acquire the storage space size of the device, and divide the storage space into a plurality of areas;

[0050] A MasterKey is randomly generated in the security zone of the device, and the MasterKey is used to perform an XOR operation with the region address of each of the regions to obtain a region key RegionKey corresponding to each of the regions;

[0051] According to the storage address of the single-byte data to be encrypted, determine the region where the single-byte data is located, and obtain the region key RegionKey corresponding to the region; use the region key RegionKey and the storage address of the single-byte data to perform calculations to obtain the round key RoundKey corresponding to the single-byte data;

[0052] Perform Sbox substitution on the single-byte data, and split the replaced single-byte data into a low-order part and a high-order part; input the split low-order and high-order parts of data and the round key RoundKey into a Feistel structure to perform multiple rounds of encryption operations to obtain encrypted low-order and high-order parts of data; merge the encrypted low-order and high-order parts of data, and perform Sbox inverse substitution to obtain encrypted single-byte ciphertext data; store the single-byte ciphertext data in the storage address of the single-byte data.

[0053] When implementing:

[0054] The present invention provides a single-byte Feistel encryption storage method based on a storage structure, which is used to perform single-byte encryption on data stored in a device. The encryption process of the device is divided into two parts, one part is performed in the device security area, and the other part is performed in the device RAM area, such as Figure 1 As shown:

[0055] Part 1: Process of installing safety area

[0056] S1.1: Randomly generate MasterKey;

[0057] S1.1.1 randomly generates a string of MasterKey in the security zone of the device. The value of this string of MasterKey complies with the NIST 800-57 security standard and will not leave the security zone, ensuring its security. In this use case, we set the size of the generated MasterKey to 16 bytes.

[0058] S1.2: Obtain the device storage address and calculate the region key RegionKey;

[0059] S1.2.1 All devices will allocate a space for the data they need to access. In this use case, it is assumed that the storage space for single-byte encrypted data is 64K, which is divided into 16 areas, and the size of each area is 4K;

[0060] S1.2.2 Read the value of the storage address and calculate the region key RegionKey of the Xth region using the following formula x ,This calculation is also performed in the secure area of ​​the device, ensuring the stability of the regional key;

[0061] RegionKey x =

[0062] (((IVx^MasterKey) / 0xFFFF)×((IVx^MasterKey)%0xFFFF)) a

[0063] Where: x∈[0,N-1], N is the number of regions, IV x is the region address of the xth storage space of the storage device, and calculates the region key RegionKey x When 0xFFFF is used, the number of FFs in it is equal to half the number of bytes of IV XOR MasterKey value, and the value of a is the same as the number of FFs.

[0064] Suppose the address IV storing single-byte encrypted data is 16 bytes, and the first twelve bytes of data are the same. In order to ensure the uniqueness of the regional key, we take the first 13 bytes for calculation. At the same time, the number of FFs in the numerator is 8, and a is 8. Suppose the MasterKey in this example is also 16 bytes, which is equivalent to taking the first eight bytes of IV and MasterKey XOR multiplied by the last eight bytes, and then raising the product to eight times the power to obtain the regional key RegionKey.

[0065] S1.2.3 The process of calculating N region keys RegionKey is performed in the security area of ​​the device, and the calculated results are exported to the RAM area of ​​the device. When the device loses power, the region key RegionKey is destroyed.

[0066] Part 2: Process of installing RAM area;

[0067] S2.1: Determine the region key RegionKey;

[0068] S2.1.1 Input the single-byte data to be encrypted, and determine the RegionKey according to the single-byte data storage address. x In this example, we assume that we take the region key RegionKey3 in the third region;

[0069] S2.2: Calculate the round key RoundKey;

[0070] S2.2.1 Read the region key stored in RegionKey3, and take the last three bytes of the region address, and use the following formula to calculate the encryption key SubKey used in the single-byte encryption process; SubKey = (((RegionKey x / 0xFFFF)^(RegionKey x %0xFFFF))< <L4)|(RegionKey x %0xFFFF);

[0071] Among them, the length of 0xFFFF should be RegionKey x Half the length, the value of L4 is RegionKey xThe number of F is 4. The high four bits and low four bits of RegionKey3 are XORed, and the result is used as the high four bits and combined with the low four bits of RegionKey3 to generate a set of 8 bytes of data as the encryption key SubKey.

[0072] S2.2.2 In this example, we use the Feistel structure to perform eight encryptions in total, reverse the order of the encryption keys in S2.2.1, and derive the 8-byte single-byte round key RoundKey.

[0073] S2.3: Use the RoundKey obtained in S2.2.2 to encrypt the single-byte data with the help of the Feistel structure, as follows:

[0074] S2.3.1 obtain the single-byte plaintext data to be encrypted, perform Sbox substitution on the plaintext data, and split it into the upper four bits and the fourth bit;

[0075] S2.3.2 transmits the high and low four bits of the single-byte data into the encryption algorithm framework respectively. In this use case, the encryption algorithm function is iterated 8 times in total, that is, m=8;

[0076] S2.3.3 Use the following formula to calculate the data obtained during the first round of encryption;

[0077] S2.3.3.1 During the first round of encryption, the lower four bits of input data R0 are first transferred to the upper four bits of input data of the second round of encryption.

[0078] S2.3.3.2 Take the lower four bits R0 of the first round input and the single-byte round key RoundKey0 in S2.2.2 and put them into formula F for calculation. First, split RoundKey0 into the upper four bits RoundKey L0 With the lower four bits of RoundKey R0 , respectively, RoundKey L0 With RoundKey R0 XOR with R0, and then XOR the two results to get the value of F(R0,RoundKey0), and then XOR this value with the high four bits of the input L0, and transfer this result to the low four bits of the second round of encryption, and combine it with the four bits of data in S2.3.3.1 to form the result of the first round of encryption, which is also the input of the second round of encryption.

[0079] Ct m =R m-1 |L m-1 ^F(R m-1 ,RoundKey m-1 )

[0080] F(R m-1 ,RoundKey m-1 )=((R m-1 ^RoundKey Lm-1 ))^((R m-1 ^RoundKey Rm-1 ))

[0081] S2.3.3.3 Repeat steps in S2.3.3.2 six times;

[0082] In the last round of encryption in S2.3.7, there is no need to exchange the order of data during the encryption process. The lower four bits of the seventh round of encryption result are directly used as the lower four bits of the eighth round of encryption result output, and a new copy of this result and RoundKey7 in S2.2.2 are taken as input and passed into the formula of S2.3.3.2. This output is XORed with the upper four bits of the seventh round of encryption result and used as the upper four bits of the eighth round of encryption result output.

[0083] S2.3.8 combines the left and right outputs of the eighth round and performs Sbox permutation to obtain the final single-byte encrypted ciphertext output.

[0084] Since this device uses a symmetric encryption algorithm, the decryption process is the inverse process of encryption. Decryption is used to observe whether the algorithm can restore the data before encryption. If successful, it means that the encryption process is correct.

[0085] After the algorithm is designed according to the above implementation, all possible combinations of IV addresses and keys are enumerated, and encryption and decryption tests are performed on all possible single-byte data. Finally, all combinations of IV addresses and keys can encrypt all possible single-byte data and output the original data after decryption.

[0086] Example 2

[0087] The present invention provides a single-byte Feistel encryption storage device based on a storage structure, using the method described, the device comprising:

[0088] The security zone module is used to randomly generate the MasterKey;

[0089] A region key calculation module, used to derive N groups of region keys RegionKey;

[0090] A round key calculation module, used to derive the round key RoundKey in the encryption process;

[0091] The encryption module is used to encrypt the input single-byte data to be encrypted.

[0092] The embodiments of the present invention have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments.

Claims

1. A single-byte Feistel encryption storage method based on a storage structure, characterized in that The following steps are involved: S1. Check the MasterKey area. If the MasterKey is the default value, randomly generate a MasterKey that meets the preset security standards. S2. Each time the storage device is powered on, the actual storage space size of the storage device is obtained, the number of regions N is determined according to the storage space size, the storage space is divided into N regions, and the address of each region is input into the security zone; In the security zone, the region key RegionKey corresponding to each region is calculated using the MasterKey and the address of each region; S3, obtaining the storage address of the data to be encrypted, determining the corresponding region key RegionKey according to the high bits of the storage address; and deriving the round key RoundKey for m rounds of encryption of the data to be encrypted according to the storage address and the region key; S4. Use the round key RoundKey to perform m rounds of encryption on the encrypted data using the Feistel encryption structure to obtain an encryption result; perform Sbox nonlinear permutation on the encryption result to obtain the final encrypted data.

2. The single-byte Feistel encryption storage method based on the storage structure according to claim 1 is characterized in that The S1 specifically includes: When the storage device is powered on for the first time, the value of the MasterKey storage area is checked; If the value of the MasterKey storage area is the default value, the random number generator is triggered to generate a random number that complies with the NIST800-57 security standard as the MasterKey; The generated MasterKey is stored in the MasterKey storage area of ​​the security zone.

3. The single-byte Feistel encryption storage method based on the storage structure according to claim 1 is characterized in that The S2 specifically includes: S21, obtaining the size of the actual storage space of the device, selecting an appropriate N according to the size of the storage space of the device, and dividing the storage space into N areas; S22, send the region address of each space to the security zone, and use the MasterKey and the region address in the security zone to calculate the region key RegionKey using the following formula x ; RegionKey x = (((IVx^MasterKey) / 0xFFFF)×((IVx^MasterKey)%0xFFFF)) a Where: x∈[0,N-1], N is the number of regions, IV x is the region address of the xth storage space of the storage device, and calculates the region key RegionKey x When 0xFFFF, the number of FFs in it is equal to half the number of bytes of IV XOR MasterKey value, and the value of a is the same as the number of FFs; S23. Temporarily store the calculated N region keys RegionKey in the RAM of the device.

4. The single-byte Feistel encryption storage method based on the storage structure according to claim 3 is characterized in that The calculation process of the regional key RegionKey is carried out in the security area of ​​the device. During the calculation process, the MasterKey does not leave the security area. Only the regional key RegionKey is stored in the device RAM area. When the device loses power, the regional key RegionKey is destroyed.

5. The single-byte Feistel encryption storage method based on the storage structure according to claim 1 is characterized in that The S3 specifically includes: S31, when it is necessary to encrypt a single byte of data to be encrypted in a certain storage area, determine the storage area to which the byte belongs according to the high bit of the storage address of the byte; S32, read the region key RegionKey corresponding to the storage area from RAM x , using the region key RegionKey x Calculate the encryption key SubKey; S33. According to the number of encryption rounds m, m bytes are obtained from the encryption key SubKey as the round key RoundKey for m rounds of encryption.

6. The single-byte Feistel encryption storage method based on the storage structure according to claim 5 is characterized in that In the above-mentioned S32, the encryption key SubKey is calculated using the following formula: SubKey=(((RegionKey x / 0xFFFF)^(RegionKey x %0xFFFF))<<L4)|(RegionKey x %0xFFFF) Among them, the length of 0xFFFF should be RegionKey x Half the length, the value of L4 is RegionKey x Half the number of bits.

7. The single-byte Feistel encryption storage method based on the storage structure according to claim 1 is characterized in that Before performing m rounds of encryption in S4, the plaintext data to be encrypted is obtained, and Sbox nonlinear permutation is performed on the plaintext data.

8. The single-byte Feistel encryption storage method based on the storage structure according to claim 1 is characterized in that In S4, the round key RoundKey is used to use the Feistel encryption structure to perform m rounds of encryption on the encrypted data using the following formula: Ct m =R m-1 |L m-1 ^F(R m-1 ,RoundKey m-1 ) F(R m-1 ,RoundKey m-1 )=((R m-1 ^RoundKey Lm-1 ))^((R m-1 ^RoundKey Rm-1 )) Where: Ct m is the result after one round of encryption, R m-1 It is the lower four bits of the input data to be encrypted. m-1 The upper four bits of the input data to be encrypted, RoundKey m-1 RoundKey Lm-1 The high four bits of the single-byte encryption key used in this round, RoundKey Rm-1 It is the lower four bits of the single-byte encryption key used in this round, and m is the number of the current encryption round.

9. A single-byte Feistel encrypted storage device based on a storage structure, using the method according to any one of claims 1 to 8, characterized in that: The device comprises: The security zone module is used to randomly generate the MasterKey; A region key calculation module, used to derive N groups of region keys RegionKey; A round key calculation module, used to derive the round key RoundKey in the encryption process; The encryption module is used to encrypt the input single-byte data to be encrypted.

Images