Secret key encapsulation method and device and secret key de-encapsulation method and device

Abstract

The invention provides a key packaging method. The key packaging method comprises the following steps: obtaining key data to be packaged; generating a random disturbance factor, and performing encryption processing on the key data based on the random disturbance factor to obtain target ciphertext data; obtaining authentication data based on the target ciphertext data; and obtaining key encapsulation data at least based on the random disturbance factor, the authentication data and target ciphertext data, the target ciphertext data including updated key data obtained by performing a dynamic refresh operation on the key data during the encryption processing. The invention also provides a key de-encapsulation method.

Description

Technical Field

[0001] The present disclosure relates to the field of privacy computing technology, and more particularly to a key encapsulation method, apparatus, and key decapsulation method, apparatus. Background Art

[0002] In the context of the growing demand for information security, as a core asset, the confidentiality and integrity of keys are vulnerable to side-channel attack threats. Such attacks can steal sensitive information without cracking the algorithm by analyzing physical signals such as power consumption and electromagnetic leakage. Although traditional key encapsulation methods rely on symmetric encryption to protect keys, it is difficult to prevent information leakage in the plaintext processing stage; while protection means such as masking have problems such as high refresh overhead and high resource occupancy, and it is difficult to effectively manage in hardware. Summary of the Invention

[0003] In view of the above problems, the present disclosure provides a key encapsulation method, apparatus, and key decapsulation method, apparatus.

[0004] According to a first aspect of the present disclosure, there is provided a key encapsulation method, including: obtaining key data to be encapsulated; generating a random perturbation factor, encrypting the key data based on the random perturbation factor to obtain target ciphertext data; obtaining authentication data based on the target ciphertext data; and obtaining key encapsulation data based on at least the random perturbation factor, the authentication data, and the target ciphertext data, wherein the target ciphertext data includes updated key data obtained by performing a dynamic refresh operation on the key data during the encryption process.

[0005] According to an embodiment of the present disclosure, the encrypting the key data based on the random perturbation factor to obtain target ciphertext data specifically includes: dividing the key data into a plurality of first data blocks; and performing a block encryption operation based on the random perturbation factor and the plurality of first data blocks to obtain the target ciphertext data.

[0006] According to an embodiment of the present disclosure, the block encryption operation specifically includes: generating a first key stream based on the random perturbation factor; encrypting the plurality of first data blocks based on the first key stream to obtain first ciphertext data; performing a dynamic refresh operation on the key data; and decoding the first ciphertext data to obtain the target ciphertext data.

[0007] According to an embodiment of the present disclosure, the updated key data is stored in the runtime environment.

[0008] The second aspect of the present disclosure provides a key de - encapsulation method, characterized in that the method includes: obtaining key encapsulation data; obtaining a random perturbation factor and authentication data based on the key encapsulation data; performing verification based on the random perturbation factor and the authentication data; and in response to successful verification, performing decryption processing on the key encapsulation data to obtain target de - encapsulated key data; wherein the target de - encapsulated key data includes updated key data obtained by performing a dynamic refresh operation on the key data during the decryption processing.

[0009] According to an embodiment of the present disclosure, the performing decryption processing on the key encapsulation data to obtain target de - encapsulated key data specifically includes: obtaining target ciphertext data based on the key encapsulation data; dividing the target ciphertext data into a plurality of second data blocks; and performing block decryption operations based on the random perturbation factor and the plurality of second data blocks to obtain the target de - encapsulated key data.

[0010] According to an embodiment of the present disclosure, the block decryption operation specifically includes: encoding the plurality of second data blocks to obtain second ciphertext data; generating a second key stream based on the random perturbation factor; decrypting the second ciphertext data based on the second key stream to obtain the target de - encapsulated key data; and performing a dynamic refresh operation on the target de - encapsulated key data.

[0011] According to an embodiment of the present disclosure, the performing verification based on the random perturbation factor and the authentication data specifically includes: obtaining intermediate authentication data based on the authentication data; generating target authentication data based at least on the random perturbation factor, the intermediate authentication data, and an authentication key; performing a dynamic refresh operation on the authentication key to obtain an updated authentication key; and performing verification based on the target authentication data and the authentication data.

[0012] According to an embodiment of the present disclosure, the updated key data is stored in the runtime environment.

[0013] The third aspect of the present disclosure provides a key encapsulation device, including: a key data acquisition module for acquiring key data to be encapsulated; an encryption processing module for generating a random perturbation factor and encrypting the key data based on the random perturbation factor to obtain target ciphertext data, wherein the target ciphertext data includes updated key data obtained by performing a dynamic refresh operation on the key data during the encryption processing; an authentication data acquisition module for obtaining authentication data based on the target ciphertext data; and a key encapsulation module for obtaining key encapsulation data based at least on the random perturbation factor, the authentication data, and the target ciphertext data.

[0014] A fourth aspect of the present disclosure provides a key decapsulation device, including: a key encapsulation data acquisition module, configured to acquire key encapsulation data; an authentication data acquisition module, configured to acquire a random perturbation factor and authentication data based on the key encapsulation data, wherein the target decapsulation key data includes updated key data obtained by performing a dynamic refresh operation on the key data during the decryption process; a verification module, configured to perform verification based on the random perturbation factor and the authentication data; and a decryption module, configured to, in response to passing the verification, perform decryption processing based on the key encapsulation data to obtain target decapsulation key data.

[0015] A fifth aspect of the present disclosure provides an electronic device, including: one or more processors; a memory, configured to store one or more computer programs, and the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of the first aspect or the second aspect.

[0016] A sixth aspect of the present disclosure further provides a computer program product, including a computer program or instruction, and when the computer program or instruction is executed by a processor, the steps of the above method are implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, the above content and other objects, features, and advantages of the present disclosure will become clearer. In the drawings:

[0018] Figure 1 Schematically shows an application scenario diagram of a key encapsulation method, device, and a key decapsulation method, device according to an embodiment of the present disclosure;

[0019] Figure 2 Schematically shows a flowchart of a key encapsulation method according to an embodiment of the present disclosure;

[0020] Figure 3 Schematically shows a flowchart of a key decapsulation method according to an embodiment of the present disclosure;

[0021] Figure 4 Schematically shows a flowchart of key encapsulation encryption based on a mask structure according to some embodiments of the present disclosure;

[0022] Figure 5 Schematically shows an algorithm architecture diagram of an extended output function;

[0023] Figure 6 Schematically shows a flowchart of key decapsulation decryption based on a mask structure according to some embodiments of the present disclosure;

[0024] Figure 7Schematically shows a structured flowchart of an authentication tag generation and verification process according to an embodiment of the present disclosure;

[0025] Figure 8A Schematically shows a structural block diagram of a key encapsulation device according to an embodiment of the present disclosure;

[0026] Figure 8B Schematically shows a structural block diagram of a key decapsulation device according to an embodiment of the present disclosure; and

[0027] Figure 9 Schematically shows a block diagram of an electronic device suitable for implementing a key encapsulation / decapsulation method according to an embodiment of the present disclosure. Detailed implementation manners

[0028] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the following detailed description, for the sake of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, obviously, one or more embodiments can also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessarily confusing the concepts of the present disclosure.

[0029] The terms used herein are merely for describing specific embodiments and are not intended to limit the present disclosure. The terms "including", "comprising", etc. used herein indicate the presence of the described features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0030] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0031] In the case of using expressions such as "at least one of A, B, and C", generally, it should be interpreted according to the meaning commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include, but not be limited to, a system having only A, only B, only C, having A and B, having A and C, having B and C, and / or having A, B, and C, etc.).

[0032] Some block diagrams and / or flowcharts are shown in the accompanying drawings. It should be understood that some blocks in the block diagrams and / or flowcharts, or combinations thereof, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when executed by the processor, these instructions can create a device for implementing the functions / operations illustrated in these block diagrams and / or flowcharts.

[0033] Therefore, the technology of the present disclosure can be implemented in the form of hardware and / or software (including firmware, microcode, etc.). Additionally, the technology of the present disclosure can take the form of a computer program product on a computer-readable medium storing instructions, which can be used by or in conjunction with an instruction execution system. In the context of the present disclosure, a computer-readable medium can be any medium that can contain, store, transmit, propagate, or transport instructions. For example, a computer-readable medium can include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, components, or propagation media. Specific examples of computer-readable media include: magnetic storage devices such as magnetic tapes or hard disk drives (HDDs); optical storage devices such as compact discs (CD-ROMs); memories such as random access memories (RAMs) or flash memories; and / or wired / wireless communication links.

[0034] First, the technical terms described herein are explained and illustrated as follows.

[0035] A side-channel attack is an attack method that obtains sensitive data (such as an encryption key) by analyzing non-functional physical information leaked by an encryption device during operation. Such attacks do not rely on mathematical cracking or logical vulnerabilities, but rather utilize the side effects generated by the device during the execution of encryption operations.

[0036] Side-channel attack resistance refers to the design of technical means to enable an encryption system to protect its sensitive information from being leaked when faced with side-channel attacks. Side-channel attacks do not rely on cracking the encryption algorithm itself, but rather extract secret information by analyzing the physical characteristics of the device during operation.

[0037] The ML-DSA post-quantum signature algorithm (ML-DSA: Merkle–Lattice Digital Signature Algorithm) is a post-quantum signature algorithm that combines the Merkle tree structure and lattice-based digital signature technology, aiming to provide secure authentication and message integrity verification in a quantum computing environment. The algorithm constructs a signature structure using a hash function and lattice-based problems, and has high security and a certain computational efficiency.

[0038] A post - quantum key refers to a key generated using post - quantum cryptographic algorithms. These keys are designed to withstand potential security threats posed by future quantum computers. Compared with traditional encryption algorithms, post - quantum algorithms typically involve larger key sizes to ensure security against quantum computing attacks.

[0039] Key encapsulation is an encryption mechanism used to protect keys from being leaked during transmission or storage. Its basic principle is to encrypt the key using symmetric or asymmetric encryption algorithms to generate ciphertext, and at the same time, combine an authentication mechanism to ensure that the key has not been tampered with. The encapsulated key can be securely distributed or stored without exposing the plaintext.

[0040] Key decapsulation is the corresponding process to key encapsulation, used to recover the original key data from the encapsulated ciphertext. This process usually includes authentication verification, encrypted data parsing, and decryption operations to ensure that the recovered key has integrity and confidentiality.

[0041] Embodiments of the present disclosure provide a key encapsulation method, including: obtaining key data to be encapsulated; generating a random perturbation factor, encrypting the key data based on the random perturbation factor to obtain target ciphertext data; obtaining authentication data based on the target ciphertext data; and obtaining key encapsulation data based at least on the random perturbation factor, the authentication data, and the target ciphertext data, wherein the target ciphertext data includes updated key data obtained by performing a dynamic refresh operation on the key data during the encryption process. By performing a dynamic refresh operation on the key data during the encryption process, the intermediate data in the encryption process has randomness and uniqueness, thereby significantly reducing the risk of the intermediate variables being observed and restored in the side channel, and enhancing the anti - side - channel attack ability of the overall encryption process. At the same time, this dynamic refresh mechanism can achieve security enhancement of key data during transmission and encapsulation without relying on additional key management overhead, especially suitable for high - security - sensitive scenarios, ensuring that the target ciphertext data has stronger attack unpredictability and encapsulation integrity while maintaining structural integrity.

[0042] Embodiments of the present disclosure provide a key de - encapsulation method, including: obtaining key encapsulation data; obtaining a random perturbation factor and authentication data based on the key encapsulation data; performing verification based on the random perturbation factor and the authentication data; and in response to successful verification, performing decryption processing on the key encapsulation data to obtain target de - encapsulated key data; wherein the target de - encapsulated key data includes updated key data obtained by performing a dynamic refresh operation on the key data during the decryption processing. By performing a dynamic refresh operation on the key data during the decryption processing and defining the decryption result as the updated key data, the static exposure of the key during the decryption process is effectively avoided, making each key export result unpredictable and non - reusable, and effectively improving the defense ability against side - channel attacks.

[0043] Figure 1 Schematically shows an application scenario diagram of a key encapsulation method, apparatus, and a key de - encapsulation method, apparatus according to an embodiment of the present disclosure.

[0044] As Figure 1 shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for communication links between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0045] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications may be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0046] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices with a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop portable computers, and desktop computers, etc.

[0047] The server 105 may be a server that provides various services. For example, it may be a background management server (only for example) that supports the websites browsed by the user using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process data such as user requests received, and feedback the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices. The server 105 may include a first server and a second server.

[0048] It should be noted that the key encapsulation method provided by the embodiments of the present disclosure may be executed by the server 105, or may be locally executed by the terminal device (such as the first terminal device 101) and then upload the encapsulated data. The key decapsulation method provided by the embodiments of the present disclosure may be executed by the server 105, or may be downloaded by the terminal device (such as the first terminal device 102) and locally executed. Correspondingly, the key encapsulation device and the key decapsulation device provided by the embodiments of the present disclosure may be set in the server 105 or in the terminal device. The key encapsulation method and the key decapsulation method provided by the embodiments of the present disclosure may also be executed by a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105. Correspondingly, the key encapsulation device and the key decapsulation device provided by the embodiments of the present disclosure may also be set in a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105.

[0049] It should be understood that Figure 1 the numbers of terminal devices, networks, and servers in

[0050] are merely illustrative. According to the implementation requirements, there may be any number of terminal devices, networks, and servers. Figure 1 Based on the Figures 2 to 7 scenario described below, the key encapsulation / decapsulation methods of the disclosed embodiments will be described in detail through

[0051] Figure 2 FIG. schematically shows a flowchart of a key encapsulation method according to an embodiment of the present disclosure.

[0052] As Figure 2 shown, the key encapsulation method of this embodiment includes operations S210 to S240.

[0053] At operation S210, obtain key data to be encapsulated. The key data to be encapsulated may include sensitive information for subsequent communication, data protection, authentication, or other scenarios. For example, the key data to be encapsulated may include a private key generated by a post-quantum cryptographic algorithm, which has a large size and high security sensitivity and requires a special encapsulation method to ensure security during transmission and storage. Another example is that the key data may include sensitive key materials such as homomorphic encryption keys or key shards for multi-party secure computation.

[0054] At operation S220, generate a random perturbation factor, and encrypt the key data based on the random perturbation factor to obtain target ciphertext data. The target ciphertext data includes updated key data obtained by performing a dynamic refresh operation on the key data during the encryption process. Specifically, the random perturbation factor can be implemented as a random initialization vector (IV) or other form of random number to ensure that the ciphertext generated by each encapsulation operation has high randomness and unpredictability, thereby enhancing resistance to side-channel attacks.

[0055] For example, the random perturbation factor can be a 256-bit random bit string, which is used to construct a structured data header and combined with a key encryption key to call an extendable output function (XOF) to generate a key stream; this key stream can be used to perform masked encryption on the key data block by block to enhance the anti-replay ability of the encapsulation process.

[0056] Another example is that in a scenario supporting multi-purpose key scheduling, the random perturbation factor not only includes the initialization vector IV, but may also include context parameters such as key usage identifiers (such as "signature", "decryption") and timestamps. Based on this, a key processing context frame can be constructed to uniquely identify the context of the current encapsulation operation. Subsequently, the XOF can be called in combination with the frame structure and the key encryption key to generate a key stream and perform block-by-block masked scrambling (e.g., XOR encryption) on the key data, so as to ensure that the target ciphertext data generated from the same key material for different uses or time periods is completely different, preventing key abuse between horizontal systems.

[0057] Another example is that the random perturbation factor can be used as one of the input parameters of a key derivation function (KDF), and combined with a master key or a master seed key to generate a one-time session key. This session key can be used to perform block encryption on the key data to obtain ciphertext data.

[0058] In the embodiments of the present disclosure, the dynamic refresh operation is an active perturbation mechanism designed to improve the side-channel security of the key encapsulation process, which can continuously disrupt the mask structure or session key state during the encryption process to prevent the risk of information leakage caused by long-term reuse.

[0059] For example, when masking and scrambling key data using a key stream generated based on XOF, a random refresh operation can be performed on the current key mask structure after processing each data block, and updated key data can be generated after all dynamic refresh operations are completed.

[0060] For another example, after block encryption is completed, the storage copy of the original key data can be indirectly refreshed by re-deriving the session key, ensuring that even if the key-encapsulated data is reused multiple times, an attacker cannot deduce the original key pattern from the side channel.

[0061] For another example, in a scenario where authentication paths are involved in encryption, the perturbation fields (such as random frame fields, usage identifiers) embedded in the authentication structure can participate in mask reconstruction and switching operations to achieve an update of the key data structure at the mask level, enabling different encryption outputs for the same key material under different authentication contexts.

[0062] Through the above dynamic refresh mechanism, the target ciphertext data is no longer a static encryption result, but a key representation result continuously updated based on the perturbation process. The mask states involved in the encryption process do not land or write back, and only participate in operations within the running state, thereby enhancing the resistance of the key encapsulation process to high-intensity side-channel threats.

[0063] In operation S230, authentication data is obtained based on the target ciphertext data. The authentication data can include an authentication tag, a checksum, or a message authentication code (MAC), etc., for subsequent data receivers to verify the integrity and authenticity of the key-encapsulated data.

[0064] For example, a hash function can be used to calculate a hash value for the target ciphertext data, and an authentication tag can be generated based on the combination of the hash value and an authentication key.

[0065] For another example, a digital signature algorithm (such as ECDSA) can be used to sign the target ciphertext data, and the signature result can be used as part of the authentication tag, enabling the receiver to perform source verification and integrity check on the ciphertext data using the public key.

[0066] In operation S240, key-encapsulated data is obtained based on at least the random perturbation factor, the authentication data, and the target ciphertext data. The key-encapsulated data can be used for subsequent transmission or storage, and extended fields can also be added according to the application scenario requirements to enhance security and compliance capabilities.

[0067] For example, in a structured frame scenario, the random perturbation factor, authentication data, and target ciphertext data can be written into a predefined data frame in a fixed format, with a clear field order and support for version management, enabling the receiver to quickly parse the frame content through the frame header fields.

[0068] For another example, in the variable-length encapsulation format, the frame format can be dynamically adjusted according to the actual length of the target ciphertext data or authentication data. The boundaries of each field are indicated by the identifiers within the frame, adapting to multiple key types and usage scenarios, and enhancing the flexibility of the encapsulation format.

[0069] For another example, in the security enhancement scenario, the combined content including the perturbation factor, authentication data, and ciphertext data can be further subjected to an overall hashing or encryption operation, and the result is attached to the tail of the data frame as the digest value of the complete encapsulation, for supporting double integrity verification.

[0070] For another example, in the environment of cross-system collaboration, the encapsulated data can also include security context information (such as algorithm identifier, timestamp, usage label, etc.), to support different systems to select appropriate de-encapsulation processes or execution strategies according to the context conditions.

[0071] For another example, in the compliance supervision scenario, a structured audit label field can also be added to the key encapsulation data, for recording information such as the policy number, responsible node, encapsulation time, etc. of the encapsulation operation, facilitating post-event auditing and security accountability.

[0072] To enhance the anti-tampering ability under untrusted storage or transmission media, the encapsulated data can also be encapsulated as an encrypted compression format as a whole. For example, using the LZMA+AES double-layer mechanism, the encapsulation body is first compressed and then encrypted, further improving security and volume efficiency.

[0073] It should be noted that the specific encryption algorithm form of the key data or the key encapsulation process is not limited in this embodiment. For example, in the specific implementation, lattice-based post-quantum signature algorithms such as ML-DSA can be used to protect the key-related data; in other implementations, other candidate encryption standard algorithms can also be used to adapt to different security policies and computing platforms. Further, the key encapsulation method of the present disclosure can adapt to large-size and high-sensitivity keys, such as key data generated by post-quantum algorithms, key parameters in homomorphic encryption, and distributed key fragments generated in multi-party secure computing, etc.

[0074] Figure 3 Schematically shows a flowchart of a key de-encapsulation method according to an embodiment of the present disclosure.

[0075] As Figure 3 shown, the key de-encapsulation method of this embodiment includes operation S310 to operation S340.

[0076] In operation S310, obtain the key encapsulation data.

[0077] It should be noted that the "key-encapsulated data" in this embodiment is not limited to a specific structure or format. It can be the data result generated by the key encapsulation method described in other embodiments of the present disclosure, or the original ciphertext payload directly provided by an external device.

[0078] In operation S320, a random perturbation factor and authentication data are obtained based on the key-encapsulated data. Specifically, the frame data header or field identifier of the key-encapsulated data can be parsed to extract the perturbation source information and the authentication data structure therefrom. In addition, according to the in-frame offset indicator or variable-length field identifier, the target ciphertext data included in the key-encapsulated data can be further obtained.

[0079] In operation S330, verification is performed based on the random perturbation factor and the authentication data. The purpose of the verification process is to confirm that the source of the key-encapsulated data is trustworthy, the content has not been tampered with, and to prevent security threats such as man-in-the-middle attacks and replay attacks. Further, verification can also be combined with the target ciphertext data.

[0080] For example, a digest value is calculated for the target ciphertext data based on a hash function, and a verification tag is generated by combining the authentication key and the perturbation factor; the verification tag is compared with the authentication data included in the key-encapsulated data to determine whether the data has been tampered with during transmission or storage.

[0081] For another example, in the public key signature verification mode, the authentication data can be de-signed using a pre-registered signature verification public key, and the de-signature result is checked for consistency with the digest value reconstructed from the ciphertext data.

[0082] For another example, in scenarios of anti-replay or key usage binding, context fields (such as time window, usage scope, etc.) can also be embedded in the authentication tag structure, and the system needs to parse and perform constraint comparison during the verification phase to ensure that the key usage timing and strategy match.

[0083] If the verification passes, the process proceeds to operation S340. If the verification fails, the de-encapsulation operation can be terminated or a security alert can be triggered.

[0084] In operation S340, in response to the verification passing, decryption processing is performed based on the key-encapsulated data to obtain the target de-encapsulated key data.

[0085] For example, in a structured framing scenario, based on a predefined data frame template, information such as the version field, key usage identifier, perturbation parameter, field boundary indicator, etc. identified in the frame data header can be extracted to parse the segmentation position of the encapsulated content, thereby extracting various necessary parameters for decryption processing, and calling the corresponding decryption module according to a predetermined logic to complete key recovery.

[0086] For another example, in a variable-length encapsulation format, the position boundaries of the authentication tag, ciphertext data, and perturbation factor can be dynamically calculated based on the in-frame field identifier or variable-length header information, enabling precise parsing of the key encapsulation content with a non-fixed structure. This method is particularly applicable to application scenarios where different algorithms, different key lengths, and different authentication strength requirements coexist.

[0087] For another example, in a security enhancement scenario with a dual integrity guarantee mechanism, after completing the basic authentication check and ciphertext decoding operations, the combined content of the perturbation factor, authentication data, and ciphertext data can also be subjected to overall hash verification or comparison of the secondary encryption digest value to ensure that the key is not affected by operations such as man-in-the-middle attacks, repackaging, or frame modification, thereby strengthening the authenticity and anti-tampering of the key recovery process.

[0088] For another example, in a cross-system collaborative deployment scenario, the key encapsulation data may contain security context information such as algorithm type, time tag, usage policy ID, etc. During the unpacking process, it is possible to determine whether to allow the key to be used for a specific business process based on the above context conditions, and accordingly select the correct unpacking path or verification module to ensure that the key is only valid within the authorized scope and prevent lateral spread.

[0089] For another example, in a compliance supervision sensitive scenario, the unpacking process can also parse the audit tag field in the data frame, which can record information such as encapsulation time, responsible node, compliance policy number, etc., providing support for subsequent post-event auditing and tracing of key transfer behaviors.

[0090] Furthermore, when processing key encapsulation data from an untrusted storage or communication link, double operations of decompression and decryption can also be performed on the encapsulation data. If an encrypted compression format (such as LZMA+AES) is used, it is necessary to first complete the rapid decompression of the encapsulation body, and then decrypt and restore it in combination with the perturbation factor and key stream, thereby ensuring information security while reducing the data volume.

[0091] In the embodiments of the present disclosure, the target unpacking key data includes updated key data obtained by performing a dynamic refresh operation on the key data during the decryption process. The key unpacking process can also be integrated into the key import function for synchronous execution. When the system receives untrusted encapsulated key data from the outside, authentication verification, ciphertext unpacking, and dynamic refresh operations of the key mask structure can be automatically completed during the import process.

[0092] For example, during the decryption process, the key data can be decoded into a refreshable structure, such as a boolean mask variable or an intermediate state mask representation, and during each stage of decryption, a perturbation update operation is performed on the key variables or temporary intermediate data participating in the decoding calculation.

[0093] For another example, after the ciphertext is restored in the decapsulation operation, the temporary key copy can be indirectly re-perturbed by re-deriving the session decryption key or re-arranging the authentication path perturbation structure, so that attackers cannot derive the consistent decoding path through techniques such as cache replay or template construction.

[0094] For another example, during the decapsulation process, when context fields such as frame identifiers, timestamps, and usage policies are embedded in the authentication path, these perturbation fields can be used as part of the key recovery process to reconstruct the mask structure through authentication coupling, ensuring that the key presents different states in each context and preventing the key from being reused or disguised within the system.

[0095] Similarly, the dynamic refresh operation during the decapsulation process can effectively reduce the risk of intermediate state attacks caused by storage process leakage or access anomalies, while avoiding the synchronization complexity and cache coherence problems brought by the traditional write-back mechanism.

[0096] It should be noted that updating the key data refers to the dynamically generated intermediate representation of the key based on the mask structure updated by each round of perturbation or the re-derived session key stream during the execution of the encapsulation / decapsulation process. The updated key data directly participates in the generation of ciphertext or the recovery of plaintext in the running state, and the encryption or decryption operation can be completed without writing it back to storage or recording it in an external storage device, effectively avoiding the intermediate exposure of the static key state and reducing the synchronization complexity and potential leakage surface brought by storage.

[0097] This embodiment is applicable to application scenarios with high requirements for security sensitivity. For example, for long key encapsulation / decapsulation operations in post-quantum cryptosystems, such as for signature verification, encrypted communication, identity credential generation, etc.; edge key initialization in distributed IoT systems, ensuring the unpredictability of keys in resource-constrained terminals through the key encapsulation process, and the decapsulation method supports real-time key recovery on the device local and dynamically refreshes the mask trajectory to ensure that the key initialization process cannot be reconstructed; for example, the key injection and import process in financial-grade security chips or trusted execution environments (TEEs), effectively preventing intermediate state analysis under physical contact; for example, a dual-stack key scheduling platform that supports the switching between national cryptographic algorithms / international standards, realizing key usage isolation through the binding of perturbation factors and the authentication structure; for example, multi-tenant key escrow and distribution services in cloud computing scenarios, ensuring that the logic of the encapsulated keys of different tenants does not overlap through dynamic refresh and context frame fields, and the decapsulation method can verify and recover the specified tenant key in the key management service (KMS) to prevent data isolation failure or cross-domain attack risks; for example, an encapsulation backup mechanism that supports long-term key lifecycle management, ensuring the irreversibility of the key backup process by combining authentication tags and perturbation structures, and the decapsulation method guarantees the verifiability and context consistency of the key's anti-replay and anti-copy abuse capabilities during the recovery phase.

[0098] In addition, the encapsulation / de-encapsulation process described in this embodiment is applicable not only to software algorithm implementation, but also to hardware acceleration implementation. For example, the dynamic perturbation encapsulation / de-encapsulation logic provided by the present disclosure is deployed in an FPGA, TPM, HSM, or dedicated anti-side-channel security chip to achieve high-speed and high-intensity service capabilities.

[0099] The following will take the post-quantum signature algorithm ML-DSA based on lattice construction as an example to illustrate the specific application scenarios of the encapsulation / de-encapsulation of the embodiments of the present disclosure.

[0100] In the ML-DSA algorithm, the public key is in the form of pk = (ρ, t1), where ρ is the seed parameter for generating the structured public key matrix A, and t1 represents the high-order part of the key polynomial t, which is responsible for participating in the judgment of signature legality during the verification phase. The private key sk contains (ρ, K, Tr, s1, s2, t0), where K is the key seed for generating the challenge value c, Tr is the public key hash value, which is used to improve the verification efficiency; s1 and s2 are low-noise private key polynomials, and t0 is the low-order part of the key polynomial, which is used to reconstruct the complete t value at the verification end.

[0101] From the perspective of key security, elements such as K, s1, s2, and t0 belong to critical security parameters, and their confidentiality and integrity must be ensured simultaneously during transmission and use. ρ, Tr, t1, etc. belong to public security parameters, and mainly rely on the authentication mechanism to ensure that their contents have not been maliciously tampered with.

[0102] To ensure that the critical parameters have anti-side-channel capabilities during the encapsulation process, a Boolean domain mask representation method is introduced. Specifically: [[K]] represents the masked representation of the Key Encryption Key (KEK) used to generate the key stream, which can be a Boolean mask vector; [[P]] represents the set of key load masks to be encrypted, including critical private key components such as s1, s2, and K, which are the main encryption objects during the encapsulation process.

[0103] It should be noted that in this article, [[·]] represents a Boolean domain mask variable.

[0104] The authentication-related data AD participates in the generation of the authentication tag as an auxiliary security parameter, and its content can include information such as t1 and Tr that only need to be authenticated but not encrypted and protected. C is the encapsulation key, including the encrypted payload P, the authentication information for AD and P, and internal auxiliary information (such as random numbers).

[0105] To improve the system scalability and multi-purpose adaptability, the embodiments of the present disclosure further introduce a frame data header frame enc ,frame encIt can be composed of the following fields for identifying the encapsulation context and driving the key stream generation process:

[0106] ID (32 bits): Used to identify the algorithm type, authentication structure, key package type and version, etc.;

[0107] DS (8 bits): Used to specify the use of data, such as hashing, key message authentication code, encryption, etc.;

[0108] ctr (24 bits): Takes values of 0, 1, 2, …, and is used to encrypt multiple data blocks. During the authentication process, if there is no parallel processing, it is set to 0;

[0109] IV (256 bits): The initialization vector is randomly selected. The same IV is used for the frame data header of the same key.

[0110] The frame data header frame enc Can be used as a perturbation source for XOF, and jointly drive the key stream generation process with the KEK mask variable [[K]], constructing a high-entropy pseudo-random output stream during each round of block encryption or authentication, and used to mask different data blocks of the encrypted [[P]] respectively.

[0111] According to an embodiment of the present disclosure, operation S220 may further include: dividing the key data into multiple first data blocks; and performing a block encryption operation based on the random perturbation factor and the multiple first data blocks to obtain the target ciphertext data.

[0112] Figure 4 Schematically shows a key encapsulation encryption flowchart based on a mask structure according to some embodiments of the present disclosure.

[0113] Such as Figure 4 As shown, the key data to be encapsulated can be represented as multiple boolean masked data blocks (such as P0, P1, P2 in the figure). These data blocks may come from the same logical key and have been masked before processing to minimize physical leakage during the intermediate calculation process.

[0114] At the same time, a set of context information can be constructed and introduced, including the frame data header and the KEK key mask. The frame data header can contain information such as key usage identification, algorithm version, block index, authentication structure identification, etc., and the KEK key mask is used as a masked representation of the key encryption key to generate a perturbation-sensitive encryption mask stream.

[0115] In an embodiment of the present disclosure, a key stream can be generated based on XOF. The frame data header and the KEK key mask are jointly used as inputs and fed into multiple XOF modules. Each XOF can generate high-entropy, pseudo-random key stream segments based on the perturbation source and the structural input, which are respectively represented as x0, x1, and x2 in the figure. Since XOF is sensitive to structural perturbations and has strong non-linear diffusion capabilities, it can ensure the high entropy and unpredictability of the key stream.

[0116] Figure 5 Schematically shows the algorithm architecture diagram of the extended output function.

[0117] As Figure 5 shown, the input of XOF can include multiple independent zero mask sources. A zero mask source refers to an initialization mask source whose starting state does not load any actual key data, marked as zero mask A, zero mask B, and zero mask C, corresponding to multiple internal random perturbation paths respectively. These mask inputs are respectively injected into the register components RA, RB, and RC after passing through a structural perturbation device (such as the funnel-shaped symbol in the figure) to initialize three independent random distribution paths.

[0118] In this architecture, the input signal received by XOF is introduced into a boolean operator (shown as the exclusive-or operation ⊕ in the figure) on the RC path to achieve the mixing of the input content and the mask perturbation stream. This mask fusion design can effectively break the association between externally observable variables and internal computing states, thereby enhancing the anti-interference ability of the system against side-channel detection.

[0119] Subsequently, the data streams of the three paths are respectively fed into the perturbation mixing module λ to perform cross-path shuffling (as shown by the cross arrows) to further disrupt the relative order and offset consistency between the paths. At this stage, the random states carried by each path are permuted to different positions and can participate in cross-path vector perturbation operations.

[0120] After passing through the λ transformation module, the data enters the X' processing unit, which can implement non-linear transformations (such as S-box substitution, finite field multiplication, or conditional bit perturbation, etc.) to enhance the statistical uniformity and unpredictability of the output stream.

[0121] Finally, the three processing paths respectively generate corresponding output masks, such as Figure 5 the output mask 1, output mask 2, and output mask 3 in. These masks will be used as components of the key perturbation stream in subsequent encryption operations to drive processes such as key block scrambling, authentication tag generation, or structured encapsulation.

[0122] Return to reference Figure 4, the XOR encryption operation can be performed separately on each data block Pi and the corresponding key stream xi to form an intermediate ciphertext block Ci (i.e., C0, C1, C2). This Boolean domain perturbation process can effectively resist information leakage caused by mask failure and destroy the observable correlation in the side channel.

[0123] According to an embodiment of the present disclosure, to further enhance the anti-attack ability, a dynamic refresh operation can also be performed on the encapsulated key mask and / or the KEK key mask during the encryption process. The refresh can be dynamically triggered based on the encryption round number, block index, context tag, or authentication path to ensure that the mask state changes continuously during the encryption process, thereby interrupting the possible statistical dependency chain and resisting multiple sampling analysis. For example, after each data block Pi is processed, it can be determined whether to refresh the KEK mask [[K]] according to the current block index and context state to enhance the unpredictability of the mask; a global refresh can also be performed after each update of the authentication path.

[0124] Refer to Figure 4 , multiple intermediate ciphertext blocks are sent to the decoding module, which can restore the encrypted data in the Boolean mask format to the standard key encapsulation format, for example, concatenate them into a key package structure by bytes or fields, and output the ciphertext block C. The ciphertext block C can be used as the core encryption payload in the subsequent key encapsulation process to construct an authentication tag, generate an encapsulated data frame, or be transmitted to the de-encapsulation end for secure import.

[0125] The block encryption mechanism provided in the embodiments of the present disclosure not only realizes the confidentiality encapsulation of key data, but also combines a perturbation-driven dynamic mask refresh strategy to enhance the randomness and non-determinism of the encryption path at the structural level, effectively improving the anti-side channel ability of the overall key encapsulation process in high-security scenarios.

[0126] In the embodiments of the present disclosure, the updated key data is stored in the runtime environment, thereby avoiding writing the key to an external non-volatile memory during the processing to reduce the security risk caused by data residue or persistent storage leakage. The runtime environment can be a protected memory space established by the system during the execution of key processing operations, which is only open to trusted runtime logics (such as key encapsulation modules, de-encapsulation modules, or authentication modules), and is automatically released or overwritten after the operation ends.

[0127] For example, in a runtime container such as a secure processor, a trusted execution environment, or a hardware security module, the updated key data can be temporarily stored in an isolated register group or a dedicated RAM area, and the system immediately destroys its reference after completing the authentication encapsulation or de-encapsulation operation to avoid being illegally accessed or restored during system exceptions, restarts, or attack detections.

[0128] For another example, in a software isolation environment, such as a key service instance deployed based on kernel-mode isolation or containerized sandbox, the masked keys, refreshed key variables, or intermediate authentication data structures generated during the running period are also retained only within the life cycle, and are completely cleared after use through methods such as timed refreshing, memory encryption, and zeroing and erasing, further ensuring that the keys are not leaked due to log output, virtual memory paging, or abnormal interruption.

[0129] In some embodiments, to ensure the controllability and traceability of the running environment, a context binding mechanism can also be set for updating key data. For example, bind the key refresh identifier with the call request ID, timestamp, usage identifier, etc., and only allow the refresh result to be called in predefined usage scenarios, thereby preventing the key from being reused or transferred between different tasks, tenants, or sessions.

[0130] In the embodiments of the present disclosure, operation S320 may further include: obtaining target ciphertext data based on the key-encapsulated data; dividing the target ciphertext data into multiple second data blocks; and performing a block decryption operation based on the random perturbation factor and the multiple second data blocks to obtain the target de-encapsulated key data.

[0131] Figure 6 Schematically shows a key de-encapsulation and decryption flow chart based on a mask structure according to some embodiments of the present disclosure.

[0132] As Figure 6 shown, the input end receives the ciphertext block C generated during the encapsulation process. At the initial stage of the operation, the ciphertext C can be sent to a random encoding module for preprocessing. Specifically, the system performs an encoding operation on the ciphertext block C to convert it into an internal representation [[C]] in the form of a Boolean mask, so as to be compatible with the key processing path of the mask structure.

[0133] Next, a perturbation input can be introduced, including a frame data header and a KEK key mask, which are input into multiple XOF modules as context parameters. During this process, the XOF takes frame enc and [[K]] as inputs to generate corresponding key streams [[x]] (i.e., x0, x1, x2, etc.) for decrypting different data blocks. The generated key streams have high entropy and context binding properties, ensuring the uniqueness and anti-replay ability of each de-encapsulation process.

[0134] In the decryption phase, an exclusive-or operation (⊕) can be performed on the masked ciphertext [[C]] and the key stream [[x]] to recover the decrypted payload mask [[P]]. This operation eliminates the mask perturbation bit by bit, restoring the scrambled key fragments when encapsulating. Since both [[C]] and [[x]] are in the masked space, the exclusive-or operation maintains the encryption semantics while avoiding the direct exposure of the original key, enhancing the side-channel resistance of the decryption path.

[0135] To further enhance the attack resistance of the system, after one decryption, the KEK key mask [[K]] used can be refreshed to generate a new key mask [[K']], preventing the attacker from capturing features due to mask reuse during long-term operation or repeated calls.

[0136] Refer to Figure 6 , a refresh operation can be performed on the payload mask [[P]] obtained by decryption to obtain a new [[P']], which is output as the target decapsulation key data for subsequent signature verification, decryption operations, or key import processes.

[0137] Through the above operation process, combined with the perturbation-sensitive masked ciphertext structure, the key stream generated by XOF, and the dynamic mask refresh mechanism, the block decryption method provided in this embodiment can ensure the correctness of key decapsulation while significantly enhancing its security in a high side-channel risk environment.

[0138] The authentication scenarios of the embodiments of the present disclosure will be specifically described below by taking the authentication method based on a hash function as an example.

[0139] Figure 7 Schematically shows a structured flowchart of the authentication tag generation and verification process according to an embodiment of the present disclosure.

[0140] As Figure 7 shown, the authentication mechanism of this embodiment takes the hash digest of authentication data, structured frame data, and an authentication key mask as inputs, constructs an authentication perturbation path through multiple XOFs, and thus generates a structured authentication tag. This authentication process is applicable to integrity verification in key encapsulation and decapsulation scenarios, and enhances the anti-side-channel attack ability through a dynamic perturbation mechanism.

[0141] The authentication data may include ciphertext blocks, public parameters, frame data headers, encryption algorithm identifiers, etc., which generate an authentication data hash value after being processed by a hash function. This hash value, together with the frame data header and the authentication key mask (such as in the form of a KEK mask), is passed as a perturbation input to multiple XOF modules. The example in the figure includes three parallel XOF paths, corresponding to the authentication output fragments T0, T1, and T2 respectively.

[0142] Each XOF module takes a frame data header, an authentication key mask, and an authentication data hash as inputs, and generates a pseudo-random output stream through non-linear perturbation and mixing processing. Subsequently, the system performs combined perturbation processing on these output streams within the Boolean domain to form intermediate authentication mask variables (T0, T1, T2 in the figure). These variables are further decoded into standard authentication fields and concatenated to generate the final authentication tag T.

[0143] To enhance the secure use of the authentication key, this embodiment introduces a dynamic refresh mechanism in the authentication tag generation process. During the generation of the intermediate authentication mask, the mask key (such as the KEK key mask) participating in the authentication calculation is perturbed and updated. The refresh method can include re-deriving the mask seed or generating a new mask coding scheme in combination with the characteristics of the authentication data to ensure that each authentication tag generation process is non-reproducible and non-stable from the perspective of side-channel observation, thereby preventing the leakage of the authentication key.

[0144] In the verification phase of the authentication process, it is carried out on the decapsulation or communication receiving side. Based on the received authentication data, perturbation factors, and updated authentication key, the system regenerates the target authentication tag through the same expansion path as above and compares it with the received tag T. If the verification is successful, it indicates that the encapsulated key content has not been tampered with, and the integrity and source authenticity of the authentication data are confirmed; if the verification fails, the decapsulation process is immediately terminated to avoid potential middle-state attacks or forged data being introduced into the system.

[0145] Through the authentication perturbation structure as Figure 7 shown, the authentication method provided by this disclosure not only has an efficient tag generation ability, but also effectively improves the anti-analysis ability of the authentication path through multi-source input mixing and key dynamic refresh mechanism, and is applicable to the key encapsulation and communication data authentication processing flow in high-security scenarios.

[0146] Overall, the key encapsulation and decapsulation method provided by this disclosure introduces a dynamic refresh mechanism during the encryption and decryption processes, perturbs and updates the key data and its intermediate mask representation in real time, realizes multi-dimensional perturbation of the key stream, authentication path, and data frame, makes each encapsulation result unpredictable and context-unique, effectively avoids the problem of key reuse leakage; at the same time, by integrating the key refresh and processing operations, it does not rely on additional storage synchronization mechanisms or write-back instructions, and reduces the system complexity and performance burden from the implementation perspective.

[0147] Figure 8A Schematically shows the structural block diagram of the key encapsulation device according to an embodiment of this disclosure.

[0148] As Figure 8AAs shown, the key encapsulation device 800 of this embodiment includes a key data acquisition module 801, an encryption processing module 802, an authentication data acquisition module 803, and a key encapsulation module 804.

[0149] The key data acquisition module 801 can be used to acquire the key data to be encapsulated. In one embodiment, the key data acquisition module 801 can be used to perform the operation S210 described above, which will not be elaborated here.

[0150] The encryption processing module 802 can be used to generate a random perturbation factor, encrypt the key data based on the random perturbation factor to obtain target ciphertext data, where the target ciphertext data includes updated key data obtained by performing a dynamic refresh operation on the key data during the encryption process. In one embodiment, the encryption processing module 802 can be used to perform the operation S220 described above, which will not be elaborated here.

[0151] The authentication data acquisition module 803 can be used to obtain authentication data based on the target ciphertext data. In one embodiment, the authentication data acquisition module 803 can be used to perform the operation S230 described above, which will not be elaborated here.

[0152] The key encapsulation module 804 can be used to obtain key encapsulation data based on at least the random perturbation factor, the authentication data, and the target ciphertext data. In one embodiment, the key encapsulation module 804 can be used to perform the operation S240 described above, which will not be elaborated here.

[0153] According to an embodiment of the present disclosure, the encryption processing module 802 can also be used to divide the key data into multiple first data blocks; and perform block encryption operations based on the random perturbation factor and the multiple first data blocks to obtain the target ciphertext data.

[0154] According to an embodiment of the present disclosure, the encryption processing module 802 can also be used to generate a first key stream based on the random perturbation factor; encrypt the multiple first data blocks based on the first key stream to obtain first ciphertext data; perform a dynamic refresh operation on the key data; and decode the first ciphertext data to obtain the target ciphertext data.

[0155] According to an embodiment of the present disclosure, any multiple of the key data acquisition module 801, the encryption processing module 802, the authentication data acquisition module 803, and the key encapsulation module 804 may be combined and implemented in one module, or any one of them may be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules may be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the key data acquisition module 801, the encryption processing module 802, the authentication data acquisition module 803, and the key encapsulation module 804 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on substrate, a system on package, an application specific integrated circuit (ASIC), or may be implemented by any other reasonable means such as hardware or firmware through circuit integration or packaging, or may be implemented in any one of the three implementation manners of software, hardware, and firmware, or in an appropriate combination of any several of them. Alternatively, at least one of the key data acquisition module 801, the encryption processing module 802, the authentication data acquisition module 803, and the key encapsulation module 804 may be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding functions may be executed.

[0156] Figure 8B The structural block diagram of the key decapsulation device according to an embodiment of the present disclosure is schematically shown.

[0157] As Figure 8B shown, the key decapsulation device 810 of this embodiment includes a key encapsulation data acquisition module 811, an authentication data acquisition module 812, a verification module 813, and a decryption module 814.

[0158] The key encapsulation data acquisition module 811 may be used to acquire key encapsulation data. In one embodiment, the key encapsulation data acquisition module 811 may be used to perform the operation S310 described above, which will not be elaborated here.

[0159] The authentication data acquisition module 812 may be used to acquire a random perturbation factor and authentication data based on the key encapsulation data, wherein the target decapsulation key data includes updated key data obtained by performing a dynamic refresh operation on the key data during the decryption process during the decryption process. In one embodiment, the authentication data acquisition module 812 may be used to perform the operation S320 described above, which will not be elaborated here.

[0160] The verification module 813 may be used to perform verification based on the random perturbation factor and the authentication data. In one embodiment, the verification module 813 may be used to perform the operation S330 described above, which will not be elaborated here.

[0161] The decryption module 814 can be used to perform decryption processing on the key-encapsulated data in response to successful verification to obtain the target unpacking key data. In one embodiment, the decryption module 814 can be used to execute the operation S340 described above, which will not be elaborated here.

[0162] According to an embodiment of the present disclosure, the authentication data acquisition module 812 can also be used to obtain target ciphertext data based on the key-encapsulated data; divide the target ciphertext data into multiple second data blocks; and perform block decryption operations based on the random perturbation factor and the multiple second data blocks to obtain the target unpacking key data.

[0163] According to an embodiment of the present disclosure, the authentication data acquisition module 812 can also be used to encode multiple second data blocks to obtain second ciphertext data; generate a second key stream based on the random perturbation factor; decrypt the second ciphertext data based on the second key stream to obtain the target unpacking key data; and perform a dynamic refresh operation on the target unpacking key data.

[0164] According to an embodiment of the present disclosure, the verification module 813 can also be used to obtain intermediate authentication data based on the authentication data; generate target authentication data based at least on the random perturbation factor, the intermediate authentication data, and the authentication key; perform a dynamic refresh operation on the authentication key to obtain an updated authentication key; and perform verification based on the target authentication data and the authentication data

[0165] According to an embodiment of the present disclosure, any multiple modules among the key encapsulation data acquisition module 811, the authentication data acquisition module 812, the verification module 813, and the decryption module 814 may be combined and implemented in one module, or any one of them may be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules may be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the key encapsulation data acquisition module 811, the authentication data acquisition module 812, the verification module 813, and the decryption module 814 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on substrate, a system on package, an application specific integrated circuit (ASIC), or may be implemented by any other reasonable means such as hardware or firmware through circuit integration or packaging, or may be implemented in any one of the three implementation manners of software, hardware, and firmware or in any suitable combination of several of them. Alternatively, at least one of the key encapsulation data acquisition module 811, the authentication data acquisition module 812, the verification module 813, and the decryption module 814 may be at least partially implemented as a computer program module, and when the computer program module is run, it may execute corresponding functions.

[0166] Figure 9 A block diagram of an electronic device suitable for implementing the key encapsulation / decapsulation method according to an embodiment of the present disclosure is schematically shown.

[0167] As Figure 9 shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which may perform various appropriate actions and processes according to a program stored in a read only memory (ROM) 902 or a program loaded from a storage section 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (such as an application specific integrated circuit (ASIC)), etc. The processor 901 may also include on-board memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0168] In the RAM 903, various programs and data required for the operation of the electronic device 900 are stored. The processor 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. The processor 901 performs various operations of the method flow according to the embodiments of the present disclosure by executing the programs in the ROM 902 and / or the RAM 903. It should be noted that the programs may also be stored in one or more memories other than the ROM 902 and the RAM 903. The processor 901 may also perform various operations of the method flow according to the embodiments of the present disclosure by executing the programs stored in the one or more memories.

[0169] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, and the input / output (I / O) interface 905 is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the input / output (I / O) interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc. and a speaker, etc.; a storage portion 908 including a hard disk, etc.; and a communication portion 909 including a network interface card such as a LAN card, a modem, etc. The communication portion 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed so that a computer program read from it can be installed into the storage portion 908 as needed.

[0170] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist separately without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the one or more programs are executed, the method according to the embodiments of the present disclosure is implemented.

[0171] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In the present disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program, and this program can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the above-described ROM 902 and / or RAM 903 and / or one or more memories other than ROM 902 and RAM 903.

[0172] An embodiment of the present disclosure further includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product runs in a computer system, the program code is used to enable the computer system to implement the data processing method provided by the embodiment of the present disclosure.

[0173] When the computer program is executed by the processor 901, it executes the above functions defined in the system / apparatus of the embodiment of the present disclosure. According to an embodiment of the present disclosure, the above-described systems, apparatuses, modules, units, etc. can be implemented by computer program modules.

[0174] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices and magnetic storage devices. In another embodiment, the computer program may also be transmitted and distributed in the form of a signal on a network medium, and is downloaded and installed through the communication part 909, and / or installed from the removable medium 911. The program code contained in the computer program can be transmitted by any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0175] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, it executes the above functions defined in the system of the embodiment of the present disclosure. According to an embodiment of the present disclosure, the above-described systems, devices, apparatuses, modules, units, etc. can be implemented by computer program modules.

[0176] In accordance with embodiments of the present disclosure, program code for executing the computer programs provided by the embodiments of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages include, but are not limited to, such as Java, C++, Python, the "C" language, or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user's computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (e.g., by connecting through the Internet using an Internet service provider).

[0177] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagram can represent a module, a program segment, or a part of code that contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks can occur in a different order than that marked in the accompanying drawings. For example, two consecutive blocks shown can actually be executed substantially in parallel, and they can sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram or flowchart, and the combination of blocks in the block diagram or flowchart, can be implemented by a dedicated hardware-based system for performing the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0178] Those skilled in the art can understand that the features described in the various embodiments of the present disclosure can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure can be combined and / or combined in various ways. All such combinations and / or combinations fall within the scope of the present disclosure.

[0179] The above describes the embodiments of the present disclosure. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the embodiments are described separately above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Without departing from the scope of the present disclosure, those skilled in the art can make various substitutions and modifications, and all such substitutions and modifications should fall within the scope of the present disclosure.

Claims

1. A key encapsulation method, characterized in that, The method includes: Obtaining key data to be encapsulated; Generating a random perturbation factor, encrypting the key data based on the random perturbation factor to obtain target ciphertext data; Obtaining authentication data based on the target ciphertext data; and Obtaining key encapsulation data based on at least the random perturbation factor, the authentication data, and the target ciphertext data, wherein the target ciphertext data includes updated key data obtained by performing a dynamic refresh operation on the key data during the encryption process.

2. The key encapsulation method according to claim 1, wherein The encrypting the key data based on the random perturbation factor to obtain target ciphertext data specifically includes: Dividing the key data into a plurality of first data blocks; and Performing a block encryption operation based on the random perturbation factor and the plurality of first data blocks to obtain the target ciphertext data.

3. The key encapsulation method according to claim 2, wherein The block encryption operation specifically includes: Generating a first key stream based on the random perturbation factor; Encrypting the plurality of first data blocks based on the first key stream to obtain first ciphertext data; Performing a dynamic refresh operation on the key data; and Decoding the first ciphertext data to obtain the target ciphertext data.

4. The key encapsulation method according to any one of claims 1 to 3, characterized in that, The updated key data is stored in the runtime environment.

5. A key decapsulation method, characterized in that, The method includes: Obtaining key encapsulation data; Obtaining a random perturbation factor and authentication data based on the key encapsulation data; Verifying based on the random perturbation factor and the authentication data; and In response to successful verification, performing a decryption process on the key encapsulation data to obtain target decapsulation key data; wherein the target decapsulation key data includes updated key data obtained by performing a dynamic refresh operation on the key data during the decryption process.

6. The key decapsulation method according to claim 5, wherein The decrypting the key encapsulation data to obtain target decapsulation key data specifically includes: Obtaining target ciphertext data based on the key encapsulation data; Dividing the target ciphertext data into a plurality of second data blocks; and Performing a block decryption operation based on the random perturbation factor and the plurality of second data blocks to obtain the target decapsulation key data.

7. The key decapsulation method according to claim 6, characterized in that, The block decryption operation specifically includes: Encoding the plurality of second data blocks to obtain second ciphertext data; Generating a second key stream based on the random perturbation factor; Decrypting the second ciphertext data based on the second key stream to obtain the target decapsulation key data; and Performing a dynamic refresh operation on the target decapsulation key data.

8. The key decapsulation method according to claim 6, wherein The verifying based on the random perturbation factor and the authentication data specifically includes: Obtaining intermediate authentication data based on the authentication data; Generating target authentication data based on at least the random perturbation factor, the intermediate authentication data, and an authentication key; Performing a dynamic refresh operation on the authentication key to obtain an updated authentication key; and Verifying based on the target authentication data and the authentication data.

9. The key decapsulation method according to any one of claims 5 to 8, characterized in that The updated key data is stored in the runtime environment.

10. An electronic device, comprising: One or more processors; A memory for storing one or more computer programs, The feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 4 or claims 5 to 9.

Images