Data encryption method, device, medium and computer program product

Abstract

The present application discloses a data encryption method, device, medium and computer program product, which relate to the field of data encryption technology. By obtaining a random number corresponding to the data amount based on the data size of a data unit to be encrypted and the type of secure virtual machine used by the decryption device, a virtual machine code is generated based on the random number, and the first data is calculated based on the data unit to be encrypted and the virtual machine code, thereby obtaining the encryption result corresponding to the data to be encrypted, thereby realizing an encryption scheme for generating the virtual machine code from the data to be encrypted. When decryption is required, the original data can be restored by performing an operation based on the first data and the virtual machine code through the secure virtual machine. Since the virtual machine code has no practical meaning without virtual machine interpretation, the original data can only be restored after being interpreted and executed by the virtual machine, which can achieve a high data protection strength and effectively resist reverse cracking.

Description

Technical Field

[0001] The present invention relates to the field of data encryption technology, and in particular to a data encryption method, device, medium and computer program product. Background Art

[0002] With the rapid development of information technology and the growing demand for data security, data encryption technology has become a key means of protecting information assets and is widely used in many scenarios, including network communications, data storage, identity authentication, cloud computing, and the Internet of Things. However, current data encryption technologies typically use specific encryption algorithms, which often have relatively mature cracking methods and are easily detected and reverse engineered by attackers.

[0003] How to improve the data protection strength of data encryption is a technical problem that those skilled in the art need to solve. Summary of the Invention

[0004] The present invention provides a data encryption method, device, medium and computer program product to at least solve the problem of low protection strength of data encryption in related technologies.

[0005] The present invention provides a data encryption method, comprising:

[0006] Get the string of data to be encrypted;

[0007] Obtaining a random number corresponding to the data amount according to the data amount of a data unit to be encrypted of the character string of the data to be encrypted and the type of the secure virtual machine used by the decryption device;

[0008] Based on the random number, generate a virtual machine code corresponding to the type of the secure virtual machine;

[0009] Obtaining first data corresponding to the data unit to be encrypted by calculation according to the data unit to be encrypted and the virtual machine code;

[0010] An encryption result corresponding to the data to be encrypted is obtained according to the virtual machine code corresponding to the data unit to be encrypted and the first data corresponding to the data unit to be encrypted.

[0011] The present invention also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any one of the above-mentioned data encryption methods when executing the computer program.

[0012] The present invention also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned data encryption methods are implemented.

[0013] The present invention also provides a computer program product, comprising a computer program, which implements the steps of any of the above-mentioned data encryption methods when executed by a processor.

[0014] The present invention uses the data size of a data unit to be encrypted in a string of data to be encrypted and the type of secure virtual machine used by the decryption device to obtain a random number corresponding to the data size. A virtual machine code is generated based on the type of secure virtual machine and the random number. The first data corresponding to the data unit to be encrypted is calculated based on the data unit to be encrypted and the virtual machine code. Thus, the virtual machine code establishes a connection between the data unit to be encrypted and the first data. That is, the data unit to be encrypted can be restored from the virtual machine code and the first data. Thus, based on the virtual machine code corresponding to the data unit to be encrypted and the first data corresponding to the data unit to be encrypted, an encryption result corresponding to the data to be encrypted is obtained, thereby implementing an encryption scheme that generates virtual machine code from encrypted data. The virtual machine code is complex and difficult to understand, and the virtual machine supports protection methods such as code obfuscation. Without the virtual machine, the virtual machine itself is meaningless. Only after being interpreted and executed by the virtual machine can the original data be restored. This achieves high data protection strength and effectively resists reverse engineering. When decryption is required, the secure virtual machine performs calculations based on the first data and the virtual machine code to restore the original data. This approach is simple to use and highly scalable. Therefore, the present invention addresses the problem in related arts where encrypted data generated by specific encryption algorithms is easily cracked, thereby improving the protection strength of data encryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present invention, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0016] Figure 1 A flowchart of a data encryption method provided by an embodiment of the present invention;

[0017] Figure 2 A schematic diagram of the architecture of a data encryption and decryption system provided by an embodiment of the present invention;

[0018] Figure 3 A flowchart of a virtual machine code generation process provided by an embodiment of the present invention;

[0019] Figure 4 A flowchart of a virtual machine code execution process provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0020] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0021] It should be noted that, in the description of the present invention, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. The terms "first," "second," etc., in the present invention are used to distinguish similar objects, and are not used to describe a particular order or precedence.

[0022] In order to enable those skilled in the art to better understand the solutions of the present invention, the present invention is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0023] Here, some key terms used in the embodiments of the present invention are explained.

[0024] A virtual machine (VM) is a software-simulated computer system that can simulate one or more virtual computer environments on a physical computer and run its own operating system and applications, just like on a real physical computer.

[0025] The virtual machine in the embodiments of the present invention refers to a process virtual machine, which simulates an operating environment that includes an instruction interpretation and execution engine capable of executing custom instructions, as well as register space required for data storage, and can be used to execute specific programs or code. Unlike conventional virtual machine software, such as VMware, which runs operating systems, the virtual machine in the embodiments of the present invention merely simulates the operating mechanisms of a central processing unit (CPU) and can execute specific program code. It does not fully simulate a computer's hardware environment or run an operating system, making it a relatively low-level and basic virtual machine.

[0026] Virtual Machine-based Code Protection (VMP) is an advanced code protection method that increases the difficulty of reverse engineering by converting a program's original instructions into a custom virtual machine instruction set and executing these instructions within a virtual machine. The core of VMP technology is to convert a program's original instructions (such as x86 instructions) into a custom virtual machine instruction set (VM Bytecode) and execute these instructions within a custom virtual machine. Reverse engineers must first understand the VM's instruction set and operating mechanisms before restoring the original code, significantly increasing the difficulty of reverse engineering. Among related technologies, VMP is commonly used in software code protection and has achieved good results.

[0027] Common data encryption schemes in related technologies include symmetric encryption, XOR encryption, custom encryption algorithms, code obfuscation, and dynamic encryption. Symmetric encryption is the most commonly used, but suffers from issues such as its algorithmic features being easily discovered and analyzed, and the key required making it susceptible to reverse engineering. XOR encryption is simple and easy to conceal, but its strength is low. Custom encryption algorithms vary in strength depending on the specific design and implementation, resulting in low reliability. Code obfuscation algorithms are fixed and easy to analyze and crack. Dynamic encryption offers higher strength and a more complex process, but since it also uses a specific method to calculate dynamically generated data, it can still be cracked through tracing and reverse engineering. In summary, common data encryption schemes in related technologies utilize specific encryption algorithms to encrypt data, making them easy for attackers to crack by analyzing patterns in the ciphertext.

[0028] To enhance the data protection strength of data encryption technology, embodiments of the present invention apply virtual machine protection technology to data encryption. Because virtual machine code is complex and difficult to understand, and virtual machine implementations support protection methods such as code obfuscation, it is meaningless without the virtual machine. Only after being interpreted and executed by the virtual machine can the original data be restored. This achieves high data protection strength and effectively resists reverse engineering.

[0029] However, data itself is not equivalent to software code. That is, software code is an instruction, and virtual machine code is also an instruction. Therefore, the generation scheme of virtual machine code from software code cannot be directly applied to data protection. Therefore, in an embodiment of the present invention, the data size of a data unit to be encrypted in the string of the data to be encrypted and the type of secure virtual machine used by the decryption device are used to obtain a random number corresponding to the data size, and a virtual machine code is generated based on the random number. The first data corresponding to the data unit to be encrypted is calculated based on the data unit to be encrypted and the virtual machine code, thereby establishing a connection between the data unit to be encrypted and the first data. That is, the data unit to be encrypted can be restored through the virtual machine code and the first data.

[0030] Thus, the embodiments of the present invention achieve the goal of generating virtual machine code from the data to be encrypted, achieving the advantage of virtual machine protection technology in that the virtual machine code generated is difficult to crack. Even if an attacker obtains part or all of the virtual machine code, it is difficult to analyze the patterns within it. Furthermore, because the embodiments of the present invention generate the virtual machine code using random numbers and do not establish a direct correspondence between data and virtual machine code, this further enhances randomness compared to virtual machine protection technology that generates virtual machine code from software code, thereby achieving higher data protection strength.

[0031] Furthermore, the virtual machine itself does not rely on specific components or functional implementations, possessing strong cross-platform capabilities. Data encryption and decryption can be achieved through simple calls, making integration and use simple. The virtual machine only implements instruction execution and virtual machine environment maintenance. Actual data protection algorithms are implemented using virtual machine code, which allows for flexible addition, deletion, and modification, offering excellent scalability. The virtual machine itself can also be modified, allowing for the flexible addition and removal of customized protection instructions for even better data protection.

[0032] An embodiment of the present invention provides a data encryption method. The method is described in detail below in conjunction with the execution process of the data encryption method.

[0033] Figure 1 A flowchart of a data encryption method provided by an embodiment of the present invention; Figure 2 A schematic diagram of the architecture of a data encryption and decryption system provided by an embodiment of the present invention.

[0034] like Figure 1 As shown, the data encryption method provided by the embodiment of the present invention may include:

[0035] S101: Obtain a character string of data to be encrypted.

[0036] S102: Obtain a random number corresponding to the data volume according to the data volume of a data unit to be encrypted of the character string of the data to be encrypted and the type of the secure virtual machine used by the decryption device.

[0037] S103: Generate a virtual machine code corresponding to the type of the secure virtual machine based on the random number.

[0038] S104: Obtain first data corresponding to the data unit to be encrypted by calculation according to the data unit to be encrypted and the virtual machine code.

[0039] S105: Obtain an encryption result corresponding to the data to be encrypted according to the virtual machine code corresponding to the data unit to be encrypted and the first data corresponding to the data unit to be encrypted.

[0040] To distinguish it from a virtual machine in the usual sense, in the embodiment of the present invention, the virtual machine used to execute virtual machine code is referred to as a "secure virtual machine".

[0041] like Figure 2 As shown, the data encryption and decryption architecture provided by the embodiments of the present invention primarily consists of a virtual machine code generator and a secure virtual machine. The virtual machine code generator is used to read the data to be encrypted and generate the virtual machine code using a randomization method. The virtual machine code generator may include a data reading module, a virtual machine code generation module, a virtual machine code scrambling module, and a virtual machine code output module, which are respectively used to read the string of data to be encrypted, generate the virtual machine code, scramble the virtual machine code, and output the virtual machine code.

[0042] The secure virtual machine reads virtual machine code and executes the corresponding virtual machine instructions. Different virtual machine codes correspond to different operations, which perform different processing on the data in the virtual registers, such as addition, subtraction, multiplication, and division. When all virtual machine codes are executed, the data in the virtual registers undergoes a series of processing and calculations by the virtual machine code to generate a string of the original data, achieving the goal of dynamically restoring the original data string. The secure virtual machine can include a virtual machine code reading module, a virtual machine code execution module, and an output module, respectively used for reading virtual machine code, executing virtual machine code, and outputting plaintext data.

[0043] In the embodiment of the present invention, the type of data to be encrypted may be private data, keys, network communication data, configuration files and sensitive parameters, log files, etc., or other data that needs to be encrypted.

[0044] The data encryption method provided by the embodiments of the present invention can be applied to data transmission. A sending device can generate a virtual machine code from the data to be encrypted, send the virtual machine code and first data to a receiving device, and the receiving device invokes a secure virtual machine to perform calculations based on the virtual machine code and the first data to restore the original data. In this case, a virtual machine code generator can be deployed on the sending device, and a secure virtual machine can be deployed on the receiving device.

[0045] The data encryption method provided in the embodiments of the present invention can also be applied to data storage. When writing data, virtual machine code is generated from the data to be encrypted, and the virtual machine code and first data are written to a storage medium. When reading data, a secure virtual machine is invoked to perform calculations based on the read virtual machine code and first data to restore the original data. In this case, the virtual machine code generator and secure virtual machine can be deployed in a storage controller.

[0046] For S101, in order to perform calculations with the virtual machine code, the data to be encrypted in the form of a string is required. Then, the data to be encrypted in the form of a string can be obtained, or the data to be encrypted can be converted into a string form.

[0047] In S102, the data unit to be encrypted is a substring obtained from the string of the data to be encrypted. The substring can be a plurality of substrings into which the string of the data to be encrypted is divided. Specifically, substrings of the preset string length can be sequentially intercepted from the beginning of the string of the data to be encrypted, according to a preset string length, until the entire string of the data to be encrypted is completely divided. If the length of the last substring is less than the preset string length, characters can be added to the last substring to bring it up to the preset string length. In this case, the string lengths of the data units to be encrypted are consistent.

[0048] In other optional implementations of the present invention, the string lengths of the data units to be encrypted may not be constrained to be consistent. In this case, substrings of the preset length may be sequentially intercepted from the starting position of the string of the data to be encrypted, according to a preset length, until the entire string of the data to be encrypted is completely split. If the length of the last substring is less than the preset length, no additional characters are added. Alternatively, the data to be encrypted may be split according to specific characters in the string as nodes, resulting in multiple substrings of the same or different lengths as the data units to be encrypted.

[0049] In the embodiment of the present invention, the length of the data unit to be encrypted may be 1 byte.

[0050] Next, a corresponding virtual machine code is generated for the data unit to be encrypted.

[0051] Generating virtual machine code requires an opcode and operands. The opcode is a key part of a virtual machine instruction, indicating the operation the virtual machine should perform. An opcode is typically a fixed-length code, with each opcode corresponding to a specific operation or instruction.

[0052] The functions of opcodes include: determining the instruction type, for example, instructing the virtual machine to perform arithmetic operations (such as addition and subtraction), logical operations (such as AND and OR), data movement (such as loading and storing), etc.; controlling the instruction flow, for example, some opcodes may be used to control program jumps (such as conditional jumps and unconditional jumps), thereby changing the execution order of the program; simplifying instruction parsing. When executing an instruction, the virtual machine will first parse the opcode and determine how to process subsequent operands based on the value of the opcode. The existence of opcodes enables the virtual machine to quickly identify the type of instruction, thereby simplifying the instruction parsing process and improving execution efficiency.

[0053] An operand is the data portion of a virtual machine instruction used in conjunction with an opcode. The operand provides the specific data or data address required for the opcode to perform its operation. Operands have several functions: providing the data to operate on. Operands directly provide the data required for the opcode to perform its operation. For example, in arithmetic instructions, operands can be the numerical values involved in the calculation, while in data movement instructions, operands can be the source and destination addresses of the data. Operands specify the object of the operation. For example, in memory access instructions, operands can specify the memory address, telling the virtual machine where to load data from or store it. Operand values can also affect the specific execution behavior of the instruction. Different operands can cause the same opcode to produce different results. For example, for the same addition opcode, the result is 3 when the operands are 1 and 2, but 5 when the operands are 2 and 3.

[0054] That is, in virtual machine instructions, opcodes and operands work closely together. The opcode determines what operation the virtual machine should perform, while the operand provides the specific data or address of the data required to perform the operation. Together, they determine the complete meaning and execution behavior of the virtual machine instruction. For example, the virtual machine instruction is "ADD R1, R2, R3," where the opcode "ADD" indicates an addition operation, and the operands are R1 (destination register), R2 (first operand register), and R3 (second operand register). In this instruction: the opcode ADD tells the virtual machine to perform an addition operation, and the operands R1, R2, and R3 specify the registers involved in the addition operation. Specifically, the virtual machine will add the values in R2 and R3 and store the result in R1.

[0055] Because the data unit to be encrypted may not be an instruction, and the virtual machine code is a computational instruction, it is impossible to directly convert the data unit to the virtual machine code. Therefore, in an embodiment of the present invention, the virtual machine code is generated based on a random number, and the random number is used as the operation code and / or operand required to generate the virtual machine code.

[0056] For each data unit to be encrypted, it is necessary to obtain a random number corresponding to the data amount based on the data size of the data unit to be encrypted (i.e., the string length) and the type of secure virtual machine used by the decryption device. For example, if generating a virtual machine code requires 1 opcode and 3 operands, then 4 random numbers need to be obtained, and the data size of each random number is consistent with the data unit to be encrypted.

[0057] In an embodiment of the present invention, in order to further increase the difficulty of cracking the virtual machine code, the virtual machine code can be obtained from a random number stream. Then, obtaining the random number of the corresponding data amount in S102 may include: reading the random number of the corresponding data amount from a pre-generated random number stream. Pre-generating a random number stream may include: obtaining a random number seed; passing the random number seed into the stream cipher algorithm to generate a random number stream. The random number seed is essentially a random string of a specific length, and the length depends on the key length required by the stream cipher algorithm to be used subsequently. Call the stream cipher algorithm, and pass the random number seed as the algorithm key to generate a random number stream. The stream cipher algorithm is a symmetric encryption algorithm, the core of which is to generate a key stream and perform byte-by-byte XOR with the plaintext to achieve encryption / decryption.

[0058] The embodiment of the present invention uses a stream cipher algorithm to generate a random number stream, and generates a virtual machine code based on the random number read from the random number stream. Since the random number stream is data of infinite length, using the random number stream as the basis for generating the virtual machine code can achieve high randomness and unpredictability in the virtual machine code generation process, and can circumvent the resource problems caused by reading ultra-long random numbers from the operating system, thereby further increasing the difficulty of cracking the encryption result.

[0059] In S103 , the obtained random number is used as the operation code and operation number required for generating the virtual machine code, and the virtual machine code is generated.

[0060] Regarding S104, the virtual machine code generated in S103 only represents a calculation instruction and has no direct correspondence with the data unit to be encrypted. Therefore, the data to be encrypted is calculated with the virtual machine code to obtain the first data.

[0061] In some optional implementations of the present invention, obtaining the first data corresponding to the data unit to be encrypted by calculating the data unit to be encrypted and the virtual machine code in S104 may include: performing an inverse operation corresponding to the virtual machine code on the data unit to be encrypted to obtain the first data. That is, the calculation instruction corresponding to the virtual machine code is denoted as function , and its inverse operation is , then substitute the data unit to be encrypted into the function to calculate and obtain the first data (denoted as ), so that when the decryption device decrypts, the first data Substitute the function corresponding to the virtual machine code , to restore the original data.

[0062] In some other optional implementations of the embodiments of the present invention, the computing instructions corresponding to the virtual machine code can be directly executed on the data unit to be encrypted to obtain the first data. When the decryption device decrypts, the inverse operation of the virtual machine code is executed on the first data to restore the original data.

[0063] At S105, an encryption result corresponding to the data to be encrypted is obtained based on the virtual machine code corresponding to the data unit to be encrypted and the first data corresponding to the data unit to be encrypted. Specifically, the virtual machine codes corresponding to the data units to be encrypted can be sequentially listed as a set of virtual machine codes, and the virtual machine codes and the first data can be used as the encryption result. Alternatively, the order of the virtual machine codes corresponding to the data units to be encrypted can be shuffled to further enhance randomness.

[0064] At this time, if the attacker obtains part or even all of the virtual machine code and the first data, what he sees is also a string of irregular characters, and he cannot analyze the patterns and crack it like the encryption algorithm cracking scheme in the related art.

[0065] The data encryption method provided by the embodiments of the present invention utilizes the data size of a data unit to be encrypted in a string of data to be encrypted and the type of secure virtual machine used by the decryption device to obtain a random number corresponding to the data size, generates a virtual machine code based on the random number, and calculates the first data corresponding to the data unit based on the data unit to be encrypted and the virtual machine code. This establishes a connection between the data unit to be encrypted and the first data via the virtual machine code, meaning that the data unit to be encrypted can be restored from the virtual machine code and the first data. Thus, based on the virtual machine code corresponding to the data unit to be encrypted and the first data corresponding to the data unit to be encrypted, an encryption result corresponding to the data to be encrypted is obtained, thereby implementing an encryption scheme that generates virtual machine code from encrypted data. The virtual machine code is complex and difficult to understand, and the virtual machine implementation supports protection methods such as code obfuscation. Without the virtual machine, it is meaningless in itself; only after being interpreted and executed by the virtual machine can the original data be restored. This achieves high data protection strength and effectively resists reverse engineering. When decryption is required, the secure virtual machine performs calculations based on the first data and the virtual machine code to restore the original data. This method is simple to use and highly scalable. Therefore, the present invention addresses the problem in related arts where encrypted data generated by specific encryption algorithms is easily cracked, thereby improving the protection strength of data encryption.

[0066] In an embodiment of the present invention, obtaining a random number corresponding to the data amount based on the data amount of a data unit to be encrypted of the string of the data to be encrypted and the type of the secure virtual machine used by the decryption device in S102 may include: determining the number of operation codes of a virtual machine code and the number of operands of a virtual machine code based on the type of the secure virtual machine; taking the number of random numbers as the sum of the number of operation codes of a virtual machine code and the number of operands of the virtual machine code minus one; and obtaining a corresponding number of random numbers, wherein the data amount of a random number is equal to the data amount of the data unit to be encrypted.

[0067] In S103, based on the random number, a virtual machine code corresponding to the type of the secure virtual machine is generated, which may include: determining a parameter of the virtual machine code according to the position of the data unit to be encrypted in the character string of the data to be encrypted, and determining the remaining parameters in the virtual machine code according to the random number; the parameters of the virtual machine code include an operation code of the virtual machine code and an operand of the virtual machine code; and generating the virtual machine code according to the operation code of the virtual machine code and the operand of the virtual machine code.

[0068] That is to say, on the basis of arranging the virtual machine codes corresponding to each data unit to be encrypted in random order, the position of the data unit to be encrypted in the character string of the data to be encrypted can be used as the operation code or operand. At this time, the number of random numbers to be obtained is the sum of the number of operation codes and the number of operands required by the virtual machine code minus one.

[0069] In an embodiment of the present invention, the secure virtual machine may adopt a three-operand register virtual machine. At this time, in S102, based on the data size of a data unit to be encrypted in the string of the data to be encrypted and the type of the secure virtual machine adopted by the decryption device, obtaining a random number corresponding to the data size may include: reading three random numbers of the same data size according to the data size of the data unit to be encrypted. In S103, based on the random numbers, generating a virtual machine code corresponding to the type of the secure virtual machine may include: determining the operation code of the virtual machine code according to one of the random numbers, determining the two data source operands of the virtual machine code according to the other two random numbers, determining the target address operand of the virtual machine code according to the position of the data unit to be encrypted in the data to be encrypted, and generating the virtual machine code of the three-operand register virtual machine according to the operation code, the data source operand, and the target address operand.

[0070] Three operands means that a virtual machine instruction contains an opcode and three operand numbers. The three operands correspond to two data sources and a data destination address respectively. For example, "1+2=3", "1" and "2" are the data from two sources (which may be the data itself or read from a register. In short, there are two data sources); "+" is the opcode, which means addition; "3" corresponds to the operation destination address, that is, the location where the result of the instruction execution needs to be stored.

[0071] A register-based virtual machine is a virtual machine based on a register architecture. Registers are spaces that can store fixed-size data, and the virtual machine contains multiple registers. Virtual machine instructions can operate directly on the data in the registers, rather than through the stack as with stack-based virtual machines. (Stacks require data to be first-in, first-out, last-out, so when processing multiple data simultaneously, sequential management and multiple operations are required. Registers, on the other hand, can achieve the same purpose by specifying different registers for separate processing.) Therefore, register-based virtual machines generally outperform stack-based virtual machines in performance because they reduce the number of memory accesses.

[0072] In some other embodiments of the present invention, when other types of secure virtual machines (such as stack virtual machines) or other types of register virtual machines (such as single-operand register virtual machines) are used, random numbers are obtained based on the number of opcodes and the number of operands required to generate the virtual machine code, and the corresponding virtual machine code is generated. These are not described in detail here.

[0073] In an embodiment of the present invention, when generating a virtual machine code for a data unit to be encrypted, a data unit to be encrypted can be randomly selected without having to be processed in sequence. Instead, the operand or operation code of the virtual machine code can be used to reflect the position of the data unit to be encrypted in the character string of the data to be encrypted.

[0074] Alternatively, in an embodiment of the present invention, the opcodes and operands required to generate the virtual machine code can be completely determined by random numbers, that is, in S102, based on the data size of a data unit to be encrypted of the string of the data to be encrypted and the type of secure virtual machine adopted by the decryption device, a random number corresponding to the data size is obtained, which can include: determining the number of opcodes of a virtual machine code and the number of operands of a virtual machine code according to the type of secure virtual machine; obtaining a corresponding number of random numbers according to the number of opcodes and the number of operands, and the data size of a random number is equal to the data size of the data unit to be encrypted.

[0075] In S103, based on the random number, generating a virtual machine code corresponding to the type of the secure virtual machine may include: determining an operation code of the virtual machine code and an operand of the virtual machine code according to the random number, respectively, to generate the virtual machine code according to the operation code of the virtual machine code and the operand of the virtual machine code.

[0076] Taking a three-operand register-based virtual machine as an example, obtaining a random number corresponding to the data size of a data unit to be encrypted in the string of data to be encrypted and the type of the security virtual machine used by the decryption device in S102 may include: reading four random numbers of the same data size based on the data size of the data unit to be encrypted. Generating a virtual machine code corresponding to the type of the security virtual machine based on the random numbers in S103 may include: determining an opcode of the virtual machine code based on one of the random numbers, determining two data source operands of the virtual machine code based on two of the random numbers, determining a target address operand of the virtual machine code based on the remaining random number, and generating the virtual machine code of the three-operand register-based virtual machine based on the opcode, the data source operand, and the target address operand.

[0077] At this time, in the encryption result of the data to be encrypted, the virtual machine code corresponding to each data unit to be encrypted can be arranged in the order agreed upon by the encryption device and the decryption device, for example, according to the original order of the data units to be encrypted in the data to be encrypted, or arranged in an agreed random order.

[0078] As described in the above embodiment, obtaining the first data corresponding to the data unit to be encrypted by calculation according to the data unit to be encrypted and the virtual machine code in S104 may include: performing an inverse operation corresponding to the virtual machine code on the data unit to be encrypted to obtain the first data.

[0079] On this basis, in order to further increase data security, performing an inverse operation corresponding to the virtual machine code on the encrypted data unit to obtain the first data may include: performing multiple rounds of inverse operations of the virtual machine code on the encrypted data unit to obtain the first data.

[0080] In an embodiment of the present invention, the number of rounds of virtual machine code inverse operations performed on the data unit to be encrypted may be determined based on a pre-input virtual machine code generation complexity control parameter. Performing multiple rounds of virtual machine code inverse operations on the data unit to be encrypted to obtain the first data may include: performing multiple rounds of virtual machine code inverse operations on the data unit to be encrypted based on the virtual machine code generation complexity control parameter, and using the result obtained in the last round as the first data.

[0081] In some optional implementations of the present invention, for each unit of data to be encrypted, the same virtual machine code may be used in each round of inverse operations, with the first data obtained in the last round being the retained first data. In this case, the decryption device determines the number of inverse operation rounds based on the virtual machine code generation complexity control parameter, and performs a corresponding number of virtual machine code operations on the first data to restore the original data.

[0082] In other optional implementations of the embodiments of the present invention, to further improve data security, multiple virtual machine codes may be generated for each data unit to be encrypted. In this case, performing multiple rounds of inverse operations on the data unit to be encrypted to obtain the first data may include: in a current round of inverse operations, using the data unit to be encrypted or the output result of the previous round of inverse operations as input data, performing an inverse operation of the virtual machine code corresponding to the current round of inverse operations on the input data of the current round of inverse operations to obtain the output result of the current round of inverse operations; if a preset number of generation times is reached, using the output result of the current round of inverse operations as the first data; if the preset number of generation times is not reached, using the output result of the current round of inverse operations to enter a random number corresponding to the data size of the data unit to be encrypted and the type of secure virtual machine used by the decryption device. The preset number of generation times is determined according to a virtual machine code generation complexity control parameter.

[0083] At this point, multiple virtual machine codes are generated for each data unit to be encrypted. To further improve data security, the multiple virtual machine codes corresponding to each data unit to be encrypted can be shuffled. Obtaining an encryption result corresponding to the data to be encrypted based on the virtual machine codes corresponding to the data units to be encrypted and the first data corresponding to the data units to be encrypted can include: shuffling the virtual machine codes corresponding to each data unit to be encrypted so that the arrangement order of the virtual machine codes corresponding to the same data unit to be encrypted in the encryption result of the data to be encrypted is the same as the order in which the virtual machine codes are generated, thereby obtaining a shuffled virtual machine code result; and using the shuffled virtual machine code result and the first data as the encryption result corresponding to the data to be encrypted.

[0084] As long as the arrangement order of multiple virtual machine codes corresponding to the same data unit to be encrypted in the virtual machine code scrambled result is consistent with the generation order of the virtual machine codes, the decryption device can still restore the data units to be encrypted separately when calling the secure virtual machine to sequentially execute the virtual machine codes in the virtual machine code scrambled result.

[0085] For example, for the data unit to be encrypted and , The inverse calculations corresponding to the corresponding virtual machine codes are:

[0086] ;

[0087] ;

[0088] ;

[0089] in, 、 is the intermediate calculation result (i.e. the output result of the previous round of inverse operation), for The corresponding first data.

[0090] The inverse calculations corresponding to the corresponding virtual machine codes are:

[0091] ;

[0092] ;

[0093] ;

[0094] in, 、 is the intermediate calculation result (i.e. the output result of the previous round of inverse operation), for The corresponding first data.

[0095] Will and The corresponding virtual machine code is processed in random order, and the arrangement order of the virtual machine code corresponding to the same data unit to be encrypted is guaranteed to be the same as the generation order of the virtual machine code. Then the decryption device calls the secure virtual machine to execute the random result of the virtual machine code, and can still restore the and :

[0096] ;

[0097] ;

[0098] ;

[0099] ;

[0100] ;

[0101] .

[0102] Note that since it is an inverse operation, the order in which the decryption device executes the scrambled results of the virtual machine code should be opposite to the order in which the virtual machine code was generated.

[0103] In an embodiment of the present invention, the virtual machine codes corresponding to the data units to be encrypted are arranged in random order so that the arrangement order of the virtual machine codes corresponding to the same data unit to be encrypted in the encryption result of the data to be encrypted is the same as the generation order of the virtual machine codes, thereby obtaining a random virtual machine code result. This may include: randomly taking out the front virtual machine code from the virtual machine codes corresponding to a data unit to be encrypted and adding it to the encryption result queue of the data to be encrypted, until all the virtual machine codes are added to the encryption result queue, thereby obtaining a random virtual machine code result.

[0104] As described in the above embodiment, obtaining the first data corresponding to the data unit to be encrypted by calculation according to the data unit to be encrypted and the virtual machine code in S104 may also include: performing an operation corresponding to the virtual machine code on the data unit to be encrypted to obtain the first data.

[0105] On this basis, to further increase data security, performing operations corresponding to the virtual machine code on the encrypted data unit to obtain the first data may include: performing multiple rounds of virtual machine code operations on the encrypted data unit to obtain the first data.

[0106] In an embodiment of the present invention, the number of rounds of virtual machine code operations performed on the data unit to be encrypted may be determined based on a pre-input virtual machine code generation complexity control parameter. Performing multiple rounds of virtual machine code operations on the data unit to be encrypted to obtain the first data may include: performing multiple rounds of virtual machine code operations on the data unit to be encrypted based on the virtual machine code generation complexity control parameter, and using the result obtained in the last round as the first data.

[0107] In some optional implementations of the present invention, for each unit of data to be encrypted, the same virtual machine code may be used in each round of operations, with the first data obtained in the last round being the retained first data. In this case, the decryption device determines the number of inverse operation rounds based on the virtual machine code generation complexity control parameter, and performs the corresponding number of inverse operations on the first data using the virtual machine code to restore the original data.

[0108] In other optional implementations of the embodiments of the present invention, to further improve data security, multiple virtual machine codes may be generated for each data unit to be encrypted. In this case, performing multiple rounds of virtual machine code operations on the data unit to be encrypted to obtain the first data may include: in a current round of operations, using the data unit to be encrypted or the output result of the previous round of operations as input data, performing the virtual machine code operation corresponding to the current round of operations on the input data of the current round of operations to obtain the output result of the current round of operations; if the preset number of generation times is reached, using the output result of the current round of operations as the first data; if the preset number of generation times is not reached, using the output result of the current round of operations to enter a random number corresponding to the data size of the data unit to be encrypted and the type of secure virtual machine used by the decryption device. The preset number of generation times is determined according to a virtual machine code generation complexity control parameter.

[0109] At this point, multiple virtual machine codes are generated for each data unit to be encrypted. To further improve data security, the multiple virtual machine codes corresponding to each data unit to be encrypted can be shuffled. Obtaining an encryption result corresponding to the data to be encrypted based on the virtual machine codes corresponding to the data units to be encrypted and the first data corresponding to the data units to be encrypted can include: shuffling the virtual machine codes corresponding to each data unit to be encrypted so that the arrangement order of the virtual machine codes corresponding to the same data unit to be encrypted in the encryption result of the data to be encrypted is the same as the order in which the virtual machine codes are generated, thereby obtaining a shuffled virtual machine code result; and using the shuffled virtual machine code result and the first data as the encryption result corresponding to the data to be encrypted.

[0110] As described in the above embodiment, since the arrangement order of multiple virtual machine codes corresponding to the same data unit to be encrypted in the virtual machine code scrambling result is kept consistent with the generation order of the virtual machine code, the decryption device can still restore the data units to be encrypted separately and obtain the original data when calling the secure virtual machine sequence to perform the inverse operation of the virtual machine code in the virtual machine code scrambling result.

[0111] To further enhance data security, in an embodiment of the present invention, generating a virtual machine code corresponding to the type of secure virtual machine based on a random number in S103 may include: generating an initial virtual machine code based on the random number; obtaining variable parameters agreed upon between the device and the decryption device; and generating a virtual machine code from the initial virtual machine code using the variable parameters. The variable parameters may be values of agreed registers, system environment variable parameters, user IDs, etc. For example, one or more of the timestamp of the encryption device, the product serial number of the encryption device, and the location information of the encryption device may be used. When executing the virtual machine code, the decryption device first restores the virtual machine code to the initial virtual machine code based on the agreed variable parameters, and then executes to restore the original data.

[0112] In an embodiment of the present invention, a many-to-many relationship between virtual machine code and instruction can also be established, that is, a virtual machine code is not strongly related to a specific instruction, but there is a many-to-many correspondence. Here, lowercase letters represent virtual machine codes and uppercase letters represent instructions for example, that is, virtual machine code a is not completely related to instruction A, but may represent instructions A, B, C, and D; correspondingly, instruction A is not necessarily triggered only by virtual machine code a, but may be triggered by virtual machine codes a, b, c, and d. Then, in an embodiment of the present invention, S104 calculates the first data corresponding to the data unit to be encrypted based on the data unit to be encrypted and the virtual machine code, which may include: determining the calculation type corresponding to the virtual machine code based on variable parameters, and then calculating the first data based on the calculation type corresponding to the data unit to be encrypted and the virtual machine code. Among them, the variable parameters can also use the value of the agreed register, the system environment variable parameter, the user ID, etc. For example, one or more of the timestamp of the encryption device, the product serial number of the encryption device, and the location information of the encryption device can be used.

[0113] Therefore, the virtual machine code and the actual instructions are in a many-to-many relationship. When the decryption device calls the secure virtual machine to execute the virtual machine code, it determines the calculation type corresponding to the virtual machine code based on the agreed variable parameters, and then executes it accordingly to restore the original data.

[0114] The embodiment of the present invention complicates the correspondence between virtual machine codes and instructions through the many-to-many relationship between virtual machine codes and instructions, thereby further improving the security of encrypted data.

[0115] In an embodiment of the present invention, generating a virtual machine code corresponding to the type of the secure virtual machine based on a random number in S103 may also include: generating an initial virtual machine code based on the random number; replacing the initial virtual machine code with a virtual machine code of equivalent calculation, and the computational complexity of the virtual machine code is higher than that of the initial virtual machine code.

[0116] That is to say, for the calculation instructions corresponding to the virtual machine code, the calculation instructions will be directly executed when the virtual machine code is executed. For example, the "+" in "1+2=3" has the core process of adding data from two sources. The implementation of this process in the code is relatively simple and easy to reverse and analyze. In the embodiment of the present invention, based on the generation of the initial virtual machine code, it can be replaced with a virtual machine code with equivalent calculation and higher computational complexity. For example, "1+2=3" can be replaced with " ", the latter has the same calculation results as the former, but the corresponding instructions are more complex, which further increases the difficulty of data cracking.

[0117] In an embodiment of the present invention, obtaining an encryption result corresponding to the data to be encrypted based on the virtual machine code corresponding to the data unit to be encrypted and the first data corresponding to the data unit to be encrypted in S105 may include: arranging the encryption results of each data unit to be encrypted, and then performing at least one of the following processes on the arranged result: adding a first virtual machine code corresponding to an invalid process, adding a second virtual machine code corresponding to a false process, and performing control flow flattening on the process of the virtual machine code, to obtain the encryption result of the data to be encrypted.

[0118] That is to say, the virtual machine code corresponding to each data unit to be encrypted is obfuscated, which can include the reading and identification process of the virtual machine code, the call instruction execution, and the process within the instruction, such as invalid process (that is, the process itself has no meaning and is dispensable. For example, it will not perform any operations, or it will perform some operations, but the data before and after execution are exactly the same, etc.), false process (that is, inserting if-else and other codes to generate various branch processes, but the new branch processes will not actually be executed at all. They are just placed here as false processes to deceive the reverser), control flow flattening (dividing the original sequential execution process into multiple blocks, and placing these blocks in a while loop, and controlling which process block to execute in each round of the loop through a control variable and switch-case code, thereby achieving a process execution effect equivalent to the original process. However, the various process blocks in the code are completely equal, and it is impossible to distinguish which one comes first and which one comes later, and it is impossible to determine the execution order), etc., thereby complicating the virtual machine code process and increasing the difficulty of reverse engineering.

[0119] In an embodiment of the present invention, if the data to be encrypted is data in the software to be encrypted, which involves the confidentiality of both the software code and the data, corresponding virtual machine codes can be generated for the software code to be encrypted and the data to be encrypted, respectively, and the virtual machine codes corresponding to the software code to be encrypted and the virtual machine codes corresponding to the data to be encrypted are confused and arranged, and then transmitted or stored, thereby further increasing the difficulty of cracking the data, and also increasing the difficulty of cracking the software code.

[0120] Based on the above embodiment, an embodiment of the present invention provides an implementation method of a virtual machine code generation process and a virtual machine code execution process.

[0121] Figure 3 A flowchart of a virtual machine code generation process provided by an embodiment of the present invention; Figure 4 A flowchart of a virtual machine code execution process provided by an embodiment of the present invention.

[0122] like Figure 3 As shown, the steps of generating virtual machine code from the data to be encrypted and encrypting it provided in the embodiment of the present invention may include:

[0123] S301: Obtain a character string of data to be encrypted and a virtual machine code generation complexity control parameter.

[0124] The program obtains the user-specified string of data to be encrypted and the virtual machine code generation complexity control parameter. This parameter is used to control the amount of randomly generated virtual machine code to avoid generating too much or too little virtual machine code that does not meet the requirements. (Too much affects performance, while too little affects protection strength. The user can specify the appropriate complexity control parameter based on their needs.) After obtaining the user-specified string of data to be encrypted and the virtual machine code generation complexity control parameter, the program begins generating random virtual machine code.

[0125] S302: Generate a random number seed.

[0126] The program generates a random number seed, which is essentially a random string of a specific length, the length of which depends on the key length required by the stream cipher algorithm used later.

[0127] S303: Calling a stream cipher algorithm with a random number seed to generate a random number stream.

[0128] Call the stream cipher algorithm and pass in the random number seed as the algorithm key to generate a random number stream. The stream cipher algorithm is a symmetric encryption algorithm. Its core is to generate a key stream and perform byte-by-byte XOR with the plaintext to achieve encryption / decryption.

[0129] The algorithm is used in this embodiment of the present invention because the virtual machine code generation process requires highly random, unpredictable, and infinitely long data as the basis for random generation of the virtual machine code. The key stream generated by the stream cipher algorithm meets this requirement and can avoid resource issues caused by reading overly long random numbers from the operating system. Therefore, the random number seed generated in S302 is used here to call the stream cipher algorithm to further generate the random number stream.

[0130] S304: Determine whether there are any unprocessed data units to be encrypted; if yes, proceed to S305; if not, proceed to S311.

[0131] Try to read a byte from the string of data to be encrypted specified by the user for processing.

[0132] If the data can be read, the process of generating the virtual machine code is entered, that is, S305; if the reading fails (for example, the user specifies an empty string, or the string has been processed and there are no remaining characters), the virtual machine code out-of-order protection process is entered, that is, S311.

[0133] S305: Read a one-byte unit of data to be encrypted.

[0134] A one-byte unit of data to be encrypted is read from the unprocessed portion of the character string of the data to be encrypted.

[0135] S306: Read three bytes of data from the random number stream as a reference to generate a virtual machine code.

[0136] After reading the data unit to be encrypted, the virtual machine code generator reads three bytes of random data from the random number stream. These three bytes serve as the basis for generating the virtual machine code. The virtual machine code generator examines the contents of these three bytes, predicting the generated virtual machine code from the first byte and then determining the two source operands in the virtual machine code from the second two bytes. The destination operand in a three-operand instruction is determined by the current data position (i.e., the position of the data unit to be encrypted within the encrypted data string) and is not randomized.

[0137] Due to the randomness and unpredictability of the random number stream, the generated virtual machine code is also random, and the data at the specified destination address will be processed randomly.

[0138] S307: Determine the calculation type corresponding to the virtual machine code according to the variable parameters.

[0139] After initially generating the virtual machine code, the virtual machine code generator will read some environmental conditions, namely the "virtual machine code-instruction many-to-many design" introduced in the above embodiment.

[0140] After reading the variable parameters, the generated virtual machine code is synthesized to determine the actual virtual machine instruction corresponding to the virtual machine code and obtain its calculation type.

[0141] S308: Perform an inverse operation of the calculation type corresponding to the virtual machine code on the data unit to be encrypted to obtain a character after the operation.

[0142] Since the ultimate goal of the virtual machine is to generate specified data through random instructions, and after the processing of the above steps, the virtual machine code generated by the virtual machine code generator can only generate random data, it is necessary to use the inverse operation of the operation of the instruction corresponding to the virtual machine code to operate with the original data unit to be encrypted (or the post-operation character generated in the previous cycle) to obtain the post-operation character output by the current round of inverse operation.

[0143] For example, if the unit of data to be encrypted is 5 and the randomly generated virtual machine instruction is a=a+1, then the operation to be performed here is to perform the inverse operation "-1" on the original data 5, so that the character after the operation is 4.

[0144] The calculated character obtained in this way, when executed in the secure virtual machine, can execute the instruction operation "4+1" corresponding to the virtual machine code, and then generate the original target data character 5.

[0145] S309: Determine whether the number of calculation rounds corresponding to the virtual machine code generation complexity control parameter is reached; if yes, proceed to S310; if not, proceed to S306.

[0146] At this point, a random virtual machine code has been generated. By design, a character can be processed and dynamically generated using one to any number of virtual machine codes. More virtual machine codes increase strength, but also reduce performance. Therefore, the user must specify a virtual machine code generation complexity control parameter to control the number of generated virtual machine codes.

[0147] This step checks the virtual machine code generation complexity control parameter entered by the user in S101, compares it with the current virtual machine code generation state, and determines whether to generate more virtual machine code based on the comparison result. If the virtual machine code generation does not meet the user's requirements, the process jumps to S306 to further read random data to generate virtual machine code. If the virtual machine code generation complexity control parameter has been met, no further virtual machine code is generated and the process proceeds to S310.

[0148] S310: Using the calculated characters output by the last round of inverse calculation corresponding to the data unit to be encrypted as the first data, generating an initialization data virtual machine code, and writing the first data.

[0149] The generated multiple virtual machine codes satisfy the virtual machine code generation complexity control parameters. Multiple virtual machine codes corresponding to the data units to be encrypted and a first data after multiple rounds of inverse operations have been obtained. To ensure that the first data after multiple rounds of inverse operations can participate in the execution of the virtual machine code and ultimately generate the target character, a load instruction is generated to load the first data into the virtual register.

[0150] When executed in the secure virtual machine, the first data will first be loaded into the register by the load instruction, and then processed by the aforementioned generated virtual machine code to finally obtain the target data character.

[0151] At this point, a complete randomized virtual machine code block containing multiple virtual machine codes is generated for a single-byte data unit to be encrypted. After this step is completed, the process jumps to S304 and reads the next data unit to be encrypted to start a new round of randomized virtual machine code generation.

[0152] S311: Virtual machine code out-of-order processing.

[0153] When all the data units to be encrypted have been read and processed, the process of generating the virtual machine code is completed.

[0154] However, the virtual machine code is distributed in blocks, with each block dedicated to processing a single byte of encrypted data at a specific location. To further increase the difficulty of data cracking, this embodiment of the present invention shuffles the virtual machine code, extracting all virtual machine code blocks individually. A random virtual machine code block is then selected, and a section of virtual machine code is extracted from the front of the block and placed in the final virtual machine code area. The same operation is then performed on another random virtual machine code block.

[0155] This processing method ensures that the virtual machine codes in all virtual machine code blocks are evenly and randomly distributed in the final complete virtual machine code, and the relative order of the virtual machine codes within each virtual machine code block remains unchanged (for example, virtual machine code blocks ABC and XYZ are randomly ordered to XABYCZ, and the relative order of ABC remains unchanged), thereby ensuring that the final execution result is correct.

[0156] S312: Output the virtual machine code file.

[0157] After the processing is completed, the final virtual machine code can be packaged and exported into a file, which can be compiled into the target program for reference.

[0158] like Figure 4 As shown, the steps of executing the virtual machine code by the secure virtual machine include:

[0159] S401: Read the virtual machine code file.

[0160] The secure virtual machine starts and receives the virtual machine code passed by the user.

[0161] S402: Determine whether there is any unexecuted virtual machine code. If yes, proceed to step 403; if no, proceed to step 404.

[0162] The secure virtual machine reads a virtual machine code from the transmitted virtual machine code. If the virtual machine code can be read, the secure virtual machine proceeds to S403 to parse and execute the virtual machine code; if the virtual machine code cannot be read, it means that the virtual machine code has been executed, and the secure virtual machine jumps to S405 to output data.

[0163] S403: Read variable parameters to determine the calculation type corresponding to the virtual machine code.

[0164] The secure virtual machine parses the read virtual machine code and reads the agreed variable parameters. Based on the variable parameters, it determines the real virtual machine instruction corresponding to the virtual machine code, that is, the real calculation type. It then obtains the two source operands and destination number of the instruction and calls the corresponding virtual machine instruction.

[0165] S404: Execute the operation corresponding to the virtual machine code.

[0166] After the virtual machine instruction is called, the source operand and destination number are obtained, and the virtual machine instruction flow is executed to perform operations on the data of the source operand and store it in the destination.

[0167] At this point, one virtual machine instruction is executed and returned, and the process returns to S402 to read the next virtual machine code and parse and execute it.

[0168] S405: Copy the register content to the target area.

[0169] When no new virtual machine code can be read in S402, it means that all virtual machine instructions have been executed, and the data in the virtual machine register is a dynamically generated string of data to be encrypted. At this time, the virtual machine will execute the export process and copy the data in the register to the specified memory area. The user can use this data by accessing this area.

[0170] S406: Clean up the environment and exit.

[0171] After the export is completed, the secure virtual machine will clean up various variables and register areas used during the execution process. After the cleanup is completed, the virtual machine will automatically exit.

[0172] It should be noted that during the execution of the secure virtual machine, the design of instruction flow equivalent replacement, process obfuscation, etc. described in the above embodiments have been internalized in the virtual machine code and are executed without affecting the normal functional flow of the secure virtual machine. Therefore, there is no need to Figure 4 It is shown in the flowchart, but in fact each step in the flowchart contains these obfuscation protection designs.

[0173] These designs can hide the execution process within the secure virtual machine, thereby improving the strength of the secure virtual machine and ensuring that the execution process of the relevant virtual machine code cannot be reversed, thereby improving the security of the dynamic restoration process of the string of the encrypted data.

[0174] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0175] An embodiment of the present invention also provides a data encryption device, which may include: a first acquisition unit, used to obtain a character string of data to be encrypted; a second acquisition unit, used to obtain a random number corresponding to the data amount based on the data amount of a data unit to be encrypted in the character string of the data to be encrypted and the type of secure virtual machine adopted by the decryption device; a generation unit, used to generate a virtual machine code corresponding to the type of secure virtual machine based on the random number; a calculation unit, used to calculate the first data corresponding to the data unit to be encrypted based on the data unit to be encrypted and the virtual machine code; a determination unit, used to obtain the encryption result corresponding to the data to be encrypted based on the virtual machine code corresponding to the data unit to be encrypted and the first data corresponding to the data unit to be encrypted.

[0176] In the embodiment of the present invention, the second acquiring unit acquiring the random number corresponding to the data amount may include: reading the random number corresponding to the data amount from a pre-generated random number stream.

[0177] In an embodiment of the present invention, the second acquisition unit obtains a random number of corresponding data size based on the data size of a data unit to be encrypted of the string of the data to be encrypted and the type of the secure virtual machine adopted by the decryption device, which may include: determining the number of operation codes of a virtual machine code and the number of operands of a virtual machine code according to the type of the secure virtual machine; taking the sum of the number of operation codes of a virtual machine code and the number of operands of the virtual machine code minus one as the number of random numbers; and obtaining a corresponding number of random numbers, where the data size of a random number is equal to the data size of the data unit to be encrypted.

[0178] In an embodiment of the present invention, a generation unit generates a virtual machine code corresponding to the type of the secure virtual machine based on a random number, which may include: determining a parameter of the virtual machine code according to the position of the to-be-encrypted data unit in the character string of the to-be-encrypted data, and determining the remaining parameters in the virtual machine code according to the random number; the parameters of the virtual machine code include an operation code of the virtual machine code and an operand of the virtual machine code; and generating the virtual machine code according to the operation code of the virtual machine code and the operand of the virtual machine code.

[0179] In an embodiment of the present invention, the secure virtual machine can be a three-operand register virtual machine. The second acquisition unit obtains a random number corresponding to the data size of a data unit to be encrypted in the string of the data to be encrypted and the type of the secure virtual machine used by the decryption device, which may include: reading three random numbers of the same data size according to the data size of the data unit to be encrypted. The generation unit generates a virtual machine code corresponding to the type of the secure virtual machine based on the random numbers, which may include: determining the operation code of the virtual machine code according to one of the random numbers, determining two data source operands of the virtual machine code according to the other two random numbers, determining the target address operand of the virtual machine code according to the position of the data unit to be encrypted in the data to be encrypted, and generating the virtual machine code of the three-operand register virtual machine according to the operation code, the data source operand and the target address operand.

[0180] In an embodiment of the present invention, the calculation unit calculates the first data corresponding to the data unit to be encrypted according to the data unit to be encrypted and the virtual machine code, which may include: performing an inverse operation corresponding to the virtual machine code on the data unit to be encrypted to obtain the first data.

[0181] In an embodiment of the present invention, the computing unit performs an inverse operation corresponding to the virtual machine code on the data unit to be encrypted to obtain the first data, which may include: performing multiple rounds of inverse operations of the virtual machine code on the data unit to be encrypted to obtain the first data.

[0182] In an embodiment of the present invention, the computing unit performs multiple rounds of inverse operations of a virtual machine code on a data unit to be encrypted to obtain first data, which may include: in a current round of inverse operation, taking the data unit to be encrypted or the output result of the previous round of inverse operation as input data, performing an inverse operation of the virtual machine code corresponding to the current round of inverse operation on the input data of the current round of inverse operation to obtain an output result of the current round of inverse operation; if a preset number of generations is reached, taking the output result of the current round of inverse operation as the first data; if the preset number of generations is not reached, taking the output result of the current round of inverse operation to enter a random number corresponding to the data amount according to the data amount of the data unit to be encrypted and the type of secure virtual machine adopted by the decryption device, and obtaining the corresponding data amount.

[0183] In an embodiment of the present invention, the determination unit obtains an encryption result corresponding to the data to be encrypted based on the virtual machine code corresponding to the data unit to be encrypted and the first data corresponding to the data unit to be encrypted, which may include: arranging the virtual machine codes corresponding to each data unit to be encrypted in random order so that the arrangement order of the virtual machine codes corresponding to the same data unit to be encrypted in the encryption result of the data to be encrypted is the same as the generation order of the virtual machine codes, thereby obtaining a random result of the virtual machine codes; and using the random result of the virtual machine codes and the first data as the encryption result corresponding to the data to be encrypted.

[0184] In an embodiment of the present invention, the determining unit shuffles the virtual machine codes corresponding to the data units to be encrypted so that the arrangement order of the virtual machine codes corresponding to the same data unit to be encrypted in the encryption result of the data to be encrypted is the same as the generation order of the virtual machine codes, thereby obtaining a shuffled virtual machine code result. This may include: randomly taking out the front-end virtual machine code from the virtual machine codes corresponding to a data unit to be encrypted and adding it to the encryption result queue of the data to be encrypted, until all the virtual machine codes are added to the encryption result queue, thereby obtaining a shuffled virtual machine code result.

[0185] In an embodiment of the present invention, generating a virtual machine code corresponding to the type of secure virtual machine based on a random number may include: generating an initial virtual machine code based on the random number; obtaining variable parameters agreed upon by the device and the decryption device; and generating a virtual machine code from the initial virtual machine code using the variable parameters.

[0186] In an embodiment of the present invention, the generation unit generates a virtual machine code corresponding to the type of the secure virtual machine based on a random number, which may include: generating an initial virtual machine code according to the random number; replacing the initial virtual machine code with a virtual machine code of equivalent calculation, and the computational complexity of the virtual machine code is higher than that of the initial virtual machine code.

[0187] The description of the features in the embodiment corresponding to the data encryption device can be found in the relevant description of the embodiment corresponding to the data encryption method, and will not be repeated here.

[0188] An embodiment of the present invention further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any of the above data encryption method embodiments.

[0189] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps of any one of the above-mentioned data encryption method embodiments when running.

[0190] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0191] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any one of the above data encryption method embodiments are implemented.

[0192] An embodiment of the present invention also provides another computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in any of the above-mentioned data encryption method embodiments are implemented.

[0193] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0194] The above describes in detail the data encryption method, device, medium, and computer program product provided by the present invention. This article uses specific examples to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only intended to help understand the method and core concept of the present invention. It should be noted that those skilled in the art can make various improvements and modifications to the present invention without departing from the principles of the present invention, and such improvements and modifications also fall within the scope of protection of the present invention.

Claims

1. A data encryption method, characterized in that: include: Get the string of data to be encrypted; Obtaining a random number corresponding to the data amount according to the data amount of a data unit to be encrypted of the character string of the data to be encrypted and the type of the secure virtual machine used by the decryption device; Based on the random number, generate a virtual machine code corresponding to the type of the secure virtual machine; Obtaining first data corresponding to the data unit to be encrypted by calculation according to the data unit to be encrypted and the virtual machine code; Obtaining an encryption result corresponding to the data to be encrypted according to the virtual machine code corresponding to the data unit to be encrypted and the first data corresponding to the data unit to be encrypted; The method of obtaining a random number corresponding to the data amount according to the data amount of a data unit to be encrypted of the character string of the data to be encrypted and the type of the secure virtual machine used by the decryption device includes: Determining the number of required operation codes and the number of operands according to the type of the secure virtual machine; Taking the data size of one of the to-be-encrypted data units as the data size of one of the random numbers, obtaining a number of random numbers corresponding to the number of operation codes and the number of operands; Generating a virtual machine code corresponding to the type of the secure virtual machine based on the random number includes: Generate the virtual machine code using the random number as an operation code and an operand; Obtaining first data corresponding to the data unit to be encrypted by calculation according to the data unit to be encrypted and the virtual machine code, including: An inverse operation corresponding to the virtual machine code is performed on the data unit to be encrypted to obtain the first data; or a calculation instruction corresponding to the virtual machine code is performed on the data unit to be encrypted to obtain the first data.

2. The data encryption method according to claim 1, wherein: Get the random number corresponding to the data volume, including: The random number corresponding to the data amount is read from a pre-generated random number stream.

3. The data encryption method according to claim 1, wherein: Obtaining a random number corresponding to the data amount according to the data amount of a data unit to be encrypted of the character string of the data to be encrypted and the type of the secure virtual machine used by the decryption device includes: Determining the number of operation codes of the virtual machine code and the number of operands of the virtual machine code according to the type of the secure virtual machine; The number of random numbers is the sum of the number of operation codes of the virtual machine code and the number of operands of the virtual machine code minus one; A corresponding number of random numbers is obtained, where the data size of one random number is equal to the data size of the data unit to be encrypted.

4. The data encryption method according to claim 3, wherein: Generating a virtual machine code corresponding to the type of the secure virtual machine based on the random number includes: determining a parameter of the virtual machine code according to the position of the data unit to be encrypted in the character string of the data to be encrypted, and determining the remaining parameters of the virtual machine code according to the random number; the parameters of the virtual machine code include an operation code of the virtual machine code and an operand of the virtual machine code; The virtual machine code is generated according to the operation code of the virtual machine code and the operand of the virtual machine code.

5. The data encryption method according to claim 4, characterized in that: The secure virtual machine is a three-operand register virtual machine; Obtaining a random number corresponding to the data amount according to the data amount of a data unit to be encrypted of the character string of the data to be encrypted and the type of the secure virtual machine used by the decryption device includes: Reading three random numbers of the same size according to the size of the data unit to be encrypted; Generating a virtual machine code corresponding to the type of the secure virtual machine based on the random number includes: An operation code of the virtual machine code is determined based on one of the random numbers, two data source operands of the virtual machine code are determined based on the other two random numbers, a target address operand of the virtual machine code is determined based on the position of the data unit to be encrypted in the data to be encrypted, and the virtual machine code of the three-operand register virtual machine is generated based on the operation code, the data source operand and the target address operand.

6. The data encryption method according to claim 1, wherein: Performing an inverse operation corresponding to the virtual machine code on the data unit to be encrypted to obtain the first data includes: Perform multiple rounds of inverse operations of the virtual machine code on the data unit to be encrypted to obtain the first data.

7. The data encryption method according to claim 6, characterized in that: Performing multiple rounds of inverse operations of the virtual machine code on the data unit to be encrypted to obtain the first data includes: In the current round of inverse operation, the data unit to be encrypted or the output result of the previous round of inverse operation is used as input data, and the inverse operation of the virtual machine code corresponding to the current round of inverse operation is performed on the input data of the current round of inverse operation to obtain the output result of the current round of inverse operation; If the preset number of generation times is reached, the output result of the current round of inverse operation is used as the first data; If the preset number of generation times is not reached, the output result of the current round of inverse operation is used to enter the data size of the data unit to be encrypted and the type of secure virtual machine used by the decryption device to obtain a random number corresponding to the data size.

8. The data encryption method according to claim 7, characterized in that: Obtaining an encryption result corresponding to the data to be encrypted according to the virtual machine code corresponding to the data unit to be encrypted and the first data corresponding to the data unit to be encrypted, including: shuffling the virtual machine codes corresponding to the data units to be encrypted so that the arrangement order of the virtual machine codes corresponding to the same data unit to be encrypted in the encryption result of the data to be encrypted is the same as the generation order of the virtual machine codes, thereby obtaining a shuffled virtual machine code result; The virtual machine code scrambled result and the first data are used as the encryption result corresponding to the data to be encrypted.

9. The data encryption method according to claim 8, characterized in that: The virtual machine codes corresponding to the data units to be encrypted are randomly arranged so that the arrangement order of the virtual machine codes corresponding to the same data unit to be encrypted in the encryption result of the data to be encrypted is the same as the generation order of the virtual machine codes, to obtain a virtual machine code random order result, including: The front-end virtual machine code is randomly taken out from the virtual machine code corresponding to a unit of data to be encrypted and added to the encryption result queue of the data to be encrypted, until all the virtual machine codes are added to the encryption result queue to obtain the random order result of the virtual machine codes.

10. The data encryption method according to claim 1, wherein: Generating a virtual machine code corresponding to the type of the secure virtual machine based on the random number includes: Generate an initial virtual machine code based on the random number; Obtaining variable parameters agreed upon between the device and the decryption device; The variable parameters are used to generate the virtual machine code from the initial virtual machine code.

11. The data encryption method according to claim 1, wherein: Generating a virtual machine code corresponding to the type of the secure virtual machine based on the random number includes: Generate an initial virtual machine code based on the random number; The initial virtual machine code is replaced by the virtual machine code with equivalent calculation, and the calculation complexity of the virtual machine code is higher than that of the initial virtual machine code.

12. An electronic device, characterized in that: include: memory for storing computer programs; A processor, configured to implement the steps of the data encryption method according to any one of claims 1 to 11 when executing the computer program.

13. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the data encryption method according to any one of claims 1 to 11 when executed by a processor.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the data encryption method according to any one of claims 1 to 11 are implemented.

Images