AES-based data enhancement encryption method, system, device and medium

Abstract

The present invention provides a data enhancement encryption method, system, device, and medium based on AES, belonging to the field of data security technology. The method comprises: receiving plaintext data to be encrypted and a password provided by a user; deriving a master key and an HMAC key from the password and a randomly generated salt value using a key derivation function; randomly generating an initialization vector, and encrypting the plaintext data using the master key using the AES encryption mode to obtain encrypted ciphertext data; performing a message authentication code calculation on the ciphertext data, the initialization vector, and the salt value using the HMAC key to generate an HMAC check value; and combining the salt value, the initialization vector, the ciphertext data, and the HMAC check value into a final output encrypted data packet. The present invention further improves the security and integrity of data by introducing a series of enhancement mechanisms such as strong key derivation, random salt value, message authentication code, and initialization vector.

Description

Technical Field

[0001] The present invention belongs to the field of data security technology, and more specifically relates to a data enhancement encryption method, system, device and medium based on AES. Background Art

[0002] With the rapid development of information technology, cybersecurity issues have become increasingly prominent. In recent years, data leaks, phishing, malware, and other attack methods have emerged one after another, causing significant losses to businesses and individuals. To address these challenges, information security technologies are constantly evolving, and encryption is one of the key means of ensuring data security.

[0003] Traditional encryption schemes typically rely on symmetric encryption algorithms (such as AES), asymmetric encryption algorithms (such as RSA), and hash functions (such as SHA). Although these algorithms perform well in their respective fields, they still face some challenges in practical applications:

[0004] AES encryption: AES is a widely used symmetric encryption standard with strong encryption capabilities. However, AES itself does not provide data integrity verification, so in practical applications, it is often combined with HMAC or other message authentication codes to ensure data integrity and authenticity.

[0005] RSA encryption: RSA is an asymmetric encryption algorithm commonly used for digital signatures and key exchange. While RSA offers high security, its high computational complexity makes it less performant when encrypting large amounts of data. Furthermore, RSA's long key length increases key management and transmission costs.

[0006] SHA Hash Function: SHA is a commonly used hash function used to generate fixed-length message digests. However, SHA only ensures data integrity and does not provide encryption. Therefore, in practical applications, it is often combined with other encryption algorithms. Summary of the Invention

[0007] In response to the above problems, the purpose of the present invention is to provide a data enhancement encryption method, system, device and medium based on AES, which further improves the security and integrity of data by introducing a series of enhancement mechanisms such as strong key derivation, random salt value, message authentication code and initialization vector.

[0008] To achieve the above-mentioned purpose, the present invention is implemented through the following technical solutions:

[0009] In a first aspect, an embodiment of the present application provides a data enhancement encryption method based on AES, comprising:

[0010] Receive the plaintext data to be encrypted and the password provided by the user;

[0011] deriving a first key and a second key from the password and a randomly generated salt value using a key derivation function; the first key is a master key, and the second key is an HMAC key for integrity verification;

[0012] Randomly generate an initialization vector, and use the AES encryption mode to encrypt the plaintext data with the first key to obtain encrypted ciphertext data;

[0013] Performing a message authentication code calculation on the ciphertext data, the initialization vector, and the salt value using the second key to generate an HMAC check value;

[0014] The salt value, initialization vector, ciphertext data and HMAC check value are combined into the encrypted data packet that is finally output.

[0015] In an optional embodiment, receiving the plaintext data to be encrypted and the password provided by the user includes:

[0016] Obtaining plaintext data to be encrypted based on the text or file to be encrypted;

[0017] Receives the password string entered by the user and is used to generate the encryption key.

[0018] In an optional embodiment, deriving the first key and the second key from the password and the randomly generated salt value using a key derivation function includes:

[0019] The PBKDF2 function or the Argon2 function is used to take the password and the randomly generated salt value as input, and the hash algorithm is repeatedly executed under a specified number of iterations to derive the first key and the second key.

[0020] In an optional embodiment, the randomly generated initialization vector and the encrypted plaintext data using the first key in the AES encryption mode to obtain the encrypted ciphertext data include:

[0021] Start the encryption operation and randomly generate an initialization vector;

[0022] The plaintext data is encrypted using the first key using the CBC encryption mode or the GCM encryption mode to obtain encrypted ciphertext data.

[0023] In an optional embodiment, performing message authentication code calculation on the ciphertext data, the initialization vector, and the salt value using the second key to generate an HMAC check value includes:

[0024] Splicing the ciphertext data, the initialization vector, and the salt value to generate spliced ​​data;

[0025] Use the second key as the authentication key and use the SHA-256 hash algorithm to perform a hash operation on the spliced ​​data to generate an HMAC check value.

[0026] In an optional embodiment, combining the salt value, the initialization vector, the ciphertext data, and the HMAC check value into the encrypted data packet that is finally output includes:

[0027] The salt value, initialization vector, ciphertext data and HMAC check value are combined to generate an encrypted data packet in the following format:

[0028] [Salt||IV||Ciphertext||HMAC];

[0029] Among them, Salt is the salt value, IV is the initialization vector, Ciphertext is the ciphertext data, and HMAC is the HMAC check value.

[0030] In an optional embodiment, the specified number of iterations is no less than 100,000 times; the salt value and initialization vector are generated by a secure random number generator, and both have a length of 16 bytes.

[0031] In a second aspect, the embodiment of the present application further provides a data enhancement encryption system based on AES, comprising:

[0032] A data receiving module, used to receive the plaintext data to be encrypted and the password provided by the user;

[0033] A key generation module, configured to derive a first key and a second key from the password and a randomly generated salt value using a key derivation function; the first key is a master key, and the second key is an HMAC key for integrity verification;

[0034] A data encryption module is used to randomly generate an initialization vector and encrypt the plaintext data using the first key in the AES encryption mode to obtain encrypted ciphertext data;

[0035] A check value calculation module is used to perform message authentication code calculation on the ciphertext data, the initialization vector and the salt value using the second key to generate an HMAC check value;

[0036] The data combination output module is used to combine the salt value, initialization vector, ciphertext data and HMAC check value into the final output encrypted data packet.

[0037] In a third aspect, an embodiment of the present application further provides an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the program, the steps of the AES-based data enhancement encryption method as described in any one of the above items are implemented.

[0038] In a fourth aspect, an embodiment of the present application further provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the AES-based data enhancement encryption method as described in any one of the above items are implemented.

[0039] It can be seen from the above technical solutions that the present invention has the following advantages:

[0040] In the AES-based data enhancement encryption method provided in this application, a master key and an HMAC key are derived from a user password and a random salt value by utilizing a key derivation function, and the plaintext data is encrypted in combination with a random initialization vector and an AES encryption mode, and an HMAC check value is generated for integrity verification. Finally, the salt value, initialization vector, ciphertext data, and HMAC check value are combined into an encrypted data packet output, which effectively enhances the security and integrity of data encryption. The ability to resist brute force cracking and tampering is improved through a high number of iterations, secure random number generation, and specific encryption and hash algorithms.

[0041] This application generates a strong encryption key from the user-provided password using a key derivation function such as PBKDF2 or Argon2. This approach significantly increases the difficulty of brute-force cracking compared to using the password directly as the key.

[0042] This application generates a new random IV and salt value for each encryption operation, effectively preventing replay attacks. Even the same plaintext and password will produce different ciphertexts, thus avoiding the risk of pattern leakage.

[0043] This application integrates HMAC checksum to ensure that data has not been tampered with during transmission and to verify the authenticity of the data source. By calculating the HMAC checksum value after encryption, the recipient can verify the integrity and authenticity of the data before decryption.

[0044] This application provides a flexible and easy-to-implement framework that allows you to adjust encryption modes, key derivation parameters, and other details based on specific needs. Whether it is a financial institution, a medical institution, or other professional institution, you can customize the encryption scheme according to your needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solution of the present invention, the following is a brief introduction to the drawings required for the description. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0046] Figure 1 This is a flowchart of the AES-based data enhancement encryption method provided in this application.

[0047] Figure 2 This is a schematic diagram of the structure of the AES-based data enhancement encryption system provided in this application.

[0048] Figure 3 This is a schematic diagram of the structure of the electronic device provided in this application. DETAILED DESCRIPTION

[0049] The various embodiments of the present disclosure will be described in more detail below in the specific steps of the AES-based data enhancement encryption method. The present disclosure can have various embodiments, and adjustments and changes can be made therein. However, it should be understood that there is no intention to limit the various embodiments of the present disclosure to the specific embodiments disclosed herein, but rather that the present disclosure should be understood to cover all adjustments, equivalents, and / or alternatives that fall within the spirit and scope of the various embodiments of the present disclosure.

[0050] To facilitate a clear description of the technical solutions of the embodiments of the present application, some of the terms and technologies involved in the embodiments of the present application are briefly introduced below:

[0051] PBKDF2 (Password-Based Key Derivation Function 2): PBKDF2 is a password-based key derivation function that generates a fixed-length key by repeatedly hashing the input password and a salt value. It is often used to generate strong encryption keys, especially in situations where high security is required.

[0052] Argon2: Argon2 is another widely recognized key derivation function, particularly suitable for applications requiring high memory consumption. Compared to PBKDF2, Argon2 introduces memory-hard features during the calculation process, making it more difficult to attack with hardware acceleration such as GPUs and ASICs.

[0053] HMAC (Hash-based Message Authentication Code): HMAC is a message authentication code based on a hash function, used to verify the integrity and authenticity of data. By appending an HMAC checksum to encrypted data, it can effectively prevent man-in-the-middle attacks and data tampering.

[0054] AES-GCM (Galois / CounterMode): AES-GCM is an encryption mode that provides both encryption and authentication. It is more efficient than CBC mode, especially when supported by hardware. It can significantly increase encryption and decryption speed while ensuring data integrity and authenticity.

[0055] ECB (Electronic Codebook) mode vs. CBC (Cipher Block Chaining) mode: ECB mode is a simple encryption mode, but it has significant security risks. Identical plaintext blocks will generate identical ciphertext blocks, which can easily lead to pattern leakage. In contrast, CBC mode effectively avoids the risk of pattern leakage by introducing an initialization vector (IV).

[0056] Hereinafter, the terms "include" or "may include" as used in various embodiments of the present disclosure indicate the presence of disclosed functions, operations, or elements, and do not limit the addition of one or more functions, operations, or elements. In addition, as used in various embodiments of the present disclosure, the terms "include," "have," and their cognates are intended only to indicate specific features, numbers, steps, operations, elements, components, or combinations of the foregoing, and should not be understood as excluding the presence of one or more other features, numbers, steps, operations, elements, components, or combinations of the foregoing, or the possibility of adding one or more features, numbers, steps, operations, elements, components, or combinations of the foregoing.

[0057] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0058] See also Figure 1 FIG. 1 is a flowchart of a data enhancement encryption method based on AES in a specific embodiment, the method comprising:

[0059] S1: Receives the plaintext data to be encrypted and the password provided by the user.

[0060] In a specific embodiment, the plaintext data to be encrypted is obtained based on the text or file to be encrypted; at the same time, a password string input by the user is received and used to generate an encryption key. The password input is pre-processed, including removing spaces, converting upper and lower case letters, or hashing.

[0061] For example, in this step, first obtain the following data:

[0062] Plaintext to be encrypted: can be any form of data, such as text, files, etc.

[0063] User-provided password: The password string entered by the user is used to generate the encryption key.

[0064] S2: derive a first key and a second key from the password and a randomly generated salt value using a key derivation function; the first key is a master key, and the second key is an HMAC key used for integrity verification.

[0065] In a specific embodiment, a PBKDF2 function or an Argon2 function is used, with the password and a randomly generated salt as input, to derive the first and second keys by repeatedly executing a hash algorithm for a specified number of iterations. The specified number of iterations is no less than 100,000; the salt is generated using a secure random number generator and is 16 bytes long.

[0066] For example, use PBKDF2 or Argon2 to derive two keys from a password and a randomly generated salt:

[0067] Encryption key: used for AES encryption.

[0068] HMAC key: used to generate a message authentication code.

[0069] PBKDF2 is a password-based key derivation function that generates a fixed-length key by repeatedly hashing the input password and salt. Its main parameters include:

[0070] a) Iterations: Increasing the number of iterations can significantly increase the difficulty of brute force cracking.

[0071] b) Salt value: Random data used each time a key is generated to ensure that even the same password will generate a different key.

[0072] c) Hash algorithm: SHA-256 or a stronger hash algorithm is usually used.

[0073] In this step, at least 100,000 iterations are used, combined with a randomly generated 16-byte salt value. This not only increases the computational complexity but also makes rainbow table attacks almost impossible.

[0074] Argon2 is another widely recognized key derivation function, particularly suitable for memory-intensive applications. Compared to PBKDF2, Argon2 introduces memory-hardness during its calculations, making attacks using hardware acceleration such as GPUs and ASICs more difficult.

[0075] In this method, you can choose to use PBKDF2 or Argon2 based on specific performance requirements. For resource-constrained environments (such as mobile devices or embedded systems), PBKDF2 may be a better choice; for server-side or high-performance applications, Argon2 provides higher security.

[0076] It's important to note that the primary purpose of the salt in this method is to prevent rainbow table attacks and ensure that even identical plaintext and passwords produce different ciphertexts. A new random salt value is generated for each encryption operation. This salt value is not only used for key derivation but is also stored as metadata in the final encrypted data. This allows the key to be regenerated during decryption by extracting the salt value.

[0077] The process of generating a random salt value is very simple, but crucial. The following is a sample code snippet showing how to use Python's os.urandom() function to generate a 16-byte random salt value:

[0078] import os

[0079] def generate_random_salt():

[0080] return os.urandom(16)# Generate a 16-byte random salt value

[0081] In practical applications, the salt value must be both random and unique. Any reuse of the salt value may lead to security vulnerabilities, so it is recommended to generate a new salt value for each encryption operation.

[0082] S3: Randomly generate an initialization vector, and use the AES encryption mode to encrypt the plaintext data with the first key to obtain encrypted ciphertext data.

[0083] In a specific embodiment, an encryption operation is first initiated, and an initialization vector of 16 bytes is generated by a secure random number generator. Then, the plaintext data is encrypted using the first key in the CBC encryption mode or the GCM encryption mode to obtain the encrypted ciphertext data.

[0084] It's important to note that in this method, the initialization vector (IV) is a crucial component of the AES encryption mode, particularly in CBC (CipherBlockChaining) mode. The IV's primary function is to ensure that even identical plaintext and key combinations produce different ciphertexts, thereby preventing mode leaks and replay attacks.

[0085] In this method, a new random IV is generated for each encryption operation. This IV is not only used during the encryption process but is also stored as part of the metadata in the final encrypted data. This allows the IV to be extracted during decryption to correctly decrypt the data.

[0086] The process of generating a random IV is similar to generating a salt value. Here is a sample code snippet showing how to use Python's os.urandom() function to generate a 16-byte random IV:

[0087] def generate_random_iv():

[0088] return os.urandom(16)# Generate 16 bytes of random IV

[0089] It is important to note that the IV must remain random and unique. Any reuse of the IV may lead to serious security issues, so it is recommended to generate a new IV for each encryption operation.

[0090] S4: Execute message authentication code calculation on the ciphertext data, the initialization vector and the salt value using the second key to generate an HMAC check value.

[0091] In a specific implementation, the ciphertext data, the initialization vector and the salt value are first concatenated to generate concatenated data; then the second key is used as the authentication key, and the SHA-256 hash algorithm is used to perform a hash operation on the concatenated data to generate an HMAC check value.

[0092] For example, the Message Authentication Code (HMAC) is an important mechanism used in this method to ensure data integrity and authenticity. By adding an HMAC checksum to the encrypted data, man-in-the-middle attacks and data tampering can be effectively prevented.

[0093] In this step, the HMAC calculation process is as follows:

[0094] Use a key derivation function to generate two keys: an encryption key and an HMAC key.

[0095] Hash the encrypted data, IV, and salt to generate an HMAC checksum.

[0096] Store the HMAC checksum as part of the metadata in the final encrypted data.

[0097] S5: Combine the salt value, initialization vector, ciphertext data and HMAC check value into the final output encrypted data packet.

[0098] In a specific embodiment, the format of the encrypted data packet is as follows:

[0099] [ Salt (16 bytes) || IV (16 bytes) || Ciphertext (n bytes) || HMAC (32 bytes) ];

[0100] Where Salt is a randomly generated salt value, IV is the initialization vector, Ciphertext is the ciphertext after AES encryption, and HMAC is the HMAC-SHA256 checksum.

[0101] For example, the output format of this step is designed to ensure that all necessary metadata are properly preserved so that the original data can be correctly restored during decryption. The output format should contain the following information:

[0102] Salt: Random data used for key derivation.

[0103] Initialization Vector (IV): Random data used in the encryption process.

[0104] Encrypted data: ciphertext after AES encryption.

[0105] HMAC checksum: A checksum used to verify data integrity and authenticity.

[0106] The following is a sample output format:

[0107] encrypted_data = salt || iv || ciphertext || hmac_value

[0108] This format is not only concise and clear, but also easy to parse and process. To further optimize the output format, you can consider compressing or encoding each part to reduce transmission and storage overhead.

[0109] In addition, it should be noted that, based on the above data enhancement encryption method, the present invention also discloses a data decryption process.

[0110] The decryption process consists of the following steps:

[0111] a) Extract the Salt, IV, Ciphertext, and HMAC from the encrypted data packet; b) Use the same password and Salt to derive the master key and HMAC key again; c) Recalculate the HMAC for the extracted Ciphertext, IV, and Salt and compare it with the original HMAC; d) If the HMAC verification passes, decrypt the Ciphertext using the master key and IV to obtain the original plaintext; e) Otherwise, throw an exception and terminate the decryption operation.

[0112] In this embodiment, by deriving a key from a user password and a random salt value, randomly generating an initialization vector, using AES to encrypt plaintext data, generating an HMAC check value in combination with a message authentication code, and combining the salt value, initialization vector, ciphertext data, and HMAC check value into an encrypted data packet, the security of key derivation can be enhanced, the confidentiality of encrypted data can be guaranteed, and data integrity can be ensured. In addition, the security and reliability of the overall encryption scheme can be improved by specifying the number of iterations and using a secure random number generator.

[0113] like Figure 2 As shown, the following is an embodiment of the AES-based data enhancement encryption system provided by the embodiment of the present disclosure. This system and the AES-based data enhancement encryption method of the above-mentioned embodiments belong to the same inventive concept. For details not fully described in the embodiment of the AES-based data enhancement encryption system, please refer to the embodiment of the above-mentioned AES-based data enhancement encryption method.

[0114] A data enhancement encryption system based on AES includes: a data receiving module, a key generating module, a data encryption module, a check value calculating module and a data combination output module.

[0115] The data receiving module is used to receive the plaintext data to be encrypted and the password provided by the user.

[0116] A key generation module is used to derive a first key and a second key from the password and a randomly generated salt value using a key derivation function; the first key is a master key, and the second key is an HMAC key used for integrity verification.

[0117] The data encryption module is used to randomly generate an initialization vector and use the AES encryption mode to encrypt the plaintext data with the first key to obtain the encrypted ciphertext data.

[0118] The check value calculation module is used to perform message authentication code calculation on the ciphertext data, the initialization vector and the salt value using the second key to generate an HMAC check value.

[0119] The data combination output module is used to combine the salt value, initialization vector, ciphertext data and HMAC check value into the final output encrypted data packet.

[0120] The AES-based data-enhanced encryption system provided in this embodiment encrypts plaintext data using the AES encryption mode by deriving a key from the user password and a random salt value. The HMAC key is then used to calculate a checksum between the ciphertext data, the initialization vector, and the salt value, ultimately forming an encrypted data packet. This system enhances the security and integrity of data encryption. The random salt and iteratively derived key effectively resist brute force attacks, while the HMAC checksum ensures that data has not been tampered with. It also supports multiple encryption modes and hash algorithms, enhancing encryption flexibility and reliability.

[0121] Figure 3 A schematic diagram of the hardware structure of an electronic device for implementing various embodiments of the present invention.

[0122] The AES-based data enhancement encryption method provided in the embodiments of the present application can be applied to electronic devices. Those skilled in the art will understand that the electronic device structure involved in the embodiments of the present invention does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange components differently. In the embodiments of the present invention, electronic devices include but are not limited to laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments of the present application described and / or required herein.

[0123] The electronic device may include a processor, an external memory interface, an internal memory, a universal serial bus (USB) interface, a charging management module, a power management module, a battery, a wireless communication module, an audio module, a speaker, a microphone, a sensor module, a button, a camera, a display, and a SIM card interface, etc.

[0124] A processor may include one or more processing units, such as a central processing unit (CPU), an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU). Different processing units may be independent devices or integrated into one or more processors.

[0125] The processor can be the nerve center and command center of the electronic device. The controller can generate operation control signals based on the instruction opcode and timing signal to complete the control of instruction fetching and execution.

[0126] The processor may also include a memory for storing instructions and data. In some embodiments, the memory in the processor is a cache memory. This memory can store instructions or data that the processor has just used or is reusing. If the processor needs to use the instruction or data again, it can directly call it from the memory. This avoids repeated accesses, reduces processor latency, and thus improves system efficiency.

[0127] The external memory interface can be used to connect an external memory card, such as a MicroSD card, to expand the storage capacity of an electronic device. The external memory card communicates with the processor through the external memory interface, enabling data storage. For example, files such as music and videos can be stored on the external memory card.

[0128] Internal memory can be used to store computer-executable program code, which includes instructions. The processor executes the instructions stored in the internal memory to perform various functional applications and data processing of the electronic device. The internal memory can include a program storage area and a data storage area. The internal memory can include high-speed random access memory and non-volatile memory, such as at least one disk storage device, flash memory device, universal flash storage (UFS), etc.

[0129] The wireless communication function of an electronic device can be implemented through an antenna, a wireless communication module, a modem processor, and a baseband processor.

[0130] Wireless communication modules can provide wireless communication solutions for electronic devices, including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared technology (IR), etc.

[0131] Electronic devices can implement audio functions through audio modules, speakers, receivers, microphones, headphone jacks, and application processors.

[0132] Electronic devices can achieve shooting functions through ISP, camera, video codec, GPU, display and application processor.

[0133] Electronic devices can achieve display functions through GPU, display screen and application processor.

[0134] A GPU is a microprocessor for image processing that connects the display screen to the application processor. The GPU performs mathematical and geometric calculations for graphics rendering. A processor may include one or more GPUs, which execute program instructions to generate or modify display information.

[0135] The display screen is used to display images, videos, etc. The display screen includes a display panel.

[0136] The above-mentioned electronic device implements the data enhancement encryption method based on AES of the present application by deriving a master key and an HMAC key for integrity verification from the password provided by the user and a randomly generated salt value, randomly generating an initialization vector and encrypting the plaintext data using the AES encryption mode, performing a message authentication code calculation on the ciphertext data, the initialization vector and the salt value using the HMAC key to generate a verification value, and finally combining this information into an encrypted data packet, thereby achieving the beneficial effects of enhancing the security of the encryption process, protecting the confidentiality of the encrypted data and ensuring the integrity of the data.

[0137] The storage medium provided in this application stores a program product that can implement the AES-based data enhancement encryption method.

[0138] AES-based data enhancement encryption methods include:

[0139] Receive the plaintext data to be encrypted and the password provided by the user;

[0140] deriving a first key and a second key from the password and a randomly generated salt value using a key derivation function; the first key is a master key, and the second key is an HMAC key for integrity verification;

[0141] Randomly generate an initialization vector, and use the AES encryption mode to encrypt the plaintext data with the first key to obtain encrypted ciphertext data;

[0142] Performing a message authentication code calculation on the ciphertext data, the initialization vector, and the salt value using the second key to generate an HMAC check value;

[0143] The salt value, initialization vector, ciphertext data and HMAC check value are combined into the encrypted data packet that is finally output.

[0144] In some possible implementations, the AES-based data enhancement encryption method disclosed herein can be implemented in the form of a program product, which includes program code. When the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps described in the above "Exemplary Method" section of this specification according to various exemplary implementations of the present disclosure.

[0145] The storage medium of the present disclosure can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, a system, device or component of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0146] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data enhancement encryption method based on AES, characterized in that: include: Receive the plaintext data to be encrypted and the password provided by the user; deriving a first key and a second key from the password and a randomly generated salt value using a key derivation function; The first key is a master key, and the second key is an HMAC key used for integrity verification; Randomly generate an initialization vector, and use the AES encryption mode to encrypt the plaintext data with the first key to obtain encrypted ciphertext data; Performing a message authentication code calculation on the ciphertext data, the initialization vector, and the salt value using the second key to generate an HMAC check value; The salt value, initialization vector, ciphertext data and HMAC check value are combined into an encrypted data packet for final output; The deriving of the first key and the second key from the password and the randomly generated salt value by using a key derivation function includes: Using a PBKDF2 function or an Argon2 function, with the password and a randomly generated salt value as input, repeatedly executing a hash algorithm for a specified number of iterations to derive a first key and a second key; The randomly generated initialization vector and the plaintext data are encrypted using the first key in the AES encryption mode to obtain the encrypted ciphertext data, including: Start the encryption operation and randomly generate an initialization vector; Encrypt the plaintext data using the first key using the CBC encryption mode or the GCM encryption mode to obtain encrypted ciphertext data; The performing message authentication code calculation on the ciphertext data, the initialization vector, and the salt value by using the second key to generate an HMAC check value includes: Splicing the ciphertext data, the initialization vector, and the salt value to generate spliced ​​data; Use the second key as the authentication key and use the SHA-256 hash algorithm to perform a hash operation on the spliced ​​data to generate an HMAC check value; The step of combining the salt value, the initialization vector, the ciphertext data, and the HMAC check value into a final output encrypted data packet includes: The salt value, initialization vector, ciphertext data and HMAC check value are combined to generate an encrypted data packet in the following format: [Salt||IV||Ciphertext||HMAC]; Among them, Salt is the salt value, IV is the initialization vector, Ciphertext is the ciphertext data, and HMAC is the check value.

2. The AES-based data enhancement encryption method according to claim 1, characterized in that: The receiving of the plaintext data to be encrypted and the password provided by the user includes: Obtaining plaintext data to be encrypted based on the text or file to be encrypted; Receives the password string entered by the user and is used to generate the encryption key.

3. The AES-based data enhancement encryption method according to claim 1, characterized in that: The specified number of iterations is no less than 100,000 times; the salt value and initialization vector are generated by a secure random number generator, and both have a length of 16 bytes.

4. A data enhancement encryption system based on AES, characterized in that: The system adopts the AES-based data enhancement encryption method as claimed in any one of claims 1 to 3; The system comprises: A data receiving module, used to receive the plaintext data to be encrypted and the password provided by the user; A key generation module, configured to derive a first key and a second key from the password and a randomly generated salt value using a key derivation function; the first key is a master key, and the second key is an HMAC key for integrity verification; A data encryption module is used to randomly generate an initialization vector and encrypt the plaintext data using the first key in the AES encryption mode to obtain encrypted ciphertext data; A check value calculation module is used to perform message authentication code calculation on the ciphertext data, the initialization vector and the salt value using the second key to generate an HMAC check value; The data combination output module is used to combine the salt value, initialization vector, ciphertext data and HMAC check value into the final output encrypted data packet.

5. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the AES-based data enhancement encryption method according to any one of claims 1 to 3 are implemented.

6. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the AES-based data enhancement encryption method according to any one of claims 1 to 3 are implemented.

Images