Data processing method and device, electronic equipment, chip and storage medium
By receiving and deriving keys based on version numbers, the problem of data leakage in the device system is solved, and the secure binding and flexible decryption of business data is realized.
Patent Information
- Application Number
- CN202410362278.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-03-27
- Publication Date
- 2025-07-25
AI Technical Summary
There are security vulnerabilities in the equipment system, resulting in information and data leakage. It is difficult for the existing technology to effectively bind business data and version numbers, and it is impossible to ensure data security and decryption flexibility.
By receiving the target service key and version number sent by the second device, using the version number for key derivation, obtaining the second service key, and key encapsulate the first service key based on the second service key, generating a key ciphertext, and binding the service key and version number is realized.
Even if there are security vulnerabilities, the updated version number cannot obtain the target business data, ensuring the security of the business data and improving the flexibility of data decryption.
Smart Images
Figure CN120378129A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field of key security, and particularly to a data processing method, apparatus, electronic device, chip and storage medium. Background Art
[0002] Since there are many data assets in the device system, such as digital currency, privacy data, etc. To prevent data from being attacked, secure boot technology can be used. During the boot phase, cryptographic signature verification is performed on the system image. When the signature of the image is valid, the image can be executed; otherwise, the image cannot be executed and the boot process terminates. However, when there are security vulnerabilities in the images running on the device, when the vulnerabilities are exploited, the information and data in the device may be leaked. Summary of the Invention
[0003] The present application aims to at least solve one of the technical problems in the related art to some extent.
[0004] To this end, the first object of the present application is to propose a data processing method to bind the target service to the current version number, ensuring the security of service data. At the same time, encryption and decryption are performed based on the version number, improving the flexibility of data decryption.
[0005] The second object of the present application is to propose a data processing apparatus.
[0006] The third object of the present application is to propose an electronic device.
[0007] The fourth object of the present application is to propose a computer-readable storage medium.
[0008] The fifth object of the present application is to propose a computer program product.
[0009] To achieve the above object, an embodiment of the first aspect of the present application proposes a data processing method, including: receiving a first service key and a version number of a target service sent by a second device; obtaining a second service key of the target service according to the version number; performing key encapsulation on the first service key based on the second service key to obtain a key ciphertext of the first service key; and sending the key ciphertext of the first service key to the second device.
[0010] To achieve the above object, an embodiment of the first aspect of the present application proposes another data processing method, including: receiving a service data ciphertext, a key ciphertext of a first service key and a version number sent by a second device; performing key de-encapsulation on the key ciphertext according to the version number to obtain the first service key; and decrypting the service data ciphertext based on the first service key to obtain service data.
[0011] To achieve the above object, an embodiment of the first aspect of the present application provides another data processing method, including: sending a first service key and a version number of a target service to a first device; receiving a key ciphertext of the first service key sent by the first device; encrypting service data based on the first service key to obtain a service data ciphertext; and sending the version number, the key ciphertext of the first service key, and the service data ciphertext to a user device.
[0012] To achieve the above object, an embodiment of the second aspect of the present application provides a data processing apparatus, including: a receiving module, configured to receive a first service key and a version number of a target service sent by a second device; an obtaining module, configured to obtain a second service key of the target service according to the version number; a packaging module, configured to perform key packaging on the first service key based on the second service key to obtain a key ciphertext of the first service key; and a sending module, configured to send the key ciphertext of the first service key to the second device.
[0013] To achieve the above object, an embodiment of the second aspect of the present application provides another data processing apparatus, including: a receiving module, configured to receive a service data ciphertext, a key ciphertext of a first service key, and a version number sent by a second device; a de-packaging module, configured to perform key de-packaging on the key ciphertext according to the version number to obtain the first service key; and a decryption module, configured to decrypt the service data ciphertext based on the first service key to obtain service data.
[0014] To achieve the above object, an embodiment of the second aspect of the present application provides another data processing apparatus, including: a first sending module, configured to send a first service key and a version number of a target service to a first device; a receiving module, configured to receive a key ciphertext of the first service key sent by the first device; an encrypting module, configured to encrypt service data based on the first service key to obtain a service data ciphertext; and a second sending module, configured to send the version number, the key ciphertext of the first service key, and the service data ciphertext to a user device.
[0015] To achieve the above object, an embodiment of the third aspect of the present application provides an electronic device, including: a processor; and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory, so that the processor can execute the data processing method described in the embodiment of the first aspect above.
[0016] To achieve the above object, an embodiment of the fourth aspect of the present application provides a computer-readable storage medium, on which a computer program is stored, and the computer instructions are used to cause the computer to execute the data processing method described in the embodiment of the above aspect.
[0017] To achieve the above object, an embodiment of the fifth aspect of the present application provides a chip, including at least one processor and a communication interface; the communication interface is configured to receive signals input to the chip or signals output from the chip, and the processor communicates with the communication interface and implements the data processing method described in the first aspect through a logic circuit or by executing code instructions.
[0018] The data processing method, apparatus, electronic device, chip, and storage medium provided in the present application receive the first service key and version number of the target service sent by the second device, perform key derivation on the root key according to the version number to obtain the second service key of the target service. Then, use the second service key to perform key encapsulation on the first service key to obtain the key ciphertext of the first service key, and send the key ciphertext to the second device. Obtaining the second service key based on the version number can associate the service key with the version number, realizing the binding of the target service to the current version number. Since the version number is continuously updated, even if there is a security vulnerability, the target service data cannot be obtained according to the updated version number, ensuring the security of the service data. At the same time, encryption and decryption are performed based on the version number, improving the flexibility of data decryption.
[0019] Additional aspects and advantages of the present application will be given in part in the following description, become apparent in part from the following description, or be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS
[0020] The above and / or additional aspects and advantages of the present application will become apparent and be readily understood from the following description of the embodiments in conjunction with the drawings, where:
[0021] Figure 1 is a schematic flowchart of a data processing method provided by an embodiment of the present application;
[0022] Figure 2 is a schematic flowchart of another data processing method provided by an embodiment of the present application;
[0023] Figure 3 is a schematic flowchart of the first device generating the key ciphertext of the first service key provided by an embodiment of the present application;
[0024] Figure 4 is a schematic flowchart of another data processing method provided by an embodiment of the present application;
[0025] Figure 5 is a schematic flowchart of another data processing method provided by an embodiment of the present application;
[0026] Figure 6 is a schematic flowchart of the user equipment obtaining service data provided by an embodiment of the present application;
[0027] Figure 7 Schematic flowchart of another data processing method provided by an embodiment of the present application;
[0028] Figure 8 Interaction schematic diagram of a data processing method provided by an embodiment of the present application;
[0029] Figure 9 Schematic structural diagram of a data processing device provided by an embodiment of the present application;
[0030] Figure 10 Schematic structural diagram of another data processing device provided by an embodiment of the present application;
[0031] Figure 11 Schematic structural diagram of another data processing device provided by an embodiment of the present application. Detailed implementation manners
[0032] The embodiments of the present application will be described in detail below. Examples of the embodiments are shown in the accompanying drawings, where the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to explain the present application, but should not be construed as limiting the present application.
[0033] The data processing method and device of the embodiments of the present application will be described below with reference to the accompanying drawings.
[0034] Figure 1 is a flowchart of a data processing method shown according to an exemplary embodiment. The data processing method can be executed by a first device. As Figure 1 shown, the data processing method of the embodiments of the present application includes but is not limited to the following steps:
[0035] S101: Receive the first service key and version number of the target service sent by the second device.
[0036] It should be noted that the execution subject of the data processing method provided by the embodiments of the present application is an electronic device, and the electronic device can be a terminal device. Optionally, the terminal device can be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device can be a mobile phone, a tablet computer, a notebook computer, a handheld computer, an in-vehicle electronic device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc., and the non-mobile electronic device can be a personal computer (PC), a television, etc. The embodiments of the present application do not make specific limitations.
[0037] The first device in the embodiments of this application may be an electronic device of an Original Equipment Manufacturer (OEM) that receives a target service, and the second device may be an electronic device of a service provider that provides the target service.
[0038] In some implementations, the first service key of the target service refers to the key used to encrypt the service data of the target service, and the second device encrypts the service data. The first device can encapsulate the first service key of the target service by receiving the first service key and version number sent by the second device, thereby improving the security of the key. Among them, the version number is determined by the version of the target service, and the version number is usually represented in the form of numbers. For example, version 1.0, version 2.1, etc.
[0039] In some implementations, to ensure the security of data transmission, a dedicated communication link can be established between the first device and the second device in advance. That is to say, this communication link is used for data transmission between the first device and the second device. The first device can receive the first service key and version number of the target service sent by the second device based on this communication link.
[0040] S102. Obtain the second service key of the target service according to the version number.
[0041] In some implementations, the root key of the first device can be derived to obtain the second service key of the target service according to the version number. A Key Derivation Function (KDF) can be used to perform key derivation to obtain the second service key of the target service.
[0042] It can be understood that the root key is stored in the local memory of the device, and the root key is related to the type of the device. The root keys of devices of the same type are the same. Key derivation is the process of generating new keys through specific algorithms using one or more initial keys and perturbation factors. This process involves using KDF to generate new keys from existing keys.
[0043] Optionally, the version number can be used as the perturbation factor for key derivation, and the version number and the root key are input into the KDF to implement key derivation of the root key to obtain the second service key.
[0044] S103. Perform key encapsulation on the first service key based on the second service key to obtain the key ciphertext of the first service key.
[0045] In some implementations, key encapsulation is performed on the first service key based on the second service key, that is, the first service key is encrypted using the second service key to obtain the encrypted first service key, which is the key ciphertext of the first service key.
[0046] Optionally, an encryption algorithm can be used to encrypt the first service key based on the second service key. For example, an asymmetric encryption algorithm can be used to encrypt the first service key using the second service key to obtain the key ciphertext of the first service key.
[0047] S104. Send the key ciphertext of the first service key to the second device.
[0048] In some implementations, after the first device performs key encapsulation on the first service key to obtain the key ciphertext of the first service key, the key ciphertext of the first service key can be sent to the second device based on the pre-established communication link between the first device and the second device.
[0049] In the data processing method provided by the embodiments of the present application, the first device receives the first service key and version number of the target service sent by the second device, and performs key derivation on the root key according to the version number to obtain the second service key of the target service. Then, the second service key is used to perform key encapsulation on the first service key to obtain the key ciphertext of the first service key, and the key ciphertext is sent to the second device. Obtaining the second service key based on the version number can associate the service key with the version number, realizing the binding of the target service to the current version number. Since the version number is updated continuously, even if there is a security vulnerability, the target service data cannot be obtained according to the updated version number, ensuring the security of the service data. At the same time, encryption and decryption are performed based on the version number, improving the flexibility of data decryption.
[0050] Figure 2 is a flowchart of a data processing method shown according to an exemplary embodiment. The data processing method can be executed by the first device. As Figure 2 shown, the data processing method of the embodiments of the present application includes but is not limited to the following steps:
[0051] S201. Receive the first service key and version number of the target service sent by the second device.
[0052] In the embodiments of the present application, the implementation manner of step S201 can be implemented by any one of the embodiments of the present application, and no limitation is made here and will not be elaborated further.
[0053] S202. Obtain the root key stored locally, and obtain the second service key of the target service according to the root key and the version number.
[0054] In some implementations, the root key is stored in the local memory of the device. By reading the local memory, the root key can be obtained. Further, the version number is determined as an interference factor for key derivation, and key derivation is performed on the root key based on the interference factor to obtain the second service key.
[0055] Optionally, a KDF can be used to perform key derivation on the root key to obtain the second service key. By inputting the interference factor and the root key into the KDF, the KDF performs key derivation and outputs the second service key.
[0056] S203, perform key encapsulation on the first service key based on the second service key to obtain the key ciphertext of the first service key.
[0057] In the embodiments of the present application, the implementation manner of step S203 can be implemented by any one of the embodiments of the present application respectively, and no limitation is made here and will not be elaborated.
[0058] S204, send the key ciphertext of the first service key to the second device.
[0059] In the embodiments of the present application, the implementation manner of step S204 can be implemented by any one of the embodiments of the present application respectively, and no limitation is made here and will not be elaborated.
[0060] In the data processing method provided by the embodiments of the present application, the first device receives the first service key and the version number of the target service sent by the second device, obtains the root key stored locally, and performs key derivation on the root key using the version number as an interference factor to obtain the second service key of the target service. Then, the second service key is used to perform key encapsulation on the first service key to obtain the key ciphertext of the first service key, and the key ciphertext is sent to the second device. Obtaining the second service key based on the version number can associate the service key with the version number, realizing the binding of the target service to the current version number. Since the version number is constantly updated, even if there is a security vulnerability, the target service data cannot be obtained based on the updated version number, ensuring the security of the service data. At the same time, encryption and decryption are performed based on the version number, improving the flexibility of data decryption.
[0061] An encryption machine is provided in the first device, and the steps related to encryption can be executed by the encryption machine. For example, the encryption machine can execute the encryption of the service data of the target service; it can also execute the key derivation of the root key; it can also execute the encryption of the first service key.
[0062] Such as Figure 3Flowchart of the first device generating the ciphertext of the first service key. The second device sends the version number and the first service key (KEY_service1) to the first device of the OEM based on the communication link. The first device reads the local memory to obtain the root key (OEM_PFK), uses the version number as the interference factor, and performs key derivation on the root key using KDF to obtain the second service key (KEK_service1). Further, the first device uses the second service key to perform key encapsulation on the first service key to obtain the ciphertext of the first service key (KEY_service1 ciphertext), and sends the ciphertext to the second device. Then the second device can finally obtain the version number, the ciphertext of the first service key, and the ciphertext of the service data encrypted with the first service key for the target service.
[0063] Figure 4 is a flowchart of a data processing method shown according to an exemplary embodiment. The data processing method can be executed by a user device. As Figure 4 shown, the data processing method of the embodiments of the present application includes but is not limited to the following steps:
[0064] S401, receive the ciphertext of the service data, the ciphertext of the first service key, and the version number sent by the second device.
[0065] In some implementations, the user device can receive the ciphertext of the service data, the ciphertext of the first service key, and the version number sent by the second device. Among them, the ciphertext of the service data is obtained by the second device encrypting the target service with the first service key, the version number is determined by the version of the target service, and the ciphertext of the first service key is encrypted by the first device.
[0066] S402, perform key de-encapsulation on the ciphertext according to the version number to obtain the first service key.
[0067] In some implementations, the ciphertext of the service key is obtained by the second service key performing key encapsulation on the first service key. Key derivation can be performed on the ciphertext of the service key to obtain the second service key, and based on the second service key, the ciphertext of the service key can be de-encapsulated to obtain the first service key.
[0068] Optionally, the root key can be obtained, and the root key can be used as the key. According to the version number, key derivation is performed on the ciphertext of the service key to obtain the second service key. Then, a decryption operation is performed on the ciphertext of the service key to obtain the first service key.
[0069] S403, decrypt the ciphertext of the service data based on the first service key to obtain the service data.
[0070] In some implementations, the ciphertext of the service data is obtained by the second device encrypting the data of the target service using the first service key. The service data can be decrypted using the first service key to obtain the service data.
[0071] Optionally, the ciphertext of the service data can be decrypted based on the algorithm used for the service data encryption operation using the first service key, thereby obtaining the service data.
[0072] In the data processing method provided by the embodiments of the present application, the user device receives the ciphertext of the service data, the ciphertext of the key of the first service key, and the version number sent by the second device, and based on the version number, unpacks the ciphertext of the key, and can obtain the first service key when encrypting the service data from the ciphertext of the key, and then can use the first service key to decrypt the ciphertext of the service data to obtain the service data. Using the version number for key encapsulation and unpacking improves the security of the key and further ensures the security of the service data. At the same time, encryption and decryption based on the version number improves the flexibility of data decryption.
[0073] Figure 5 is a flowchart of a data processing method shown according to an exemplary embodiment. This data processing method can be executed by a user device. As Figure 5 shown, the data processing method of the embodiments of the present application includes but is not limited to the following steps:
[0074] S501, receive the ciphertext of the service data, the ciphertext of the key of the first service key, and the version number sent by the second device.
[0075] In the embodiments of the present application, the implementation manner of step S501 can be implemented in any one of the embodiments of the present application, and no limitation is made here and will not be elaborated further.
[0076] S502, obtain the root key and the non-volatile storage NV value stored locally.
[0077] In some implementations, based on the root key, the version number, and the non-volatile storage (Nonvolatile Memory, NV) value, key derivation can be performed on the ciphertext of the key of the first service key to obtain the second service key.
[0078] It can be understood that the NV value refers to setting a version counter (NVcounter) in the memory of the device to ensure that the version will not roll back to the old version after the version is updated. Among them, the NV value is updated based on the image, and the NV value can only increase and cannot decrease. When the version number in the image is greater than or equal to the NV value, the image can pass the security verification and can be installed on the device to prevent the device from installing an old version of the image.
[0079] In some implementations, the root key and the NV value are stored in a memory, and the second device cannot directly access the target memory storing the root key and the NV value. The root key and the NV value can be read by invoking the corresponding function. Optionally, the root key and the NV value can be read from the target memory through the Key Manage (KM) hardware unit of the user device.
[0080] S503. Obtain a second service key according to the NV value, the version number, and the root key.
[0081] In some implementations, the user device can perform key derivation in the KM hardware unit to obtain the second service key. Optionally, after receiving the version number sent by the second device, the user device can configure the version number in the KM hardware unit through the Central Processing Unit (CPU) in the user device.
[0082] In some implementations, the interference factor for key derivation can be determined from the NV value and the version number, and then multi-level key derivation is performed on the root key to obtain the second service key. Optionally, the minimum value in the NV value and the version number is determined as the interference factor for key derivation through the KM hardware unit of the user device, and multi-level key derivation is performed on the root key based on the interference factor to obtain the second service key.
[0083] S504. Perform key de-encapsulation on the key ciphertext of the first service key based on the second service key to obtain the first service key.
[0084] In some implementations, the decryption algorithm can be determined based on the encryption algorithm used by the first device for key encapsulation of the first service key. Then, based on this decryption algorithm, the user device can decrypt the key ciphertext of the first service key using the second service key to obtain the first service key.
[0085] S505. Decrypt the service data ciphertext based on the first service key to obtain the service data.
[0086] In the embodiments of the present application, the implementation manner of step S505 can be implemented by any one of the embodiments of the present application respectively, and no limitation is made here and no further description is given.
[0087] In the data processing method provided by the embodiment of the present application, the user equipment receives the ciphertext of service data, the ciphertext of the key of the first service key and the version number sent by the second device, obtains the root key and the NV value, determines the interference factor for key derivation from the NV value and the version number, and performs multi-level key derivation on the root key to obtain the second service key. Further, based on the second service key, the ciphertext of the key is unpacked, the first service key used for encrypting the service data can be obtained from the ciphertext of the key, and then the first service key can be used to decrypt the ciphertext of the service data to obtain the service data. Using the version number for key encapsulation and unpacking improves the security of the key and further ensures the security of the service data. The decryption process of the second service key is completed in the KM hardware unit. Even if there are vulnerabilities in the software, other devices cannot obtain the second service key, which ensures the security of the key. At the same time, encryption and decryption based on the version number improve the flexibility of data decryption.
[0088] A system-on-chip (SOC) is a circuit that integrates the key components of a system on a single chip and can implement the functions of a complete system. Such chips play a core role in user equipment such as mobile phones, tablets, and smart home appliances. As a possible implementation, as Figures 4 - 5 shown in the embodiment, it can be executed by the SOC chip in the user equipment.
[0089] As Figure 6 shown is a flowchart of the user equipment obtaining service data. The second device sends the ciphertext of service data, the ciphertext of the key of the first service key (KEY_SERVICE1 ciphertext), and the version number to the user equipment. The user equipment configures the version number into the KM hardware unit. The KM hardware unit obtains the NV value and the root key (OEM_PFK) from the target memory (efuse), determines the minimum value from the NV value and the version number as the interference factor for key derivation, and uses the interference factor to perform multi-level key derivation on the root key based on KDF to obtain the second service key (KEK_SERVICE1). Further, the user equipment uses the second service key to unpack the ciphertext of the key of the first service key to obtain the first service key (KEY_SERVICE1), and uses the first service key to decrypt the ciphertext of the service data to obtain the service data.
[0090] Figure 7 is a flowchart of a data processing method shown according to an exemplary embodiment. The data processing method can be executed by the second device. As Figure 7 shown, the data processing method of the embodiment of the present application includes but is not limited to the following steps:
[0091] S701, send the first service key and the version number of the target service to the first device.
[0092] S702. Receive the ciphertext of the first service key sent by the first device.
[0093] In some implementations, the second device may send the first service key and the version number of the target service to the first device. The first device performs key encapsulation on the first service key to obtain the ciphertext of the first service key, and the second device receives the ciphertext of the first service key sent by the first device.
[0094] In some implementations, to ensure the security of data transmission, a dedicated communication link may be established between the first device and the second device in advance. That is to say, this communication link is used for data transmission between the first device and the second device. The second device may send the first service key and the version number to the first device based on this communication link, and receive the ciphertext of the first service key sent by the first device.
[0095] S703. Encrypt the service data based on the first service key to obtain the ciphertext of the service data.
[0096] In some implementations, the second device may encrypt the service data using the first service key based on the encryption algorithm to obtain the ciphertext of the service data. For example, a symmetric encryption algorithm may be used to encrypt the service data to obtain the ciphertext of the service data.
[0097] S704. Send the version number, the ciphertext of the first service key, and the ciphertext of the service data to the user device.
[0098] In some implementations, by sending the first service key and the version number to the first device, the second device can obtain the ciphertext of the first service key, and then send the ciphertext of the key, the version number, and the ciphertext of the service data to the user device. The user device can decrypt the ciphertext of the service data based on the ciphertext of the key and the version number to finally obtain the service data.
[0099] In the data processing method provided by the embodiments of the present application, the second device can obtain the ciphertext of the first service key sent by the first device by sending the first service key and the version number of the target service to the first device. The second device encrypts the service data to obtain the ciphertext of the service data, and sends the version number, the ciphertext of the first service key, and the ciphertext of the service data to the user device. The user device decrypts the ciphertext of the service data to finally obtain the service data. By associating the service key with the version number, the target service is bound to the current version number. Since the version number is updated continuously, even if there is a security vulnerability, the target service data cannot be obtained according to the updated version number, which ensures the security of the service data. At the same time, encryption and decryption are performed based on the version number, which improves the flexibility of data decryption.
[0100] Figure 8An interaction diagram of a data processing method shown according to an exemplary embodiment, as Figure 8 shown, the data processing method of the embodiments of the present application includes, but is not limited to, the following steps:
[0101] S801, the second device sends a first service password and a version number to the first device.
[0102] S802, the first device obtains a second service key according to the version number.
[0103] S803, the first device performs key encapsulation on the first service key based on the second service key to obtain a key ciphertext of the first service key.
[0104] S804, the first device sends the key ciphertext to the second device.
[0105] S805, the second device encrypts the service data based on the first service key to obtain a service data ciphertext.
[0106] S806, the second device sends the version number, the key ciphertext, and the service data ciphertext to the user device.
[0107] S807, the user device performs key de-encapsulation on the key ciphertext according to the version number to obtain the first service key.
[0108] S808, the user device decrypts the service data ciphertext based on the first service key to obtain the service data.
[0109] In the data processing method provided by the embodiments of the present application, the first device receives the first service key and the version number of the target service sent by the second device, performs key derivation on the root key according to the version number to obtain the second service key of the target service. Furthermore, the first service key is used to perform key encapsulation on the first service key to obtain a key ciphertext of the first service key, and the key ciphertext is sent to the second device. Obtaining the second service key based on the version number can associate the service key with the version number, realizing the binding of the target service to the current version number. Since the version number is updated continuously, even if there is a security vulnerability, the target service data cannot be obtained according to the updated version number, ensuring the security of the service data. At the same time, encryption and decryption are performed based on the version number, improving the flexibility of data decryption.
[0110] To implement the above embodiments, the present application also proposes a data processing device.
[0111] Figure 9 A structural schematic diagram of a data processing device provided by an embodiment of the present application.
[0112] As Figure 9 shown, the data processing device 900 includes:
[0113] A receiving module 901, configured to receive a first service key and a version number of a target service sent by a second device;
[0114] An obtaining module 902, configured to obtain a second service key of the target service according to the version number;
[0115] An encapsulating module 903, configured to perform key encapsulation on the first service key based on the second service key to obtain a key ciphertext of the first service key;
[0116] A sending module 904, configured to send the key ciphertext of the first service key to the second device.
[0117] In a possible implementation manner of the embodiment of the present application, the obtaining module 902 is further configured to: obtain a root key stored locally, and obtain the second service key of the target service according to the root key and the version number.
[0118] In a possible implementation manner of the embodiment of the present application, the obtaining module 902 is further configured to: determine the version number as an interference factor for key derivation; perform key derivation on the root key based on the interference factor to obtain the second service key.
[0119] In the data processing device provided in the embodiment of the present application, the first device receives the first service key and the version number of the target service sent by the second device, performs key derivation on the root key according to the version number to obtain the second service key of the target service. Then, the second service key is used to perform key encapsulation on the first service key to obtain the key ciphertext of the first service key, and the key ciphertext is sent to the second device. Obtaining the second service key based on the version number can associate the service key with the version number, implement binding the target service to the current version number. Since the version number is updated continuously, even if there is a security vulnerability, the target service data cannot be obtained according to the updated version number, ensuring the security of the service data. At the same time, encryption and decryption are performed based on the version number, improving the flexibility of data decryption.
[0120] To implement the above embodiment, the present application further proposes another data processing device.
[0121] Figure 10 It is a schematic structural diagram of a data processing device provided in an embodiment of the present application.
[0122] As Figure 10 shown, the data processing device 1000 includes:
[0123] A receiving module 1001, configured to receive a service data ciphertext, a key ciphertext of a first service key, and a version number sent by a second device;
[0124] The decapsulation module 1002 is used to perform key decapsulation on the key ciphertext according to the version number to obtain the first service key;
[0125] The decryption module 1003 is used to decrypt the service data ciphertext based on the first service key to obtain service data.
[0126] In a possible implementation manner of the embodiment of the present application, the decapsulation module 1002 is further used to: obtain the root key and the non-volatile storage NV value stored locally; obtain the second service key according to the NV value, the version number, and the root key; perform key decapsulation on the key ciphertext of the first service key based on the second service key to obtain the first service key.
[0127] In a possible implementation manner of the embodiment of the present application, the decapsulation module 1002 is further used to: determine the minimum value of the NV value and the version number as the interference factor for key derivation through the key management KM hardware unit of the user equipment, and perform multi-level key derivation on the root key based on the interference factor to obtain the second service key.
[0128] In a possible implementation manner of the embodiment of the present application, the decapsulation module 1002 is further used to: read the root key and the NV value from the target memory through the KM hardware unit of the user equipment.
[0129] In a possible implementation manner of the embodiment of the present application, the decapsulation module 1002 is further used to: configure the version number in the KM hardware unit through the central processing unit CPU in the user equipment.
[0130] In the data processing device provided in the embodiment of the present application, the user equipment receives the service data ciphertext, the key ciphertext of the first service key, and the version number sent by the second device, and performs decapsulation on the key ciphertext based on the version number, so as to obtain the first service key when encrypting the service data from the key ciphertext. Furthermore, the first service key can be used to decrypt the service data ciphertext to obtain the service data. Using the version number for key encapsulation and decapsulation improves the security of the key and further ensures the security of the service data. At the same time, encrypting and decrypting based on the version number improves the flexibility of data decryption.
[0131] To implement the above embodiment, the present application also proposes another data processing device.
[0132] Figure 11 It is a schematic structural diagram of a data processing device provided in an embodiment of the present application.
[0133] Such as Figure 11As shown in the figure, the data processing device 1100 includes:
[0134] A first sending module 1101, configured to send a first service key and a version number of a target service to a first device;
[0135] A receiving module 1102, configured to receive a ciphertext of the first service key sent by the first device;
[0136] An encryption module 1103, configured to encrypt service data based on the first service key to obtain a ciphertext of the service data;
[0137] A second sending module 1104, configured to send the version number, the ciphertext of the first service key, and the ciphertext of the service data to a user device.
[0138] In the data processing device provided in the embodiment of the present application, by sending the first service key and the version number of the target service to the first device, the second device can obtain the ciphertext of the first service key sent by the first device. The second device encrypts the service data to obtain a ciphertext of the service data, and sends the version number, the ciphertext of the first service key, and the ciphertext of the service data to the user device, and the user device decrypts the ciphertext of the service data to finally obtain the service data. By associating the service key with the version number, the target service is bound to the current version number. Since the version number is updated continuously, even if there is a security vulnerability, the target service data cannot be obtained according to the updated version number, ensuring the security of the service data. At the same time, encryption and decryption are performed based on the version number, improving the flexibility of data decryption.
[0139] It should be noted that the foregoing explanation of the data processing method embodiment also applies to the data processing device in this embodiment, and will not be elaborated here.
[0140] To implement the foregoing embodiment, the present application also provides an electronic device, including: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method provided in the foregoing embodiment.
[0141] To implement the foregoing embodiment, the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored, and when the computer-executable instructions are executed by a processor, they are used to implement the method provided in the foregoing embodiment.
[0142] To implement the foregoing embodiment, the present application also provides a computer program product, including a computer program, and when the computer program is executed by a processor, it implements the method provided in the foregoing embodiment.
[0143] To implement the above embodiments, the present application also proposes a chip, including at least one processor and a communication interface; the communication interface is used to receive signals input to the chip or signals output from the chip, and the processor communicates with the communication interface and implements the data processing method provided by the foregoing embodiments through logic circuits or by executing code instructions.
[0144] The collection, storage, use, processing, transmission, provision, and application of the user's personal information involved in the present application all comply with the provisions of relevant laws and regulations and do not violate public order and good customs.
[0145] It should be noted that personal information from users should be collected for legal and reasonable purposes and should not be shared or sold outside of these legal uses. In addition, such collection / sharing should be carried out after obtaining the informed consent of the user, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization including authorizing relevant user information before the user uses the function. In addition, any necessary steps should be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy policies and procedures.
[0146] The present application is expected to provide an implementation plan for users to selectively block the use or access of personal information data. That is, the present application is expected to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, the risk can be minimized by restricting data collection and deleting data. In addition, when applicable, personal identifiers are removed from such personal information to protect the privacy of users.
[0147] In the descriptions of the foregoing embodiments, the descriptions referring to terms such as "one embodiment", "some embodiments", "example", "specific example", or "some examples" mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic descriptions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, without contradiction, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.
[0148] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, features defined with "first" and "second" may explicitly or implicitly include at least one such feature. In the description of this application, "a plurality of" means at least two, such as two, three, etc., unless otherwise specifically and clearly defined.
[0149] Any process or method description represented in a flowchart or described otherwise herein can be understood to represent a module, segment, or portion of code including one or more executable instructions for implementing a customized logical function or process. The scope of the preferred embodiments of this application includes additional implementations, where functions may be executed in a substantially simultaneous manner or in an order opposite to that shown or discussed, according to the functions involved, which should be understood by those skilled in the technical field to which the embodiments of this application pertain.
[0150] The logic and / or steps represented in a flowchart or described otherwise herein, for example, can be considered a sequenced list of executable instructions for implementing a logical function, which can be specifically implemented in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, a system including a processor, or other systems that can fetch and execute instructions from the instruction execution system, apparatus, or device. For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of the computer-readable medium include the following: an electrical connection portion with one or more wirings (electronic device), a portable computer diskette (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpretation, or otherwise processing as appropriate, and then stored in a computer memory.
[0151] It should be understood that each part of the present application can be implemented by hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, any one of the following techniques known in the art or a combination thereof can be used: discrete logic circuits with logic gate circuits for implementing logic functions on data signals, application-specific integrated circuits with suitable combinational logic gate circuits, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.
[0152] Those of ordinary skill in the art can understand that all or part of the steps carried by the method of the above embodiments can be completed by instructing relevant hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.
[0153] In addition, in each embodiment of the present application, each functional unit can be integrated into a processing module, or each unit can exist physically alone, or two or more units can be integrated into one module. The above integrated module can be implemented in the form of hardware or in the form of a software functional module. When the above integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.
[0154] The above-mentioned storage medium can be a read-only memory, a magnetic disk, an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present application. Those of ordinary skill in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present application.
Claims
1. A data processing method, characterized in that, The method includes: Receiving a first service key and a version number of a target service sent by a second device; Obtaining a second service key of the target service according to the version number; Performing key encapsulation on the first service key based on the second service key to obtain a key ciphertext of the first service key; Sending the key ciphertext of the first service key to the second device.
2. The method according to claim 1, wherein The obtaining the second service key of the target service according to the version number includes: Obtaining a root key stored locally, and obtaining the second service key of the target service according to the root key and the version number.
3. The method according to claim 2, wherein The obtaining the second service key of the target service according to the root key and the version number includes: Determining the version number as an interference factor for key derivation; Performing key derivation on the root key based on the interference factor to obtain the second service key.
4. A data processing method, characterized in that, The method includes: Receiving a service data ciphertext, a key ciphertext of a first service key, and a version number sent by a second device; Performing key decapsulation on the key ciphertext according to the version number to obtain the first service key; Decrypting the service data ciphertext based on the first service key to obtain service data.
5. The method according to claim 4, characterized in that, The performing key decapsulation on the key ciphertext according to the version number to obtain the first service key includes: Obtaining a root key stored locally and a non-volatile storage NV value; Obtaining the second service key according to the NV value, the version number, and the root key; Performing key decapsulation on the key ciphertext of the first service key based on the second service key to obtain the first service key.
6. The method according to claim 5, wherein The obtaining the second service key according to the NV value, the version number, and the root key includes: Determining the minimum value of the NV value and the version number as an interference factor for key derivation through a key management KM hardware unit of the user device, and performing multi-level key derivation on the root key based on the interference factor to obtain the second service key.
7. The method according to claim 5, characterized in that, The obtaining the root key stored locally and the non-volatile storage NV value includes: Reading the root key and the NV value from a target memory through the KM hardware unit of the user device.
8. The method according to claim 5 or 6, characterized in that, Before determining the minimum value of the NV value and the version number as an interference factor for key derivation, it further includes: Configuring the version number into the KM hardware unit through a central processing unit CPU in the user device.
9. A data processing method, characterized in that, The method includes: Sending a first service key and a version number of a target service to a first device; Receiving the key ciphertext of the first service key sent by the first device; Encrypting service data based on the first service key to obtain a service data ciphertext; Sending the version number, the key ciphertext of the first service key, and the service data ciphertext to a user device.
10. A data processing device, characterized in that, The apparatus includes: A receiving module, configured to receive a first service key and a version number of a target service sent by a second device; An obtaining module, configured to obtain a second service key of the target service according to the version number; An encapsulation module, configured to perform key encapsulation on the first service key based on the second service key to obtain a key ciphertext of the first service key; A sending module, configured to send the key ciphertext of the first service key to the second device.
11. A data processing device, characterized in that, The apparatus includes: A receiving module, configured to receive a service data ciphertext, a key ciphertext of the first service key, and a version number sent by a second device; A de-encapsulation module, configured to perform key de-encapsulation on the key ciphertext according to the version number to obtain the first service key; A decryption module, configured to decrypt the service data ciphertext based on the first service key to obtain service data.
12. A data processing device, characterized in that, The apparatus includes: A first sending module, configured to send the first service key and the version number of a target service to a first device; A receiving module, configured to receive the key ciphertext of the first service key sent by the first device; An encryption module, configured to encrypt service data based on the first service key to obtain a service data ciphertext; A second sending module, configured to send the version number, the key ciphertext of the first service key, and the service data ciphertext to a user device.
13. An electronic device, characterized in that, It includes: A processor and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1-3, or the method according to any one of claims 4-8, or the method according to claim 9.
14. A computer-readable storage medium, characterized in that, Computer-executable instructions are stored in the computer-readable storage medium, and when the computer-executable instructions are executed by a processor, they are used to implement the method according to any one of claims 1-3, or the method according to any one of claims 4-8, or the method according to claim 9.
15. A chip, characterized in that, It includes at least one processor and a communication interface; the communication interface is configured to receive a signal input to the chip or a signal output from the chip, and the processor communicates with the communication interface and implements the method according to any one of claims 4 to 8 through logic circuits or by executing code instructions.