Data encryption method and device in file transmission process, equipment and medium

Abstract

The invention discloses a data encryption method and device in a file transmission process, equipment and a medium, and relates to the technical field of computer security, and the method comprises the steps: obtaining to-be-transmitted data in a UEFI file, and carrying out the block processing of the to-be-transmitted data according to a preset block size, so as to obtain a plurality of plaintext blocks; performing an AES encryption process on each plaintext block, and performing column mixing operation on each plaintext block to obtain a process matrix; carrying out expansion processing on each process matrix based on the confusion vector so as to obtain a target matrix with two newly added columns; and re-splicing each target matrix to obtain an encrypted ciphertext result. The problem that the same plaintext generates the same ciphertext is avoided through a mode of obtaining the target matrix by performing extension processing on the process matrix, and the security of the file transmission process is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a data encryption method, device, equipment and medium in a file transmission process. Background Art

[0002] In the UEFI (Unified Extensible Firmware Interface) environment, the security of file transfer is extremely important, especially in scenarios such as firmware updates, configuration file transfers, or sensitive data exchange. AES (Advanced Encryption Standard), as an efficient and secure symmetric encryption algorithm, is widely used in encryption and decryption operations during UEFI file transfers. AES is used to protect the confidentiality and integrity of UEFI firmware files. During file transfer, AES can encrypt firmware files to ensure that data is not stolen or tampered with during transmission. AES is a symmetric encryption algorithm that is widely used for data encryption. It supports key lengths of 128 bits, 192 bits, and 256 bits, and the corresponding number of encryption rounds are 10, 12, and 14 rounds, respectively. The following are the main processes of AES encryption and decryption. Figure 1 As shown, the UEFI environment supports multiple AES encryption modes, including ECB (Electronic Codebook Mode), CBC (Cipher Block Chaining Mode), CFB (Cipher Feedback Mode), OFB (Output Feedback Mode), and CTR (Counter Mode). These modes can be selected based on specific needs to improve encryption efficiency and security. When transferring files in UEFI, selecting the appropriate AES mode requires comprehensive consideration of security, efficiency, hardware, and memory requirements.

[0003] Modes like CFB, OFB, and CTR typically require additional initialization vectors or counters (CTR), making implementation complex and requiring high hardware requirements. For example, while CTR mode supports parallel encryption, it requires ensuring the uniqueness of the counter. While ECB mode offers a simple algorithm, ease of implementation, fast encryption and decryption, and efficient hardware implementation, it cannot conceal plaintext patterns and is vulnerable to frequency analysis attacks. While CBC mode encrypts the same plaintext block into different ciphertext blocks, it transmits them serially, making it inefficient. An error in one block can affect the decryption of all subsequent blocks, easily revealing the plaintext structure.

[0004] It can be seen that how to quickly encrypt data during the file transfer process, avoid the elements in each matrix from being fully confused with other elements, and reduce the risk of exposure of the same blocks is a problem that needs to be solved by those skilled in the art. Summary of the Invention

[0005] The purpose of the embodiments of the present invention is to provide a data encryption method, device, equipment and medium for the file transmission process, which can quickly encrypt the data in the file transmission process, avoid the elements in each matrix from being fully confused with other elements, and reduce the risk of exposure of the same blocks.

[0006] To solve the above technical problems, an embodiment of the present invention provides a data encryption method for a file transmission process, comprising:

[0007] Obtain the data to be transmitted in the UEFI file, and divide the data to be transmitted into blocks according to a preset block size to obtain a number of plaintext blocks;

[0008] Execute the AES encryption process on each plaintext block separately, and obtain the process matrix after performing the column mixing operation on each plaintext block;

[0009] Expand each process matrix based on the confusion vector to obtain the target matrix with two additional columns;

[0010] Reconnect each target matrix to obtain the encrypted ciphertext result.

[0011] Optionally, the data to be transmitted is divided into blocks according to a preset block size to obtain a number of plaintext blocks, including:

[0012] The data to be transmitted is divided into blocks of 16 bytes to obtain several plaintext blocks.

[0013] Optionally, the data to be transmitted is divided into blocks of 16 bytes to obtain a number of plaintext blocks, including:

[0014] Check whether the data length of the data to be transmitted is a multiple of 16 bytes;

[0015] If not, the data to be transmitted is padded to obtain the padded data to be transmitted;

[0016] The padded data to be transmitted is divided into blocks to obtain several plaintext blocks.

[0017] Optionally, perform an AES encryption process on each plaintext block separately, including:

[0018] Build the execution thread of the corresponding AES encryption process for each plaintext block;

[0019] The execution threads are started in parallel to perform the AES encryption process on each plaintext block.

[0020] Optionally, perform an AES encryption process on each plaintext block separately, including:

[0021] Expand the initial key into multiple round keys for the AES encryption process; where each round key corresponds to a single AES encryption process of a single plaintext block;

[0022] Arrange the round keys and plaintext blocks into a round key matrix and a plaintext matrix respectively under the same preset dimension;

[0023] Perform XOR processing on the corresponding matrix elements in the round key matrix and the plaintext matrix to obtain the round key addition matrix;

[0024] According to the matrix elements of the round key addition matrix, the corresponding target number is searched from the preset confusion degree mapping table, and the corresponding matrix elements are replaced with the target number to obtain the replaced matrix;

[0025] Perform a circular left shift on each row of the replaced matrix to obtain a row-shifted matrix;

[0026] Performing XOR processing and multiplication operation on each column of the row-shifted matrix and the preset matrix to obtain a process matrix;

[0027] Accordingly, after expanding each process matrix based on the confusion vector to obtain the target matrix with two new columns, it also includes:

[0028] Determine whether the current target matrix is the matrix of the last round;

[0029] If so, each target matrix is reassembled to obtain the encrypted ciphertext result;

[0030] If not, the process jumps to executing the step of arranging the round keys and the plaintext blocks into a round key matrix and a plaintext matrix respectively under the same preset dimension.

[0031] Optionally, each process matrix is expanded based on the confusion vector to obtain a target matrix with two additional columns, including:

[0032] Set the newly added first column of matrix elements to all be zero, and set the newly added second column of matrix elements to be the XOR value of the matrix elements on the line with a slope of 1 in the process matrix and the confusion vector;

[0033] The matrix elements in the first column and the matrix elements in the second column are added to form the last two columns of the process matrix to obtain the target matrix with the two newly added columns.

[0034] Optionally, reconstruct the target matrices to obtain the encrypted ciphertext, including:

[0035] De-filling each target matrix to obtain an updated target matrix;

[0036] The updated target matrices are reconnected to obtain the encrypted ciphertext result.

[0037] In a second aspect, an embodiment of the present invention provides a data encryption device for a file transmission process, comprising:

[0038] A block segmentation module is used to obtain the data to be transmitted in the UEFI file and segment the data to be transmitted according to a preset block size to obtain a number of plaintext blocks;

[0039] The encryption module is used to perform the AES encryption process on each plaintext block and obtain a process matrix after performing a column mixing operation on each plaintext block;

[0040] An expansion module is used to expand each process matrix based on the confusion vector to obtain a target matrix with two additional columns;

[0041] The splicing module is used to re-splice each target matrix to obtain the encrypted ciphertext result.

[0042] In a third aspect, an embodiment of the present invention provides an electronic device, including:

[0043] memory for storing computer programs;

[0044] A processor is used to execute the computer program to implement the steps of the data encryption method in the file transmission process disclosed above.

[0045] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the data encryption method of the file transfer process disclosed above are implemented.

[0046] It can be seen that the present invention discloses a data encryption method for a file transfer process, including: obtaining data to be transmitted in a UEFI file, and performing block processing on the data to be transmitted according to a preset block size to obtain a number of plaintext blocks; executing an AES encryption process on each of the plaintext blocks, and obtaining a process matrix after performing a column mixing operation on each of the plaintext blocks; expanding each of the process matrices based on a confusion vector to obtain a target matrix with two newly added columns; and re-splicing each of the target matrices to obtain an encrypted ciphertext result.

[0047] It can be seen from the above technical solution that when the transmitted data is processed in blocks, each block performs encryption, expansion and splicing independently, and all operations have no dependencies between blocks, which conforms to the parallel characteristics. Each process matrix is independently expanded to add two new columns. The expansion operation makes the process matrix generated by the same plaintext block after column mixing no longer directly output as ciphertext, but is transformed into a target matrix. In this way, the final spliced ciphertext block is different due to the expansion, and the problem of generating the same ciphertext for the same plaintext is avoided without destroying the independence of the blocks. Moreover, after the column mixing, the process matrix is intercepted, and only the column expansion and simple operations are required. Compared with modes such as CBC / CTR that require IV management or chain calculations, there is no need for cross-block state storage, which meets the constraints of the UEFI environment on lightweight firmware. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0049] Figure 1 A flowchart of an AES encryption and decryption method for an existing file transmission process provided by an embodiment of the present invention;

[0050] Figure 2 A flow chart of a data encryption method for a file transmission process provided by an embodiment of the present invention;

[0051] Figure 3 A flowchart of a data encryption method for a specific file transmission process provided by an embodiment of the present invention;

[0052] Figure 4 A flowchart of a data decryption method for a specific file transmission process provided by an embodiment of the present invention;

[0053] Figure 5 A schematic diagram of the structure of a data encryption device for a file transmission process provided by an embodiment of the present invention;

[0054] Figure 6 A diagram of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0055] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0056] The terms "including" and "having," as used in the present description and accompanying drawings, and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or elements is not limited to the listed steps or elements and may include steps or elements that are not listed.

[0057] In order to enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0058] In the UEFI environment, the security of file transfer is crucial, especially in scenarios such as firmware updates, configuration file transfers, or sensitive data exchange. As an efficient and secure symmetric encryption algorithm, AES is widely used in encryption and decryption operations during UEFI file transfers. AES is used to protect the confidentiality and integrity of UEFI firmware files. During file transfer, AES can encrypt firmware files to ensure that data is not stolen or tampered with during transmission. AES is a symmetric encryption algorithm that is widely used for data encryption. It supports key lengths of 128 bits, 192 bits, and 256 bits, and the corresponding number of encryption rounds are 10, 12, and 14 rounds, respectively. The following are the main processes of AES encryption and decryption: Figure 1 As shown in the figure, the UEFI environment supports multiple AES encryption modes, such as ECB, CBC, CFB, OFB, and CTR. These modes can be selected based on specific needs to improve encryption efficiency and security. During UEFI file transfer, selecting the appropriate AES operating mode requires comprehensive consideration of factors such as security, efficiency, hardware, and memory requirements.

[0059] Modes like CFB, OFB, and CTR typically require additional initialization vectors or counters (CTR), making implementation complex and requiring high hardware requirements. For example, while CTR mode supports parallel encryption, it requires ensuring the uniqueness of the counter. While ECB mode offers a simple algorithm, ease of implementation, fast encryption and decryption, and efficient hardware implementation, it cannot conceal plaintext patterns and is vulnerable to frequency analysis attacks. While CBC mode encrypts the same plaintext block into different ciphertext blocks, it transmits them serially, making it inefficient. An error in one block can affect the decryption of all subsequent blocks, easily revealing the plaintext structure.

[0060] To this end, the present invention provides a data encryption scheme for the file transfer process, which can quickly encrypt the data in the file transfer process, avoid the elements in each matrix from being fully confused with other elements, and reduce the risk of exposure of the same blocks.

[0061] Next, a data encryption method for a file transmission process provided by an embodiment of the present invention is described in detail. Figure 2A data encryption method for a file transmission process provided in an embodiment of the present invention includes:

[0062] Step S11: obtaining the data to be transmitted in the UEFI file, and performing block processing on the data to be transmitted according to a preset block size to obtain a plurality of plaintext blocks.

[0063] In this embodiment, for the UEFI environment, in scenarios such as firmware update, configuration file transfer or sensitive data exchange, the corresponding data to be transmitted are UEFI firmware files, configuration files, and sensitive data respectively; wherein, the above-mentioned data to be transmitted contains duplicate data. Specifically, in the firmware update scenario, the data to be encrypted is the firmware image block in the UEFI capsule file, which includes an executable code segment, a hardware abstraction layer module and a security signature area. Among them, there are a large number of 0xFF padding fields in the firmware signature area. In the configuration file transfer scenario, the data to be encrypted includes the UEFI boot manager configuration, the system description table (including a fixed signature) and the kernel boot parameters. The header structure of this type of data is highly similar. In the sensitive data exchange scenario, the data to be encrypted covers the measurement log extension value of TPM2.0, the secure boot key revocation list and the hardware encryption certificate. Although these data are small in size, they are highly sensitive.

[0064] In this embodiment, the data to be transmitted is divided into blocks of 16 bytes to obtain a number of plaintext blocks. It can be understood that the data to be transmitted is divided into blocks of 16 bytes to obtain plaintext blocks arranged in 4×4. .

[0065] In this embodiment, it is detected whether the data length of the data to be transmitted is a multiple of 16 bytes; if not, the data to be transmitted is padded to obtain the padded data to be transmitted; the padded data to be transmitted is divided into blocks to obtain a number of plaintext blocks. It can be understood that before block division, it is first detected whether the data length of the data to be transmitted is a multiple of 16 bytes. If so, it is directly divided into blocks, and the block division result is that the last plaintext block is all the remaining data of the current data to be transmitted; if not, it means that if the block division is normal, the bytes of the last plaintext block are less than 16 bytes. In order to facilitate the subsequent plaintext block encryption processing, the data to be transmitted needs to be byte-padded. A specific byte padding method is that if the current data to be transmitted is 23 bytes, then according to the above rules, the current data to be transmitted lacks 9 bytes of data, so 9 bytes with a value of 9 are padded to the end of the current data to be transmitted. It should be noted that the padding value carries length information, and the padding can be accurately removed after decryption. Another specific byte padding method is to use a 23-byte data structure. According to the above rule, if the data to be transmitted is missing 9 bytes, then the end of the data to be transmitted is padded with 9 0x00 bytes. It should be noted that the current byte padding method must ensure that the end of the data to be transmitted does not contain 0x00 bytes. Otherwise, decryption will make it difficult to distinguish between the original data to be transmitted and the padding. Other byte padding methods are also possible and are not specifically limited to this.

[0066] Step S12: Execute the AES encryption process on each plaintext block respectively, and obtain a process matrix after performing a column mixing operation on each plaintext block.

[0067] In this embodiment, a corresponding AES encryption process execution thread is established for each plaintext block; each execution thread is started in parallel to execute the AES encryption process on each plaintext block. It is understood that in order to speed up data encryption and transmission, a corresponding AES encryption process execution thread is established for each plaintext block. Once all plaintext blocks are divided, all execution threads are directly started in parallel, and each execution thread independently executes the AES encryption process for the current plaintext block.

[0068] In this embodiment, the encryption process of the AES encryption process of one thread is described. Specifically: the initial key is expanded into multiple round keys for the AES encryption process; wherein each round key corresponds to a single AES encryption process of a single plaintext block; the round keys and plaintext blocks are arranged into a round key matrix and a plaintext matrix under the same preset dimension; each matrix element in the round key matrix and the plaintext matrix is subjected to corresponding XOR processing to obtain a round key addition matrix; according to the matrix elements of the round key addition matrix, the corresponding target number is searched from the preset confusion degree mapping table, and the corresponding matrix element is replaced with the target number to obtain a replaced matrix; each row of the replaced matrix is subjected to a circular left shift processing to obtain a row-shifted matrix; each column of the row-shifted matrix is subjected to XOR processing and multiplication operation with the preset matrix to obtain a process matrix. It can be understood that the current plaintext matrix is 4×4. At the same time, the round keys of the current round should also be arranged into a 4×4 round key matrix , add the two 4×4 matrices (each byte is XORed) to get the round key addition matrix , thus completing the round key addition, the process of adding the two matrices is as follows:

[0069] ;

[0070] in, denote the rows and columns of the matrix respectively, where .

[0071] Furthermore, an S-box (preset confusion mapping table) is used to perform nonlinear replacement on each byte of the round key addition matrix. The S-box is a fixed 256-byte mapping table used to increase the confusion of the data. Each byte is replaced with the value in the S-box. Each byte in the round key addition matrix generated after the first step of round key addition is expressed in hexadecimal, and then the first hexadecimal digit is used as the row and the second digit as the column to find the corresponding number in the S-box table, and use this number to replace the original number, thus completing the byte transformation. The matrix obtained after the replacement is Expressed as:

[0072] ;

[0073] Shift each row of the matrix obtained in the previous step to the left in a circular manner. Row 0 is not moved, row 1 is shifted left by 1 byte, row 2 is shifted left by 2 bytes, row 3 is shifted left by 3 bytes, and so on, to obtain the matrix after row shifting. , which is expressed as follows:

[0074] ;

[0075] Pair Matrix Perform matrix multiplication on each column of . Use the fixed matrix given by AES to perform XOR and multiplication with the current column to further confuse the data and obtain the process matrix ,It should be noted that this step is not performed in the last round of encryption. The process matrix is expressed as follows: .

[0076] After the key expansion step is completed and before the independent encryption step begins, a dynamic key offset mechanism is introduced. In traditional AES encryption, the round keys generated after key expansion are relatively fixed for each round of encryption. However, the dynamic key offset mechanism of the present invention dynamically adjusts the round keys based on the characteristics of the plaintext grouping and pre-defined rules. The specific implementation method is as follows:

[0077] Offset parameter generation: Based on the hash value of the plaintext block and a global random seed (randomly generated at the beginning of each encryption session and unchanged during the session), an offset parameter is generated through modular or bitwise combination operations. This offset parameter is a fixed-length value (e.g., 16 bits) and is used for subsequent round key adjustments. The generated offset parameter is bitwise XORed with the expanded round key (if the round key length is greater than the offset parameter length, the offset parameter is repeated for XOR) to obtain a new round key with the offset adjustment. The round key, after dynamic key offset, is used in subsequent independent encryption steps.

[0078] By introducing a dynamic key offset mechanism, even for the same plaintext block, the round keys used in different encryption sessions or different plaintext group sequences will differ, further enhancing the complexity and security of encryption. At the same time, this mechanism has low computational complexity and does not significantly affect the efficiency of ECB mode. Furthermore, it works in conjunction with the subsequent obfuscation optimization process to comprehensively enhance the security of the encryption algorithm from both the key usage and data obfuscation levels.

[0079] Step S13: Expand each process matrix based on the confusion vector to obtain a target matrix with two newly added columns.

[0080] In this embodiment, the newly added first column matrix elements are all set to zero, and the newly added second column matrix elements are set to the XOR value of the matrix elements on the line with a slope of 1 in the process matrix and the confusion vector; the first column matrix elements and the second column matrix elements are added to form the last two columns of the process matrix to obtain the target matrix after the two columns are added. It can be understood that the process matrix Expand to target matrix , add two columns to the original process matrix, and the corresponding fourth column matrix elements (the newly added first column matrix) are , the fifth column matrix elements (the second column matrix elements of the newly added quota) are:

[0081] ;

[0082] The structure of the target matrix formed is shown in Table 1:

[0083] Table 1

[0084]

[0085] As shown in Table 1, each element in the fifth column is obtained by XORing all elements on the line with a slope of 1, where w is the confusion vector and ⊕ is the XOR operation on the Galois field:

[0086] ;

[0087] Therefore, the target matrix obtained after expansion is It is expressed as follows:

[0088] ;

[0089] The final optimized target matrix is expressed as follows:

[0090] ;

[0091] The elements are derived from the following formula:

[0092] ;

[0093] ;

[0094] ;

[0095] ;

[0096] The target matrix H and the confusion vector w after the obfuscation optimization are output, and then the encryption is completed through the subsequent splicing steps.

[0097] Accordingly, after expanding each process matrix based on the confusion vector to obtain a target matrix with two additional columns, the process further includes: determining whether the current target matrix is the matrix of the last round; if so, reassembling each target matrix to obtain the encrypted ciphertext result; if not, jumping to the step of arranging the round key and plaintext block into a round key matrix and plaintext matrix of the same preset dimension. It is understandable that because the encryption process requires multiple rounds of encryption, it is necessary to check the current target matrix obtained after each round to determine whether it is the matrix of the last round. If so, all target matrices in the current round are output and reassembled to obtain the encrypted ciphertext result. If not, jumping to the step of adding the round key.

[0098] Step S14: reassemble the target matrices to obtain the encrypted ciphertext result.

[0099] In this embodiment, when each output target matrix does not contain a padding value, corresponding concatenation processing is performed according to the marking order during block division to obtain an encrypted ciphertext result.

[0100] In this embodiment, each target matrix is de-padded to obtain an updated target matrix; the updated target matrices are then reassembled to obtain the encrypted ciphertext. It is understood that when the output target matrix contains padding values, the corresponding target matrix needs to be de-padded to obtain an updated target matrix, and the updated target matrices are then reassembled in the order in which they were marked when separated to obtain the encrypted ciphertext.

[0101] Reference Figure 3 As shown in FIG, the data encryption method for the file transmission process of the present invention includes the following four main steps, which are performed in sequence in each round:

[0102] 1) Byte replacement:

[0103] Performs nonlinear substitution on each byte using an S-box, a fixed 256-byte mapping table used to increase data obfuscation.

[0104] 2) Row shift:

[0105] Shift each row of the matrix left circularly. Row 0 is not shifted, row 1 is shifted left by 1 byte, row 2 is shifted left by 2 bytes, row 3 is shifted left by 3 bytes, and so on.

[0106] 3) Column mixing:

[0107] Perform matrix multiplication on each column of the matrix. XOR and multiply the current column with a fixed matrix to further obfuscate the data. This step is not performed in the final round of encryption.

[0108] 4) Obfuscation optimization:

[0109] Expand the matrix to a matrix with two additional columns. The elements in the fourth column are all 0, and each element in the fifth column is the XOR of all elements on the line with slope 1.

[0110] Output the obfuscation-optimized matrix H and obfuscation vector w, and then complete the encryption through subsequent steps.

[0111] 5) Round key addition:

[0112] Perform an XOR operation on the data block and the round key of the current round. This step is used to introduce key information into the encryption process.

[0113] like Figure 4 As shown in the figure, it is the decryption process corresponding to the above data encryption process. The decryption process is the reverse operation of the above encryption process. The main process is as follows Figure 4 As shown, each round performs the following steps in sequence:

[0114] 1) Reverse byte replacement:

[0115] Each byte is replaced using an inverse S-box, which is the inverse mapping of the S-box.

[0116] 2) Retrograde displacement:

[0117] Shift each row of the matrix right circularly. Row 0 is not shifted, row 1 is shifted right by 1 byte, row 2 is shifted right by 2 bytes, row 3 is shifted right by 3 bytes, and so on.

[0118] 3) Reverse column mixing:

[0119] Perform inverse matrix multiplication on each column of the matrix. This step is not performed in the final round of decryption.

[0120] 4) Deobfuscation optimization:

[0121] With the help of matrix H and confusion vector w, the extended matrix is replaced and restored to the matrix before column mixing.

[0122] 5) Round key addition:

[0123] Perform an XOR operation on the round key of the current round and the data block.

[0124] It can be seen that the optimization algorithm proposed in the present invention, while taking into account the advantages of the ECB mode algorithm such as simplicity, ease of implementation, and fast parallel processing encryption and decryption speed, adds obfuscation optimization processing, fully ensuring that the elements in each matrix are fully obfuscated with other elements, thereby effectively avoiding the risk of the same plaintext blocks being encrypted into the same ciphertext blocks and thus being exposed.

[0125] It can be seen from the above technical solution that when the transmitted data is processed in blocks, each block performs encryption, expansion and splicing independently, and all operations have no dependencies between blocks, which conforms to the parallel characteristics. Each process matrix is independently expanded to add two new columns. The expansion operation makes the process matrix generated by the same plaintext block after column mixing no longer directly output as ciphertext, but is transformed into a target matrix. In this way, the final spliced ciphertext block is different due to the expansion, and the problem of generating the same ciphertext for the same plaintext is avoided without destroying the independence of the blocks. Moreover, after the column mixing, the process matrix is intercepted, and only the column expansion and simple operations are required. Compared with modes such as CBC / CTR that require IV management or chain calculations, there is no need for cross-block state storage, which meets the constraints of the UEFI environment on lightweight firmware.

[0126] Figure 5 A schematic structural diagram of a data encryption device for a file transmission process provided by an embodiment of the present invention includes:

[0127] The block segmentation module 11 is used to obtain the data to be transmitted in the UEFI file and segment the data to be transmitted according to a preset block size to obtain a plurality of plaintext blocks;

[0128] The encryption module 12 is used to perform the AES encryption process on each plaintext block and obtain a process matrix after performing a column mixing operation on each plaintext block;

[0129] An expansion module 13 is used to expand each process matrix based on the confusion vector to obtain a target matrix with two additional columns;

[0130] The splicing module 14 is used to re-splice the target matrices to obtain an encrypted ciphertext result.

[0131] Figure 5 The description of the features in the corresponding embodiment can be found in Figure 2 The relevant descriptions of the corresponding embodiments will not be repeated here one by one.

[0132] It can be seen from the above technical solution that when the transmitted data is processed in blocks, each block performs encryption, expansion and splicing independently, and all operations have no dependencies between blocks, which conforms to the parallel characteristics. Each process matrix is independently expanded to add two new columns. The expansion operation makes the process matrix generated by the same plaintext block after column mixing no longer directly output as ciphertext, but is transformed into a target matrix. In this way, the final spliced ciphertext block is different due to the expansion, and the problem of generating the same ciphertext for the same plaintext is avoided without destroying the independence of the blocks. Moreover, after the column mixing, the process matrix is intercepted, and only the column expansion and simple operations are required. Compared with modes such as CBC / CTR that require IV management or chain calculations, there is no need for cross-block state storage, which meets the constraints of the UEFI environment on lightweight firmware.

[0133] Figure 6 A structural diagram of an electronic device provided by an embodiment of the present invention, such as Figure 6 As shown, the electronic device includes: a memory 20 for storing computer programs;

[0134] The processor 21 is configured to implement the steps of the data encryption method for the file transmission process in the above embodiment when executing a computer program.

[0135] The electronic device provided in this embodiment may include but is not limited to a smart phone, a tablet computer, a laptop computer, or a desktop computer.

[0136] The processor 21 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 21 may be implemented in at least one of the following hardware forms: a digital signal processing (DSP), a field-programmable gate array (FPGA), or a programmable logic array (PLA). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a graphics processing unit (GPU), which is responsible for rendering and drawing the content required to be displayed on the display screen. In some embodiments, the processor 21 may also include an artificial intelligence (AI) processor, which is responsible for processing computing operations related to machine learning.

[0137] The memory 20 may include one or more computer-readable storage media, which may be non-transitory. The memory 20 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 20 is at least used to store the following computer program 201, wherein, after the computer program is loaded and executed by the processor 21, it can implement the relevant steps of the data encryption method of the file transfer process disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 20 may also include an operating system 202 and data 203, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 202 may include Windows, Unix, Linux, etc. The data 203 may include but is not limited to data transmitted from an external device and received by the electronic device, data collected by its own input and output interface 23, etc.

[0138] In some embodiments, the electronic device may further include a display screen 22 , an input / output interface 23 , a communication interface 24 , a power supply 25 , and a communication bus 26 .

[0139] It is understood that if the data encryption method for the file transfer process in the above-mentioned embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the current technology, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and performs all or part of the steps of the various embodiments of the present invention. The aforementioned storage medium includes: a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), an electrically erasable programmable ROM, a register, a hard drive, a removable disk, a CD-ROM, a magnetic disk, or an optical disk, and other media that can store program code.

[0140] Based on this, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the data encryption method in the above-mentioned file transmission process are implemented.

[0141] The above describes in detail the solutions provided by the embodiments of the present invention. The various embodiments are described in a progressive manner throughout this specification, with each embodiment focusing on its differences from other embodiments. Reference can be made to the descriptions of the common and similar parts between the various embodiments. The devices disclosed in the embodiments are described briefly because they correspond to the methods disclosed in the embodiments. For relevant details, refer to the descriptions of the methods.

[0142] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0143] The above is a detailed introduction to the solution provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only intended to help understand the method and core ideas of the present invention. It should be pointed out that, for those skilled in the art, without departing from the principles of the present invention, several improvements and modifications may be made to the present invention, and such improvements and modifications also fall within the scope of protection of the claims of the present invention.

Claims

1. A data encryption method for a file transmission process, characterized in that: include: Obtaining data to be transmitted in the UEFI file, and dividing the data to be transmitted into blocks according to a preset block size to obtain a plurality of plaintext blocks; Performing an AES encryption process on each of the plaintext blocks, and obtaining a process matrix after performing a column mix operation on each of the plaintext blocks; Expanding each of the process matrices based on the confusion vector to obtain a target matrix with two additional columns; The target matrices are reassembled to obtain an encrypted ciphertext result.

2. The data encryption method for file transmission according to claim 1, characterized in that: The block processing of the data to be transmitted according to a preset block size to obtain a plurality of plaintext blocks includes: The data to be transmitted is divided into blocks according to a block size of 16 bytes to obtain a plurality of plaintext blocks.

3. The data encryption method for file transmission according to claim 2, characterized in that: The data to be transmitted is divided into blocks according to a block size of 16 bytes to obtain a plurality of plaintext blocks, including: Detecting whether the data length of the data to be transmitted is a multiple of 16 bytes; If not, performing length padding on the data to be transmitted to obtain padded data to be transmitted; The padded data to be transmitted is divided into blocks to obtain a plurality of plaintext blocks.

4. The data encryption method for file transmission process according to claim 1, characterized in that: The AES encryption process is performed on each of the plaintext blocks, including: Constructing a corresponding AES encryption process execution thread for each of the plaintext blocks; The execution threads are started in parallel to perform the AES encryption process on the plaintext blocks.

5. The data encryption method for file transmission process according to claim 1, characterized in that: The AES encryption process is performed on each of the plaintext blocks, including: Expanding the initial key into multiple round keys for the AES encryption process; wherein each round key corresponds to a single AES encryption process of a single plaintext block; Arranging the round keys and the plaintext blocks into a round key matrix and a plaintext matrix respectively under the same preset dimension; Performing corresponding XOR processing on each matrix element in the round key matrix and the plaintext matrix to obtain a round key addition matrix; Searching for a corresponding target number from a preset confusion degree mapping table according to the matrix elements of the round key addition matrix, and replacing the corresponding matrix elements with the target number to obtain a replaced matrix; Performing a cyclic left shift on each row of the replaced matrix to obtain a row-shifted matrix; Performing an XOR operation and a multiplication operation on each column of the row-shifted matrix and a preset matrix to obtain a process matrix; Accordingly, after the process matrices are expanded based on the confusion vector to obtain a target matrix with two additional columns, the method further includes: Determine whether the current target matrix is the matrix of the last round; If yes, then re-joining the target matrices to obtain an encrypted ciphertext result; If not, the process jumps to executing the step of arranging the round keys and the plaintext blocks into a round key matrix and a plaintext matrix respectively in the same preset dimension.

6. The data encryption method for file transmission process according to claim 1, characterized in that: The process matrices are expanded based on the confusion vector to obtain a target matrix with two additional columns, including: Set the newly added first column of matrix elements to all be zero, and set the newly added second column of matrix elements to be the XOR value of the matrix elements on the line with a slope of 1 in the process matrix and the confusion vector; The first column of matrix elements and the second column of matrix elements are added to form the last two columns of the process matrix, so as to obtain a target matrix with two newly added columns.

7. The data encryption method for file transmission according to claim 1, characterized in that: The re-joining of the target matrices to obtain an encrypted ciphertext result includes: performing a defilling process on each of the target matrices to obtain an updated target matrix; The updated target matrices are reassembled to obtain an encrypted ciphertext result.

8. A data encryption device for a file transmission process, characterized in that: include: A block segmentation module is used to obtain the data to be transmitted in the UEFI file and segment the data to be transmitted according to a preset block size to obtain a plurality of plaintext blocks; An encryption module, configured to execute an AES encryption process on each of the plaintext blocks, and obtain a process matrix after performing a column mixing operation on each of the plaintext blocks; An expansion module, configured to expand each of the process matrices based on the confusion vector to obtain a target matrix with two additional columns; The splicing module is used to re-splice the target matrices to obtain an encrypted ciphertext result.

9. An electronic device, characterized in that: include: memory for storing computer programs; A processor, configured to execute the computer program to implement the steps of the data encryption method for a file transmission process according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the data encryption method for a file transmission process according to any one of claims 1 to 7.

Images