Product encryption method and system based on soft encryption of hybrid encryption algorithm

Abstract

The invention provides a product encryption method and system based on soft encryption of a hybrid encryption algorithm, and relates to the technical field of hardware security and function authority control of vehicle part logo equipment, and the method comprises the following steps: encryption initialization, equipment online encryption and authorization file generation; an encryption initialization step: the Web end sends License information, and after verification, the Web end loads an encryption initialization page; an equipment online encryption step: connecting the equipment, performing related verification and encrypting related equipment, reading encrypted ciphertext information by the equipment, and encrypting hardware by using a built-in algorithm; and an authorization file encryption step: reading the configuration information of the authorization file, carrying out related verification and encryption of related equipment, and generating the authorization file. The method can use a soft encryption mode, integrates various security encryption algorithms, adopts a W / S deployment mode, and has the advantages of flexible function, wide application range, simplicity in deployment, convenience in operation and the like.

Description

Technical Field

[0001] The present invention relates to the technical field of vehicle department standard equipment hardware security and function authority control, and in particular to a product encryption method and system based on hybrid encryption algorithm soft encryption. Background Art

[0002] Currently, most hardware products use hardware encryption, or a small number are sold directly to users without encryption. The security of these products is generally not high, and even if they are encrypted, there is a high risk of being cracked. Their characteristics are as follows:

[0003] 1. Hardware products are not encrypted. These products lack security guarantees. On the one hand, the manufacturer's various algorithms and technologies pose the risk of being cracked and misused. On the other hand, there is a lack of effective permission control, resulting in low user retention and certain security issues during use.

[0004] 2. Hardware products use hardware encryption algorithms. This type of product provides a certain level of security, but the encryption algorithm is simple, presenting a high risk of being cracked and misused, failing to effectively protect the manufacturer's rights. It is difficult to maintain and upgrade; once the encryption falls into the hands of the user, it can only be maintained and upgraded by returning it to the manufacturer. It also lacks effective permission control and cannot adapt to the diverse needs of users.

[0005] 3. Directly using hardware encryption has low security, high cost, difficulty in maintenance, difficulty in updating and upgrading, and inability to provide users with diverse services. This has long been one of the problems in the hardware production and sales industry.

[0006] Most hardware products currently on the market utilize the aforementioned encryption methods. For hardware products requiring minimal technical expertise and confidentiality, some manufacturers opt out of encryption. For such products, encryption is naturally insignificant. However, for products requiring high technical, confidentiality, and security, product encryption is essential. Currently, most manufacturers opt for hardware decryption, employing different underlying encryption codes for each component of the device. This approach is labor-intensive and complex, while also offering limited security and reliability. As a traditional hardware encryption method, cracking methods and attempts have already established a mature industry chain, and security issues are a growing problem.

[0007] In addition to encrypting hardware components, some manufacturers also encrypt the entire device after assembly to improve product security. However, this method is still part of the traditional encryption process and does not completely break away from the existing flaws and constraints. It also increases the complexity of the work and is not worth learning from in terms of security. Summary of the Invention

[0008] In view of the defects in the prior art, the present invention provides a product encryption method and system based on hybrid encryption algorithm soft encryption.

[0009] According to the present invention, a product encryption method and system based on hybrid encryption algorithm soft encryption is provided, and the scheme is as follows:

[0010] In a first aspect, a product encryption method based on hybrid encryption algorithm soft encryption is provided, the method comprising: encryption initialization, device online encryption, and generation of an authorization file;

[0011] Encryption initialization steps: The Web client sends the license information, which is verified and then loads the encryption initialization page.

[0012] Device online encryption steps: connect the device, perform relevant verification and encrypt the relevant device, the device reads the encrypted ciphertext information, and uses the built-in algorithm to complete the encryption of the hardware;

[0013] Authorization file encryption steps: read the authorization file configuration information, perform relevant verification and encryption of related devices, and generate an authorization file.

[0014] Preferably, the encryption initialization step includes:

[0015] Step S1.1: The web client sends the license information;

[0016] Step S1.2: The local server obtains the machine-related information, performs the first verification, and applies for verification on the cloud server;

[0017] Step S1.3: The cloud server performs a second verification on the user. If the verification passes, the server reads and returns the encrypted initialization information data.

[0018] Step S1.4: The web client loads the encryption initialization page.

[0019] Preferably, step S2 includes:

[0020] Step S2.1: Connect the device;

[0021] Step S2.2: Obtain relevant information including basic device information, GPS module information, 3 / 4G module information, and MAC information;

[0022] Step S2.3: Load the encrypted configuration set by the user and verify the validity of the configuration items;

[0023] Step S2.4: Use DES to encrypt the basic open function permissions of the device;

[0024] Step S2.5: Obtain the device AI open function permission authorization signature and encrypt it using a hybrid DES and RSA algorithm;

[0025] Step S2.6: Encrypt the lock server using a DES and RSA hybrid algorithm;

[0026] Step S2.7: Encrypt the hidden server using a hybrid DES and RSA algorithm;

[0027] Step S2.8: Encrypt the device MAC address using a hybrid DES and RSA algorithm;

[0028] Step S2.9: Send the encrypted ciphertext information in sequence;

[0029] Step S2.10: The device reads the encrypted ciphertext information and uses the built-in algorithm to complete the encryption of the hardware.

[0030] Preferably, step S3 includes:

[0031] Step S3.1: Read the authorization file configuration information;

[0032] Step S3.2: Read the basic information required for encryption from the database, including the basic information of the device generating the authorization file;

[0033] Step S3.3: Load the encryption configuration set by the user and perform necessary verification;

[0034] Step S3.4: Use DES to encrypt the basic open function permissions of the device;

[0035] Step S3.5: Obtain the device AI open function permission authorization signature and encrypt it using a hybrid DES and RSA algorithm;

[0036] Step S3.6: Encrypt the lock server using a DES and RSA hybrid algorithm;

[0037] Step S3.7: Encrypt the hidden server using a hybrid DES and RSA algorithm;

[0038] Step S3.8: Encrypt the device MAC address using a DES and RSA hybrid algorithm;

[0039] Step S3.9: Generate an authorization file.

[0040] In a second aspect, a product encryption system based on hybrid encryption algorithm and soft encryption is provided, the system comprising: a web page and an encryption server; the encryption server comprises a local server and a cloud server, and includes a device interaction module, a database interaction module, an encryption authorization module, an authorization file generation module, and a user control module;

[0041] Among them, the device interaction module: including the network port interaction module and the serial port interaction module, interacts with the device through different communication protocols to obtain device information and issue instructions;

[0042] Database interaction module: responsible for interacting with the database, reading necessary encryption configuration information from the database, and writing encrypted operation information into the database for update and query;

[0043] Encryption authorization module: obtains basic device information and user configuration information. This type of information uses the DES and RSA hybrid encryption algorithm to encrypt the device;

[0044] Authorization file generation module: Based on the encryption configuration information provided by the user, it obtains the necessary information required for encryption from the database, uses the same algorithm process as the encryption device, and finally generates an authorization file that can be used for offline encryption of the device;

[0045] User control module: adopts hardware identification control mode, registers users by issuing licenses calculated by security algorithms, and ensures the security of encryption process.

[0046] Preferably, the database interaction module runs on a cloud server, and all important information needs to be serialized before being stored in the database; all operations related to accessing the database need to undergo strict user control verification.

[0047] Preferably, the Web end and the local server communicate via HTTPS and WebSocket, and the communication messages are encoded in protobuf and undergo secondary encryption verification, thereby transmitting a large amount of available messages while ensuring security.

[0048] Preferably, the local server and the cloud server communicate via HTTPS, and the communication messages are encoded in protobuf and undergo secondary encryption verification, user permission verification, and timestamp verification, thereby transmitting a large amount of available messages while ensuring security.

[0049] Preferably, the cloud server and the authorization server communicate via HTTPS and perform interactive operations within the local area network to ensure the security of the authorization signature.

[0050] Preferably, the local server and the hardware device communicate via HTTPS and COM serial port, the HTTPS communication supports new devices, and the COM serial port encryption is compatible with complex old devices.

[0051] Compared with the prior art, the present invention has the following beneficial effects:

[0052] The adoption of W / S implementation and solutions simplifies operation and deployment, integrates the encryption process, and increases system flexibility, simplicity, and practicality. It also provides enterprise managers with the ability to remotely view encryption processes and progress information, improving scheduling flexibility and production management efficiency. Through permission control and the generation of encrypted authorization files, customers can remotely encrypt devices and update encryption information in batches, significantly reducing equipment maintenance and upgrade costs. Different personalized servers can also be provided for different customers. Specifically:

[0053] (1) Improve the reliability and security of encryption by integrating multiple secure encryption algorithms such as DES and RSA.

[0054] (2) Through functional permission development control, different functions are customized for different customers, which reduces the complexity of hardware device operation and improves user stickiness.

[0055] (3) By generating authorization files, we provide customers with remote batch encryption device solutions and encryption information update solutions, simplifying the traditional processing flow.

[0056] (4) Through various encryption configuration methods such as manual and order, different solutions are provided for different operational needs, improving overall efficiency.

[0057] (5) Through the encryption operation history data recorded in the database, it is easy to trace the encryption history information, evaluate the production encryption progress of the equipment, and better schedule management.

[0058] (6) By providing different communication methods (network port, serial port), it provides compatibility for different devices and can encrypt simple and complex hardware devices at the same time.

[0059] (7) Through the implementation and deployment of W / S, a more centralized maintenance and upgrade solution can be provided, which reduces the cost of using the system and greatly increases its ease of use and practicality. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Other features, objects and advantages of the present invention will become more apparent upon reading the detailed description of non-limiting embodiments with reference to the following drawings:

[0061] Figure 1 It is the overall framework diagram of the present invention;

[0062] Figure 2 It is a process principle diagram of the present invention;

[0063] Figure 3 This is a schematic diagram of the architecture of the present invention;

[0064] Figure 4 This is a flow chart of the encryption algorithm of the present invention;

[0065] Figure 5 Initialization flow chart of the encryption service of the present invention;

[0066] Figure 6 This is a flowchart of the AI ​​authorization process of the present invention;

[0067] Figure 7 This is a flow chart of the encryption process of the device of the present invention;

[0068] Figure 8 The present invention uses an encrypted online device to implement the functional diagram;

[0069] Figure 9 The present invention adopts the generation authorization implementation function diagram. DETAILED DESCRIPTION

[0070] The present invention will be described in detail below with reference to specific embodiments. The following examples will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those skilled in the art, several changes and improvements can be made without departing from the scope of the present invention. These all fall within the scope of protection of the present invention.

[0071] The embodiment of the present invention provides a product encryption method based on hybrid encryption algorithm soft encryption. Compared with traditional encryption methods, it has the advantages of low cost, high security, strong maintainability and scalability. There are three main types of traditional chip encryption: first, data is placed inside the chip, and the data is compared to see if they are the same. The disadvantage is that it is easy to be simulated; second, the board and the encryption chip simultaneously place the key (which can be the same, or the same after special data calculation), and encrypt the random number (which will not be reused), and determine whether it is a legal chip based on the result. The disadvantage is that if the board program is cracked, the encryption chip will become invalid; third, part of the board program is transplanted to the encryption chip, and the encryption chip function is called when needed. The disadvantage is that the cost is high and the user's workload increases. The user needs to develop the full chip program last year, and build a download program environment for mass production.

[0072] The embodiment of the present invention uses a combination of soft encryption and cloud authorization to achieve product encryption. The software authorization is bound to the product hardware information, including the CPU serial number, hard disk serial number, network card, MAC address, SN number, etc., to generate authorization information, and a hybrid encryption algorithm is used to generate authorization ciphertext to complete the encryption of the hardware; at the same time, the product's available functional permissions, terminal server information, and hidden server information are used to generate authorization information, and a hybrid encryption algorithm is used to generate authorization ciphertext, which is then bound to the authorization server to complete further encryption. By combining the two methods, the security and reliability of product encryption are improved, and it is also convenient to track, manage, crack, remedy, and upgrade the authorized software.

[0073] Overall, the functional modules are divided into user control module, encryption configuration module, manual configuration module, order configuration module, software encryption module, and authorization file module.

[0074] The user control module provides product encryption and authorization file generation for specific users. This control is implemented through license verification. A license is a string composed of the computer's CPU ID and hard drive ID, plus specific information, encrypted using the DES algorithm. Encryption and authorization functions are only available after a valid license is registered with the server. Specific functions can be configured as needed.

[0075] The encryption configuration module will initialize the last configured information on the page. Newly registered accounts must first be encrypted manually or after setting the order information. Encryption uses the websocket communication protocol and two-way data transmission.

[0076] The manual configuration module selects the corresponding information according to user needs. This module has flexible functions, simple deployment, and easy operation, which improves the user experience.

[0077] In the order configuration module, select the conditions from the order selection page to query all configuration data under the conditions. Select one and confirm to encrypt or generate the authorization file.

[0078] The software encryption module uses hybrid encryption algorithms such as RSA and DES. It binds specific information such as the product's CPU serial number, hard drive serial number, network card, MAC address, and SN number to generate authorization information. This information is also bound to the product's functional permissions, terminal server information, and hidden server information. Finally, the authorization information is encrypted using an encryption algorithm to generate ciphertext authorization information, which is then sent to the device.

[0079] The authorization file module generates an authorization file based on the user-selected configuration file and the personalized configuration information provided in the manual or order configuration modules, using hybrid encryption algorithms such as RSA and DES. Much of the process is similar to the software encryption module. The generated authorization file can be encrypted offline or in batches on the device.

[0080] The information exchange of the present invention uses DES encryption technology. Mixing specific signatures, timestamps and other information with the transmitted data and using DES encryption can further improve communication security and avoid risks such as request forgery.

[0081] The information interaction of the present invention uses the protobuf data serialization protocol. The protobuf (protocol buffer) serialization protocol is a mixed-language data standard within Google. By serializing (serializing) structured data, a language-independent, platform-independent, and extensible serialized structured data format is used in the fields of communication protocols, data storage, etc. In terms of performance: after serialization, the data size can be reduced by 3 times; the serialization speed is fast; the transmission speed is fast. In terms of use: it is easy to use, and the protobuf compiler automatically serializes and deserializes; the maintenance cost is low, and multiple platforms only need to maintain a set of object protocol files, namely .proto files; it has good scalability, and the data structure can be updated without destroying the old data format; it has good encryption, and http transmission content capture can only capture byte data. In terms of scope of use: cross-platform; cross-language; and strong scalability.

[0082] The information interaction of the present invention uses HTTP2 and WebSocket communication protocols. The combination of HTTP2 and WebSocket communication protocols can reduce server load pressure, improve performance, and realize more interactive functions.

[0083] Next, the present invention will be described in more detail.

[0084] The embodiment of the present invention provides a product encryption system based on hybrid encryption algorithm soft encryption, referring to Figure 1 As shown, it specifically includes: a web page and an encryption server (local server, cloud server); the encryption server includes a device interaction module, a database interaction module, an encryption authorization module, an authorization file generation module and a user control module.

[0085] Among them, the device interaction module: including the network port interaction module and the serial port interaction module, can interact with the device through different communication protocols to obtain device information, issue instructions, etc.

[0086] Database interaction module: responsible for interacting with the database, reading necessary encryption configuration information from the database, and writing encrypted operation information into the database for update and query.

[0087] In particular, the database interaction module runs on a cloud server, and all important information must be serialized before being stored in the database. All operations related to database access are subject to strict user control and verification. This ensures the security of the database and the security of the product encryption process.

[0088] Encryption authorization module: obtains basic device information and user configuration information. This type of information is encrypted using a hybrid encryption algorithm of DES and RSA. For important functions, this module can interact with the authorization server to obtain the necessary authorization information to allow the device to obtain permission to enable these functions.

[0089] Generate authorization file module: Based on the encryption configuration information provided by the user, obtain the necessary information required for encryption from the database, use the same algorithm process as the encryption device, and finally generate an authorization file that can be used for offline encryption of the device.

[0090] User Control Module: This module uses hardware-based authentication to register users by issuing licenses calculated using a security algorithm, ensuring the security of the encryption process. Different functions in this module require different permissions to prevent the misuse of high-risk operations such as registration and deletion.

[0091] The web client and the local server communicate via HTTPS and WebSocket. Communication messages are encoded in protobuf and undergo secondary encryption verification, ensuring security while being able to transmit a large number of available messages.

[0092] The local server and the cloud server communicate via HTTPS. The communication messages are encoded in protobuf and undergo secondary encryption verification, user permission verification, and timestamp verification. This ensures security while enabling the transmission of a large number of available messages.

[0093] The cloud server and the authorization server communicate via HTTPS and perform interactive operations within the local area network to ensure the security of the authorization signature and avoid leakage.

[0094] The local server and hardware devices communicate via HTTPS and COM serial ports. The HTTPS communication supports new devices, and the COM serial port encryption is compatible with complex old devices. Multiple types of peer-to-peer methods are suitable for different scenarios.

[0095] The present invention also provides a product encryption method based on hybrid encryption algorithm soft encryption, which specifically includes: encryption initialization, device online encryption and generation of authorization files.

[0096] The encryption initialization steps include:

[0097] Step S1.1: The web client sends the license information;

[0098] Step S1.2: The local server obtains the machine-related information, performs the first verification, and applies for verification on the cloud server;

[0099] Step S1.3: The cloud server performs a second verification on the user. If the verification passes, the server reads and returns the encrypted initialization information data.

[0100] Step S1.4: The web client loads the encryption initialization page.

[0101] The steps for online device encryption include:

[0102] Step S2.1: Connect the device;

[0103] Step S2.2: Obtain basic device information, GPS module information, 3 / 4G module information, and MAC information;

[0104] Step S2.3: Load the encrypted configuration set by the user (manually or by order), verify the validity of the configuration items, and ensure the robustness of the system;

[0105] Step S2.4: Use DES to encrypt the basic open function permissions of the device;

[0106] Step S2.5: Obtain the device AI open function permission authorization signature and encrypt it using a hybrid DES and RSA algorithm;

[0107] Step S2.6: Encrypt the lock server using a DES and RSA hybrid algorithm;

[0108] Step S2.7: Encrypt the hidden server using a hybrid DES and RSA algorithm;

[0109] Step S2.8: Encrypt the device MAC address using a hybrid DES and RSA algorithm;

[0110] Step S2.9: Send the encrypted ciphertext information in sequence;

[0111] Step S2.10: The device reads the encrypted ciphertext information and uses the built-in algorithm to complete the encryption of the hardware.

[0112] The steps for encrypting the authorization file include:

[0113] Step S3.1: Read the configuration file and obtain the device SN, etc., for use in step S3.2;

[0114] Step S3.2: Read the basic information required for encryption from the database based on the information provided in the configuration file, including the basic information of the device generating the authorization file;

[0115] Step S3.3: Load the encryption configuration set by the user and perform necessary verification;

[0116] Step S3.4: Use DES to encrypt the basic open function permissions of the device;

[0117] Step S3.5: Obtain the device AI open function permission authorization signature and encrypt it using a hybrid DES and RSA algorithm;

[0118] Step S3.6: Encrypt the lock server using a DES and RSA hybrid algorithm;

[0119] Step S3.7: Encrypt the hidden server using a hybrid DES and RSA algorithm;

[0120] Step S3.8: Encrypt the device MAC address using a DES and RSA hybrid algorithm;

[0121] Step S3.9: Generate an authorization file for device offline encryption, batch encryption, etc.

[0122] Specifically, the device uses different algorithm processing procedures for online encryption and authorized file encryption. Online encryption omits some unnecessary verification steps, resulting in faster speeds. Authorized file encryption requires decoding and verification of the preceding information in the file before proceeding to the next encryption step.

[0123] The following description is given in conjunction with specific embodiments.

[0124] The present invention provides a product encryption system based on hybrid encryption algorithm soft encryption, which includes a Web page and an encryption server (local server, cloud server); the encryption server includes a device interaction module, a database interaction module, an encryption authorization module, an authorization file generation module, and a user control module; the device interaction module includes a network port interaction module and a serial port interaction module, which can interact with the device through different communication protocols to obtain device information, issue instructions, etc.

[0125] Overall, this system is based on user encryption configuration, device basic information, GPS information, 3 / 4G module information, etc., and uses DES, RSA and other security encryption algorithm integration technologies to strictly manage permissions in communication, ciphertext generation, etc., to encrypt the device, or generate authorization files for customers to encrypt devices in batches.

[0126] Specifically, the system's functions are implemented through a combination of modules. The device interaction module, including the network port interaction module and the serial port interaction module, interacts with devices through various communication protocols to obtain device information and issue commands. The database interaction module is responsible for interacting with the database, reading necessary encryption configuration information from the database and writing encrypted operation information to the database for update and query purposes. The encryption authorization module obtains basic device information and user configuration information, encrypting this information using a hybrid DES and RSA encryption algorithm. For critical functions, this module interacts with the authorization server to obtain the necessary authorization information, allowing the device to obtain permission to enable these functions. The authorization file generation module retrieves the necessary encryption information from the database based on the encryption configuration information provided by the user. Using an algorithm similar to that used for encryption devices, it ultimately generates an authorization file for the device to encrypt offline. The user control module uses hardware identification control to register users by issuing licenses calculated using a secure algorithm, thereby ensuring the security of the encryption process. Different functions within this module require different operation permissions to prevent the abuse of high-risk operations such as registration and deletion.

[0127] This system is implemented using the W / S architecture and supports front-end and back-end separation deployment.

[0128] The local server deployment method is:

[0129] Step a: Edit the config.ini file and modify the listening port, cloud server address, etc.

[0130] Step b: Edit the env.conf file and set the server running environment variables

[0131] Step c. Run the command to register the server as a service

[0132] Step d: Set the service to start automatically and start with the system

[0133] Step e. Run the command to start the local server

[0134] The cloud server deployment method is:

[0135] Step a: Edit the config.ini file and modify the listening port, cloud server address, etc.

[0136] Step b. Run the command to register the server as a service

[0137] Step c: Set the service startup mode, turn off automatic restart, etc.

[0138] Step d. Run the command to start the cloud server

[0139] Step e: Check the authorization server status and cloud server status

[0140] The web deployment method is:

[0141] Step a: Configure proxy servers such as nginx and tomcat

[0142] Step b: Deploy static files (HTML / CSS / JavaScript) on the web

[0143] Step c. Start the proxy server

[0144] Step d: Access the service initialization service and test the system availability

[0145] The implementation structure of this system makes system deployment simple and efficient, can provide a more centralized maintenance and upgrade solution, reduces the cost of system use, and greatly increases ease of use and practicality.

[0146] The use of this system is also relatively simple. Taking the online encryption device as an example, the specific steps are:

[0147] Step a: The web client sends the license information.

[0148] Step b: The local server obtains the machine-related information, performs the first verification, and applies for verification on the cloud server;

[0149] Step c: The cloud server performs a second verification on the user. If the verification passes, the server reads and returns the encrypted initialization information data.

[0150] Step d: Load the encryption initialization page on the Web side;

[0151] Step e, connecting the device;

[0152] Step f, obtain basic device information, GPS module information, 3 / 4G module information, MAC information, etc.;

[0153] Step g: Load the encryption configuration set by the user (manual or order) and perform necessary verification;

[0154] Step h: Use DES to encrypt the basic open function permissions of the device;

[0155] Step i: Obtain the authorization signature for the device's AI open function permissions and encrypt it using a hybrid DES and RSA algorithm;

[0156] Step j, encrypt the locking server using a DES and RSA hybrid algorithm;

[0157] Step k: Encrypt the hidden server using a DES and RSA hybrid algorithm;

[0158] Step 1: Encrypt the device MAC address using a hybrid algorithm of DES and RSA;

[0159] Step m: Send encrypted ciphertext information in sequence;

[0160] Step n: The device reads the encrypted ciphertext information and uses the built-in algorithm to complete the encryption of the hardware.

[0161] More specifically, the process principle diagram of this system is as follows Figure 2 As shown in the figure, the web client interacts with the local server to set encryption configuration; the local server interacts with the cloud server to read the basic information required for encryption and obtain the encryption algorithm key, signature, etc.; the local server interacts with the device to obtain basic device information, encrypts it based on the signature and key obtained by the server, generates encrypted ciphertext information, and sends the encrypted information to the device.

[0162] More specifically, the system architecture diagram is as follows Figure 3 As shown in the figure, based on user configuration and basic device information, the local server uses the signature, key, and encryption algorithm obtained from the cloud encryption server to calculate different ciphertext information and send it to the device. The device parses the obtained ciphertext and other information and performs hardware-coded encryption and software encryption for different permissions and functions.

[0163] More specifically, the encryption algorithm principle diagram of this system is as follows Figure 4 As shown in the figure, the device interaction module is responsible for interacting with the device, the database interaction module reads and stores data information, the encryption authorization module applies for and generates authorization signatures, and the user control module is responsible for verifying user information and performing secondary encryption on communication information.

[0164] More specifically, the encryption flow chart of this system is as follows Figure 5 、 Figure 6 and Figure 7 It includes three main processes: encryption service initialization, user authentication and loading of necessary encryption information; AI authorization process, obtaining authorization signature and issuing it; device encryption process, generating ciphertext and issuing it to the device.

[0165] Example 1:

[0166] This embodiment uses an encrypted online device to implement the functions of the present invention.

[0167] Reference Figure 8 As shown, the system service is initialized, the device is connected, and after user configuration is completed, click Start Encryption. The local server and cloud server interact to generate encrypted ciphertext and send it to the device. The device finally parses the ciphertext, completing the encryption process. Each step provides success and failure indicators.

[0168] Example 2:

[0169] This embodiment uses the generation authorization to implement the functions of the present invention.

[0170] Reference Figure 9 As shown, after system service initialization, user configuration, and uploading of the authorization file configuration file are complete, click Generate. The local server and cloud server interact to generate the necessary verification information and encryption information required for the authorization file based on the configuration information. Each step provides success and failure indicators.

[0171] The embodiments of the present invention provide a product encryption method and system based on hybrid encryption algorithm soft encryption, which improves the traditional product encryption methods and processes, uses modern popular solutions, and realizes a new product encryption scheme by reconstructing the encryption method, simplifying the encryption process, and adding permission control features. It breaks away from the constraints of traditional encryption, avoids old defects, is simple to deploy, and operates efficiently, greatly simplifies the old process, improves the efficiency of product production, and provides better compatibility for the addition of new functions. The present invention supports soft encryption products and permission control, adopts W / S implementation and deployment methods, is simple to operate, and makes complex calibration work more convenient and efficient. At the same time, it adds a method for encrypting authorization files, which can be easily updated and upgraded, solving the problems of redundant steps and low resource utilization in the current field.

[0172] Those skilled in the art will appreciate that, in addition to implementing the system and its various devices, modules, and units provided by the present invention in purely computer-readable program code, it is entirely possible to implement the same functions of the system and its various devices, modules, and units provided by the present invention in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component; the devices, modules, and units for implementing various functions can also be considered as both software modules implementing the method and structures within the hardware component.

[0173] The above describes specific embodiments of the present invention. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art may make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. The embodiments of this application and the features in the embodiments may be combined with each other in any manner unless there is a conflict.

Claims

1. A product encryption method based on hybrid encryption algorithm soft encryption, characterized in that: Includes: encryption initialization, device online encryption and generation of authorization files; Encryption initialization steps: The Web client sends the license information, which is verified and then loads the encryption initialization page. Device online encryption steps: connect the device, perform relevant verification and encrypt the relevant device, the device reads the encrypted ciphertext information, and uses the built-in algorithm to complete the encryption of the hardware; Authorization file encryption steps: read the authorization file configuration information, perform relevant verification and encryption of related devices, and generate an authorization file.

2. The product encryption method based on hybrid encryption algorithm soft encryption according to claim 1 is characterized in that: The encryption initialization step includes: Step S1.1: The web client sends the license information; Step S1.2: The local server obtains the machine-related information, performs the first verification, and applies for verification on the cloud server; Step S1.3: The cloud server performs a second verification on the user. If the verification passes, the server reads and returns the encrypted initialization information data. Step S1.4: The web client loads the encryption initialization page.

3. The product encryption method based on hybrid encryption algorithm soft encryption according to claim 2 is characterized in that: The step S2 comprises: Step S2.1: Connect the device; Step S2.2: Obtain relevant information including basic device information, GPS module information, 3 / 4G module information, and MAC information; Step S2.3: Load the encrypted configuration set by the user and verify the validity of the configuration items; Step S2.4: Use DES to encrypt the basic open function permissions of the device; Step S2.5: Obtain the device AI open function permission authorization signature and encrypt it using a hybrid DES and RSA algorithm; Step S2.6: Encrypt the lock server using a DES and RSA hybrid algorithm; Step S2.7: Encrypt the hidden server using a hybrid DES and RSA algorithm; Step S2.8: Encrypt the device MAC address using a hybrid DES and RSA algorithm; Step S2.9: Send the encrypted ciphertext information in sequence; Step S2.10: The device reads the encrypted ciphertext information and uses the built-in algorithm to complete the encryption of the hardware.

4. The product encryption method based on hybrid encryption algorithm soft encryption according to claim 2 is characterized in that: The step S3 comprises: Step S3.1: Read the authorization file configuration information; Step S3.2: Read the basic information required for encryption from the database, including the basic information of the device generating the authorization file; Step S3.3: Load the encryption configuration set by the user and perform necessary verification; Step S3.4: Use DES to encrypt the basic open function permissions of the device; Step S3.5: Obtain the device AI open function permission authorization signature and encrypt it using a hybrid DES and RSA algorithm; Step S3.6: Encrypt the lock server using a DES and RSA hybrid algorithm; Step S3.7: Encrypt the hidden server using a hybrid DES and RSA algorithm; Step S3.8: Encrypt the device MAC address using a DES and RSA hybrid algorithm; Step S3.9: Generate an authorization file.

5. A product encryption system based on hybrid encryption algorithm soft encryption, characterized in that: include: Web page and encryption server; the encryption server has a local server and a cloud server, including a device interaction module, a database interaction module, an encryption authorization module, an authorization file generation module and a user control module; Among them, the device interaction module: including the network port interaction module and the serial port interaction module, interacts with the device through different communication protocols to obtain device information and issue instructions; Database interaction module: responsible for interacting with the database, reading necessary encryption configuration information from the database, and writing encrypted operation information into the database for update and query; Encryption authorization module: obtains basic device information and user configuration information. This type of information uses the DES and RSA hybrid encryption algorithm to encrypt the device; Authorization file generation module: Based on the encryption configuration information provided by the user, it obtains the necessary information required for encryption from the database, uses the same algorithm process as the encryption device, and finally generates an authorization file that can be used for offline encryption of the device; User control module: adopts hardware identification control mode, registers users by issuing licenses calculated by security algorithms, and ensures the security of encryption process.

6. The product encryption system based on hybrid encryption algorithm soft encryption according to claim 5 is characterized in that: The database interaction module runs on a cloud server, and all important information must be serialized before being stored in the database; all operations related to accessing the database must undergo strict user control verification.

7. The product encryption system based on hybrid encryption algorithm soft encryption according to claim 5 is characterized in that: The Web end and the local server communicate via HTTPS and WebSocket. The communication messages are encoded in protobuf and undergo secondary encryption verification, thereby transmitting a large amount of available messages while ensuring security.

8. The product encryption system based on hybrid encryption algorithm soft encryption according to claim 5 is characterized in that: The local server and cloud server communicate via HTTPS. Communication messages are encoded in protobuf and undergo secondary encryption verification, user permission verification, and timestamp verification, ensuring security while transmitting a large amount of available messages.

9. The product encryption system based on hybrid encryption algorithm soft encryption according to claim 5, characterized in that: The cloud server and the authorization server communicate via HTTPS and perform interactive operations within the local area network to ensure the security of the authorization signature.

10. The product encryption system based on hybrid encryption algorithm soft encryption according to claim 5, characterized in that: The local server and hardware device communicate via HTTPS and COM serial port. The HTTPS communication supports new devices, and the COM serial port encryption is compatible with complex old devices.

Images