Data encryption method and device, storage medium and electronic equipment
By decomposing the modular exponentiation task into a sequence of sub-operation tasks and executing it on the encryption module using the Montgomery modular multiplication algorithm, the problem of the encrypted data bit width exceeding the hardware capability is solved, achieving a balance between high security and economy.
Patent Information
- Application Number
- CN202511635293.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-10
- Publication Date
- 2025-12-12
AI Technical Summary
Existing encryption systems cannot complete encryption operations when the required bit width of the encrypted data exceeds the processing capacity of the hardware modules, resulting in system malfunction and limiting the development of information security systems.
The Montgomery modular multiplication algorithm is used to decompose the modular exponentiation task into a sequence of sub-operation tasks. The sub-modular multiplication and sub-modular addition tasks are executed through an encryption module to ensure that the operation length of each task matches the maximum operation length of the encryption module, thereby realizing the decomposition and execution of long-bit-width cryptographic operations.
It supports cryptographic operations with higher security strength under limited hardware resources, achieving a good balance between security and economy, and meeting the ever-increasing security requirements.
Smart Images
Figure CN121125346A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the field of encryption technology, and in particular to a data encryption method and device, a storage medium and an electronic device. BACKGROUND
[0002] In modern information security applications, data encryption is the core means to protect information confidentiality. Various encryption systems rely on special hardware modules to provide efficient cryptographic operation capabilities. These hardware modules limit the upper limit of the encryption data bit width that can be processed when designed. When the encryption data bit width requirement generated by the actual application exceeds the inherent processing capability of the hardware module, the existing technical solutions cannot complete the required encryption operation, resulting in system failure. This mismatch between encryption requirements and hardware capabilities seriously restricts the development and application of information security systems. SUMMARY
[0003] The technical problem to be solved by the present application is to provide a data encryption method, device, storage medium and electronic device, how to meet the encryption requirements of data. The specific scheme is as follows:
[0004] A data encryption method, comprising:
[0005] In the case of receiving a data encryption request, obtaining the target data to be encrypted and the encryption key in the data encryption request;
[0006] Based on the length of the modulus of the encryption key, determine the target modulus multiplication operation length of the target data corresponding to the modulus power operation task;
[0007] In the case where the target modulus multiplication operation length is greater than the maximum operation length of the encryption module, based on the Montgomery multiplication algorithm, the target data corresponding to the modulus power operation task is decomposed to obtain a sub-operation task sequence, the sub-operation task sequence includes a plurality of sub-operation tasks, each of the sub-operation tasks is one of a sub-modulus multiplication operation task and a sub-modulus addition operation task, and the operation length of each sub-operation task matches the maximum operation length of the encryption module;
[0008] Execute the sub-operation task sequence through the encryption module to obtain the encryption data corresponding to the target data.
[0009] The above method, optionally, based on the Montgomery multiplication algorithm, the target data corresponding to the modulus power operation task is decomposed to obtain a sub-operation task sequence, comprising:
[0010] The modulus power operation task is decomposed into a plurality of Montgomery modulus multiplication operation tasks with a target modulus multiplication operation length through a binary modulus power algorithm;
[0011] For each Montgomery modular multiplication task with a target modular multiplication length, obtain each operand in the Montgomery modular multiplication task, and based on the Montgomery modular multiplication algorithm, split each operand in the Montgomery modular multiplication task into multiple data blocks, wherein the bit width of each data block is less than or equal to the maximum operation length of the encryption module.
[0012] The sub-operation task sequence is generated based on the data blocks after each operand is split.
[0013] Optionally, in the above method, generating the sub-operation task sequence based on the data blocks split from each operand includes:
[0014] According to the calculation process of the CIOS method of Montgomery modular multiplication, the data blocks after splitting each operand are used to generate a multiplication operation sequence and an addition operation sequence; wherein, each multiplication operation in the multiplication operation sequence is used to calculate the product of two data blocks; each addition operation in the addition operation sequence is used to accumulate data blocks or intermediate results; the bit width of both the multiplication operation and the addition operation is less than or equal to the maximum operation length of the encryption module;
[0015] The sub-operation task sequence is formed by combining the multiplication operation sequence and the addition operation sequence.
[0016] Optionally, in the above method, the step of obtaining encrypted data corresponding to the target data by executing the sub-operation task sequence through the encryption module includes:
[0017] Based on the sub-operation task sequence and the preset modulus parameter, a calling instruction for the encryption module is generated; wherein, the calling instruction includes a modular multiplication instruction and a modular addition instruction, the bit width of the preset modulus parameter is equal to the maximum operation length of the encryption module, and each bit of the preset modulus parameter is one;
[0018] The encryption module is invoked based on the invocation instruction to obtain the encryption operation result of the encryption module;
[0019] The encrypted data corresponding to the target data is obtained based on the result of the encryption operation.
[0020] Optionally, in the above method, the step of obtaining encrypted data corresponding to the target data by executing the sub-operation task sequence through the encryption module includes:
[0021] Output the encrypted data corresponding to the target data.
[0022] A data encryption device, comprising:
[0023] The acquisition unit is used to acquire the target data to be encrypted and the encryption key in the data encryption request when a data encryption request is received.
[0024] The determining unit is used to determine the target modular multiplication length of the modular exponentiation task corresponding to the target data based on the length of the modulus of the encryption key.
[0025] The decomposition unit is used to decompose the modular exponentiation task corresponding to the target data based on the Montgomery modular multiplication algorithm when the target modular multiplication operation length is greater than the maximum operation length of the encryption module, to obtain a sub-operation task sequence. The sub-operation task sequence includes multiple sub-operation tasks, each of which is either a sub-modular multiplication operation task or a sub-modular addition operation task, and the operation length of each sub-operation task matches the maximum operation length of the encryption module.
[0026] An execution unit is used to execute the sub-operation task sequence through the encryption module to obtain encrypted data corresponding to the target data.
[0027] Optionally, in the aforementioned apparatus, the decomposition unit includes:
[0028] The decomposition subunit is used to decompose the modular exponentiation task into multiple Montgomery modular multiplication tasks with target modular multiplication lengths using a binary modular exponentiation algorithm.
[0029] The acquisition subunit is used to acquire each operand in the Montgomery modular multiplication task for each target modular multiplication length, and to split each operand in the Montgomery modular multiplication task into multiple data blocks based on the Montgomery modular multiplication algorithm, wherein the bit width of each data block is less than or equal to the maximum operation length of the encryption module.
[0030] A sub-unit is generated to generate the sequence of sub-operation tasks based on the data blocks after each operand is split.
[0031] Optionally, in the aforementioned apparatus, the generation subunit includes:
[0032] The first execution module is used to generate a multiplication operation sequence and an addition operation sequence from the data blocks after splitting each operand according to the calculation process of the CIOS method of Montgomery modular multiplication; wherein, each multiplication operation in the multiplication operation sequence is used to calculate the product of two data blocks; each addition operation in the addition operation sequence is used to accumulate data blocks or intermediate results; the bit width of both the multiplication operation and the addition operation is less than or equal to the maximum operation length of the encryption module;
[0033] The second execution module is used to construct the sub-operation task sequence by combining the multiplication operation sequence and the addition operation sequence.
[0034] A storage medium includes storage instructions, wherein, when the instructions are executed, the device in which the storage medium resides executes the data encryption method described above.
[0035] An electronic device includes a memory and one or more instructions, wherein one or more instructions are stored in the memory and configured to be executed by one or more processors using the data encryption method described above.
[0036] This application provides a data encryption method, apparatus, storage medium, and electronic device. The method includes: upon receiving a data encryption request, obtaining the target data to be encrypted and an encryption key from the data encryption request; determining the target modular multiplication operation length of the modular exponentiation task corresponding to the target data based on the length of the modulus of the encryption key; if the target modular multiplication operation length is greater than the maximum operation length of the encryption module, decomposing the modular exponentiation task corresponding to the target data based on the Montgomery modular multiplication algorithm to obtain a sequence of sub-operation tasks, the sequence of sub-operation tasks including multiple sub-operation tasks, each sub-operation task being one of a sub-modular multiplication operation task and a sub-modular addition operation task, the operation length of each sub-operation task matching the maximum operation length of the encryption module; and executing the sequence of sub-operation tasks through the encryption module to obtain encrypted data corresponding to the target data. By analyzing the matching relationship between the modulus length of the encryption key and the hardware capabilities of the encryption module, the Montgomery modular multiplication algorithm is used when necessary to decompose long-bit-width cryptographic operation tasks into a hardware-processable sequence of sub-tasks. This method enables limited hardware resources to support cryptographic operations with higher security strength, meeting ever-increasing security requirements and achieving a good balance between security and economy. Attached Figure Description
[0037] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.
[0038] Figure 1 A flowchart of a data encryption method provided in this application;
[0039] Figure 2 A flowchart of a process for obtaining encrypted data corresponding to target data is provided in this application;
[0040] Figure 3 A schematic diagram of the structure of a data encryption device provided in this application;
[0041] Figure 4 This is a schematic diagram of the structure of an electronic device provided in this application. Detailed Implementation
[0042] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0043] In this application, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0044] This application provides a data encryption method that can be applied to electronic devices, such as mobile terminals, tablets, servers, or encryption devices. The method flowchart is shown below. Figure 1 As shown, it specifically includes:
[0045] S101: Upon receiving a data encryption request, obtain the target data to be encrypted and the encryption key in the data encryption request.
[0046] In this embodiment, the data encryption request can be a secure communication request from an application, operating system, or hardware component. For example, the data encryption request can be a transaction data encryption request during mobile payment, an upload encryption request for data stored in the cloud, or a transmission encryption request for data collected by an IoT device.
[0047] Optionally, the target data is the raw data that the user or system needs to encrypt and protect. In this application, the target data can be text data, image data, audio data, video data, or binary stream data, etc. For example, in a mobile payment scenario, the target data may include sensitive information such as the user's payment amount, payee information, and transaction timestamp; in a cloud storage scenario, the target data may include the user's documents, photos, or personal settings information, etc.
[0048] The encryption key is the public key in a key pair used to execute public-key cryptographic algorithms. In this application, the encryption key can correspond to the RSA algorithm, the SM2 algorithm, or other public-key cryptosystems based on modular exponentiation. The modulus n contained in the encryption key is the core parameter that determines the encryption strength and security, and its bit length directly affects the complexity of the encryption operation.
[0049] S102: Based on the length of the modulus of the encryption key, determine the target modular multiplication length of the modular exponentiation task corresponding to the target data.
[0050] In this embodiment, the length of the modulus directly determines the security strength of public-key cryptography. For example, when using the RSA-2048 algorithm, the length of the modulus is 2048 bits; when using the RSA-4096 algorithm, the length of the modulus is 4096 bits. The target modular multiplication operation length is related to the length of the modulus. When performing modular exponentiation, the core modular multiplication operation needs to process a bit width that is comparable to the length of the modulus.
[0051] Optionally, determining the target modular multiplication length aims to assess the scale of required computational resources and match it with the hardware capabilities of the encryption module. For example, if the maximum operation length of the encryption module is 1024 bits, then to process an encryption request with a modulus length of 4096 bits, the 4096-bit modular multiplication task needs to be decomposed.
[0052] S103: When the target modular multiplication operation length is greater than the maximum operation length of the encryption module, the modular exponentiation operation task corresponding to the target data is decomposed based on the Montgomery modular multiplication algorithm to obtain a sub-operation task sequence. The sub-operation task sequence includes multiple sub-operation tasks, each of which is either a sub-modular multiplication operation task or a sub-modular addition operation task. The operation length of each sub-operation task matches the maximum operation length of the encryption module.
[0053] In this embodiment, the encryption module can be a hardware accelerator, security chip, or cryptographic coprocessor specifically designed for cryptographic operations. This encryption module natively supports cryptographic instructions with a specific maximum operation length, such as 1024-bit modular multiplication and modular addition operations. When the target modular multiplication operation length exceeds this maximum operation length, task decomposition is required.
[0054] Optionally, the decomposition process based on the Montgomery modular multiplication algorithm includes two levels: First, the modular exponentiation operation is decomposed into multiple Montgomery modular multiplication tasks of target modular multiplication length using a binary modular exponentiation algorithm; then, for each Montgomery modular multiplication task, the CIOS implementation method is used to split its operands into multiple data blocks, generating a sequence consisting of sub-modular multiplication tasks and sub-modular addition tasks. The bit width of the data block is less than or equal to the maximum operation length of the encryption module, ensuring that each sub-operation task can be directly executed on the encryption module.
[0055] For example, when a 4096-bit modular multiplication operation needs to be processed, it can be broken down into a sequence of multiplication and addition operations between multiple 1024-bit data blocks. These operations can be directly processed by an encryption module with a maximum operation length of 1024 bits.
[0056] S104: The encryption module executes the sub-operation task sequence to obtain the encrypted data corresponding to the target data.
[0057] In this embodiment, the execution of the sub-operation task sequence is achieved by calling the modular multiplication and modular addition instructions of the encryption module. To make the modular operation instruction equivalent to a normal multiplication-addition operation, the modulus parameter of the instruction is set to a value of all 1s with a bit width equal to the maximum operation length of the encryption module. In this way, arithmetic operations can be completed without changing the hardware design.
[0058] During execution, each sub-modular multiplication and sub-modular addition task is processed sequentially according to the logical order of the sub-operation task sequence. Intermediate results are combined according to the combination logic of the Montgomery modular multiplication algorithm to finally obtain the result of the target modular multiplication operation length. Based on the results of each Montgomery modular multiplication operation, the results are combined using the execution logic of the binary modular exponentiation algorithm to finally complete the modular exponentiation operation and obtain the encrypted data corresponding to the target data.
[0059] As can be seen from the above, in this application, when an electronic device receives a data encryption request, it analyzes the matching relationship between the modulus length of the encryption key and the hardware capabilities of the encryption module. When necessary, it uses the Montgomery modular multiplication algorithm to decompose the long-bit-width cryptographic operation task into a sequence of hardware-processable subtasks. This method enables limited hardware resources to support cryptographic operations with higher security strengths, meeting ever-increasing security requirements and achieving a good balance between security and economy.
[0060] In one embodiment provided in this application, based on the above-described scheme, optionally, the step of decomposing the modular exponentiation task corresponding to the target data based on the Montgomery modular multiplication algorithm to obtain a sequence of sub-operation tasks includes:
[0061] The modular exponentiation task is decomposed into multiple Montgomery modular multiplication tasks with target modular multiplication lengths using a binary modular exponentiation algorithm.
[0062] For each Montgomery modular multiplication task with a target modular multiplication length, obtain each operand in the Montgomery modular multiplication task, and based on the Montgomery modular multiplication algorithm, split each operand in the Montgomery modular multiplication task into multiple data blocks, wherein the bit width of each data block is less than or equal to the maximum operation length of the encryption module.
[0063] The sub-operation task sequence is generated based on the data blocks after each operand is split.
[0064] In this embodiment, the binary modular exponentiation algorithm transforms the complex modular exponentiation operation into a series of modular multiplication operations by expanding the exponent into binary. The algorithm iterates through each binary bit of the exponent, determining whether to perform additional modular multiplication operations based on the bit values. This transforms a modular exponentiation operation of the form a^b mod n into multiple sequentially executed Montgomery modular multiplication operations, where 'a' can represent the target data to be encrypted, or data converted from the target data, and 'b' can be the exponent of the encryption key.
[0065] In the Montgomery modular multiplication task, the operands include all the parameters involved in the modular multiplication operation. For example, in the operation s = montgomery(s, t), the operands include the current state value s, the multiplier t, and the modulus n. These operands are all large integers of the target modular multiplication length and cannot be directly processed by the encryption module.
[0066] The process of splitting operands into data blocks based on the Montgomery modular multiplication algorithm can be implemented using the CIOS method of Montgomery modular multiplication. This method treats each operand as an array of multiple data blocks with smaller bit widths, where the bit width of the data block is determined by the maximum operation length of the encryption module. For example, when the maximum operation length of the encryption module is 1024 bits, and the target modular multiplication operation length is 4096 bits, each operand can be split into four 1024-bit data blocks. Furthermore, when using a 32-bit processor architecture, the bit width of the data block can be selected as 32 bits to accommodate the processor's native computing power.
[0067] When generating the sub-operation task sequence, based on the computation steps of the Montgomery modular multiplication algorithm, the data blocks after each operand is split are organized into an ordered sequence of operations. This sequence includes multiple sub-modular multiplication and sub-modular addition tasks, where the data bit width processed by each sub-operation task does not exceed the maximum operation length of the encryption module. For example, in the CIOS method, this sequence includes a sequence of multiplication operations and a sequence of addition operations between data blocks. Through the organic combination of these basic operations, the complete Montgomery modular multiplication effect is ultimately achieved.
[0068] Through the above decomposition process, long-width modular exponentiation operations, which were originally impossible for the encryption module to process directly, are transformed into a series of sub-operation tasks that the encryption module can execute. This enables high-strength cryptographic operations to be supported with limited hardware resources, balancing security with hardware cost and performance requirements.
[0069] In one embodiment provided in this application, based on the above-described scheme, optionally, generating the sub-operation task sequence based on the data blocks after splitting each operand includes:
[0070] Based on the calculation process of the coarse-grained operand scanning method CIOS of Montgomery modular multiplication, the data blocks after splitting each operand are used to generate multiplication operation sequences and addition operation sequences; wherein, each multiplication operation in the multiplication operation sequence is used to calculate the product of two data blocks; each addition operation in the addition operation sequence is used to accumulate data blocks or intermediate results; the bit width of both multiplication and addition operations is less than or equal to the maximum operation length of the encryption module;
[0071] The sub-operation task sequence is formed by combining the multiplication operation sequence and the addition operation sequence.
[0072] The multiplication operation sequence consists of multiple independent multiplication operations, each handling the multiplication of two data blocks. For example, when the data block width is 32 bits, each multiplication operation calculates the product of two 32-bit numbers, producing a 64-bit intermediate result. These multiplication operations are arranged in an ordered manner according to the computation steps of the CIOS method, ensuring the correctness and completeness of the computation process.
[0073] Optionally, the addition operation sequence includes operations that accumulate data blocks or intermediate results produced by multiplication.
[0074] In this embodiment, a complete sub-operation task sequence is formed by organically combining the multiplication operation sequence and the addition operation sequence. By executing each multiplication and addition operation in the sequence in sequence, the long-width Montgomery modular multiplication operation, which was originally impossible for the encryption module to process directly, can be completed equivalently.
[0075] In one embodiment provided in this application, based on the above scheme, optionally, the process of obtaining encrypted data corresponding to the target data by executing the sub-operation task sequence through the encryption module is as follows: Figure 2 As shown, it includes:
[0076] S201: Generate a calling instruction for the encryption module based on the sub-operation task sequence and the preset modulus parameter; wherein the calling instruction includes a modular multiplication instruction and a modular addition instruction, the bit width of the preset modulus parameter is equal to the maximum operation length of the encryption module, and each bit of the preset modulus parameter is one.
[0077] The process of generating the calling instructions includes parsing each sub-operation task in the sub-operation task sequence and mapping it to instructions supported by the encryption module. For a sub-modular multiplication task, a corresponding modular multiplication calling instruction is generated; for a sub-modular addition task, a corresponding modular addition calling instruction is generated. All calling instructions are configured with the preset modulus parameter as the modulus for the modular operation.
[0078] When executing the call instructions, the encryption module processes each modular multiplication and addition operation sequentially according to the instruction sequence. Since the preset modulus parameter is all 1s, the encryption module actually performs ordinary multiplication and addition operations when executing these instructions, but its calculation process still benefits from the performance advantages brought by hardware acceleration. Specifically, a 1024-bit modular multiplication instruction, after setting the modulus to all 1s, will produce the exact same result as a normal 1024-bit multiplication operation.
[0079] In this embodiment, by setting the modulus parameter to a value of all 1s equal to the maximum operational length of the encryption module, the modular multiplication and modular addition instructions will not change the calculation result during execution because the operands are always less than this special modulus. Therefore, the modular multiplication instruction is equivalent to a regular multiplication operation, and the modular addition instruction is equivalent to a regular addition operation. For example, when the maximum operational length of the encryption module is 1024 bits, the preset modulus parameter is set to a 1024-bit value of all 1s.
[0080] S202: Invoke the encryption module based on the invocation instruction to obtain the encryption operation result of the encryption module.
[0081] S203: Obtain the encrypted data corresponding to the target data based on the encryption operation result.
[0082] In this embodiment, the process of obtaining the encrypted data corresponding to the target data based on the encryption operation result includes multiple levels of combination operations. First, the intermediate results of each basic operation are integrated according to the combination logic of the Montgomery modular multiplication algorithm to obtain the complete Montgomery modular multiplication operation result; then, multiple Montgomery modular multiplication operation results are combined according to the execution logic of the binary modular exponentiation algorithm to finally obtain the result of the modular exponentiation operation, that is, the encrypted data corresponding to the target data.
[0083] In one embodiment provided in this application, based on the above scheme, optionally, the step of obtaining encrypted data corresponding to the target data by executing the sub-operation task sequence through the encryption module includes:
[0084] Output the encrypted data corresponding to the target data.
[0085] In this embodiment, the output encrypted data can be used in various security scenarios. For example, in secure communication, the data can be used as transmitted ciphertext data; in digital signature applications, the data can be used as a component of the signature value.
[0086] To illustrate the specific implementation process and principles of this application in detail, the following examples are provided:
[0087] In a general 32-bit processor architecture, multiple 32-bit data units are combined to represent large integers, so the base value w in the implementation is generally taken as 2^32.
[0088] To implement the RSA-4096 algorithm, which performs modular exponentiation of a 4096-bit length, the following processing flow is adopted:
[0089] Step 1: Convert the modular exponentiation operation into a modular multiplication sequence. The specific goal is to calculate s = a^b mod n. In this embodiment, the exponent b can be represented in binary form as b_k, b_(k-1) ... b_1, b_0, where the highest bit b_k ≠ 0. Initialization: s = montgomery(aR² mod n), t = montgomery(aR² mod n). Loop execution: Decrement from i = k-1 to 0; calculate s = montgomery(s*s mod n); if b_i = 1, then calculate s = montgomery(s*t mod n). Final calculation: s = montgomery(s*1 mod n). Note
[0090] Where R² = 2^(4096*2) mod n. This step transforms the modular exponentiation operation into a series of Montgomery modular multiplication operations.
[0091] Step 2: Decompose the modular multiplication operation into 1024-bit units. In this embodiment, based on the Montgomery algorithm, the 4096-bit modular multiplication operation is decomposed into an operation sequence with 1024-bit basic units. Using this method, the maximum bit width of all basic operations is 1024 bits.
[0092] Step 3: Hardware instruction mapping implementation. In this embodiment, all basic operations are 1024-bit addition and multiplication. The modulus can be set to a 2048-bit all-1 value. Under this configuration, although modulo arithmetic instructions are called, the actual operation result is equivalent to that of ordinary addition and multiplication because the operands are much smaller than the modulus.
[0093] In this embodiment, through the above process, the 4096-bit modular exponentiation is first decomposed into a 4096-bit Montgomery modular multiplication sequence, and then decomposed into 1024-bit addition and multiplication operations using the CIOS method, ultimately mapping to the 2048-bit modular arithmetic instructions supported by the hardware. This series of transformations enables high-bit-width cryptographic operations to be implemented with limited hardware resources.
[0094] and Figure 1 Corresponding to the method described herein, embodiments of this application also provide a data encryption device, applied to electronic devices, for use in encryption of data. Figure 1 The specific implementation of the method is shown in the schematic diagram of the device. Figure 3 As shown, it includes:
[0095] The acquisition unit 301 is used to acquire the target data to be encrypted and the encryption key in the data encryption request when a data encryption request is received;
[0096] The determining unit 302 is used to determine the target modular multiplication length of the modular exponentiation task corresponding to the target data based on the length of the modulus of the encryption key.
[0097] The decomposition unit 303 is used to decompose the modular exponentiation task corresponding to the target data based on the Montgomery modular multiplication algorithm when the target modular multiplication operation length is greater than the maximum operation length of the encryption module, to obtain a sub-operation task sequence. The sub-operation task sequence includes multiple sub-operation tasks, each of which is either a sub-modular multiplication operation task or a sub-modular addition operation task, and the operation length of each sub-operation task matches the maximum operation length of the encryption module.
[0098] The execution unit 304 is used to execute the sub-operation task sequence through the encryption module to obtain the encrypted data corresponding to the target data.
[0099] In one embodiment provided in this application, based on the above-described solution, optionally, the decomposition unit 303 includes:
[0100] The decomposition subunit is used to decompose the modular exponentiation task into multiple Montgomery modular multiplication tasks with target modular multiplication lengths using a binary modular exponentiation algorithm.
[0101] The acquisition subunit is used to acquire each operand in the Montgomery modular multiplication task for each target modular multiplication length, and to split each operand in the Montgomery modular multiplication task into multiple data blocks based on the Montgomery modular multiplication algorithm, wherein the bit width of each data block is less than or equal to the maximum operation length of the encryption module.
[0102] A sub-unit is generated to generate the sequence of sub-operation tasks based on the data blocks after each operand is split.
[0103] In one embodiment provided in this application, based on the above-described scheme, optionally, the generating subunit includes:
[0104] The first execution module is used to generate a multiplication operation sequence and an addition operation sequence from the data blocks after splitting each operand according to the calculation process of the CIOS method of Montgomery modular multiplication; wherein, each multiplication operation in the multiplication operation sequence is used to calculate the product of two data blocks; each addition operation in the addition operation sequence is used to accumulate data blocks or intermediate results; the bit width of both the multiplication operation and the addition operation is less than or equal to the maximum operation length of the encryption module;
[0105] The second execution module is used to construct the sub-operation task sequence by combining the multiplication operation sequence and the addition operation sequence.
[0106] The specific principles and execution processes of each unit and module in the data encryption device disclosed in the above embodiments of this application are related to... Figure 1 The data encryption methods disclosed in the embodiments are the same, and can be found in the corresponding parts of the data encryption methods provided in the embodiments of this application above, which will not be repeated here.
[0107] This application also provides a storage medium, which includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the above-described data encryption method or the above-described control method for a mobile device.
[0108] This application also provides an electronic device, the structural schematic diagram of which is shown below. Figure 4 As shown, it specifically includes a memory 401 and one or more instructions 402, wherein one or more instructions 402 are stored in the memory 401 and are configured to be executed by one or more processors 403 to perform the above-mentioned data encryption method.
[0109] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For apparatus embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.
[0110] Finally, it should be noted that in this paper, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations.
[0111] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.
[0112] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.
[0113] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.
Claims
1. A data encryption method, characterized in that, include: Upon receiving a data encryption request, obtain the target data to be encrypted and the encryption key in the data encryption request; Based on the length of the modulus of the encryption key, determine the target modular multiplication length of the modular exponentiation task corresponding to the target data; When the target modular multiplication operation length is greater than the maximum operation length of the encryption module, the modular exponentiation operation task corresponding to the target data is decomposed based on the Montgomery modular multiplication algorithm to obtain a sub-operation task sequence. The sub-operation task sequence includes multiple sub-operation tasks, each of which is either a sub-modular multiplication operation task or a sub-modular addition operation task. The operation length of each sub-operation task matches the maximum operation length of the encryption module. The encryption module executes the sub-operation task sequence to obtain the encrypted data corresponding to the target data.
2. The method according to claim 1, characterized in that, The Montgomery modular multiplication algorithm decomposes the modular exponentiation task corresponding to the target data into a sequence of sub-tasks, including: The modular exponentiation task is decomposed into multiple Montgomery modular multiplication tasks with target modular multiplication lengths using a binary modular exponentiation algorithm. For each Montgomery modular multiplication task with a target modular multiplication length, obtain each operand in the Montgomery modular multiplication task, and based on the Montgomery modular multiplication algorithm, split each operand in the Montgomery modular multiplication task into multiple data blocks, wherein the bit width of each data block is less than or equal to the maximum operation length of the encryption module. The sub-operation task sequence is generated based on the data blocks after each operand is split.
3. The method according to claim 2, characterized in that, The step of generating the sub-operation task sequence based on the data blocks split from each operand includes: Based on the calculation process of the coarse-grained operand scanning method CIOS of Montgomery modular multiplication, the data blocks after splitting each operand are used to generate multiplication operation sequences and addition operation sequences; wherein, each multiplication operation in the multiplication operation sequence is used to calculate the product of two data blocks; each addition operation in the addition operation sequence is used to accumulate data blocks or intermediate results; the bit width of both multiplication and addition operations is less than or equal to the maximum operation length of the encryption module; The sub-operation task sequence is formed by combining the multiplication operation sequence and the addition operation sequence.
4. The method according to claim 3, characterized in that, The step of executing the sub-operation task sequence through the encryption module to obtain the encrypted data corresponding to the target data includes: Based on the sub-operation task sequence and the preset modulus parameter, a calling instruction for the encryption module is generated; wherein, the calling instruction includes a modular multiplication instruction and a modular addition instruction, the bit width of the preset modulus parameter is equal to the maximum operation length of the encryption module, and each bit of the preset modulus parameter is one; The encryption module is invoked based on the invocation instruction to obtain the encryption operation result of the encryption module; The encrypted data corresponding to the target data is obtained based on the result of the encryption operation.
5. The method according to claim 1, characterized in that, The step of executing the sub-operation task sequence through the encryption module to obtain the encrypted data corresponding to the target data includes: Output the encrypted data corresponding to the target data.
6. A data encryption device, characterized in that, include: The acquisition unit is used to acquire the target data to be encrypted and the encryption key in the data encryption request when a data encryption request is received; The determining unit is used to determine the target modular multiplication length of the modular exponentiation task corresponding to the target data based on the length of the modulus of the encryption key. The decomposition unit is used to decompose the modular exponentiation task corresponding to the target data based on the Montgomery modular multiplication algorithm when the target modular multiplication operation length is greater than the maximum operation length of the encryption module, to obtain a sub-operation task sequence. The sub-operation task sequence includes multiple sub-operation tasks, each of which is either a sub-modular multiplication operation task or a sub-modular addition operation task, and the operation length of each sub-operation task matches the maximum operation length of the encryption module. An execution unit is used to execute the sub-operation task sequence through the encryption module to obtain encrypted data corresponding to the target data.
7. The apparatus according to claim 6, characterized in that, The decomposition unit includes: Decomposition subunits are used to decompose the modular exponentiation task into multiple Montgomery modular multiplication tasks of target modular multiplication length using a binary modular exponentiation algorithm. The acquisition subunit is used to acquire each operand in the Montgomery modular multiplication task for each target modular multiplication length, and to split each operand in the Montgomery modular multiplication task into multiple data blocks based on the Montgomery modular multiplication algorithm, wherein the bit width of each data block is less than or equal to the maximum operation length of the encryption module. A sub-unit is generated to generate the sequence of sub-operation tasks based on the data blocks after each operand is split.
8. The apparatus according to claim 7, characterized in that, The generating subunit includes: The first execution module is used to generate a multiplication operation sequence and an addition operation sequence from the data blocks after splitting each operand according to the calculation process of the CIOS method of Montgomery modular multiplication; wherein, each multiplication operation in the multiplication operation sequence is used to calculate the product of two data blocks; each addition operation in the addition operation sequence is used to accumulate data blocks or intermediate results; the bit width of both the multiplication operation and the addition operation is less than or equal to the maximum operation length of the encryption module; The second execution module is used to form the sub-operation task sequence by combining the multiplication operation sequence and the addition operation sequence.
9. A storage medium, characterized in that, The storage medium includes storage instructions, wherein when the instructions are executed, the device containing the storage medium is controlled to perform the data encryption method as described in any one of claims 1 to 5.
10. An electronic device, characterized in that, It includes a memory, and one or more instructions, wherein one or more instructions are stored in the memory and configured to be executed by one or more processors as described in any one of claims 1 to 5.