Firmware encryption method and system based on JWE

Abstract

The invention discloses a firmware encryption method based on JWE. The method comprises the following steps: creating a JWE object based on firmware information and firmware data of firmware to be encrypted; performing data segmentation on the JWE object to obtain a plurality of data blocks; then, processing each data block, and splicing the plurality of processed data blocks to obtain an encrypted firmware file; by using a JWE encryption mechanism, the confidentiality and integrity of firmware data are effectively protected, and flexible key management, a standardized encryption mode and wide compatibility are provided; according to the method, the security, the reliability and the anti-attack capability in the equipment firmware updating process can be greatly improved, so that the method has wide application prospects and practical significance in the fields of Internet of Things equipment, embedded systems and the like.

Description

Technical Field

[0001] This invention relates to the field of chip encryption technology, and in particular to a firmware encryption method and system based on JWE. Background Technology

[0002] Firmware encryption refers to the technology of encrypting the firmware in hardware devices. Firmware is software embedded in hardware, typically the program code necessary for the device to function properly. By encrypting firmware, its content can be protected from unauthorized tampering, reverse engineering, piracy, or malware attacks.

[0003] Traditional firmware encryption algorithms mainly include symmetric encryption algorithms such as DES and AES, and asymmetric encryption algorithms such as RSA and ECC. AES encryption and decryption use the same key, while DES encryption requires a 128-bit key, which is relatively long and leads to difficulties in key management. Asymmetric encryption algorithms like RSA and ECC are computationally complex and slow. Therefore, while traditional firmware encryption methods can provide a certain level of protection, they often suffer from low encryption efficiency and poor compatibility.

[0004] Therefore, a new solution is needed. Summary of the Invention

[0005] The main objective of this invention is to address the problems of low encryption efficiency and poor compatibility of traditional firmware encryption methods by providing a firmware encryption method and system based on JWE.

[0006] To achieve the above objectives, this invention provides a firmware encryption method based on JWE, comprising the following steps:

[0007] Create a JWE object based on the firmware information and firmware data of the firmware to be encrypted;

[0008] The JWE object is segmented into multiple data blocks; and

[0009] Each data block is processed, and the processed data blocks are then concatenated to obtain an encrypted firmware file.

[0010] In the firmware encryption method based on JWE provided by this invention, the step of creating a JWE object based on the firmware information and firmware data of the firmware to be encrypted includes:

[0011] Based on the firmware information of the firmware to be encrypted, the header of the JWE object is generated;

[0012] Based on the firmware data of the firmware to be encrypted, generate the ciphertext of the JWE object;

[0013] Based on the selected encryption key, the header and the ciphertext are JWE encrypted to generate the JWE object.

[0014] In the JWE-based firmware encryption method provided by this invention, after the step of creating a JWE object based on the firmware information and firmware data of the firmware to be encrypted, the method further includes:

[0015] Based on the standard format of JWE objects, determine whether the creation of a JWE object was successful.

[0016] In the JWE-based firmware encryption method provided by this invention, the steps of processing each data block and concatenating the processed data blocks to obtain the encrypted firmware file include:

[0017] The first and last four bytes of two consecutive data blocks are swapped to obtain multiple processed data blocks;

[0018] Each processed data block is concatenated in reverse order using special characters to obtain the encrypted firmware file.

[0019] Furthermore, to achieve the above objectives, the present invention also provides a firmware encryption system based on JWE, comprising:

[0020] The JWE object creation module is used to create JWE objects based on the firmware information and firmware data of the firmware to be encrypted.

[0021] A data segmentation module is used to segment the JWE object into multiple data blocks; and

[0022] The data processing module is used to process each of the data blocks and then concatenate the processed data blocks to obtain an encrypted firmware file.

[0023] In the JWE-based firmware encryption system provided by this invention, the JWE object creation module includes:

[0024] The data generation unit is used to generate the header of the JWE object based on the firmware information of the firmware to be encrypted, and to generate the ciphertext of the JWE object based on the firmware data of the firmware to be encrypted.

[0025] A data encryption unit is used to perform JWE encryption on the header and the ciphertext based on a selected encryption key to generate the JWE object.

[0026] In the JWE-based firmware encryption system provided by this invention, the JWE object creation module further includes a verification unit, which is used to determine whether the created JWE object is successful based on the standard format of the JWE object.

[0027] In the JWE-based firmware encryption system provided by this invention, the data processing module includes:

[0028] The processing unit is used to swap the first and last four bytes of two consecutive data blocks to obtain multiple processed data blocks;

[0029] The splicing unit is used to concatenate each processed data block in reverse order using special characters to obtain the encrypted firmware file.

[0030] The present invention also provides a firmware encryption device based on JWE, including a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, it implements the steps of the firmware encryption method based on JWE as described above.

[0031] The present invention also provides a storage medium storing one or more programs, which can be executed by one or more processors to implement the steps of the JWE-based firmware encryption method as described above.

[0032] The firmware encryption system and method based on JWE provided by this invention have the following beneficial effects: Based on the firmware information and firmware data of the firmware to be encrypted, this invention creates a JWE object; the JWE object is segmented into multiple data blocks; each data block is then processed, and the processed multiple data blocks are concatenated to obtain the encrypted firmware file; by utilizing the JWE encryption mechanism, not only is the confidentiality and integrity of firmware data effectively protected, but also flexible key management, standardized encryption methods, and broad compatibility are provided; it can significantly improve the security, reliability, and anti-attack capabilities of device firmware updates, making it widely applicable and of practical significance in fields such as IoT devices and embedded systems. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort:

[0034] Figure 1 The diagram shows a flowchart of a firmware encryption method based on JWE provided in an embodiment of the present invention. Detailed Implementation

[0035] To facilitate understanding of the present invention, a more complete description will be given below with reference to the accompanying drawings. Typical embodiments of the invention are shown in the drawings. However, the invention can be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete.

[0036] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention.

[0037] Figure 1 The diagram shows a flowchart of a firmware encryption method based on JWE provided in an embodiment of the present invention. Figure 1 As shown, the JWE-based firmware encryption method includes the following steps:

[0038] Step S1: Create a JWE object based on the firmware information and firmware data of the firmware to be encrypted;

[0039] Specifically, in one embodiment of the present invention, a JWE (JSON Web Encryption) object is a standard encryption format that defines how encrypted data is embedded into a JSON structure for transmission. The JWE specification is part of the JWT (JSON Web Token) family of standards, which allows sensitive information to be encrypted within JSON data and ensures data protection during transmission. Specifically, a JWE object typically includes the following parts:

[0040] Header: Typically contains information about the encryption algorithm (such as encryption algorithm, signature algorithm, etc.) and other metadata. It is formatted as a Base64URL-encoded string containing a JSON object.

[0041] Encrypted Key: A symmetric key encrypted using a key exchange algorithm. This key is used to encrypt the actual data portion.

[0042] Initialization Vector (IV): A random value used in the encryption process to ensure that the encryption results are different even with the same encryption key. This field is usually a randomly generated string (usually 128 or 256 bits).

[0043] Ciphertext: The encrypted message content, i.e., sensitive information that needs to be protected;

[0044] Authentication Tag: Used to verify data integrity and ensure that encrypted data has not been tampered with. This tag is typically generated using an authentication encryption algorithm (such as GCM).

[0045] In this embodiment, a JWE object is first created, and firmware information and firmware data are added to the JWE for encryption. Firmware information includes descriptive or metadata about the firmware itself, helping users or the system identify and manage the firmware. Firmware information includes, but is not limited to, the following: version number, release date, author / developer, hardware compatibility, functional description, device identification information, etc. This information is usually part of the firmware and is stored in the header of the firmware file or a dedicated configuration area, helping users or the system understand the basic information about the firmware. Firmware data refers to the actual code and data required for the firmware to execute. It constitutes the core content of the firmware and directly affects the operation of the hardware device. Firmware data includes program code, configuration data, and stored data. Program code is the machine code or instructions in the firmware that implement specific functions, usually the low-level control logic for specific hardware. Configuration data is used for various parameters, settings, and options during firmware runtime. Stored data includes device initialization parameters, calibration data, or runtime status data, etc.

[0046] Therefore, step S1 includes: generating the header of the JWE object based on the firmware information of the firmware to be encrypted; generating the ciphertext of the JWE object based on the firmware data of the firmware to be encrypted; and performing JWE encryption on the header and the ciphertext based on the selected encryption key to generate the JWE object.

[0047] In this example, firmware information, such as firmware version and functionality, which helps identify and manage the firmware, is added to the header of the JWE object. Firmware data controlling the device's behavior and functions is added to the ciphertext of the JWE object, and then encrypted using a selected encryption key. JWE provides a flexible data encryption mechanism, supporting different encryption algorithms (such as symmetric and asymmetric encryption), allowing users to choose the appropriate scheme based on their application scenario. JWE not only provides data encryption protection but also ensures data integrity, preventing tampering during transmission. Through signature or hashing techniques, JWE can verify whether the firmware file has been tampered with during transmission. JWE is a standardized encryption format, widely supported and documented, ensuring compatibility with different systems and platforms, facilitating secure cross-platform communication.

[0048] In this embodiment, by adding firmware metadata to the JWE header and transmitting encrypted firmware data as ciphertext, secure protection of the firmware file can be achieved. This approach not only ensures the confidentiality of firmware data but also improves system security and flexibility through a standardized encryption mechanism. JWE's encryption and integrity verification functions are well-suited for firmware management and device security, especially in IoT and embedded device applications.

[0049] Furthermore, in one embodiment of the present invention, after creating the JWE object, it is also necessary to determine whether the creation process was successful. That is, after step S1, it is also necessary to determine whether the created JWE object was successful based on the standard format of the JWE object. JWE has a standard format that generates five parts separated by dots (.). If the generation fails, it may be due to missing necessary fields. It is necessary to check the fields required in the JOSE header and check whether related libraries or dependencies are missing.

[0050] In embodiments of the present invention, after creating a JWE object, its successful generation is ensured by checking its standard format and the required fields of the JOSE header. This not only guarantees the correctness of the encryption process but also helps identify potential dependency issues or implementation errors. This checking mechanism effectively avoids security risks caused by formatting problems, thereby ensuring the stability and security of the system.

[0051] Step S2: Perform data segmentation on the JWE object to obtain multiple data blocks;

[0052] Specifically, in one embodiment of the present invention, the ciphertext portion of the JWE object (usually encrypted payload data) is split into multiple data blocks to facilitate more efficient processing of this data. The fifth part of the JWE object is the ciphertext, which is the encrypted original data. To perform data segmentation, the ciphertext portion first needs to be extracted from the JWE string.

[0053] Specifically, in one embodiment of the present invention, the size of the ciphertext may affect the data segmentation method. For encrypted data, segmentation can be performed according to a fixed-size segmentation or a dynamic-size segmentation strategy. Fixed-size segmentation divides the ciphertext into fixed sizes (e.g., 512 bytes, 1024 bytes, etc.), ensuring each data block is the same size, suitable for large data transmission or storage. Dynamic-size segmentation dynamically determines the size of each data block based on actual conditions (e.g., network bandwidth, storage space, etc.), avoiding performance bottlenecks caused by excessively large data blocks.

[0054] In this embodiment, the ciphertext portion of the JWE object is split into multiple smaller data blocks through data segmentation. Appropriate segmentation improves the system's flexibility and efficiency while ensuring the integrity and security of the encrypted data.

[0055] Step S3: Process each data block, and then concatenate the processed data blocks to obtain the encrypted firmware file;

[0056] Specifically, in one embodiment of the present invention, after data segmentation, in order to ensure that each data block can be correctly restored at the receiving end, the segmented data needs to be processed to add an identifier or sequence number to each data block so that the receiver knows how to reassemble these data blocks. Therefore, step S3 includes: swapping the first and last four bytes of two consecutive data blocks to obtain multiple processed data blocks; reversing the order and concatenating each processed data block with special characters to obtain the encrypted firmware file.

[0057] In this embodiment, the first and last four bytes of connected data blocks are swapped, for example:

[0058] - Data block 1: ˋ[A1,A2,A3,A4,...]ˋ (A1,A2,A3,A4 are bytes)

[0059] - Data block 2: ˋ[B1,B2,B3,B4,...]ˋ (B1,B2,B3,B4 are bytes)

[0060] After the swap:

[0061] - Data block 1: ˋ[B1,B2,B3,B4,...]ˋ

[0062] - Data block 2: ˋ[A1,A2,A3,A4,...]ˋ

[0063] Then, the processed data blocks are concatenated in reverse order. Reverse concatenation means arranging the processed data blocks in reverse order and connecting them with a special character (such as ˋ0x00ˋ or other symbols). For example, if the processed data blocks are ˋ[block1,block2,block3]ˋ, then the reverse concatenation result should be: block3+0x00+block2+0x00+block1.

[0064] The complexity of the encrypted data is increased by manipulating each pair of adjacent data blocks, swapping specific bytes of them; the final encrypted firmware file is formed by reversing the processed data blocks and concatenating them with special characters.

[0065] This invention uses JWE to encrypt firmware, ensuring that the firmware content is not accessed or tampered with by unauthorized third parties during transmission. Especially in IoT and embedded systems where devices require remote upgrades or transmission of sensitive firmware, data encryption is a fundamental guarantee of device security. JWE not only provides encryption but also ensures the firmware is not tampered with during transmission through integrity verification mechanisms (such as hashing or signatures). JWE supports multiple encryption algorithms, including symmetric and asymmetric keys. For different application scenarios, appropriate key exchange and management strategies can be selected according to requirements. This flexibility makes the system more adaptable in encryption implementation and key management. By embedding metadata such as firmware version information and functional descriptions into the JWE header, the receiver can directly know the firmware version number and related features before decryption. This allows devices to more intelligently select the appropriate firmware version, avoiding functional abnormalities or device unavailability due to version incompatibility. JWE is a standardized encryption format that supports mainstream encryption algorithms and tools. Its broad support makes system design easier to implement and compatible with multiple platforms, devices, and services, making it particularly suitable for cross-platform firmware management.

[0066] The present invention also provides a firmware encryption system based on JWE, comprising: a JWE object creation module for creating a JWE object based on firmware information and firmware data of the firmware to be encrypted; a data segmentation module for segmenting the JWE object into multiple data blocks; and a data processing module for processing each data block and concatenating the processed multiple data blocks to obtain an encrypted firmware file.

[0067] Specifically, in one embodiment of the present invention, the JWE object creation module includes: a data generation unit, configured to generate the header of the JWE object based on the firmware information of the firmware to be encrypted, and generate the ciphertext of the JWE object based on the firmware data of the firmware to be encrypted; a data encryption unit, configured to perform JWE encryption on the header and the ciphertext based on a selected encryption key to generate the JWE object; and a verification unit, configured to determine whether the created JWE object was successfully created based on the standard format of the JWE object.

[0068] Specifically, in one embodiment of the present invention, the data processing module includes: a processing unit, used to swap the first and last four bytes of two consecutive data blocks to obtain multiple processed data blocks; and a splicing unit, used to splice each processed data block in reverse order using special characters to obtain the encrypted firmware file.

[0069] This invention also provides a firmware encryption device based on JWE, which may include:

[0070] Memory, used to store computer programs;

[0071] When a processor executes a computer program stored in the aforementioned memory, it can perform the following steps:

[0072] Based on the firmware information and firmware data of the firmware to be encrypted, a JWE object is created; the JWE object is segmented into multiple data blocks; each data block is processed, and the processed multiple data blocks are concatenated to obtain the encrypted firmware file.

[0073] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can perform the following steps;

[0074] Based on the firmware information and firmware data of the firmware to be encrypted, a JWE object is created; the JWE object is segmented into multiple data blocks; each data block is processed, and the processed multiple data blocks are concatenated to obtain the encrypted firmware file.

[0075] The computer-readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM) > random access memory (RAM), magnetic disks, or optical disks.

[0076] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0077] Similarly, it should be understood that, in order to simplify this disclosure and aid in understanding one or more of the various aspects of the invention, in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together in a single embodiment, figure, or description thereof. However, this method of disclosure should not be construed as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as reflected in the following claims, inventive aspects lie in fewer than all features of a single foregoing disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into this detailed description, wherein each claim itself is a separate embodiment of the invention.

[0078] Furthermore, those skilled in the art will understand that although some embodiments herein include certain features included in other embodiments but not others, combinations of features from different embodiments are intended to be within the scope of the invention and form different embodiments. For example, in the following claims, any of the claimed embodiments can be used in any combination.

[0079] It should be noted that the above embodiments are illustrative of the invention and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.

Claims

1. A firmware encryption method based on JWE, characterized in that, Includes the following steps: Create a JWE object based on the firmware information and firmware data of the firmware to be encrypted; The JWE object is segmented into multiple data blocks; as well as Each data block is processed, and the processed data blocks are then concatenated to obtain an encrypted firmware file.

2. The firmware encryption method based on JWE as described in claim 1, characterized in that, The steps to create a JWE object based on the firmware information and firmware data of the firmware to be encrypted include: Based on the firmware information of the firmware to be encrypted, the header of the JWE object is generated; Based on the firmware data of the firmware to be encrypted, generate the ciphertext of the JWE object; Based on the selected encryption key, the header and the ciphertext are JWE encrypted to generate the JWE object.

3. The firmware encryption method based on JWE as described in claim 2, characterized in that, Following the step of creating a JWE object based on the firmware information and firmware data of the firmware to be encrypted, the following also applies: Based on the standard format of JWE objects, determine whether the creation of a JWE object was successful.

4. The firmware encryption method based on JWE as described in claim 1, characterized in that, The steps of processing each data block and concatenating the processed data blocks to obtain the encrypted firmware file include: The first and last four bytes of two consecutive data blocks are swapped to obtain multiple processed data blocks; Each processed data block is concatenated in reverse order using special characters to obtain the encrypted firmware file.

5. A firmware encryption system based on JWE, characterized in that, include: The JWE object creation module is used to create JWE objects based on the firmware information and firmware data of the firmware to be encrypted. The data segmentation module is used to segment the JWE object into multiple data blocks. as well as The data processing module is used to process each of the data blocks and then concatenate the processed data blocks to obtain an encrypted firmware file.

6. The firmware encryption system based on JWE as described in claim 5, characterized in that, The JWE object creation module includes: The data generation unit is used to generate the header of the JWE object based on the firmware information of the firmware to be encrypted, and to generate the ciphertext of the JWE object based on the firmware data of the firmware to be encrypted. A data encryption unit is used to perform JWE encryption on the header and the ciphertext based on a selected encryption key to generate the JWE object.

7. The firmware encryption system based on JWE as described in claim 6, characterized in that, The JWE object creation module also includes a verification unit, which is used to determine whether the created JWE object was successful based on the standard format of the JWE object.

8. The firmware encryption system based on JWE as described in claim 5, characterized in that, The data processing module includes: The processing unit is used to swap the first and last four bytes of two consecutive data blocks to obtain multiple processed data blocks; The splicing unit is used to concatenate each processed data block in reverse order using special characters to obtain the encrypted firmware file.

9. A firmware encryption device based on JWE, characterized in that, It includes a processor and a memory, the memory storing a computer program that, when executed by the processor, implements the steps of the JWE-based firmware encryption method as claimed in any one of claims 1 to 4.

10. A storage medium, characterized in that, The storage medium stores one or more programs, which can be executed by one or more processors to implement the steps of the JWE-based firmware encryption method according to any one of claims 1 to 4.

Images