Random value generation method, system, device and storage medium based on aes

Abstract

The application discloses an AES-based random value generation method, system, device and storage medium, and the method comprises the following steps: obtaining an original true random bit stream, and performing bias correction and interception on the original true random bit stream to obtain a true random seed; based on the true random seed and an individualized string, a current round key and a current round counter value are obtained through an AES encryption algorithm, and the current round key and the current round counter value are combined into a current round state of CTR_DRBG; a current round random bit string is generated through the AES encryption algorithm according to the current round state; it is judged whether a preset target length is less than or equal to the length of the current round random bit string; if yes, random bits corresponding to the preset target length are intercepted from the current round random bit string as pseudo-random values. The application guarantees security through a true random seed, guarantees high efficiency through AES-128 encryption, and finally realizes transparent compatibility and safe use of true and pseudo random numbers.

Description

Technical Field

[0001] This invention relates to the field of random number generation technology, and in particular to a method, system, device and storage medium for generating random values ​​based on AES. Background Technology

[0002] Existing vehicle random number generators either rely on pure random numbers, which suffer from low generation efficiency and difficulty in meeting large-scale output requirements; or they rely on pure pseudo-random numbers, which suffer from insufficient initial entropy, randomness decay after long-term operation, and easy predictability. Therefore, how to achieve transparent compatibility between pure and pseudo-random numbers and to stably output highly secure random numbers over a long period of time has become an urgent problem to be solved.

[0003] The above content is only used to help understand the technical solution of the present invention and does not represent an admission that the above content is prior art. Summary of the Invention

[0004] The main objective of this invention is to provide a method, system, device, and storage medium for generating random values ​​based on AES, aiming to address the technical problem of how to achieve transparent compatibility between true and false random numbers and to output highly secure random numbers stably over a long period of time.

[0005] To achieve the above objectives, the present invention provides a method for generating random values ​​based on AES, the method comprising: S1, Obtain the original true random bit stream, and perform bias correction and truncation on the original true random bit stream to obtain the true random seed; S2, based on the true random seed and the personalized string, obtain the current round key and the current round counter value through the AES encryption algorithm, and combine the current round key and the current round counter value to form the current round state of CTR_DRBG; S3, Generate a random bit string for the current round based on the current round state of CTR_DRBG using the AES encryption algorithm; S4, determine whether the preset target length is less than or equal to the length of the current round of random bit string; if so, proceed to step S5; S5, extract random bits corresponding to the preset target length from the current round of random bit string, and use them as pseudo-random values.

[0006] Optionally, the AES encryption algorithm is:

[0007] In the formula, For the random bit string generated in round t, Let be the key for round t. Let be the counter value for round t.

[0008] Optionally, after S5, the method further includes: S6, determine whether the current round counter value meets the overflow condition. If yes, jump to S7; otherwise, jump to step S8. S7, the counter value is cleared to zero, the high-entropy initial value and the key for the next round are obtained to generate the next round state of the CTR_DRBG, and the iteration execution step S3 is returned; S8. Determine whether the reseeding condition is triggered and whether the current round has reached the preset adjustment round. If the reseeding condition is not triggered and the current round has not reached the preset adjustment round, proceed to step S9. If the reseeding condition is triggered and the current round has not reached the preset adjustment round, proceed to step S10. If the reseeding condition is not triggered and the current round has reached the preset adjustment round, proceed to step S11. S9, Update the current round counter value to generate the next round state of CTR_DRBG, and return to iterative execution step S3; S10, reacquire the true random seed, generate a new key and a new counter value based on the new true random seed to generate the next round state of the CTR_DRBG, and return to execute step S3; S11, update the current round counter value and the current round key to generate the next round state of the CTR_DRBG, and return to iterative execution step S3.

[0009] Optionally, S7 includes: S7.1, the counter value is cleared to zero, and bits of a preset number of bits are randomly extracted from the corrected bit stream as the initial value for high entropy; S7.2, Based on the high-entropy initial value, the last round key before overflow, and the last round random bit string before overflow, the next round key is obtained through an encryption algorithm; S7.3, Generate the next round state of CTR_DRBG based on the high entropy initial value and the next round key, and return to iterative execution step S3.

[0010] Optionally, S9 includes: S9.1 Update the current round counter value according to the preset increment formula to obtain the next round counter value; S9.2, Generate the next round state of CTR_DRBG based on the current round key and the next round counter value, and return to iterative execution step S3.

[0011] Optionally, S10 includes: S10.1, Reacquire the original true random bitstream, and modify and truncate the new original true random bitstream to obtain a fresh seed; S10.2, Generate a new key based on the current round state and the fresh seed, and generate a new counter value based on the new key, the fresh seed and the current round counter value; S10.3, Generate the next round state of CTR_DRBG based on the new key and the new counter value, and return to iterative execution step S3.

[0012] Optionally, S11 includes: S11.1 Update the current round counter value according to the preset increment formula to obtain the next round counter value; S11.2, Update the key based on the next round counter value, the current round key, and the current round random bit string to obtain the next round key; S11.3, Generate the next round state of CTR_DRBG based on the next round key and the next round counter, and return to execute step S3.

[0013] Furthermore, to achieve the above objectives, this invention also proposes an AES-based random value generation system, which includes: The acquisition module is used to acquire the original true random bit stream and correct the bit bias of the original true random bit stream using a preset correction method. The acquisition module is further configured to extract a preset number of bits from the modified bitstream as a true random seed when the entropy density of the modified bitstream is greater than or equal to a preset threshold. The encryption module is used to generate the current round key using the AES encryption algorithm based on the true random seed and the plaintext to be encrypted, and to perform encryption operations on the personalized string based on the current round key to obtain the current round counter value; The combination module is used to combine the current round key and the current round counter value into the current round state of CTR_DRBG; The generation module is used to generate a random bit string for the current round based on the current round state of the CTR_DRBG; The generation module is also used to determine whether the preset target length is less than or equal to the length of the current round of random bit string; The generation module is further configured to, if so, extract random bits corresponding to the preset target length from the current round of random bit string as pseudo-random values.

[0014] Furthermore, to achieve the above objectives, the present invention also proposes an AES-based random value generation device, the device comprising: a memory, a processor, and an AES-based random value generation program stored in the memory and executable on the processor, the AES-based random value generation program being configured to implement the steps of the AES-based random value generation method described above.

[0015] Furthermore, to achieve the above objectives, the present invention also proposes a storage medium storing an AES-based random value generation program, wherein when the AES-based random value generation program is executed by a processor, it implements the steps of the AES-based random value generation method described above.

[0016] This invention first obtains the original truly random bit stream, then performs bias correction and truncation on the original truly random bit stream to obtain a truly random seed. Then, based on the truly random seed and a personalized string, the current round key and current round counter value are obtained through the AES encryption algorithm. The current round key and current round counter value are combined to form the current round state of CTR_DRBG. Next, a random bit string for the current round is generated based on the current round state using the AES encryption algorithm. Finally, it is determined whether the preset target length is less than or equal to the length of the current round random bit string. If so, random bits corresponding to the preset target length are truncated from the current round random bit string as pseudo-random values. This invention, with its core of truly random entropy source injection combined with AES-128CTR_DRBG pseudo-random extension, effectively solves the problems of low efficiency in generating purely true random numbers and insufficient security in generating purely pseudo-random numbers, achieving transparent compatibility between true and pseudo-random numbers, and balancing security and efficiency. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the structure of an AES-based random value generation device in the hardware operating environment involved in the embodiments of the present invention; Figure 2 This is a flowchart illustrating the first embodiment of the AES-based random value generation method of the present invention. Figure 3 This is a structural block diagram of the first embodiment of the AES-based random value generation system of the present invention.

[0018] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0019] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the invention.

[0020] Reference Figure 1 , Figure 1This is a schematic diagram of the structure of an AES-based random value generation device for the hardware operating environment involved in the embodiments of the present invention.

[0021] like Figure 1 As shown, the AES-based random value generation device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to establish communication between these components. The user interface 1003 may include a display screen or an input unit such as a keyboard; optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wireless-Fidelity (Wi-Fi) interface). The memory 1005 may be high-speed random access memory (RAM) or stable non-volatile memory (NVM), such as a disk drive. Optionally, the memory 1005 may also be a storage system independent of the aforementioned processor 1001.

[0022] Those skilled in the art will understand that Figure 1 The structure shown does not constitute a limitation on AES-based random value generation devices and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0023] like Figure 1 As shown, the memory 1005, which serves as a storage medium, may include an operating system, a network access module, a user interface module, and an AES-based random value generation program.

[0024] exist Figure 1 In the AES-based random value generation device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and memory 1005 in the AES-based random value generation device of the present invention can be set in the AES-based random value generation device. The AES-based random value generation device calls the AES-based random value generation program stored in the memory 1005 through the processor 1001 and executes the AES-based random value generation method provided in the embodiment of the present invention.

[0025] This invention provides a method for generating random values ​​based on AES, referring to... Figure 2 , Figure 2This is a flowchart illustrating the first embodiment of the AES-based random value generation method of the present invention.

[0026] In this embodiment, the AES-based random value generation method includes the following steps: S1, obtain the original true random bit stream, and perform bias correction and truncation on the original true random bit stream to obtain the true random seed.

[0027] It is easy to understand that the execution subject of this embodiment can be an AES-based random value generation system with functions such as data processing, network communication and program execution, or other computer devices with similar functions. This embodiment does not limit it.

[0028] Furthermore, the original true random bit stream is obtained, and the bit bias of the original true random bit stream is corrected by a preset correction method; when the entropy density of the corrected bit stream is greater than or equal to a preset threshold, bits of a preset number of bits are extracted from the corrected bit stream as true random seeds.

[0029] In practical implementation, hardware-level TRNGs conforming to the NISTSP800-90B specification (such as noise diodes and quantum random number modules) are preferred. Their core advantage is generating a completely unpredictable bitstream through physical noise, avoiding the predictability defects of software pseudo-randomness. When hardware is unavailable, Linux uses / dev / random (blocking mode to ensure sufficient entropy) and Windows uses CryptGenRandomAPI. Simulating true randomness using pseudo-random numbers is strictly prohibited. During the acquisition phase, data is collected at a frequency of 1MHz for at least 10ms to ensure the original true random bitstream R... raw Length ≥ 1024 bits (reserving entropy redundancy to avoid seed failure due to insufficient entropy), real-time recording of bit timestamps during acquisition, avoiding 8 or more consecutive identical bits, and eliminating R through a preset correction method (e.g., von Neumann correction method). raw The bit offset (the core purpose is to make the probability of 0 and 1 bits appearing approach 0.5) is corrected as follows: Initialization: k=0; For i = 0, 1, ..., n-2 (step size = 2): if ,but , k = k + 1; Otherwise, discard. and These two bits; final: This is the corrected bitstream.

[0030] Where i is the index variable of the original sequence, used to traverse the original bit sequence (step size is 2, taking two adjacent bits each time); n is the original bit sequence R. raw The total length (number of bits); k is the index variable of the corrected sequence, used to record the position of the valid bits (incrementing only when retaining bits); It is the single bit value (0 or 1) at index i in the original bit sequence.

[0031] Subsequent calculations corrected the bitstream The entropy density is given by the formula:

[0032] In the formula, H is the information entropy (i.e., entropy density); b is the value of a single bit, which can only be 0 or 1; For the revised The probability of a bit valued as b satisfies p(0) + p(1) = 1.

[0033] In practical implementation, it is necessary to ≥Preset threshold (e.g., 0.98 bits / bit) (ensuring high randomness for each bit); if not, re-collect and verify.

[0034] If the entropy density of the corrected bitstream is greater than or equal to a preset threshold, from Extract a preset number of bits (e.g., the first 128 bits) as the initial seed (i.e., a truly random seed). (Can be upgraded to 256-bit to meet higher security requirements), that is ={s0,s1,...,s 127}, s i ∈{0,1}, the seed length strictly matches the AES-128 key length (core adaptation for subsequent AES-128 encryption mapping), and will Stored in an encrypted register with a locking mechanism to prevent plaintext storage and to prevent seed tampering or leakage (seed leakage will directly cause the entire generator to fail).

[0035] S2, based on the true random seed and the personalized string, obtain the current round key and the current round counter value through the AES encryption algorithm, and combine the current round key and the current round counter value to form the current round state of CTR_DRBG.

[0036] It should be noted that the processing method for obtaining the current round key and the current round counter value based on the true random seed and the personalized string through the AES encryption algorithm is as follows: the current round key is generated by the AES encryption algorithm based on the true random seed and the plaintext to be encrypted, and the personalized string is encrypted based on the current round key to obtain the current round counter value.

[0037] It should be noted that the true random seed Through AES-128 encryption mapping, the initial internal state of the Counter Mode_Deterministic Random Bit GeneratorCTR_DRBG is transformed, completing the startup of the pseudo-random number generator. The core logic is seed -> AES-128 encryption -> initial state, ensuring the unpredictability of the initial state. The data is then acquired and securely stored. Next, the internal state of CTR_DRBG (the core carrier of pseudo-random number generation) is defined, containing three 128-bit key parameters: encryption key K (initially empty, generated by seed mapping, and the core of AES-128 encryption), counter C (a random initial value truncated from R_corrected to avoid predictable pseudo-random streams caused by fixed starting points), and personalized string V (optional, defaulting to 128 bits all 0s, used to distinguish different generator instances and avoid the same seed generating the same pseudo-random stream). Then, the AES-128 encryption engine is initialized, with the core configuration in ECB mode (only used for initialization and state updates; switching to CTR mode when generating pseudo-random numbers; the core advantage of ECB mode is that it can independently encrypt each set of data, adapting to the independent generation of state parameters), setting the 128-bit key length, and enabling the AES key expansion algorithm (its core function is to expand the 128-bit key to the round keys required for 10 rounds of encryption, satisfying the AES-128 encryption specification).

[0038] The core initialization step is seed mapping: Generate an initial key by encrypting the plaintext to be encrypted (a 128-bit string of all zeros) using the AES-128 key. (The core idea is to pass the entropy value of the true random seed to the encryption key), the formula is:

[0039] Again Encrypt a personalized string V with the key and generate an initial counter. (To further enhance the randomness of the counter), the formula is:

[0040] If V is not specified, the default value will be used. Finally, ( , Assign the initial state. t represents the current round t, where t is 0. The state is locked and a verification mechanism is enabled (the core is to prevent the state from being tampered with). Before reading or updating the state, the integrity of K and C is verified (such as the round key expansion result of K and the 128-bit validity of C). If the verification fails, it is re-initialized.

[0041] S3, generate a random bit string for the current round based on the current round state of CTR_DRBG using the AES encryption algorithm.

[0042] Furthermore, based on the key and counter value within the current round state of CTR_DRBG, the random bit string for the current round is obtained through the AES encryption algorithm; The AES encryption algorithm is:

[0043] In the formula, For the random bit string generated in round t, Let be the key for round t. Let be the counter value for round t.

[0044] S4, determine whether the preset target length is less than or equal to the length of the current round of random bit string; if so, proceed to step S5; S5, extract random bits corresponding to the preset target length from the current round of random bit string, and use them as pseudo-random values.

[0045] It should be understood that the preset target length L is a user-defined setting and can be 128 bits.

[0046] In the specific implementation, when L≤128 bits, the current value is truncated. The first L bits are used as the final pseudo-random number. Output The initial randomness check checks the presence of 8 or more consecutive identical bits (0 or 1). The core purpose is to avoid low-entropy output caused by accidental anomalies. If the check fails, the current result is discarded and a new result is generated.

[0047] Further, after S5, the next round state is automatically updated, including: S6, determining whether the current round counter value meets the overflow condition; if yes, jump to S7; if no, jump to step S8; S7, the counter value is cleared to zero, obtaining the high-entropy initial value and the next round key to generate the next round state of CTR_DRBG, and returning to iterative execution step S3; S8, determining whether the reseeding condition is triggered and whether the current round has reached the preset adjustment round; if the reseeding condition is not triggered and the current round has not reached the preset adjustment round, jump to step S9; if the reseeding condition is triggered and the current round has not reached the preset adjustment round, jump to step S9. If the round is adjusted, proceed to step S10. If the reseeding condition is not triggered and the current round reaches the preset adjustment round, proceed to step S11. In S9, update the current round counter value to generate the next round state of CTR_DRBG and return to iterative execution step S3. In S10, reacquire the true random seed, generate a new key and a new counter value based on the new true random seed to generate the next round state of CTR_DRBG, and return to execution step S3. In S11, update the current round counter value and the current round key to generate the next round state of CTR_DRBG and return to iterative execution step S3.

[0048] It should be understood that the overflow condition is: when =2 128 At -1, +1=0 (counter overflow).

[0049] It should also be noted that S7 includes: S7.1, clearing the counter value and randomly extracting a preset number of bits from the corrected bit stream as the initial value of high entropy; S7.2, obtaining the next round key through an encryption algorithm based on the initial value of high entropy, the last round key before overflow, and the last round random bit string before overflow; S7.3, generating the next round state of CTR_DRBG based on the initial value of high entropy and the next round key, and returning to iterative execution step S3.

[0050] In this embodiment, if the overflow condition is met, the counter value is reset to zero, and the data is retrieved from the corrected bitstream. Randomly extract a preset number of bits (i.e., extract a non-repeating 128-bit bit string as the new initial value for the counter) as the high-entropy initial value. The next round key is obtained through an encryption algorithm based on the high-entropy initial value, the last round key before overflow, and the last round random bit string before overflow. Combine the high-entropy initial value and the next round key to form the next round state. Then return to iteratively execute step S3 to obtain... .

[0051] It should be understood that the conditions for reseeding include: 1. A cumulative total of 2 pseudo-random numbers have been generated.48 1. The reseeding condition is triggered if any one of the following conditions is met: 1. The state entropy value decreases significantly after exceeding the NISTSP800-90A specification threshold, which cannot guarantee security; 2. The state entropy value arrives at a fixed time interval (e.g., 1 hour) (to replenish the entropy source in advance and avoid the risk of state leakage); 3. The state is triggered by the application layer actively calling the interface (prioritized before sensitive operations to ensure the randomness of sensitive scenarios).

[0052] It should also be understood that, in order to eliminate the pseudo-random stream statistical correlation caused by the long-term use of the same key, the preset adjustment rounds can be 2. 20 Round, every 2 generated 20 Wheels (adjustable, no less than 2) 16 (Round) Pseudo-random number, perform key update.

[0053] It should also be noted that S9 includes: S9.1, updating the current round counter value according to a preset increment formula to obtain the next round counter value; S9.2, generating the next round state of CTR_DRBG based on the current round key and the next round counter value, and returning to the iterative execution step S3.

[0054] The default increment formula is:

[0055] In the formula, This is the counter value for round t+1.

[0056] In this embodiment, the current round key and the next round counter value are combined to form the next round state of CTR_DRBG ( ).

[0057] It should also be noted that S10 includes: S10.1, reacquiring the original true random bitstream, and correcting and truncating the new original true random bitstream to obtain a new true random seed as the fresh seed (refer to the processing method of step S1); S10.2, generating a new key based on the current round state and the fresh seed, and generating a new counter value based on the new key, the fresh seed, and the current round counter value; S10.3, generating the next round state of CTR_DRBG based on the new key and the new counter value, performing state verification (i.e., verifying the integrity of K and C), and returning to iterative execution of step S3 after the verification passes.

[0058] In this embodiment, the original true random bitstream is reacquired, and a fresh seed is obtained based on the new original true random bitstream. Based on the current round state ( ) and fresh seeds generate new keys ( ), and generate a new counter value based on the new key, the fresh seed, and the current round counter value. Then, integrity verification is performed on the new key and the new counter value. If the verification passes, a completely new state is generated based on the new key and the new counter value. If the verification fails, the process returns to the step of reacquiring the original true random bitstream until the verification passes.

[0059] It should also be noted that S11 includes: S11.1, updating the current round counter value according to a preset increment formula to obtain the next round counter value; S11.2, updating the key according to the next round counter value, the current round key, and the current round random bit string to obtain the next round key; S11.3, generating the next round state of CTR_DRBG according to the next round key and the next round counter, and returning to execute step S3.

[0060] In this embodiment, the current round counter value is updated according to a preset increment formula to obtain the next round counter value. The next round key is then obtained by updating the key based on the next round counter, the current round key, and the current round random bit string. The next round state is generated based on the next round key and the next round counter.

[0061] It should also be noted that if the reseeding condition is triggered and the current round reaches the preset adjustment round, manual intervention is required.

[0062] Furthermore, when the preset target length is greater than the length of the current round's random bit string, the required number of rounds to be generated is calculated based on the preset target length and the length of the current round's random bit string, and a random bit string corresponding to the required number of rounds to be generated is generated; the random bit strings corresponding to the required number of rounds to be generated are concatenated to obtain a temporary bit string; random bits corresponding to the preset target length are extracted from the temporary bit string as pseudo-random values.

[0063] Based on the preset target length and the length of the current round's random bit string, the required number of rounds to be generated is calculated as follows:

[0064] In the formula, Generate the required rounds. This is for rounding up.

[0065] In another embodiment, the process for generating the random bit string corresponding to the required generation round is as follows: Determine whether the current round counter value meets the overflow condition; if yes, clear the counter value to obtain a high-entropy initial value and the next round key to generate the next round state of CTR_DRBG, and generate the next round random bit string based on the next round state of CTR_DRBG; if no, determine whether the reseeding condition is triggered and whether the current round has reached the preset adjustment round. The following situations exist: 1. If the reseeding condition is not triggered and the current round has not reached the preset adjustment round, update the current round counter value to generate the next round state of CTR_DRBG, and generate the next round random bit string based on the next round state of CTR_DRBG. 1. Generate the next round random bit string based on the next round state of TR_DRBG; 2. If the reseeding condition is triggered and the current round has not reached the preset adjustment round, then obtain a new true random seed, generate a new key and a new counter value based on the new true random seed, and generate the next round state of the CTR_DRBG. Generate the next round random bit string based on the next round state of the CTR_DRBG; 3. If the reseeding condition is not triggered and the current round has reached the preset adjustment round, then update the current round counter value and the current round key to generate the next round state of the CTR_DRBG. Generate the next round random bit string based on the next round state of the CTR_DRBG. Then return to the step of determining whether the current round counter value meets the overflow condition, until the random bit string corresponding to the required generation round is generated.

[0066] It should also be noted that the following three processing methods are described: updating the current round counter value to generate the next round state of the CTR_DRBG; re-acquiring the true random seed and generating a new key and a new counter value based on the new true random seed to generate the next round state of the CTR_DRBG; and updating the current round counter value and the current round key to generate the next round state of the CTR_DRBG. For details of these three processing methods, please refer to the previous embodiment.

[0067] In the above embodiments, the long-term unpredictability of random numbers is ensured by periodically reseeding and updating the state.

[0068] In the specific implementation, the above core technical logic is encapsulated into standardized interfaces to make the underlying technology transparent and simplify application-layer calls. The core goal is to adapt to different application scenarios and ensure that the core technology can be implemented. Four C-style core interfaces are encapsulated (adapting to most development scenarios), each corresponding to a core technical process: 1. Seed injection interface seed_trng(uint8_t S, uint32_tlen), len≥16 (corresponding to a 128-bit seed), returns 0 to indicate success. Its core function is to inject the collected truly random seed into the generator and trigger the initialization process; 2. Random number acquisition interface get_random(uint8_t The `get_random` interface (`out`, `uint32_tlen`) returns 0 for success. Its core function is to call the underlying pseudo-random number generation process and output pseudo-random numbers that meet the requirements. The `reseed_trng(void)` interface returns 0 for success. Its core function is to trigger fresh seed collection and state updates to replenish the entropy source. The `check_state(void)` interface returns 0 for normal status (TRNG available, internal state valid). Its core function is to monitor the running status of core technical links and avoid abnormal risks. The standardized calling process (aligning with core technical logic) is: Initialization -> Generation -> Reseeding -> Exception Handling. Specifically, `seed_trng` is called to inject `S_init`, and `check_state` is called to confirm that the core process is normal before entering the ready state. The application layer calls `get_random` to obtain pseudo-random numbers (triggering the core generation process). When the triggering condition is met, `reseed_trng` is called automatically or manually (replenishing the entropy source). When the interface returns a non-zero value, the core process problems (such as TRNG failure or state abnormality) are investigated based on the return value, and pseudo-random numbers are prohibited from being output until the problem is resolved.

[0069] In this embodiment, the original true random bit stream is first obtained, and then biased and truncated to obtain a true random seed. Based on the true random seed and a personalized string, the current round key and counter value are obtained using the AES encryption algorithm. The current round key and counter value are combined to form the current round state of CTR_DRBG. Then, a random bit string for the current round is generated using the AES encryption algorithm based on the current round state. Finally, it is determined whether the preset target length is less than or equal to the length of the current round random bit string. If so, random bits corresponding to the preset target length are truncated from the current round random bit string as pseudo-random values. This embodiment, with true random entropy source injection combined with AES-128CTR_DRBG pseudo-random extension as its core, effectively solves the problems of low efficiency in generating pure true random numbers and insufficient security in generating pure pseudo-random numbers, achieving transparent compatibility between true and pseudo-random numbers while balancing security and efficiency.

[0070] Reference Figure 3 , Figure 3 This is a structural block diagram of the first embodiment of the AES-based random value generation system of the present invention.

[0071] like Figure 3 As shown, the AES-based random value generation system proposed in this embodiment of the invention includes: The acquisition module 3001 is used to acquire the original true random bit stream, and to modify and truncate the original true random bit stream to obtain a true random seed; Encryption module 3002 is used to obtain the current round key and the current round counter value based on the true random seed and the personalized string through the AES encryption algorithm, and to combine the current round key and the current round counter value into the current round state of CTR_DRBG; The generation module 3003 is used to generate a random bit string for the current round based on the current round state of the CTR_DRBG using the AES encryption algorithm; The interception module 3004 is used to determine whether the preset target length is less than or equal to the length of the current round of random bit string; The interception module 3004 is further configured to, if so, intercept random bits corresponding to the preset target length from the current round random bit string as pseudo-random values.

[0072] Other embodiments or specific implementations of the AES-based random value generation system of the present invention can be found in the above-described method embodiments, and will not be repeated here.

[0073] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0074] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0075] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory / random access memory, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0076] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for generating random values ​​based on AES, characterized in that, The method includes the following steps: S1, Obtain the original true random bit stream, and perform bias correction and truncation on the original true random bit stream to obtain the true random seed; S2, based on the true random seed and the personalized string, obtain the current round key and the current round counter value through the AES encryption algorithm, and combine the current round key and the current round counter value to form the current round state of CTR_DRBG; S3, Generate a random bit string for the current round based on the current round state of CTR_DRBG using the AES encryption algorithm; S4, determine whether the preset target length is less than or equal to the length of the current round of random bit string; if so, proceed to step S5; S5, extract random bits corresponding to the preset target length from the current round of random bit string, and use them as pseudo-random values.

2. The method as described in claim 1, characterized in that, The AES encryption algorithm is as follows: In the formula, For the random bit string generated in round t, Let be the key for round t. Let be the counter value for round t.

3. The method as described in claim 1, characterized in that, Following S5, the following is also included: S6, determine whether the current round counter value meets the overflow condition. If yes, jump to S7; otherwise, jump to step S8. S7, the counter value is cleared to zero, the high-entropy initial value and the key for the next round are obtained to generate the next round state of the CTR_DRBG, and the iteration execution step S3 is returned; S8. Determine whether the reseeding condition is triggered and whether the current round has reached the preset adjustment round. If the reseeding condition is not triggered and the current round has not reached the preset adjustment round, proceed to step S9. If the reseeding condition is triggered and the current round has not reached the preset adjustment round, proceed to step S10. If the reseeding condition is not triggered and the current round has reached the preset adjustment round, proceed to step S11. S9, Update the current round counter value to generate the next round state of CTR_DRBG, and return to iterative execution step S3; S10, reacquire the true random seed, generate a new key and a new counter value based on the new true random seed to generate the next round state of the CTR_DRBG, and return to execute step S3; S11, update the current round counter value and the current round key to generate the next round state of the CTR_DRBG, and return to iterative execution step S3.

4. The method as described in claim 3, characterized in that, The S7 includes: S7.1, the counter value is cleared to zero, and bits of a preset number of bits are randomly extracted from the corrected bit stream as the initial value for high entropy; S7.2, Based on the high-entropy initial value, the last round key before overflow, and the last round random bit string before overflow, the next round key is obtained through an encryption algorithm; S7.3, Generate the next round state of CTR_DRBG based on the high entropy initial value and the next round key, and return to iterative execution step S3.

5. The method as described in claim 3, characterized in that, The S9 includes: S9.1 Update the current round counter value according to the preset increment formula to obtain the next round counter value; S9.2, Generate the next round state of CTR_DRBG based on the current round key and the next round counter value, and return to iterative execution step S3.

6. The method as described in claim 3, characterized in that, S10 includes: S10.1, Reacquire the original true random bitstream, and modify and truncate the new original true random bitstream to obtain a fresh seed; S10.2, Generate a new key based on the current round state and the fresh seed, and generate a new counter value based on the new key, the fresh seed and the current round counter value; S10.3, Generate the next round state of CTR_DRBG based on the new key and the new counter value, and return to iterative execution step S3.

7. The method as described in claim 3, characterized in that, S11 includes: S11.1 Update the current round counter value according to the preset increment formula to obtain the next round counter value; S11.2, Update the key based on the next round counter value, the current round key, and the current round random bit string to obtain the next round key; S11.3, Generate the next round state of CTR_DRBG based on the next round key and the next round counter, and return to execute step S3.

8. A random value generation system based on AES, characterized in that, The system includes: The acquisition module is used to acquire the original true random bit stream, and to modify and truncate the original true random bit stream to obtain a true random seed; The encryption module is used to obtain the current round key and the current round counter value based on the true random seed and the personalized string through the AES encryption algorithm, and to combine the current round key and the current round counter value into the current round state of CTR_DRBG; The generation module is used to generate a random bit string for the current round based on the current round state of CTR_DRBG using the AES encryption algorithm; The truncation module is used to determine whether the preset target length is less than or equal to the length of the current round of random bit string; The interception module is further configured to, if so, intercept random bits corresponding to the preset target length from the current round of random bit string as pseudo-random values.

9. A random value generation device based on AES, characterized in that, The device includes: a memory, a processor, and an AES-based random value generation program stored in the memory and executable on the processor, the AES-based random value generation program being configured to implement the steps of the AES-based random value generation method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium stores an AES-based random value generation program, which, when executed by a processor, implements the steps of the AES-based random value generation method as described in any one of claims 1 to 7.

Images