Encrypted communication method, terminal and system based on white-box SM4 algorithm

Abstract

Disclosed is an encrypted communication method based on a white-box SM4 algorithm. A communication sender is pre-filled with a white-box protection code, an encrypted white-box reference algorithm code and an encrypted white-box cryptographic program, and the method comprises: invoking the white-box protection code to decrypt the encrypted white-box reference algorithm code and running the white-box reference algorithm code; locating the white-box cryptographic program on the basis of a randomly selected index value, and invoking the white-box protection code for decryption to obtain a plurality of round function operation codes in the white-box cryptographic program; loading the round function operation codes to replace round function operation codes corresponding to a serial number in the white-box reference algorithm code to obtain a session encryption white-box code; and using the session encryption white-box code to encrypt communication data, and then adding the index value to obtain encrypted communication data. When a key is switched, some dynamic link libraries are randomly reloaded, thereby reducing the resource consumption of white-box code transmission and switching while ensuring the security.

Description

Encrypted communication method, terminal and system based on white box SM4 algorithm Technical Field

[0001] The present invention relates to the field of cryptographic application technology, and in particular to an encryption communication method, terminal, and system based on a white-box SM4 algorithm. Background Art

[0002] In a white-box attack context, the execution process of the software is completely visible to the attacker. If the cryptographic software running in this environment does not have special protection for the key, the attacker can easily obtain the key information by observing or executing the cryptographic software. White-box cryptography was proposed to address this situation. Its purpose is to protect the key in the white-box attack environment, hide the key information in the execution process of the cryptographic software, and prevent attackers from extracting the key in the white-box attack environment. Different algorithm execution codes need to be formed for different keys. In this way, the key distribution is carried out in the form of the executable program implemented by the algorithm. The update of the key will cause the update of the executable program implemented by the entire algorithm. This operating mode has the following problems:

[0003] (1) The space occupied by the execution code of the cryptographic algorithm is much larger than that of a symmetric key, at least the difference is at the K-byte level and the byte level. Updating the key causes the update and distribution of the executable program of the entire algorithm implementation, which will occupy a large amount of network transmission resources or storage resources. The more frequently the key is updated, the more resources are occupied.

[0004] (2) During the operation of the executable program implemented by the algorithm, reloading the entire executable program for the algorithm implementation consumes much more resources and time than reading a symmetric key, and the impact on the system's operating status and performance is far greater than the cost of reading a symmetric key. The more frequently the key is updated, the greater the pressure on the system.

[0005] (3) Frequent key updates will lead to frequent distribution of executable programs. After the attacker eavesdrops on this process and obtains the executable program, there is still a certain possibility of obtaining the key through reverse engineering, and the distribution process is risky.

[0006] In related technologies, patent application publication number CN111800255A proposes a dynamic encryption and decryption white-box library for a block cipher white-box solution. However, this solution dynamically updates the entire algorithm code, consuming significant resources when transmitting and switching the white-box code. Patent application publication number CN115967485A proposes combining quantum communication technology and white-box algorithm technology to provide secure keys for encryption and decryption systems. The keys are also scrambled and hidden in a memory database, ensuring the security of the keys and data while simplifying the use of the encryption and decryption system. However, this solution maintains the white-box code, only the key changes. The key and code are not integrated, and updating the key does not result in a code update. This is not a classic white-box cryptography solution.

[0007] Summary of the Invention

[0008] The technical problem to be solved by the present invention is how to reduce the resource consumption of white box code transmission and switching while ensuring security.

[0009] The present invention solves the above technical problems through the following technical means:

[0010] In a first aspect, the present invention proposes an encryption communication method based on the white-box SM4 algorithm, which is applied to a communication sender, wherein the communication sender is pre-filled with a white-box protection code, an encrypted white-box reference algorithm code, and an encrypted white-box cryptographic program. The method comprises:

[0011] Calling the white-box protection code to decrypt the encrypted white-box benchmark algorithm code and running the white-box benchmark algorithm code; locating the white-box cryptographic program based on a randomly selected index value, and calling the white-box protection code to decrypt it, thereby obtaining a plurality of round function operation codes in the white-box cryptographic program;

[0012] Loading the round function operation code to replace the round function operation code with the corresponding serial number in the white box benchmark algorithm code to obtain the session encryption white box code;

[0013] The communication data is encrypted using the session encryption white box code and an index value is added to obtain encrypted communication data.

[0014] Furthermore, the white-box cryptographic program is generated by performing an encryption operation on a master key using a white-box SM4 algorithm. The number of the white-box cryptographic programs is the same as the number of the master keys. The round function operation codes in the white-box cryptographic program are respectively stored in each dynamic link library in the corresponding round function dynamic library. The dynamic link library is encrypted by the white-box protection code. The white-box cryptographic program is located based on a randomly selected index value, and the white-box protection code is called for decryption to obtain several round function operation codes in the white-box cryptographic program, including:

[0015] Randomly select two integers as index values;

[0016] An integer is used as the master key identifier to locate the round function dynamic library corresponding to the master key, and another integer is used as the round identifier to locate several dynamic link libraries in the round function dynamic library;

[0017] After calling the white box protection code to decrypt the dynamic link library, the round function operation code is obtained.

[0018] Furthermore, the communication sender is pre-filled with a number of master keys, and the master keys are distributed by a quantum key distribution network.

[0019] Furthermore, the method further comprises:

[0020] When the master key is switched, part of the dynamic link library is randomly reloaded to obtain several rounds of function operation codes.

[0021] Furthermore, the generation process of the white box protection code is as follows:

[0022] The protection key is obtained through the code generation point connected to the communication initiator, and the protection key is encrypted using the SM4 white box algorithm to generate the white box protection code and inject it into the communication initiator.

[0023] Furthermore, the generation process of the white box benchmark algorithm code includes:

[0024] Obtaining a reference key through a code generation point connected to the communication initiator, and performing an encryption operation on the reference key using an SM4 white box algorithm to generate the white box reference algorithm code;

[0025] The white box protection code is used to encrypt the white box reference algorithm code, generate an encrypted white box reference algorithm code and inject it into the communication initiator.

[0026] In a second aspect, the present invention further proposes a decryption communication method based on the white-box SM4 algorithm, which is applied to a communication receiving party, wherein the communication receiving party is pre-filled with a white-box protection code, an encrypted white-box reference algorithm code, and an encrypted white-box cryptographic program. The method comprises:

[0027] receiving encrypted communication data sent by a communication sender and extracting the added index value from the encrypted communication data;

[0028] Locating the corresponding white-box cryptographic program according to the index value, and calling the white-box protection code for decryption to obtain several round function operation codes in the white-box cryptographic program;

[0029] Calling the white box protection code to decrypt the encrypted white box benchmark algorithm code and run the white box benchmark algorithm code; loading the round function operation code to replace the round function operation code with the corresponding sequence number in the white box benchmark algorithm code to obtain the session decryption white box code;

[0030] The encrypted communication data is decrypted using the session decryption white-box code.

[0031] Furthermore, the white-box cryptographic program is generated by performing an encryption operation on a master key using a white-box SM4 algorithm. The number of the white-box cryptographic programs is the same as the number of the master keys. The round function operation codes in the white-box cryptographic program are respectively stored in each dynamic link library in the corresponding round function dynamic library, and the dynamic link library is encrypted by the white-box protection code. The index value is two integers. The corresponding white-box cryptographic program is located according to the index value, and the white-box protection code is called for decryption to obtain several round function operation codes in the white-box cryptographic program, including:

[0032] An integer is used as the master key identifier to locate the round function dynamic library corresponding to the master key, and another integer is used as the round identifier to locate several dynamic link libraries in the round function dynamic library;

[0033] The white box protection code is called to decrypt the dynamic link library to obtain the round function operation code in the dynamic link library.

[0034] Furthermore, the sequence numbers of the round function operation codes replaced in the white-box benchmark algorithm code during decryption and the sequence numbers of the round function operation codes replaced in the white-box benchmark algorithm code during encryption are in reverse order.

[0035] Furthermore, the method further comprises:

[0036] When the master key is switched, part of the dynamic link library is randomly reloaded to obtain several rounds of function operation codes.

[0037] Furthermore, the generation process of the white box protection code is as follows:

[0038] The protection key is obtained through the code generation point connected to the communication responder, and the protection key is encrypted using the SM4 white box algorithm to generate the white box protection code and inject it into the communication initiator.

[0039] Furthermore, the generation process of the white box benchmark algorithm code includes:

[0040] Obtaining a reference key through a code generation point connected to the communication responder, and performing an encryption operation on the reference key using an SM4 white box algorithm to generate the white box reference algorithm code;

[0041] The white box protection code is used to encrypt the white box reference algorithm code, generate an encrypted white box reference algorithm code and inject it into the communication initiator.

[0042] In a third aspect, the present invention further provides an encrypted communication terminal, wherein the terminal is pre-filled with a white box protection code, an encrypted white box reference algorithm code, and an encrypted white box cryptographic program, including:

[0043] A white box code running container, used to call the white box protection code;

[0044] a program decoder, configured to decrypt the encrypted white-box benchmark algorithm code using the white-box protection code and run the white-box benchmark algorithm code;

[0045] a round function locator, configured to locate the white-box cryptographic program based on a randomly selected index value, and call the white-box protection code for decryption to obtain a plurality of round function operation codes in the white-box cryptographic program;

[0046] A dynamic library loader is used to load the round function operation code to replace the round function operation code with the corresponding serial number in the white box benchmark algorithm code, obtain the session encryption white box code, use the session encryption white box code to encrypt the communication data and add the index value to obtain the encrypted communication data.

[0047] In a fourth aspect, the present invention further provides a decryption communication terminal, wherein the terminal is pre-filled with a white-box protection code, an encrypted white-box reference algorithm code, and an encrypted white-box cryptographic program, including:

[0048] A white box code running container, used to call the white box protection code;

[0049] a program decoder, configured to decrypt the encrypted white-box benchmark algorithm code using the white-box protection code and run the white-box benchmark algorithm code;

[0050] a round function locator, configured to extract an added index value from the encrypted communication data sent by the communication sender, locate the corresponding white-box cryptographic program according to the index value, and decrypt the white-box protection code using a program decoder to obtain a plurality of round function operation codes in the white-box cryptographic program;

[0051] The dynamic library loader is used to load the round function operation code to replace the round function operation code with the corresponding serial number in the white box benchmark algorithm code, obtain the session decryption white box code, and use the session decryption white box code to decrypt the encrypted communication data.

[0052] In a fifth aspect, the present invention further proposes an encryption and decryption communication system based on the white box SM4 algorithm, the system comprising: a communication sender and a communication receiver, the communication sender and the communication receiver are respectively connected to corresponding code generation points, each of the code generation points is connected to a corresponding quantum network node in a quantum key distribution network, the communication sender and the communication receiver are respectively connected to the quantum key distribution network, wherein:

[0053] The quantum key distribution network is used to inject a plurality of master keys into the communication sender and the communication receiver, and to inject a protection key, a reference key and a plurality of master keys into each of the code generation points;

[0054] The code generation point is used to generate white-box protection code, white-box base algorithm code and white-box cryptographic program corresponding to each master key based on the protection key, the base key and a plurality of master keys;

[0055] The communication sender is configured to generate a session encryption white box code based on the white box protection code injected into the code generation point connected to it, the white box base algorithm code, and the white box cryptographic program corresponding to each master key, and encrypt the communication data using the session encryption white box code to obtain encrypted communication data;

[0056] The communication receiving party is used to generate a session decryption white box code based on the white box protection code filled in the code generation point to which it is connected, the white box benchmark algorithm code and the white box cryptographic program corresponding to each master key, and use the session decryption white box code to decrypt the encrypted communication data.

[0057] The advantages of the present invention are:

[0058] (1) The present invention uses a number of master keys to generate white-box cryptographic programs with the same number of master keys, and uses protection codes to encrypt and protect the white-box cryptographic programs, stores the round function operation codes in the white-box cryptographic programs in the white-box library, and uses protection codes to encrypt and protect the white-box benchmark algorithm codes and then stores them in the white-box library; the white-box protection codes, the encrypted white-box benchmark algorithm codes and the white-box cryptographic programs are injected into the communication participants, and in the subsequent communication process, the communication participants use key identifiers to distinguish the white-box cryptographic programs corresponding to different master keys, and randomly reload part of the round function operation codes in the white-box cryptographic programs when switching the master keys, thereby reducing the resource consumption of white-box code transmission and switching while ensuring security.

[0059] Additional aspects and advantages of the present invention will be set forth in part in the description which follows and, in part, will be obvious from the description which follows, or may be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] FIG1 is a schematic flow chart of an encryption communication method based on the white-box SM4 algorithm according to an embodiment of the present invention; FIG2 is a schematic flow chart of a decryption communication method based on the white-box SM4 algorithm according to an embodiment of the present invention;

[0061] FIG3 is a schematic structural diagram of an encryption and decryption communication terminal proposed in one embodiment of the present invention;

[0062] 4 is a schematic structural diagram of an encryption and decryption communication system based on the white-box SM4 algorithm according to an embodiment of the present invention;

[0063] FIG5 is a schematic diagram of the workflow of an encryption and decryption communication system based on the white-box SM4 algorithm proposed in one embodiment of the present invention. DETAILED DESCRIPTION

[0064] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0065] Example 1

[0066] As shown in FIG1 , the first embodiment of the present invention proposes an encrypted communication method based on the white-box SM4 algorithm, which is applied to a communication sender. The communication sender is pre-filled with a white-box protection code, an encrypted white-box base algorithm code, and an encrypted white-box cryptographic program. The method includes the following steps:

[0067] S101, calling the white box protection code to decrypt the encrypted white box benchmark algorithm code and run the white box benchmark algorithm code;

[0068] S102: Locate the white-box cryptographic program based on the randomly selected index value, call the white-box protection code for decryption, and obtain several round function operation codes in the white-box cryptographic program;

[0069] S103: Load the round function operation code to replace the round function operation code with the corresponding sequence number in the white box benchmark algorithm code to obtain a session encryption white box code;

[0070] S104: Encrypt the communication data using the session encryption white box code and add an index value to obtain encrypted communication data.

[0071] It should be noted that the communication participants use secure storage media such as secure SIM cards, secure TF cards or secure U-shields to obtain the white box protection code generated by the code generation point, the encrypted white box benchmark algorithm code and the encrypted white box cryptographic program, and obtain a large number of pre-shared master keys generated and distributed by the quantum key distribution network (Quantum key distribution, QKD).

[0072] During the communication process, the communication initiator uses key identifiers to distinguish the white-box cryptographic program codes corresponding to different master keys, and divides the white-box cryptographic program codes into 32 dynamic link libraries according to 32 round function operation codes. When the master key is switched, the 32 round function operation codes are dynamically and randomly loaded according to the changes in the master key, thereby improving security; when the key is changed, a part of the 32 round function operation codes of the white-box cryptographic program is randomly updated, thereby reducing the resource consumption of white-box code transmission and switching.

[0073] In one embodiment, the white-box protection code, white-box benchmark algorithm code, and white-box cryptographic program code are generated by a code generation point connected to a corresponding communication participant and injected into the communication participant via a secure storage medium. The specific generation process is as follows:

[0074] (1) Obtaining a protection key, a base key, and several master keys;

[0075] (2) Based on the protection key and the reference key, respectively, a white box protection code and a white box reference algorithm code are generated using the SM4 white box algorithm, and the white box reference algorithm code is compressed and encrypted using the white box protection code;

[0076] (3) Based on each of the master keys, using the SM4 white box algorithm to generate a white box cryptographic program corresponding to the master key;

[0077] (4) storing each round function operation code in each of the white-box cryptographic programs into each corresponding dynamic link library and compressing it, then encrypting the dynamic link library using the white-box protection code and storing it into the corresponding round function dynamic library in the white-box library, wherein each master key corresponds to one round function dynamic library;

[0078] (5) Add indexes to the round function dynamic library in the white box library and the dynamic link library in the round function dynamic library.

[0079] Specifically, the protection key, baseline key and several master keys in this embodiment can be understood as being generated and distributed by a quantum key distribution network. By using several master keys to generate a white-box cryptographic program with the same number of master keys, the round function operation code in the white-box cryptographic program is stored in the corresponding dynamic link library in the white-box library, and the white-box baseline algorithm code is encrypted and protected by the protection code and then stored in the white-box library. When switching keys, some dynamic link libraries are randomly reloaded, thereby reducing the resource consumption of white-box code transmission and switching while ensuring security.

[0080] It should be noted that the SM4 white box algorithm can adopt the national standard GB / T 32907-2016 "Information Security Technology SM4 Block Cipher Algorithm".

[0081] This embodiment generates a white box cryptographic program based on each master key, and puts the 32 round function operation codes of the white box cryptographic program code into 32 dynamic link libraries respectively. After compression, the round function dynamic library is encrypted and protected using the white box protection code and stored in the white box library of the code generation point. The master key identifier (32-bit integer) plus the round identifier (value 1-32) is used for indexing.

[0082] After the program code is generated at the white-box code generation point, a secure storage medium such as a secure SIM card, secure TF card, or secure U-shield is used to load the white-box protection code, the dynamic library of round functions generated by each master key, and the white-box benchmark algorithm code for the communication participants. The communication participants use key identifiers to distinguish the white-box encryption program codes based on different keys during subsequent communication. When switching keys, some dynamic link libraries are randomly reloaded. The 32 round function operation codes of the white-box cryptographic program are dynamically and randomly loaded according to key changes, improving security. When changing keys, some of the 32 round functions of the white-box cryptographic program are randomly updated, reducing the resource consumption of white-box code transmission and switching.

[0083] In one embodiment, the white-box cryptographic program is generated by performing an encryption operation on a master key using a white-box SM4 algorithm. The number of the white-box cryptographic programs is the same as the number of the master keys. The round function operation codes in the white-box cryptographic program are respectively stored in each dynamic link library in the corresponding round function dynamic library. The dynamic link library is encrypted by the white-box protection code. Step S102: locating the white-box cryptographic program based on a randomly selected index value and calling the white-box protection code for decryption to obtain several round function operation codes in the white-box cryptographic program includes the following steps:

[0084] Randomly select two integers as index values;

[0085] An integer is used as the master key identifier to locate the round function dynamic library corresponding to the master key, and another integer is used as the round identifier to locate several dynamic link libraries in the round function dynamic library;

[0086] After calling the white box protection code to decrypt the dynamic link library, the round function operation code is obtained.

[0087] In one embodiment, the communication sender is pre-filled with a number of master keys, and the master keys are distributed by a quantum key distribution network.

[0088] In one embodiment, the method further comprises:

[0089] When the master key is switched, a portion of the dynamic link library in the round function dynamic library corresponding to the master key is randomly reloaded to obtain a number of round function operation codes.

[0090] Specifically, the communication initiator randomly selects two 32-bit integers, one of which is used as the master key identifier to locate the round function dynamic library corresponding to the master key, and the other is used as a bitmap to locate several round function operation codes of the 32 round function dynamic libraries (the number corresponding to the bit set to 1 in the 32-bit bitmap is the selected round function, for example, the bitmap 0x000000FF corresponds to the 1-8 round functions), calls the white box protection code to decrypt and decompress part of the dynamic link library in the round function dynamic library corresponding to the master key selected by the above two random integers, loads the located dynamic link library and replaces the round function corresponding to the 32-bit bitmap in the white box benchmark algorithm code, generates a session encryption white box code, and then uses the session encryption white box code to encrypt the communication session and appends the two random integers to the encrypted communication data to obtain encrypted communication data.

[0091] Example 2

[0092] As shown in FIG2 , the second embodiment of the present invention proposes a decryption communication method based on the white-box SM4 algorithm, which is applied to a communication receiving party. The communication receiving party is pre-filled with a white-box protection code, an encrypted white-box base algorithm code, and an encrypted white-box cryptographic program. The method includes the following steps:

[0093] S201, receiving encrypted communication data sent by a communication sender and extracting an added index value from the encrypted communication data;

[0094] S202: Locate the corresponding white-box cryptographic program according to the index value, and call the white-box protection code for decryption to obtain several round function operation codes in the white-box cryptographic program;

[0095] S203, calling the white box protection code to decrypt the encrypted white box benchmark algorithm code and run the white box benchmark algorithm code;

[0096] S204: Load the round function operation code to replace the round function operation code with the corresponding sequence number in the white-box benchmark algorithm code to obtain the session decryption white-box code;

[0097] S205: Decrypt the encrypted communication data using the session decryption white box code.

[0098] Specifically, a code generation point corresponding to the communication recipient uses a large-capacity secure storage medium to load the white-box protection code, the encrypted white-box benchmark algorithm code, and the encrypted white-box cryptographic program for the communication recipient. The specific process of the code generation point generating the white-box protection code, the white-box benchmark algorithm code, and the white-box cryptographic program is described in the above-mentioned embodiment 1.

[0099] In one embodiment, the white-box cryptographic program is generated by performing an encryption operation on a master key using a white-box SM4 algorithm. The number of the white-box cryptographic programs is the same as the number of the master keys. The round function operation codes in the white-box cryptographic program are respectively stored in each dynamic link library in the corresponding round function dynamic library, and the dynamic link library is encrypted by the white-box protection code. The index value is two integers. Step S202: locating the corresponding white-box cryptographic program according to the index value, calling the white-box protection code for decryption, and obtaining several round function operation codes in the white-box cryptographic program includes the following steps:

[0100] An integer is used as the master key identifier to locate the round function dynamic library corresponding to the master key, and another integer is used as the round identifier to locate several dynamic link libraries in the round function dynamic library;

[0101] The white box protection code is called to decrypt the dynamic link library to obtain the round function operation code in the dynamic link library.

[0102] In one embodiment, the sequence numbers of the round function operation codes replaced in the white-box benchmark algorithm code during decryption and the sequence numbers of the round function operation codes replaced in the white-box benchmark algorithm code during encryption are in reverse order.

[0103] In one embodiment, the method further comprises the following steps:

[0104] When the master key is switched, a portion of the dynamic link library in the round function dynamic library corresponding to the master key is randomly reloaded to obtain a number of round function operation codes.

[0105] Specifically, the communication recipient takes out two additional random integers from the encrypted communication data, one of which is used as the master key identifier to locate the dynamic library of round functions corresponding to the master key, and the other is used as a bitmap to locate the round function in the dynamic link library corresponding to 32 round functions (the number corresponding to the bit set to 1 in the 32-bit bitmap is the selected round function). The white-box protection code is called to decrypt and decompress the dynamic link library corresponding to the master key selected by the above two random integers, and the located dynamic link library is loaded and replaced with the round function corresponding to the 32-bit bitmap in the white-box benchmark algorithm code to generate the session decryption white-box code (because the round keys used by the encryption and decryption round functions are in reverse order, the round function sequence number replaced during decryption should be 32-"the number corresponding to the bitmap set to 1" + 1. For example, the bitmap 0x000000FF corresponds to the 24th to 32nd round functions when decrypted). The session decryption white-box code is then used to decrypt the communication session.

[0106] Example 3

[0107] As shown in FIG3 , the third embodiment of the present invention provides an encryption communication terminal, which is pre-populated with white-box protection code, encrypted white-box reference algorithm code, and encrypted white-box cryptographic program, including:

[0108] A white box code execution container 21, used to call the white box protection code;

[0109] a program decoder 22 for decrypting the encrypted white-box benchmark algorithm code using the white-box protection code and running the white-box benchmark algorithm code;

[0110] a round function locator 23 for locating the white-box cryptographic program based on a randomly selected index value, and decrypting the white-box protection code using the program decoder to obtain a plurality of round function operation codes in the white-box cryptographic program;

[0111] The dynamic library loader 24 is used to load the round function operation code to replace the round function operation code with the corresponding serial number in the white box benchmark algorithm code, obtain the session encryption white box code, use the session encryption white box code to encrypt the communication data and add the index value to obtain the encrypted communication data.

[0112] In one embodiment, the round function locator 23 is specifically configured to:

[0113] Randomly select two integers as index values;

[0114] An integer is used as the master key identifier to locate the round function dynamic library corresponding to the master key, and another integer is used as the round identifier to locate several dynamic link libraries in the round function dynamic library;

[0115] After calling the white box protection code to decrypt the dynamic link library, the round function operation code is obtained.

[0116] In one embodiment, several master keys in the communication sender are pre-filled by a quantum key distribution network.

[0117] In one embodiment, the dynamic library loader is further configured to randomly reload a portion of the dynamic link library when the master key is switched, so as to obtain a plurality of round function operation codes.

[0118] Specifically, the communication initiator randomly selects two 32-bit integers, one of which is used as the master key identifier to locate the round function dynamic library corresponding to the master key, and the other is used as a bitmap to locate the round function in the 32 dynamic link libraries (the number corresponding to the bit set to 1 in the 32-bit bitmap is the selected round function, for example, the bitmap 0x000000FF corresponds to the 1-8 round functions). The white box code runs the container running program decoder, calls the white box protection code to decrypt and decompress the dynamic link library corresponding to the master key selected by the above two random integers, calls the dynamic library loader to load and replace the round function corresponding to the 32-bit bitmap in the white box benchmark algorithm code, generates a session encryption white box code, and then uses the white box code to encrypt the communication session and append the two above two random integers to the encrypted communication data.

[0119] Example 4

[0120] As shown in FIG3 , the fourth embodiment of the present invention provides a decryption communication terminal. The terminal is pre-loaded with white-box protection code, encrypted white-box reference algorithm code, and encrypted white-box cryptographic program, including:

[0121] A white box code execution container 21, used to call the white box protection code;

[0122] a program decoder 22 for decrypting the encrypted white-box benchmark algorithm code using the white-box protection code and running the white-box benchmark algorithm code;

[0123] The round function locator 23 is used to extract the added index value from the encrypted communication data sent by the communication sender, locate the corresponding white box cryptographic program according to the index value, and use the program decoder 22 to decrypt the white box protection code to obtain a number of round function operation codes in the white box cryptographic program;

[0124] The dynamic library loader 24 is used to load the round function operation code to replace the round function operation code with the corresponding serial number in the white box benchmark algorithm code, obtain the session decryption white box code, and use the session decryption white box code to decrypt the encrypted communication data.

[0125] In one embodiment, the round function locator 23 is used to use an integer as a master key identifier to locate the round function dynamic library corresponding to the master key, use another integer as a round identifier to locate several dynamic link libraries in the round function dynamic library, and decrypt and decompress to obtain the round function operation code.

[0126] In one embodiment, the sequence numbers of the round functions replaced in the white-box benchmark algorithm code during decryption and the sequence numbers of the round functions replaced in the white-box benchmark algorithm code during encryption are in reverse order.

[0127] In one embodiment, the dynamic library loader 24 is configured to randomly reload a portion of the dynamic link library when the master key is switched, so as to obtain a plurality of round functions.

[0128] Specifically, the communication recipient takes out the additional random integers from the encrypted communication data, one of which is used as the master key identifier to locate the dynamic link library of the round function corresponding to the master key, and the other is used as the bitmap to locate the dynamic link library corresponding to the 32 round functions, and obtains several round functions (the number corresponding to the bit set to 1 in the 32-bit bitmap is the selected round function). The white box code runs the container running program decoder, calls the white box SM4 protection code to decrypt and decompress the round function dynamic link library corresponding to the master key selected by the above two random integers, calls the dynamic library loader to load and replace the round function corresponding to the 32-bit bitmap in the white box SM4 benchmark algorithm code (because the round keys used by the encryption and decryption round functions are in reverse order, the round function serial number replaced during decryption should be 32-"the number corresponding to the bitmap set to 1" + 1, for example, the bitmap 0x000000FF corresponds to the 24th to 32nd round functions when decrypted), and then uses the white box code to decrypt the communication session.

[0129] Example 5

[0130] As shown in FIG4 , the fifth embodiment of the present invention proposes an encryption and decryption communication system based on the white box SM4 algorithm, wherein the system includes: a communication sender 1 and a communication receiver 2, wherein the communication sender 1 and the communication receiver 2 are respectively connected to corresponding code generation points 3, each of the code generation points 3 is connected to a corresponding quantum network node in a quantum key distribution network 4, and the communication sender 1 and the communication receiver 2 are respectively connected to the quantum key distribution network 4, wherein:

[0131] The quantum key distribution network 4 is used to inject a plurality of master keys into the communication sender and the communication receiver, and to inject a protection key, a reference key and a plurality of master keys into each code generation point 3;

[0132] The code generation point 3 is used to generate a white box cryptographic program corresponding to each master key based on the protection key, the reference key and a plurality of master keys;

[0133] The communication sender 1 is configured to generate a session encryption white-box code based on the white-box protection code, the white-box base algorithm code, and the white-box cryptographic program corresponding to each master key injected by the code generation point 3 connected to it, and encrypt the communication data using the session encryption white-box code to obtain encrypted communication data;

[0134] The communication receiver 2 is used to generate a session decryption white box code based on the white box protection code, white box benchmark algorithm code and white box cryptographic program corresponding to each master key filled in the code generation point 3 to which it is connected, and use the session decryption white box code to decrypt the encrypted communication data.

[0135] Specifically, as shown in FIG5 , the workflow of the encryption and decryption communication system is as follows:

[0136] (1) For participants in the same organization distributed in different regions who need to communicate with each other in encrypted form, they are divided into a security domain. A protection key and a reference key are synchronized in the entire domain through the quantum key distribution network QKD and transmitted to the white box code generation point. The white box code generation point generates a white box protection code based on the protection key, and a secure storage medium is used to fill the white box protection code for the communication participants.

[0137] (2) A large number of pre-shared master keys are generated and distributed throughout the security domain for communication participants through the quantum key distribution network QKD, and are passed to the white box code generation point. The white box code generation point generates a white box cryptographic program code based on each master key and puts the 32 round function operation codes of the code into 32 dynamic link libraries respectively. After compression, they are encrypted and protected with the white box protection code and stored in the round function dynamic library in the white box library of the code generation point. Each master key corresponds to a round function dynamic library, and is indexed using the master key identifier (32-bit integer) plus the round identifier (value 1-32).

[0138] (3) The code generation point generates a white box benchmark algorithm code based on the benchmark key, which is compressed and encrypted with the white box protection code before being stored in the white box library of the code generation point.

[0139] (4) At the code generation point, a large-capacity storage medium is used to fill the dynamic library of round functions generated by each master key (each master key corresponds to 32 dynamic link libraries) and the white box benchmark algorithm code for the communication participants.

[0140] (5) The communication participants start the white box code running container, run the program decoder, call the white box protection code to decrypt and decompress, and run the white box benchmark algorithm code.

[0141] (6) The communication initiator randomly selects two 32-bit integers, one of which is used as the master key identifier to locate the dynamic link library of the round function corresponding to the master key, and the other is used as the bitmap to locate the dynamic link library corresponding to the 32 round functions, and obtains several round functions (the number corresponding to the bit set to 1 in the 32-bit bitmap is the selected round function, for example, the bitmap 0x000000FF corresponds to the 1st to 8th round functions). The white box code runs the container running program decoder, calls the white box protection code to decrypt and decompress the dynamic link library corresponding to the master key selected by the above two random integers, calls the dynamic library loader to load and replace the round function corresponding to the 32-bit bitmap in the white box benchmark algorithm code, and then uses the white box code to encrypt the communication session and appends the two random integers to the encrypted communication data.

[0142] (7) The communication receiver takes out the additional random integers from the encrypted communication data, one of which is used as the master key identifier to locate the dynamic link library of the round function corresponding to the master key, and the other is used as the bitmap to locate the dynamic link library corresponding to 32 round functions, and obtains several round functions (the number corresponding to the bit set to 1 in the 32-bit bitmap is the selected round function). The white box code runs the container running program decoder, calls the white box protection code to decrypt and decompress the dynamic link library corresponding to the master key selected by the above two random integers, calls the dynamic library loader to load and replace the round function corresponding to the 32-bit bitmap in the white box benchmark algorithm code (because the round keys used by the encryption and decryption round functions are in reverse order, the round function sequence number replaced during decryption should be 32-"the number corresponding to the bitmap set to 1" + 1, for example, the bitmap 0x000000FF corresponds to the 24th to 32nd round functions when decrypted), and then uses the white box code to decrypt the communication session.

[0143] Throughout this specification, reference to terms such as "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that a specific feature, structure, material, or characteristic described in conjunction with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0144] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "plurality" means at least two, such as two, three, etc., unless otherwise specifically defined.

[0145] Although the embodiments of the present invention have been shown and described above, it will be understood that the above embodiments are illustrative and are not to be construed as limitations on the present invention. A person skilled in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. An encryption communication method based on the white box SM4 algorithm, characterized in that: Applied to a communication sender, the communication sender is pre-filled with a white box protection code, an encrypted white box reference algorithm code and an encrypted white box cryptographic program, the method comprising: Calling the white box protection code to decrypt the encrypted white box benchmark algorithm code and run the white box benchmark algorithm code; locating the white box cryptographic program based on the randomly selected index value, and calling the white box protection code to decrypt, to obtain several round function operation codes in the white box cryptographic program; Loading the round function operation code to replace the round function operation code of the corresponding sequence number in the white box benchmark algorithm code to obtain the session encryption white box code; The communication data is encrypted using the session encryption white box code and an index value is added to obtain encrypted communication data.

2. The encryption communication method based on the white box SM4 algorithm as claimed in claim 1, characterized in that: The white-box cryptographic program is generated by performing encryption operation on the master key using the white-box SM4 algorithm. The number of the white-box cryptographic programs is the same as the number of the master keys. The round function operation codes in the white-box cryptographic program are respectively stored in each dynamic link library in the corresponding round function dynamic library. The dynamic link library is encrypted by the white-box protection code. The white-box cryptographic program is located based on the randomly selected index value, and the white-box protection code is called for decryption to obtain several round function operation codes in the white-box cryptographic program, including: Randomly select two integers as index values; An integer is used as a master key identifier to locate the round function dynamic library corresponding to the master key, and another integer is used as a round identifier to locate several dynamic link libraries in the round function dynamic library; After calling the white box protection code to decrypt the dynamic link library, the round function operation code is obtained.

3. The encryption communication method based on the white box SM4 algorithm as claimed in claim 1, characterized in that: The communication sender is pre-filled with a number of master keys, and the master keys are distributed by a quantum key distribution network.

4. The encryption communication method based on the white box SM4 algorithm as claimed in claim 2, characterized in that: The method further includes: when switching the master key, randomly reloading a portion of the dynamic link library to obtain a number of round function operation codes.

5. The encryption communication method based on the white box SM4 algorithm as claimed in claim 1, characterized in that: The generation process of the white box protection code is as follows: The protection key is obtained through the code generation point connected to the communication initiator, and the protection key is encrypted using the SM4 white box algorithm to generate the white box protection code and inject it into the communication initiator.

6. The encryption communication method based on the white box SM4 algorithm as claimed in claim 5, characterized in that: The generation process of the white box benchmark algorithm code includes: Obtaining a reference key through a code generation point connected to the communication initiator, and performing encryption operation on the reference key using an SM4 white box algorithm to generate the white box reference algorithm code; The white box protection code is used to encrypt the white box reference algorithm code, and the encrypted white box reference algorithm code is generated and injected into the communication initiator.

7. A decryption communication method based on the white box SM4 algorithm, characterized in that: Applied to a communication receiving party, the communication receiving party is pre-filled with a white box protection code, an encrypted white box reference algorithm code and an encrypted white box cryptographic program, the method comprising: Receiving encrypted communication data sent by a communication sender and taking out the added index value from the encrypted communication data; Locating the corresponding white-box cryptographic program according to the index value, and calling the white-box protection code for decryption to obtain several round function operation codes in the white-box cryptographic program; Calling the white box protection code to decrypt the encrypted white box benchmark algorithm code and run the white box benchmark algorithm code; loading the round function operation code to replace the round function operation code of the corresponding sequence number in the white box benchmark algorithm code to obtain the session decryption white box code; The encrypted communication data is decrypted using the session decryption white-box code.

8. The decryption communication method based on the white box SM4 algorithm as claimed in claim 7, characterized in that: The white-box cryptographic program is generated by performing encryption operation on the master key using the white-box SM4 algorithm. The number of the white-box cryptographic programs is the same as the number of the master keys. The round function operation codes in the white-box cryptographic program are respectively stored in each dynamic link library in the corresponding round function dynamic library, and the dynamic link library is encrypted by the white-box protection code. The index value is two integers. The corresponding white-box cryptographic program is located according to the index value, and the white-box protection code is called for decryption to obtain several round function operation codes in the white-box cryptographic program, including: An integer is used as a master key identifier to locate the round function dynamic library corresponding to the master key, and another integer is used as a round identifier to locate several dynamic link libraries in the round function dynamic library; The white box protection code is called to decrypt the dynamic link library to obtain the round function operation code in the dynamic link library.

9. The decryption communication method according to claim 7, characterized in that: The serial number of the round function operation code replaced in the white-box reference algorithm code during decryption is in reverse order to the serial number of the round function operation code replaced in the white-box reference algorithm code during encryption.

10. The decryption communication method based on the white box SM4 algorithm as claimed in claim 8, characterized in that: The method further includes: when switching the master key, randomly reloading a portion of the dynamic link library to obtain a number of round function operation codes.

11. The decryption communication method based on the white box SM4 algorithm as claimed in claim 7, characterized in that: The generation process of the white box protection code is as follows: The protection key is obtained through the code generation point connected to the communication responder, and the protection key is encrypted using the SM4 white box algorithm to generate the white box protection code and inject it into the communication initiator.

12. The decryption communication method based on the white box SM4 algorithm according to claim 11, characterized in that: The generation process of the white box benchmark algorithm code includes: Obtaining a reference key through a code generation point connected to the communication responder, and performing encryption operation on the reference key using an SM4 white box algorithm to generate the white box reference algorithm code; The white box protection code is used to encrypt the white box reference algorithm code, and the encrypted white box reference algorithm code is generated and injected into the communication initiator.

13. An encrypted communication terminal, characterized in that: The terminal is pre-filled with white box protection code, encrypted white box reference algorithm code and encrypted white box cryptographic program, including: A white box code running container, used to call the white box protection code; A program decoder, for decrypting the encrypted white-box benchmark algorithm code using the white-box protection code and running the white-box benchmark algorithm code; A round function locator, used to locate the white-box cryptographic program based on a randomly selected index value, and call the white-box protection code for decryption to obtain a number of round function operation codes in the white-box cryptographic program; A dynamic library loader is used to load the round function operation code to replace the round function operation code with the corresponding serial number in the white box benchmark algorithm code, obtain the session encryption white box code, use the session encryption white box code to encrypt the communication data and add the index value to obtain the encrypted communication data.

14. A decryption communication terminal, characterized in that: The terminal is pre-filled with a white box protection code, an encrypted white box reference algorithm code, and an encrypted white box cryptographic program, including: White box code running container, used to call the white box protection code A program decoder, for decrypting the encrypted white-box benchmark algorithm code using the white-box protection code and running the white-box benchmark algorithm code; A round function locator, used to extract the added index value from the encrypted communication data sent by the communication sender, locate the corresponding white box cryptographic program according to the index value, and use a program decoder to decrypt according to the white box protection code to obtain a number of round function operation codes in the white box cryptographic program; The dynamic library loader is used to load the round function operation code to replace the round function operation code of the corresponding sequence number in the white box benchmark algorithm code, obtain the session decryption white box code, and use the session decryption white box code to decrypt the encrypted communication data. Decryption.

15. An encryption and decryption communication system based on the white box SM4 algorithm, characterized in that: The system comprises: a communication sender and a communication receiver, the communication sender and the communication receiver are respectively connected to corresponding code generation points, each code generation point is connected to a corresponding quantum network node in a quantum key distribution network, and the communication sender and the communication receiver are respectively connected to the quantum key distribution network, wherein: The quantum key distribution network is used to inject a plurality of master keys into the communication sender and the communication receiver, and to inject a protection key, a reference key and a plurality of master keys into each of the code generation points; The code generation point is used to generate white box protection code, white box reference algorithm code and white box cryptographic program corresponding to each master key based on the protection key, the reference key and several master keys; The communication sender is used to generate a session encryption white box code based on the white box protection code filled in the code generation point connected to it, the white box benchmark algorithm code and the white box cryptographic program corresponding to each master key, and encrypt the communication data using the session encryption white box code to obtain encrypted communication data; The communication receiving party is used to generate a session decryption white box code based on the white box protection code filled in the code generation point to which it is connected, the white box benchmark algorithm code and the white box cryptographic program corresponding to each master key, and use the session decryption white box code to decrypt the encrypted communication data.

Images