WO2012071714A1

WO2012071714A1 - Data encryption and decryption method and device

Info

Publication number: WO2012071714A1
Application number: PCT/CN2010/079315
Authority: WO
Inventors: 刘慧�
Original assignee: 北京卓微天成科技咨询有限公司
Priority date: 2010-11-29
Filing date: 2010-12-01
Publication date: 2012-06-07
Also published as: CN102064936A; CN102064936B

Abstract

A data encryption and decryption method and device are provided, which relate to the technical field of data encryption and decryption. The data encryption method comprises the following steps: grouping plaintext to be encrypted; assigning an encryption function randomly to each group of the plaintext data; encrypting each group of the plaintext data respectively with the encryption function; and arranging the encrypted data to form ciphertext according to the position of the corresponding plaintext. The data encryption device comprises a grouping module, an encryption function random assignment module, and an encryption processing module. A data decryption method and device are also provided. By assigning the encryption function randomly to the plaintext to be encrypted when carrying out the encryption, encrypting the plaintext data using the assigned encryption function and arranging the encrypted data to form the ciphertext, the solution greatly improves the security of data storage and realizes the perfect encryption of data.

Description

Data encryption and decryption method and device

Technical field

The invention belongs to the technical field of data encryption and decryption, and in particular relates to a data encryption and decryption method and device. Background technique

Perfect Secrecy system-protected data, no matter how many ciphertexts intercepted by cryptanalysts, can't be solved under unlimited computing power and time. See Shannon, Claude (1949) for details. Communication Theory of Secrecy Systems , Bell System Technical Journal 28 (4): 656-715.

One-time-pad (hereinafter referred to as OTP) is one of the typical implementations. For details, see the following document, US patent 1,310,719. SECRET SIGNALING SYSTEM, SN Molotkov, "Quantum cryptography and VA Kotel 'nikov's one-time key and sampling theorems", PHYS-USP, 2006, 49 (7), 750-761, and the application of Cryptography, published on March 1, 2003. .

At present, the implementation of the perfect encryption system mainly lies in the key part, that is, how to encrypt each bit of the plaintext by an infinite number of true random keys to achieve the design purpose of the perfect encryption system. The encryption algorithms used are mostly single-OR operations, or the security of the entire system is completely dependent on the secure storage and transmission of keys. Once the key is compromised, the security of the entire system becomes very fragile. Summary of the invention

The object of the present invention is to provide a data encryption and decryption method and apparatus, which aims to solve the problem that the security of the existing perfect encryption technology completely depends on the secure preservation and transmission of the key, and the key ciphertext may be cracked once the key is leaked.

The present invention provides a data encryption method, the method comprising:

Grouping encrypted plaintext; Randomly assign an encryption function to each set of plaintext data;

Encrypting each set of plaintext data by using an encryption function;

The encrypted data is arranged according to the corresponding plaintext position to form a ciphertext.

The present invention provides a data encryption device, the device comprising:

a grouping module, configured to group the encrypted plaintext;

An encryption function random allocation module, configured to randomly allocate an encryption function for each group of plaintext data grouped by the grouping module;

And an encryption processing module, configured to encrypt data in the plaintext by using an encryption function assigned by the encryption function random allocation module, and arrange the encrypted data according to the corresponding plaintext position to form a ciphertext.

The present invention provides a data decryption method, the method comprising:

Obtaining decryption information, and collecting data from the saved random seed according to the decryption information to generate an encrypted function index random string;

Determining, according to the decryption information, a traversal start position of the encryption function index random string, and traversing the encryption function index random string and the ciphertext to be decrypted;

Determining, according to the decryption information, an encryption function corresponding to each bit bit data in the ciphertext; determining, according to the encryption function, a decryption function corresponding to each bit bit data in the ciphertext; using the decryption function to The data of the bit is restored to the data of each bit in the plaintext;

The data of each bit in the plaintext is arranged according to the ciphertext position corresponding thereto to form a plaintext. The present invention also provides a data decryption apparatus, the apparatus comprising:

An obtaining module, configured to obtain decryption information;

a random seed storage module, configured to store a random seed generated when encrypting;

The encryption function index random string generation module is configured to: according to the decryption information acquired by the acquisition module, collect data from the random seed saved by the random seed storage module to generate an encryption function index random a synchronization traversing module, configured to determine, according to the decryption information acquired by the acquiring module, a traversal start position of the encrypted function index random string, and traverse the encrypted function index random string and the ciphertext to be decrypted;

An encryption function determining module, configured to determine an encryption function corresponding to each bit bit data in the ciphertext according to the decryption information acquired by the obtaining module;

a decryption function obtaining module, configured to determine an encryption function determined by the module according to the encryption function, and determine a decryption function corresponding to each bit bit data in the ciphertext;

a plaintext restoring module, configured to restore, by using the decryption function, data of each bit in the ciphertext to data of each bit in the plaintext, and press the data of each bit in the plaintext according to the ciphertext corresponding thereto The positions are arranged to form a clear text.

The invention randomly allocates the stored encryption function for the plaintext to be encrypted when encrypting, encrypts the plaintext with the assigned encryption function, and obtains the decryption function of the ciphertext to be decrypted by creating and indexing the random string according to the encryption function. Decryption with the decryption key greatly improves the security of the data and achieves perfect encryption of the data. DRAWINGS

1 is a flowchart of a data encryption method according to an embodiment of the present invention;

2 is a flow chart showing the steps before the encryption function is randomly assigned to the plaintext to be encrypted according to the embodiment of the present invention;

3 is a flowchart of a method for performing repetitive verification on an encrypted string of an encryption function according to an embodiment of the present invention;

4 is a schematic structural diagram of a data encryption apparatus according to an embodiment of the present invention;

5 is a flowchart of a method for establishing a minimum encryption function set according to an embodiment of the present invention; FIG. 6 is a flowchart of a data decryption method according to an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a data decryption apparatus according to an embodiment of the present invention;

FIG. 8 is a schematic diagram of a principle of generating an encrypted function index random string according to an embodiment of the present invention; FIG. 9 is a schematic diagram of a data encryption process according to an embodiment of the present invention; FIG.

FIG. 10 is a schematic diagram of a data decryption process according to an embodiment of the present invention. detailed description

The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

In the embodiment of the present invention, the encrypted function is randomly allocated by the stored encryption function for the plaintext to be encrypted during encryption, and the plaintext is encrypted by the assigned encryption function; when decrypting, the decryption of the ciphertext to be decrypted is obtained by generating and indexing the random string according to the encryption function. The function decrypts.

Referring to FIG. 1 and FIG. 9, an embodiment of the present invention provides a data encryption method, including the following steps: Step S101: grouping encrypted plaintext;

Step S102: randomly assign an encryption function to each group of plaintext data;

In this embodiment, a set of encryption function storage is pre-selected, and the stored encryption function may cover all conversion paths from any predetermined bit 0, 1 in the plaintext to the corresponding position 0 or 1 in the ciphertext; after the selection is completed, when the encryption is performed , is randomly assigned to plaintext to encrypt the plaintext;

In this embodiment, each bit (bit) of the plaintext to be encrypted is used as a packet, that is, each bit of the plaintext is randomly assigned an encryption function; in practical applications, each of the plaintext to be encrypted may also be Bit, every 3 bits, every 4 bits of data as a group;

Step S103: encrypt each bit of data in the plaintext with the assigned encryption function;

Step S104: Arranging each encrypted data according to its corresponding plaintext position to form a ciphertext.

Referring to FIG. 2, the embodiment of the present invention further includes the following steps between step S101 and step S102: Step S201: generating a true random number of a predetermined length and a random seed of a predetermined length consisting of a true random number;

The method of generating a true random number is already very mature. In the specific implementation, the method of generating a true random number given in the "Applied Cryptography" published by the Machinery Industry Press on March 1, 2003 can be used. If random noise is used, use computer clock, CPU load or network packet arrival times to generate the required true random number, as a random seed, and store the generated random seed;

Step S202: Establish an encryption function set, and assign an index to each encryption function in the set; each encryption function in the set has an index corresponding thereto, and store the different indexes;

Step S203: Perform data collection on the random seed to generate an encrypted function index random string. Step S204: Synchronize the traversal encryption function index random string and the plaintext to be encrypted.

In the embodiment of the present invention, after the data collection of the random seed is generated, the step of generating the encrypted function index random string further includes the step of performing repetitive verification on the encrypted function index random string. The specific implementation manner is as shown in FIG. 3, and includes the following steps:

Step S301: generating, by the information digest operation, the information digest value of the encrypted function index random string; Step S302: comparing the information digest value of the concatenated encryption function index random string with the previously stored information digest value, if they are consistent, then the random seed is again Performing data collection, generating an encrypted function index random string, performing step S301, if not, performing step S303;

Step S303: Save the currently generated encryption function index random string to be used.

When there is a newly generated encryption function index random string, the present invention generates a message digest value of the encryption function index random string by using information digest operations such as MD5, SHA1, etc., and the information digest value and the previously stored encryption function index random string. The information digest values are compared to determine whether the newly generated encryption function index random string has been used, and if so, the encryption function index random string is regenerated, otherwise the generated encryption function index random string is saved for use. After the random string of the encrypted function index to be used is saved, the information digest value of all the encrypted function index random strings is saved.

In the present invention, the plaintext grouping information, the encryption function set, the assigned encryption function index, the key corresponding to each encryption function, and the random data used in data collection are generated and generated in the data encryption process. The seed, the information of the encrypted function index random string corresponding to the encrypted plaintext is generated again, and the cursor position information of the start of the random string of the encryption function index is traversed to form decryption information.

Referring to FIG. 4, an embodiment of the present invention provides a data encryption apparatus. In connection with the invention, the device comprises:

a grouping module 40, an encryption function random allocation module 41 and an encryption processing module 42;

When data encryption is performed, the grouping module 40 divides each bit of data in the plaintext to be encrypted into a group, and the encryption function random allocation module 41 randomly allocates an encryption function for each bit of data to be encrypted for encryption, and the encryption processing module 42 encrypts. The encryption function assigned by the function random allocation module 41 encrypts each bit of the encrypted plaintext, and arranges each bit of the encrypted data according to the position of the corresponding plaintext to form a ciphertext output.

Further, the data encryption device further includes:

The encryption function establishing module 43, the true random number generating module 44, the encryption function index random string generating module 45, the assigning module 46 and the synchronous traversing module 47;

The real random number generating module 44 is configured to generate a random length of a predetermined length and a random seed of a predetermined length composed of a true random number, and the encryption function index random string generating module 45 performs data collection on the random seed to generate an encrypted function index random string; An encryption function establishing module 43 is configured to establish and store an encryption function set; an allocation module 46 is configured to allocate an index to each encryption function in the encryption function set established by the encryption function establishing module 43; the synchronization traversal module 47 synchronously traverses the encryption function index The encryption function generated by the random string generation module 45 indexes the random string and the plaintext to be encrypted.

The encryption function index random string generation module 45 includes:

a data collection unit, configured to collect data from the random seed generated by the true random number generation module 44, and send the data collection result;

The index random string generating unit is configured to generate and save the encrypted function index random string according to the data collection result sent by the received data collecting unit.

Further, the encryption function index random string generation module 45 further includes:

The information digest value generating module is configured to generate, by using the information digest operation, an information digest value of the encrypted function index random string generated by the index random string generating unit;

a storage module, configured to store an information digest value of the encrypted function index random string generated by the information digest value generating module; The comparison module is configured to compare the information digest value generated by the information digest value generating module with the information digest value previously stored by the storage module, and send the comparison result to the encryption function index random string generation module 45.

The encryption function index random string generation module 45 regenerates the encryption function index random string according to the comparison result of the information digest value sent by the comparison module, and repeatedly compares the information digest values through the comparison module until the non-repetition occurs. The encryption function indexes a random string.

Since the perfect encryption system needs to satisfy the posterior probability that the ciphertext is intercepted is equal to its prior probability, at least one way can be converted into any ciphertext for any deterministic plaintext, and these conversion methods are completely equal ( For details, see Shannon, Claude (1949). Communication Theory of Secrecy Systems, Bell System Technical Journal 28 (4): 656-715). For binary plaintext and ciphertext stored in the computer, since all plaintext and ciphertext are composed of a series of binary numbers 0 or 1, the arbitrarily determined one-bit data 0 or 1 is always present. At least one way to convert it to 0 or 1 of the corresponding position in the ciphertext, the present invention refers to this conversion mode as a conversion path.

In order to achieve the perfect encryption of the present invention, it is necessary to find a minimum set of encryption functions that can cover all conversion paths from any predetermined bit 0,1 in the plaintext to the corresponding position 0 or 1 in the ciphertext.

Referring to FIG. 5, the present invention adopts the following method to select a minimum encryption function set, and the implementation steps are as follows: Step S501: Select an encryption function that can cover a maximum possible plaintext to a ciphertext conversion path, and record a possible conversion path covered by the encryption function;

Step S502: Determine whether the possible conversion path is completely covered, and if yes, perform steps

S505, otherwise, performing step S503;

Step S503: determining a possible conversion path that is not covered, selecting another encryption function that can cover the most uncovered possible conversion path, and recording the path covered by the current encryption function, and reselecting another possible conversion path that can cover the most uncovered. Encryption function, step S504;

Step S504: determining whether the possible transition paths that are not covered are overwritten, if yes, proceeding to step S505, otherwise, performing step S503; Step S505: All selected encryption functions are composed into a minimum encryption function set.

In order to verify the feasibility of the method, two examples are given below, but the scope of protection of the present invention is not limited to these two implementations. It is recorded that the data E(x,) of any predetermined position X of the text to the position x of the ciphertext is converted into M(x)->E(x,), where M(x), E(x ,) = 0 or 1.

Method A: By selecting the following encryption function and key,

Encryption function 1: XOR operation (XOR). The corresponding operation rules are:

0 θ 0 = 0

0 © 1 = 1

1 θ 0 = 1

1 © 1=0

Encryption function 2: f(a) = a, a is the input and the output. The corresponding operation rules are:

f(0) = 0

f(l) = 1

Overwrite the following conversion path

Method B: By selecting the following encryption function and key,

Encryption function 1: Non-operation (: ~). The corresponding operation rules are:

-0=1

~ 1 = 0

f(0) = 0

f(l) = 1 Overwrite the following conversion path

In summary, the user can select the minimum set of encryption functions according to a certain method, and then the method for randomly assigning the encryption function proposed by the present invention makes the conversion path from plaintext to ciphertext completely and randomly.

In use, after selecting the minimum encryption function and key set, the user can add other encryption functions and keys as needed to make the system more secure. The final selected encryption function set will be called by the encryption method provided by the present invention. .

For the above encryption method, an embodiment of the present invention further provides a data decryption method. Referring to FIG. 6 and FIG. 10, the method includes the following steps:

Step S601: Acquire decryption information, and collect data from the saved random seed according to the decryption information, and generate an encrypted function index random string;

The obtained decryption information is formed in the encryption process of the data, including plaintext data packet information, a random seed stored when the data is encrypted, and the information of the encrypted function index random string corresponding to the encrypted plaintext is generated again, and the traversal encryption function index is randomly generated. String start cursor position information;

Step S602: Determine, according to the decryption information, a traversal start position of the random sequence of the encryption function index, synchronously traverse the encryption function index random string and the ciphertext to be decrypted, and determine an encryption function corresponding to each data of the ciphertext according to the decryption information;

Step S603: Determine, according to the encryption function, a decryption function corresponding to each bit of the ciphertext data;

Step S604: Restore each ciphertext data into plaintext data by using a decryption function; Step S605: Arrange each data of the plaintext according to the ciphertext position corresponding thereto to form a plaintext.

In the present invention, each decryption function includes a decryption key corresponding thereto; each decryption function corresponds to an encryption function, and the decryption key required for decryption also corresponds to the encryption key used by the encryption function.

Referring to Figure 7, an embodiment of the present invention further provides a data decryption apparatus. For ease of explanation, only parts related to the present invention are shown. The device includes:

The obtaining module 71 is configured to obtain decryption information.

a random seed storage module 76, configured to store a random seed generated when encrypting;

The encryption function index random string generation module 72 is configured to generate an encryption function index random string from the random seed stored in the random seed storage module 76 according to the decryption information acquired by the acquisition module 71. The synchronization traversal module 77 is configured to acquire the module according to the acquisition module. The obtained decryption information is determined, the traversal start position of the encrypted function index random string is determined, the traversal encryption function index random string and the ciphertext to be decrypted are synchronously traversed, and the encryption function determining module 73 is configured to determine the density according to the decryption information acquired by the obtaining module 71. An encryption function corresponding to each bit data in the text;

The decryption function obtaining module 74 is configured to determine, according to the encryption function determined by the encryption function determining module 73, a decryption function corresponding to each bit bit data in the ciphertext;

The plaintext restoring module 75 is configured to use the decryption function to restore the data of each bit in the ciphertext to the data of each bit in the plaintext, and arrange the data of each bit in the plaintext according to the ciphertext position corresponding thereto to form a plaintext. .

In order to further prove the feasibility of the present invention, the following exemplifies the above-mentioned encryption implementation: 3⁄4.

Method 1. Encryption function index random string fixed bit method

There are several plaintexts to be encrypted, where the number of digits of the kth plaintext is m bits, and there are n kinds of encryption algorithms to be selected, where m, n, and k all take natural numbers, and each data bit of the kth plaintext is randomly assigned. Encryption function and corresponding key;

First, a true random number 0, 1 string of a predetermined length w bits is generated as a random seed, where w is a natural number, J.w >m; Random data acquisition of the random seed for a predetermined number of times u (u is a natural number), the starting cursor position of each data acquisition and the length of the collected data (may be greater than or equal to 0) are random, if the data is collected to a random seed At the end, return to the head to continue data collection;

The data collected each time is concatenated into an encrypted function index random string of predetermined length p, p is a natural number, ^ mouth fruit log ₂ « is an integer shell ¹ J p> mx log ₂ n , ^ mouth fruit log ₂ « integer Bay ¹ J p> mx [log ₂ w + 1] where [log ₂ η + 1] is a rounding operation on \og ₂ n + 1.

Determining whether the generated encrypted function index random string has been used, and if so, regenerating the encrypted function index random string, otherwise leaving the encrypted function index random string to be used;

Assigning a decimal number identifier to each encryption algorithm in the encryption function, such as the first encryption function assignment 0, the second encryption function assignment 1, the third encryption function assignment 2, the fourth encryption function assignment 3, and so on;

Then, the traversal data is synchronized from the generated encryption function index random string and the head of the plaintext to be stored, and each time the traversal takes 1 (3⁄4 ₂ « or [1(3⁄4 ₂ «]+1 bits, where [log ₂ «] is For the rounding operation of log ₂ «, convert the log ₂ « or [log ₂ «] + l binary digits taken by each traversal to a decimal number, and modulate the converted value against n, modulo The value is used as an index of the encryption function corresponding to the plaintext data of the bit;

Continue to synchronously traverse the encrypted function index random string and plaintext until all plaintext bits or parts are randomly assigned an encryption function;

Before each data acquisition, it is necessary to generate two random values, and respectively modulate them to obtain a random starting cursor position and the required data length;

Assuming that two true random numbers R1, R2 are generated before data acquisition, then two random values Tl, T2 smaller than w and pq, respectively, need to be generated (where q is a natural number less than or equal to p, and w is the length of the random seed , p is the length of the random string required to generate the plaintext encryption bit, q is the length of the data that has been generated, pq is the number of bits of the remaining uncollected data of the random string), then

Tl = Rl mod w

T2 = R2 mod (p-q)

Among them, mod is a modulo operation. The method of generating the random string of the encryption function index is as shown in FIG. 8.

Record that the p-bit encryption function corresponding to the k-th plaintext index random string is re _k , then re _k is equal to the sequential combination of the data randomly collected from the random seed of the predetermined length u, and the data collected from the i-th time in the random seed is (Cur _s , Cure), where i is a natural number, and iu, Cur _s is the starting cursor position in the random seed for the ith acquisition data, and accordingly Cur _e is the ending cursor position of the ith acquisition data, 0^ Both Cur and Cur _e are identified by the offset from the first position of the random seed, and 0 Cur _s Cur _e m is visible. When Cur _e is equal to Cur _s , the number of bits of data acquisition is 0, then the data acquired by the ith is random to a predetermined length. The data between Cur _s and Cur _e in the seed; further, the p-bit encryption function corresponding to the k-th plaintext index random string re _k can be expressed as:

Re _k =[(Cur _s , Cur _e )i , (Cur _s , Cur _e ) ₂ , .... (Cur _s , Cur _e )i , .... (Cur _s , Cur _e ) _u ] _k;

To illustrate the feasibility of the present invention, the true randomness/non-reproducibility of the encrypted function index random string generated by the method 1 is analyzed to ensure the true randomness and non-repetition of the random string of the encrypted function index by the comparison module. Use, it is crucial that the entire system is not cracked by the cryptanalyst.

It should be reiterated that as long as the characters used as random strings are finite, the random strings may be reproduced, and the randomness is reflected in the fact that the probability of reproduction is small and irregular. Assume that the number of bits in a random string is 1024 bits, because the characters that can form a random string are only 0 and 1, so no matter how random, the probability of reproduction is still greater than or equal to 1/2, that is, 1/( 1.79*10 ³⁰⁸

The true randomness of the encryption function assigned to each plaintext in this method 1 is embodied in two places: one is a random seed composed of true random numbers, and the other is random data acquisition in random seeds (data acquisition start position and acquisition length) Both are derived from true random numbers), generating a p-bit encryption function index random string.

Further, the p-bit random string (in the present method, the head of the random string) is traversed from a fixed position, and an encryption function index corresponding to each plaintext portion is generated (subjecting a modulo operation).

It can further be calculated that the probability that the method 1 generates the same encryption function allocation index for the same number of plaintexts depends on the probability of the p-bit encryption function index random string reproduction, and only the probability of random string reproduction based on the same random seed p-bit is considered here.

Method 2, the encryption function index random string is not fixed bit method The method 2 is similar to the method 1. The difference is: in the method, the index value of the encryption algorithm is traversed from the random position in the random string generated by the p-bit algorithm index, and the security of the whole method is enhanced by traversing the uncertainty of the starting position. Sex. The details are as follows (variable setting is the same as method 1):

First, a truly random 0,1 string of predetermined length w bits is generated as a random seed, where w is a natural number and w > m;

Random data acquisition of the random seed for a predetermined number of times U (U is a natural number), the starting position of each data acquisition and the length of the collected data (which may be greater than or equal to 0) are random, if the data collection has been randomized At the end of the seed, return to its head to continue data collection;

The data collected each time is cascaded into an encrypted function index random string of predetermined length p bits, p is a natural number, ^ mouth fruit log ₂ «is an integer, p> mx log ₂ n , ^ 口果 log ₂ « integer shell ¹ J p> mx [log ₂ w + 1]; where [log ₂ n + l] is a rounding operation on \og ₂ n + 1;

Assigning a decimal number identifier to each encryption algorithm in the set of encryption functions, such as the first encryption function assignment 0, the second encryption function assignment 1, the third encryption function assignment 2, the fourth encryption function assignment 3, and so on;

A random starting position is reserved in the p-bit random string, and the data is traversed synchronously from the p-position of the random string and the plaintext header, and each time the traversal takes the log ₂ « (if log ₂ «is an integer) or [log ₂ «] +l (if log ₂ «non-integer) bits, where [log ₂ «] is a rounding operation on log ₂ «, which will be converted each time by the log ₂ « or [log ₂ «] + l-bit binary number It is a decimal number, and then the converted value is subjected to a modulo operation on n, and the value of the modulo is used as an index of the encryption function corresponding to the plaintext data of the bit;

Continue to traverse the cryptographic function index random string and plaintext. When the data traverses to the end of the encrypted function index, continue back to the head until all plaintext bits or parts are randomly assigned encryption functions.

Before each data acquisition, two random values are generated, and the modulo is respectively obtained, and the random starting cursor position and the required data length are obtained, and the random starting cursor position and the required data length are obtained. The method of degree is as described in Method 1.

Assuming that a true random number R3 is generated before the data traversal, then it is now necessary to generate a random value T3 less than p, which is the starting position of the p-bit random string traversal, then

T3 = R3 mod p

Among them, mod is a modulo operation.

To further illustrate the feasibility of the embodiment of the present invention, the true randomness/non-reproducibility analysis of the random string of the encrypted function index in the present method 2 is now performed.

Compared with the method 1, a factor affecting the randomness of the whole method is added in the method 2, that is, in the p-bit random string, the cryptographic algorithm index corresponding to each plaintext portion is generated by traversing the data from a random position, because the traversal There are p possibilities at the beginning position, so the probability of recurring the index corresponding to the plaintext partial encryption algorithm is: l/(p*w ^u ).

Taking the data set by Method 1 as an example, where p>mx \og ₂ n , that is, ρ>160,000,000, that is, 160M bits. Then, the minimum probability of generating re _k repetition by this method is 1/(1.6*10 ^9∞8 ), and it can be seen that the probability of repetition is already low enough to conform to the characteristics of random features. In actual use, it is also possible to increase the randomness of the values of u, w, reduce the probability of repetition, or periodically replace random seeds to improve the safety of the whole method.

In summary, the above implementation can prove that the random assignment method of the encryption function is feasible in practical applications. Compared with the traditional OTP method, the traditional perfect encryption system has the following advantages:

1, because there is a protection function of the encryption function itself (in the case of unknown key, it requires more than 4 计算 computing power to restore the ciphertext to a unique plaintext), which can effectively reduce the password book (for the present invention, corresponding Is the risk of data leakage caused by an accidental leak after the encrypted function index book;

2. The security protection of the whole system is dispersed into three parts: a random seed, an encrypted function index random string and a key corresponding to each encryption function, which means that it is easier to intercept the information of the three parts at the same time. Cracking ciphertext, compared to the traditional OTP system security depends only on a large number of random keys to protect a part, the risk of data leakage is effectively dispersed.

The embodiment of the present invention randomly selects an encryption function, and uses an encryption function to randomly rotate each bit of the plaintext. The data is encrypted, and the posterior probability of the ciphertext intercepted is equal to the prior probability of the ciphertext crack, which achieves the same encryption strength as the traditional OTP method, and relies on a large number of random secrets compared with the traditional OTP system security. The key protects a part, and the data leakage risk is effectively dispersed, which can effectively reduce the risk of data leakage caused by accidental leakage of the password book.

The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection of the present invention. Within the scope.

Claims

Claim

A data encryption method, the method comprising:

Grouping encrypted plaintext;

Randomly assign an encryption function to each set of plaintext data;

Encrypting each set of plaintext data by using an encryption function;

2. The data encryption method according to claim 1, wherein the step of grouping the plaintext to be encrypted and randomly assigning an encryption function to each set of plaintext data further comprises:

Generating a true random number of a predetermined length and a random seed of a predetermined length consisting of the true random number; establishing a set of encryption functions, and assigning an index to each of the encryption functions in the set;

Performing data collection on the random seed to generate an encrypted function index random string;

Synchronizing the cryptographic function index random string and the plaintext to be encrypted.

The data encryption method according to claim 2, wherein the encryption function set includes an encryption function covering all conversion paths from any 0, 1 in the plaintext to be encrypted to a corresponding position 0 or 1 in the ciphertext, correspondingly The step of determining the encryption function covering all the conversion paths from any 0, 1 in the plaintext to be encrypted to the corresponding position 0 or 1 in the ciphertext comprises: selecting an encryption function covering the most plaintext to the ciphertext possible conversion path, and recording Determining whether the possible conversion path is completely covered, and if so, using all selected encryption functions as elements of the encryption function set; otherwise, selecting another possible conversion path that covers the most uncovered Encrypt the function, and record the path covered by the current encryption function, reselect the encryption function covering the most uncovered possible conversion path until the selected encryption function can cover all possible conversion paths, and use all selected encryption functions as the encryption The element of the function collection.

The data encryption method according to claim 2, wherein the step of performing data collection on the random seed to generate an encrypted function index random string further comprises:

Generating, by the information digest operation, the information digest value of the encrypted function index random string;

Comparing the information digest value with a previously stored information digest value, if they are consistent, then The random seed performs data collection again, generates a new encrypted function index random string, and then compares the information digest values until it determines different encrypted function index random strings. If not, saves the currently generated encryption function index randomly. string.

The data encryption method according to claim 1, wherein each of the sets of plaintext data includes at least one plaintext bit.

6. A data encryption device, the device comprising:

a grouping module, configured to group the encrypted plaintext;

The data encryption apparatus according to claim 6, wherein the apparatus further comprises: a true random number generating module, configured to generate a true random number of a predetermined length and a predetermined length consisting of the true random number Random seed

An encryption function establishing module for establishing and storing a set of encryption functions;

An allocating module, configured to allocate an index to each encryption function in the set of encryption functions established by the encryption function establishing module;

The encryption function index random string generation module is configured to perform data collection on the random seed generated by the true random number generation module, and generate an encryption function index random string;

And a synchronization traversal module, configured to synchronously traverse the encryption function index random string generated by the encryption function index random string generation module and the plaintext to be encrypted.

8. The data encryption apparatus according to claim 7, wherein the encryption function index random string generation module comprises:

a data collection unit, configured to perform data collection on the random seed generated by the true random number generation module, and send the data collection result; And an index random string generating unit, configured to generate and save an encrypted function index random string according to the received data collection result sent by the data collecting unit.

The data encryption device according to claim 8, wherein the encryption function index random string generation module further comprises:

An information digest value generating module, configured to generate, by using an information digest operation, an information digest value of an encrypted function index random string generated by the index random string generating unit;

a storage module, configured to store an information digest value of the encrypted function index random string generated by the information digest value generating module;

And a comparison module, configured to compare the information digest value generated by the information digest value generating module with the information digest value previously stored by the storage module, and send a comparison result to the encryption function index random string generation module.

10. A data decryption method, the method comprising:

The data of each bit in the plaintext is arranged according to the ciphertext position corresponding thereto to form a plaintext.

11. A data decryption apparatus, the apparatus comprising:

An obtaining module, configured to obtain decryption information;

The encryption function index random string generation module is configured to: according to the decryption information acquired by the acquisition module, collect data from the random seed saved by the random seed storage module to generate an encryption function index random String

a synchronization traversing module, configured to determine, according to the decryption information acquired by the acquiring module, a traversal start position of the encrypted function index random string, and traverse the encrypted function index random string and the to-be-decrypted ciphertext;