WO2017036158A1 - 一种加解密方法及装置 - Google Patents

一种加解密方法及装置 Download PDF

Info

Publication number
WO2017036158A1
WO2017036158A1 PCT/CN2016/080921 CN2016080921W WO2017036158A1 WO 2017036158 A1 WO2017036158 A1 WO 2017036158A1 CN 2016080921 W CN2016080921 W CN 2016080921W WO 2017036158 A1 WO2017036158 A1 WO 2017036158A1
Authority
WO
WIPO (PCT)
Prior art keywords
encryption
decryption
target
terminal
switching instruction
Prior art date
Application number
PCT/CN2016/080921
Other languages
English (en)
French (fr)
Inventor
冯磊
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017036158A1 publication Critical patent/WO2017036158A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
    • H04N21/45—Management operations performed by the client for facilitating the reception of or the interaction with the content or administrating data related to the end-user or to the client device itself, e.g. learning user preferences for recommending movies, resolving scheduling conflicts
    • H04N21/462—Content or additional data management, e.g. creating a master electronic program guide from data received from the Internet and a Head-end, controlling the complexity of a video stream by scaling the resolution or bit-rate based on the client capabilities
    • H04N21/4627—Rights management associated to the content

Definitions

  • the present application relates to, but is not limited to, the field of communication technologies, and in particular, an encryption and decryption method and apparatus.
  • Base64 a 64-based position counting method
  • sensitive parameters such as login password, WiFi (Wireless Fidelity, wireless protection) on the WEBUI (network user interface) end.
  • the password, the APN (Access Point Name) parameter, and the DHCP (Dynamic Host Configuration Protocol) parameters are encrypted by Base64 and sent to the WEBSERVER (web server), and then in the WEBSERVER. The end decrypts.
  • this encryption and decryption method has the following disadvantages: after the hacker intercepts the encrypted parameters, it is easy to crack the original sensitive parameters through the HTTP (HyperText Transfer Protocol) tool and expand the security vulnerability of the terminal product; Patching security vulnerabilities requires a lot of manpower and material resources to modify software code, upgrade versions, and so on.
  • HTTP HyperText Transfer Protocol
  • This paper provides an encryption and decryption method and device to solve the technical problem that the encryption and decryption method existing in the related art is cracked, which can improve the security of the terminal product and reduce the possibility that the encryption and decryption method is cracked.
  • An embodiment of the present invention provides an encryption and decryption method, which is applied to a terminal, and includes:
  • the terminal stores at least two sets of encryption tables and decryption tables, and each of the encryption table and the decryption table are matched.
  • the method before the switching the encryption table and the decryption table that the terminal is using to the target encryption table and the target decryption table according to the switching instruction, the method further includes:
  • the receiving, by the cloud server, the handover instruction includes:
  • the switching instruction is automatically received from the cloud server during the preset time interval.
  • the method before the switching the encryption table and the decryption table that the terminal is using to the target encryption table and the target decryption table according to the switching instruction, the method further includes:
  • a switching instruction is automatically generated within a preset time interval.
  • the embodiment of the invention further provides a computer readable storage medium storing computer executable instructions, which are implemented when the computer executable instructions are executed.
  • the embodiment of the invention further provides an encryption and decryption device, which is disposed on a terminal, and includes:
  • the switching module is configured to: switch the encryption table and the decryption table that the terminal is using to the target encryption table and the target decryption table according to the switching instruction;
  • the encryption and decryption module is configured to: perform encryption and decryption by using the switched target encryption table and the target decryption table;
  • the terminal stores at least two sets of encryption tables and decryption tables, and each of the encryption table and the decryption table are matched.
  • the encryption and decryption device further includes:
  • the receiving module is configured to: receive a switching instruction from the cloud server.
  • the receiving module is configured to: automatically receive a switching instruction from the cloud server within a preset time interval.
  • the encryption and decryption device further includes:
  • the generation module is set to: automatically generate a switching instruction within a preset time interval.
  • the embodiment of the invention further provides an encryption and decryption method, which is applied to a cloud server, and includes:
  • the terminal stores at least two sets of encryption tables and decryption tables, and each of the encryption table and the decryption table are matched.
  • the sending a handover command to a terminal includes:
  • a switching instruction is automatically sent to a terminal within a preset time interval.
  • the embodiment of the invention further provides a computer readable storage medium storing computer executable instructions, which are implemented when the computer executable instructions are executed.
  • the embodiment of the invention further provides an encryption and decryption device, which is disposed on a cloud server, and includes:
  • the sending module is configured to: send a switching instruction to a terminal, so that the terminal can switch the encryption table and the decryption table that it is using to the target encryption table and the target decryption table according to the switching instruction, and use the switched
  • the target encryption table and the target decryption table are encrypted and decrypted;
  • the terminal stores at least two sets of encryption tables and decryption tables, and each of the encryption table and the decryption table are matched.
  • the sending module is configured to: automatically send a switching instruction to a terminal in a preset time interval, so that the terminal can switch the encryption table and the decryption table that it is using according to the switching instruction.
  • the target encryption table and the target decryption table are used, and the switched target encryption table and the target decryption table are used for encryption and decryption.
  • the encryption and decryption method and device dynamically adjust the encryption table and the decryption table required for encryption and decryption according to the switching instruction, thereby quickly repairing security vulnerabilities, improving the security of the terminal product, and avoiding security problems. At the time, it takes a lot of manpower and material resources to modify the software code and upgrade the version.
  • FIG. 1 is a flow chart showing an encryption and decryption method according to an embodiment of the present invention.
  • Fig. 2 is a block diagram showing the structure of an encryption/decryption apparatus according to an embodiment of the present invention.
  • Fig. 3 is a flow chart showing the encryption and decryption method of another embodiment of the present invention.
  • Fig. 4 is a block diagram showing the structure of an encryption/decryption apparatus according to another embodiment of the present invention.
  • Figure 5 is a flow chart showing an encryption and decryption method of an alternative embodiment of the present invention.
  • an embodiment of the present invention provides an encryption and decryption method, which is applied to a terminal, and the method includes:
  • S101 Switch the encryption table and the decryption table that the terminal is using to the target encryption table and the target decryption table according to the switching instruction.
  • S102 Perform encryption and decryption by using the switched target encryption table and the target decryption table
  • the terminal stores at least two sets of encryption tables and decryption tables, and each of the encryption table and the decryption table are matched.
  • the encryption and decryption method of the embodiment of the present invention dynamically adjusts the encryption table and the decryption table required for encryption and decryption according to the switching instruction, can quickly repair the security vulnerability, improve the security of the terminal product, and avoid a large number of security problems. Human and material resources to modify the software code, upgrade version.
  • the switching instruction may have switching path information for indicating handover of the terminal, that is, switching the encryption table and the decryption table being used to the target encryption table and the target decryption table.
  • At least two sets of encryption tables and decryption tables may be stored in the terminal, and each of the encryption table and the decryption table are matched, that is, the decryption table is a reverse direction of the encryption table.
  • the decryption table is a reverse direction of the encryption table.
  • the terminal A is encrypting and decrypting using the encryption table 1 and the decryption table 1.
  • the encryption table 1 and the decryption table 1 can be switched to the target encryption table 3 according to the switching instruction.
  • the target decrypts the table 3, and uses the switched target encryption table 3 and the target decryption table 3 to perform encryption and decryption, that is, updating the encryption and decryption mode, so as to prevent the encryption table 1 and the decryption table 1 from being successfully attacked by the hacker again in a short time.
  • the method before the switching the encryption table and the decryption table that the terminal is using to the target encryption table and the target decryption table according to the switching instruction, the method may further include:
  • the receiving the switching instruction from the cloud server may include:
  • the switching instruction is automatically received from the cloud server during the preset time interval.
  • the switching instruction is automatically received from the cloud server, and the encryption table and the decryption table used by the terminal are dynamically adjusted according to the switching instruction, which can greatly increase the difficulty of the hacker to crack the password, and further improve the terminal product. Security.
  • the terminal itself can be switched by encryption and decryption. That is, in an optional embodiment of the present invention, before the switching the encryption table and the decryption table that the terminal is using to the target encryption table and the target decryption table according to the switching instruction, the method may further include:
  • a switching instruction is automatically generated within a preset time interval.
  • the terminal in the embodiment of the present invention may be, for example, a Mobile Broadband (MBB) product, a MiFi (Mobile WiFi, Mobile WiFi, is a portable broadband wireless device) product, or a client terminal device (Customer Premise). Equipment, CPE) products, etc.
  • MBB Mobile Broadband
  • MiFi Mobile WiFi, Mobile WiFi
  • CPE Customer Premise
  • CPE Equipment
  • the preset between the encryption table and the decryption table may be an irregular mapping relationship between characters, that is, a mapping relationship between characters. It can be irregular, or it can be a mapping relationship obtained by using an encryption algorithm that is difficult to crack. In this way, without understanding the encryption table and the decryption table, it is difficult to crack the encrypted content, and the possibility that the encryption and decryption method is cracked is reduced.
  • the encryption table can be as shown in Table 1
  • the matching decryption table can be as shown in Table 2:
  • the embodiment of the invention further provides a computer readable storage medium storing computer executable instructions, which are implemented when the computer executable instructions are executed.
  • an embodiment of the present invention further provides an encryption and decryption apparatus, which is disposed in a terminal, and corresponds to the encryption and decryption method shown in FIG. 1.
  • the encryption and decryption apparatus includes:
  • the switching module 21 is configured to: switch the encryption table and the decryption table that the terminal is using to the target encryption table and the target decryption table according to the switching instruction;
  • the encryption and decryption module 22 is configured to: perform encryption and decryption by using the switched target encryption table and the target decryption table;
  • the terminal stores at least two sets of encryption tables and decryption tables, and each of the encryption table and the decryption table are matched.
  • the encryption and decryption apparatus of the embodiment of the present invention dynamically adjusts the encryption table and the decryption table required for encryption and decryption according to the switching instruction, can quickly repair the security vulnerability, improve the security of the terminal product, and avoid a large number of security problems. Human and material resources to modify the software code, upgrade version.
  • the encryption and decryption apparatus may further include:
  • the receiving module is configured to: receive a switching instruction from the cloud server.
  • the receiving module may be configured to automatically receive the switching instruction from the cloud server within a preset time interval.
  • the switching instruction is automatically received from the cloud server, and the encryption table and the decryption table used by the terminal are dynamically adjusted according to the switching instruction, which can greatly increase the difficulty of the hacker to crack the password, and further improve the terminal product. Security.
  • the terminal itself can be switched by encryption and decryption. That is, in an optional embodiment of the present invention, the encryption and decryption apparatus may further include:
  • the generation module is set to: automatically generate a switching instruction within a preset time interval.
  • the preset between the encryption table and the decryption table may be an irregular mapping relationship between characters, that is, a mapping relationship between characters. It can be irregular, or it can be a mapping relationship obtained by using an encryption algorithm that is difficult to crack. In this way, without understanding the encryption table and the decryption table, it is difficult to crack the encrypted content, and the possibility that the encryption and decryption method is cracked is reduced.
  • an embodiment of the present invention further provides an encryption and decryption method, which is applied to a cloud server, and includes:
  • S301 Send a handover command to a terminal, so that the terminal can be according to the handover instruction.
  • the terminal stores at least two sets of encryption tables and decryption tables, and each of the encryption table and the decryption table are matched.
  • the encryption and decryption method of the embodiment of the present invention by sending a switching instruction to the terminal, enables the terminal to switch the encryption table and the decryption table that it is using to the target encryption table and the target decryption table according to the switching instruction, and utilize the handover.
  • the security vulnerability can be quickly repaired, the security of the terminal product can be improved, and when a security problem is avoided, a large amount of manpower and material resources are required to modify the software code and upgrade the version.
  • the sending a handover command to a terminal may include:
  • a switching instruction is automatically sent to a terminal within a preset time interval.
  • the terminal can dynamically switch the encryption table and the decryption table used by the terminal in a preset time interval, which greatly increases the difficulty of cracking the password, and further improves the security of the terminal product.
  • the embodiment of the invention further provides a computer readable storage medium storing computer executable instructions, which are implemented when the computer executable instructions are executed.
  • an embodiment of the present invention further provides an encryption and decryption apparatus, which is disposed in a cloud server, and corresponds to the encryption and decryption method shown in FIG.
  • the sending module 41 is configured to: send a switching instruction to a terminal, so that the terminal can switch the encryption table and the decryption table that it is using to the target encryption table and the target decryption table according to the switching instruction, and use the switch
  • the target encryption table and the target decryption table are encrypted and decrypted;
  • the terminal stores at least two sets of encryption tables and decryption tables, and each of the encryption table and the decryption table are matched.
  • the encryption and decryption apparatus of the embodiment of the present invention by transmitting a switching instruction to the terminal, enables the terminal to switch the encryption table and the decryption table that it is using to the target encryption table and the target decryption table according to the switching instruction, and utilize the handover.
  • the security vulnerability can be quickly repaired, the security of the terminal product can be improved, and when a security problem is avoided, a large amount of manpower and material resources are required to modify the software code and upgrade the version.
  • the sending module may be configured to: at a preset time interval Automatically sending a switching instruction to a terminal, so that the terminal can switch the encryption table and the decryption table it is using to the target encryption table and the target decryption table according to the switching instruction, and use the switched target encryption table. Encryption and decryption with the target decryption table.
  • the terminal is, for example, a UFI product, which includes a WEBUI end and a WEB SERVER end, and a Hyper Text Transfer Protocol over Secure Socket Layer (HTTPS) is used between the WEBUI end and the WEB SERVER end.
  • HTTPS Hyper Text Transfer Protocol over Secure Socket Layer
  • the WEBUI end stores n encryption tables
  • the WEBSERVER end stores corresponding n decryption tables.
  • the encryption and decryption method provided by the embodiment of the present invention is introduced by using a cloud server to send a handover instruction to a specific application scenario, where the encryption and decryption method may include the following steps:
  • the cloud server sends a handover command to the terminal, the handover instruction instructs the terminal to switch the encryption table 1 and the decryption table 1 into the target encryption table 2 and the target decryption table 2;
  • S502 The terminal switches the encryption table 1 and the decryption table 1 that are being used according to the switching instruction, switches to the target encryption table 2 and the target decryption table 2, and performs encryption and decryption by using the encryption table 2 and the decryption table 2 .
  • all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve.
  • the devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.
  • the device/function module/function unit in the above embodiment is implemented in the form of a software function module and When sold or used as a stand-alone product, it can be stored on a computer readable storage medium.
  • the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
  • the encryption and decryption method and device dynamically adjust the encryption table and the decryption table required for encryption and decryption according to the switching instruction, thereby quickly repairing security vulnerabilities, improving the security of the terminal product, and avoiding security problems. It takes a lot of manpower and material resources to modify the software code and upgrade the version.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Databases & Information Systems (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Multimedia (AREA)
  • Storage Device Security (AREA)

Abstract

一种加解密方法包括：根据切换指令，将所述终端正在使用的加密表和解密表切换为目标加密表和目标解密表；利用切换后的目标加密表和目标解密表进行加解密。

Description

一种加解密方法及装置 技术领域
本申请涉及但不限于通信技术领域，尤其一种加解密方法及装置。
背景技术
当前，加解密方法层出不穷，难度也越来越大。但是，任何密码在一定算法的加密方式下，破解只是时间问题。
相关技术中的终端产品常采用Base64(一种使用64基的位置计数法)编码机制进行简单加密，即在WEBUI(网络用户界面)端对敏感参数，例如登陆密码、WiFi(Wireless Fidelity，无线保真)密码、APN(Access Point Name，接入点名称)参数、DHCP(Dynamic Host Configuration Protocol，动态主机配置协议)参数等，通过Base64进行加密并下发到WEBSERVER(网络服务器)端，然后在WEBSERVER端进行解密。
但这种加解密方法存在以下缺点：黑客拦截加密后的参数后，很容易通过HTTP(HyperText Transfer Protocol，超文本传输协议)工具破解出原始的敏感参数，并扩大终端产品的安全漏洞；如果要修补安全漏洞，需要花费大量的人力和物力去修改软件代码，升级版本等。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本文提供一种加解密方法及装置，以解决相关技术中存在的加解密方法被破解的可能性大的技术问题，能够提升终端产品的安全性，降低加解密方式被破解的可能性。
本发明实施例提供一种加解密方法，应用于一终端，包括：
根据切换指令，将所述终端正在使用的加密表和解密表切换为目标加密表和目标解密表；
利用切换后的目标加密表和目标解密表进行加解密；
其中，所述终端中保存有至少两套加密表和解密表，且每一套的加密表和解密表都是匹配的。
可选地，所述根据切换指令，将所述终端正在使用的加密表和解密表切换为目标加密表和目标解密表之前，该方法还包括：
从云服务器接收切换指令。
可选地，所述从云服务器接收切换指令包括：
在预设时间间隔内，自动从云服务器接收切换指令。
可选地，所述根据切换指令，将所述终端正在使用的加密表和解密表切换为目标加密表和目标解密表之前，该方法还包括：
在预设时间间隔内，自动生成切换指令。
本发明实施例还提供一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被执行时实现上述加解密方法。
本发明实施例还提供一种加解密装置，设置于一终端，包括：
切换模块，设置为：根据切换指令，将所述终端正在使用的加密表和解密表切换为目标加密表和目标解密表；
加解密模块，设置为：利用切换后的目标加密表和目标解密表进行加解密；
其中，所述终端中保存有至少两套加密表和解密表，且每一套的加密表和解密表都是匹配的。
可选地，所述加解密装置还包括：
接收模块，设置为：从云服务器接收切换指令。
可选地，所述接收模块是设置为：在预设时间间隔内，自动从云服务器接收切换指令。
可选地，所述加解密装置还包括：
生成模块，设置为：在预设时间间隔内，自动生成切换指令。
本发明实施例还提供一种加解密方法，应用于一云服务器，包括：
发送一切换指令到一终端，使得所述终端能够根据所述切换指令，将其正在使用的加密表和解密表切换为目标加密表和目标解密表，并利用切换后 的目标加密表和目标解密表进行加解密；
其中，所述终端中保存有至少两套加密表和解密表，且每一套的加密表和解密表都是匹配的。
可选地，所述发送一切换指令到一终端包括：
在预设时间间隔内，自动发送一切换指令到一终端。
本发明实施例还提供一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被执行时实现上述加解密方法。
本发明实施例还提供一种加解密装置，设置于一云服务器，包括：
发送模块，设置为：发送一切换指令到一终端，使得所述终端能够根据所述切换指令，将其正在使用的加密表和解密表切换为目标加密表和目标解密表，并利用切换后的目标加密表和目标解密表进行加解密；
其中，所述终端中保存有至少两套加密表和解密表，且每一套的加密表和解密表都是匹配的。
可选地，所述发送模块是设置为：在预设时间间隔内，自动发送一切换指令到一终端，使得所述终端能够根据所述切换指令，将其正在使用的加密表和解密表切换为目标加密表和目标解密表，并利用切换后的目标加密表和目标解密表进行加解密。
通过本发明实施例的加解密方法及装置，根据切换指令对加解密所需要的加密表和解密表进行动态调整，能够快速地修复安全漏洞，提升终端产品的安全性，且避免在出现安全问题时，耗费大量的人力和物力去修改软件代码，升级版本。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图概述
图1表示本发明一实施例的加解密方法的流程图。
图2表示本发明一实施例的加解密装置的结构示意图。
图3表示本发明另一实施例的加解密方法的流程图。
图4表示本发明另一实施例的加解密装置的结构示意图。
图5表示本发明可选实施例的加解密方法的流程图。
本发明的较佳实施方式
下面结合附图对本发明的实施方式进行描述。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的各种方式可以相互组合。
参见图1，本发明实施例提供一种加解密方法，应用于一终端，该方法包括：
S101：根据切换指令，将所述终端正在使用的加密表和解密表切换为目标加密表和目标解密表；
S102：利用切换后的目标加密表和目标解密表进行加解密；
其中，所述终端中保存有至少两套加密表和解密表，且每一套的加密表和解密表都是匹配的。
本发明实施例的加解密方法，根据切换指令对加解密所需要的加密表和解密表进行动态调整，能够快速地修复安全漏洞，提升终端产品的安全性，且避免出现安全问题时，耗费大量的人力和物力去修改软件代码，升级版本。
可选地，所述切换指令中可以具有切换路径信息，用于指示终端的切换，即将正在使用的加密表和解密表切换为目标加密表和目标解密表。
为了实现切换过程，终端中可以保存有至少两套加密表和解密表，且每一套的加密表和解密表都是匹配的，即解密表是加密表的一种逆向。当一套加密表和解密表出现问题时，可切换成另一套加密表和解密表，快速实现更改加密机制。其中，所保存的加密表和解密表的套数可以根据终端内存的大小来确定，例如，终端内存越大，可以保存越多套的加密表和解密表。
举例来说，终端A正在使用加密表1和解密表1进行加解密，当终端A的加解密方式被破解时，可以根据切换指令，将加密表1和解密表1切换为目标加密表3和目标解密表3，并利用切换后的目标加密表3和目标解密表3进行加解密，即更新加解密方式，避免加密表1和解密表1短时间内再次被黑客攻击成功。
本发明可选实施例中，所述根据切换指令，将所述终端正在使用的加密表和解密表切换为目标加密表和目标解密表之前，该方法还可包括：
从云服务器接收切换指令。
实际应用中，当黑客攻击成功某一地区的一个终端产品时，这个地区的同类终端产品就会极易被攻击成功，以至于这个地区的同类终端产品易出现安全问题。为了修复这个地区的同款终端产品的安全漏洞，可以通过云服务器切换所有同款终端产品的加解密方式，避免安全问题的进一步扩大。
为了进一步地提升终端产品的安全性，所述从云服务器接收切换指令可包括：
在预设时间间隔内，自动从云服务器接收切换指令。
这样，在预设时间间隔内，自动从云服务器接收切换指令，并根据所述切换指令动态地调整终端所使用的加密表和解密表，能够大大地增加黑客破解密码的难度，进一步提升终端产品的安全性。
此外，在不依靠云服务器的情况下，也可以利用终端本身进行加解密方式的切换。即在本发明可选实施例中，所述根据切换指令，将所述终端正在使用的加密表和解密表切换为目标加密表和目标解密表之前，该方法还可包括：
在预设时间间隔内，自动生成切换指令。
这样，在节约资源的情况下，同样能够保证终端产品的安全性。
需要说明的是，本发明实施例中的终端可以例如是移动宽带(Mobile Broadband，MBB)产品、MiFi(Mobile WiFi，移动的WiFi，是一种便携式宽带无线装置)产品或客户终端设备(Customer Premise Equipment，CPE)产品等。
在本发明可选实施例中，为了增加黑客破解加解密方式的难度，所述加密表和解密表中预设的可以是字符之间的毫无规律的映射关系，即字符之间的映射关系可以是无规律的，或者可以是利用较难破解的加密算法得到的映射关系。这样，在不了解加密表和解密表的情况下，很难破解加密后的内容，降低了加解密方式被破解的可能性。
例如，加密表可如表1所示，与之匹配的解密表可如表2所示：
表1
字符 加密 字符 加密 字符 加密 字符 加密
a V u a O 23 8 lo7
b B v 12s P sw 9 h7
c AD w 12d Q hy . jj
d SG x d2 R hy , j7
e CD y 5f S sfd ！ g67
q asd K sad12 4 m4    
t bg N 2 7 89p    
表2
字符 解密 字符 解密 字符 解密 字符 解密
V a a u 23 O lo7 8
B b 12s v sw P h7 9
AD c 12d w hy Q jj .
SG d d2 x hy R j7 ,
CD e 5f y sfd S g67 ！
asd q sad12 K m4 4    
bg t 2 N 89p 7    
当根据表1的加密表和表2的解密表进行加解密时，如终端WEBUI端得到的登录密码为a8u7，经过表1加密后会得到加密参数Vlo7a89p，将加密参数Vlo7a89p下发到WEBSERVER端，然后在WEBSERVER端经过表2解密后才能得到登录密码a8u7。
本发明实施例还提供一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被执行时实现该加解密方法。
参见图2所示，本发明实施例还提供一种加解密装置，设置于一终端，与图1所示的加解密方法相对应，所述加解密装置包括：
切换模块21，设置为：根据切换指令，将所述终端正在使用的加密表和解密表切换为目标加密表和目标解密表；
加解密模块22，设置为：利用切换后的目标加密表和目标解密表进行加解密；
其中，所述终端中保存有至少两套加密表和解密表，且每一套的加密表和解密表都是匹配的。
本发明实施例的加解密装置，根据切换指令对加解密所需要的加密表和解密表进行动态调整，能够快速地修复安全漏洞，提升终端产品的安全性，且避免出现安全问题时，耗费大量的人力和物力去修改软件代码，升级版本。
实际应用中，当黑客攻击成功某一地区的一个终端产品时，这个地区的同类终端产品就会极易被攻击成功，以至于这个地区的同类终端产品易出现安全问题。为了修复这个地区的同款终端产品的安全漏洞，可以通过云服务器切换所有同款终端产品的加解密方式，避免安全问题的进一步扩大。
基于上述内容，本发明可选实施例中，所述加解密装置还可包括：
接收模块，设置为：从云服务器接收切换指令。
可选地，为了进一步地提升终端产品的安全性，所述接收模块可以是设置为：在预设时间间隔内，自动从云服务器接收切换指令。
这样，在预设时间间隔内，自动从云服务器接收切换指令，并根据所述切换指令动态地调整终端所使用的加密表和解密表，能够大大地增加黑客破解密码的难度，进一步提升终端产品的安全性。
此外，在不依靠云服务器的情况下，也可以利用终端本身进行加解密方式的切换。即在本发明可选实施例中，所述加解密装置还可包括：
生成模块，设置为：在预设时间间隔内，自动生成切换指令。
在本发明可选实施例中，为了增加黑客破解加解密方式的难度，所述加密表和解密表中预设的可以是字符之间的毫无规律的映射关系，即字符之间的映射关系可以是无规律的，或者可以是利用较难破解的加密算法得到的映射关系。这样，在不了解加密表和解密表的情况下，很难破解加密后的内容，降低了加解密方式被破解的可能性。
参见图3，本发明实施例还提供一种加解密方法，应用于一云服务器，包括：
S301：发送一切换指令到一终端，使得所述终端能够根据所述切换指令， 将其正在使用的加密表和解密表切换为目标加密表和目标解密表，并利用切换后的目标加密表和目标解密表进行加解密；
其中，所述终端中保存有至少两套加密表和解密表，且每一套的加密表和解密表都是匹配的。
本发明实施例的加解密方法，通过发送切换指令到终端，使得所述终端能够根据所述切换指令，将其正在使用的加密表和解密表切换为目标加密表和目标解密表，并利用切换后的目标加密表和目标解密表进行加解密，能够快速地修复安全漏洞，提升终端产品的安全性，且避免出现安全问题时，耗费大量的人力和物力去修改软件代码，升级版本。
可选地，为了进一步地提升终端产品的安全性，所述发送一切换指令到一终端可包括：
在预设时间间隔内，自动发送一切换指令到一终端。
这样，能够保证终端在预设时间间隔内，动态地切换其所使用的加密表和解密表，大大地增加破解密码的难度，进一步提升终端产品的安全性。
本发明实施例还提供一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被执行时实现该加解密方法。
参见图4所示，本发明实施例还提供一种加解密装置，设置于一云服务器，与图3所示的加解密方法相对应，所述加解密装置包括：
发送模块41，设置为：发送一切换指令到一终端，使得所述终端能够根据所述切换指令，将其正在使用的加密表和解密表切换为目标加密表和目标解密表，并利用切换后的目标加密表和目标解密表进行加解密；
其中，所述终端中保存有至少两套加密表和解密表，且每一套的加密表和解密表都是匹配的。
本发明实施例的加解密装置，通过发送切换指令到终端，使得所述终端能够根据所述切换指令，将其正在使用的加密表和解密表切换为目标加密表和目标解密表，并利用切换后的目标加密表和目标解密表进行加解密，能够快速地修复安全漏洞，提升终端产品的安全性，且避免出现安全问题时，耗费大量的人力和物力去修改软件代码，升级版本。
在本发明可选实施例中，所述发送模块可以是设置为：在预设时间间隔 内，自动发送一切换指令到一终端，使得所述终端能够根据所述切换指令，将其正在使用的加密表和解密表切换为目标加密表和目标解密表，并利用切换后的目标加密表和目标解密表进行加解密。
下面通过图5对本发明可选实施例的加解密方法进行详细介绍。
参见图5，终端例如是UFI产品，其包括WEBUI端和WEBSERVER端，且所述WEBUI端和WEBSERVER端之间通过安全套接字层超文本传输协议(Hyper Text Transfer Protocol over Secure Socket Layer，HTTPS)进行交互，所述WEBUI端存放着n个加密表，同时所述WEBSERVER端存放着对应的n个解密表。
在本发明可选实施例中，以通过云服务器发送切换指令为具体的应用场景对本发明实施例提供的加解密方法进行介绍，所述加解密方法可包括以下步骤：
S501：云服务器发送切换指令到终端，所述切换指令指示终端将加密表1和解密表1切换为目标加密表2和目标解密表2；
S502：终端根据所述切换指令，对其正在使用的加密表1和解密表1进行切换，切换为目标加密表2和目标解密表2，并利用所述加密表2和解密表2进行加解密。
本领域普通技术人员可以理解上述实施例的全部或部分步骤可以使用计算机程序流程来实现，所述计算机程序可以存储于一计算机可读存储介质中，所述计算机程序在相应的硬件平台上(如系统、设备、装置、器件、处理器等)执行，在执行时，包括方法实施例的步骤之一或其组合。
可选地，上述实施例的全部或部分步骤也可以使用集成电路来实现，这些步骤可以被分别制作成一个个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。
上述实施例中的装置/功能模块/功能单元可以采用通用的计算装置来实现，它们可以集中在单个的计算装置上，也可以分布在多个计算装置所组成的网络上。
上述实施例中的装置/功能模块/功能单元以软件功能模块的形式实现并 作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。上述提到的计算机可读取存储介质可以是只读存储器，磁盘或光盘等。
工业实用性
通过本发明实施例的加解密方法及装置，根据切换指令对加解密所需要的加密表和解密表进行动态调整，能够快速地修复安全漏洞，提升终端产品的安全性，且避免出现安全问题时，耗费大量的人力和物力去修改软件代码，升级版本。

Claims (12)

  1. 一种加解密方法，应用于一终端，包括：
    根据切换指令，将所述终端正在使用的加密表和解密表切换为目标加密表和目标解密表；
    利用切换后的目标加密表和目标解密表进行加解密；
    其中，所述终端中保存有至少两套加密表和解密表，且每一套的加密表和解密表都是匹配的。
  2. 根据权利要求1所述的加解密方法，所述根据切换指令，将所述终端正在使用的加密表和解密表切换为目标加密表和目标解密表之前，还包括：
    从云服务器接收切换指令。
  3. 根据权利要求2所述的加解密方法，其中，所述从云服务器接收切换指令包括：
    在预设时间间隔内，自动从云服务器接收切换指令。
  4. 根据权利要求1所述的加解密方法，所述根据切换指令，将所述终端正在使用的加密表和解密表切换为目标加密表和目标解密表之前，还包括：
    在预设时间间隔内，自动生成切换指令。
  5. 一种加解密装置，设置于一终端，包括：
    切换模块，设置为：根据切换指令，将所述终端正在使用的加密表和解密表切换为目标加密表和目标解密表；
    加解密模块，设置为：利用切换后的目标加密表和目标解密表进行加解密；
    其中，所述终端中保存有至少两套加密表和解密表，且每一套的加密表和解密表都是匹配的。
  6. 根据权利要求5所述的加解密装置，还包括：
    接收模块，设置为：从云服务器接收切换指令。
  7. 根据权利要求6所述的加解密装置，其中，所述接收模块是设置为： 在预设时间间隔内，自动从云服务器接收切换指令。
  8. 根据权利要求5所述的加解密装置，还包括：
    生成模块，设置为：在预设时间间隔内，自动生成切换指令。
  9. 一种加解密方法，应用于一云服务器，包括：
    发送一切换指令到一终端，使得所述终端能够根据所述切换指令，将其正在使用的加密表和解密表切换为目标加密表和目标解密表，并利用切换后的目标加密表和目标解密表进行加解密；
    其中，所述终端中保存有至少两套加密表和解密表，且每一套的加密表和解密表都是匹配的。
  10. 根据权利要求9所述的加解密方法，其中，所述发送一切换指令到一终端包括：
    在预设时间间隔内，自动发送一切换指令到一终端。
  11. 一种加解密装置，设置于一云服务器，包括：
    发送模块，设置为：发送一切换指令到一终端，使得所述终端能够根据所述切换指令，将其正在使用的加密表和解密表切换为目标加密表和目标解密表，并利用切换后的目标加密表和目标解密表进行加解密；
    其中，所述终端中保存有至少两套加密表和解密表，且每一套的加密表和解密表都是匹配的。
  12. 根据权利要求11所述的加解密装置，其中，所述发送模块是设置为：在预设时间间隔内，自动发送一切换指令到一终端，使得所述终端能够根据所述切换指令，将其正在使用的加密表和解密表切换为目标加密表和目标解密表，并利用切换后的目标加密表和目标解密表进行加解密。
PCT/CN2016/080921 2015-09-01 2016-05-03 一种加解密方法及装置 WO2017036158A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510555464.3 2015-09-01
CN201510555464.3A CN106487773A (zh) 2015-09-01 2015-09-01 一种加解密方法及装置

Publications (1)

Publication Number Publication Date
WO2017036158A1 true WO2017036158A1 (zh) 2017-03-09

Family

ID=58188394

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/080921 WO2017036158A1 (zh) 2015-09-01 2016-05-03 一种加解密方法及装置

Country Status (2)

Country Link
CN (1) CN106487773A (zh)
WO (1) WO2017036158A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109598151B (zh) * 2018-11-29 2023-02-21 中国电子科技集团公司第四十七研究所 指令码动态加解密方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1863206A1 (en) * 2006-05-30 2007-12-05 Huawei Technologies Co., Ltd. A method of switching a decryption key, a decryption device and a terminal
US8369525B2 (en) * 2002-10-24 2013-02-05 At&T Mobility Ii Llc Dynamic password update for wireless encryption system
CN103051963A (zh) * 2012-11-30 2013-04-17 北京视博数字电视科技有限公司 一种数字电视终端设备的安全控制方法
CN103262491A (zh) * 2011-11-09 2013-08-21 华为技术有限公司 一种保护云中数据安全的方法、装置及系统
CN103457995A (zh) * 2013-06-07 2013-12-18 北京百纳威尔科技有限公司 终端设备数据信息的存储方法、终端设备和云端服务器

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8948393B2 (en) * 2006-04-28 2015-02-03 Qualcomm Incorporated Uninterrupted transmission during a change in ciphering configuration
CN101399662B (zh) * 2008-09-27 2011-02-16 北京创毅视讯科技有限公司 获取业务密钥的方法、系统、条件接收模块及用户终端
CN101478752B (zh) * 2009-01-12 2014-11-05 中兴通讯股份有限公司 一种密钥更替方法、系统及设备
CN103873895B (zh) * 2012-12-14 2017-07-25 中国传媒大学 一种dvb/iptv双模互动业务保护系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8369525B2 (en) * 2002-10-24 2013-02-05 At&T Mobility Ii Llc Dynamic password update for wireless encryption system
EP1863206A1 (en) * 2006-05-30 2007-12-05 Huawei Technologies Co., Ltd. A method of switching a decryption key, a decryption device and a terminal
CN103262491A (zh) * 2011-11-09 2013-08-21 华为技术有限公司 一种保护云中数据安全的方法、装置及系统
CN103051963A (zh) * 2012-11-30 2013-04-17 北京视博数字电视科技有限公司 一种数字电视终端设备的安全控制方法
CN103457995A (zh) * 2013-06-07 2013-12-18 北京百纳威尔科技有限公司 终端设备数据信息的存储方法、终端设备和云端服务器

Also Published As

Publication number Publication date
CN106487773A (zh) 2017-03-08

Similar Documents

Publication Publication Date Title
US11283774B2 (en) Cloud storage using encryption gateway with certificate authority identification
KR102013091B1 (ko) 보안 통신 채널을 설정하기 위한 방법들 및 장치
CN108241517B (zh) 一种软件升级方法、客户端及电子设备
EP2831803B1 (en) Systems and methods for secure third-party data storage
CN104144049B (zh) 一种加密通信方法、系统和装置
US9530017B2 (en) Secure printing between printer and print client device
KR101982960B1 (ko) 불필요한 기능의 비활성화를 통한 가상화 애플리케이션 성능 개선
KR101891420B1 (ko) DaaS를 위한 컨텐츠 보호
US10341118B2 (en) SSL gateway with integrated hardware security module
KR20200027500A (ko) 디바이스 익명성을 제공하는 키 증명문 생성
US10601590B1 (en) Secure secrets in hardware security module for use by protected function in trusted execution environment
EP3065334A1 (en) Key configuration method, system and apparatus
US9912484B2 (en) Secure neighbor discovery (SEND) using pre-shared key
TW201330577A (zh) 基於雲儲存的資料安全保護系統及方法
EP3794852B1 (en) Secure methods and systems for identifying bluetooth connected devices with installed application
CN109104273B (zh) 报文处理方法以及接收端服务器
US20190222414A1 (en) System and method for controlling usage of cryptographic keys
TWI553504B (zh) 雲端加密系統及方法
US9524394B2 (en) Method and apparatus for providing provably secure user input/output
US20140237627A1 (en) Protecting data in a mobile environment
JP2022028686A (ja) ネットワーク環境におけるピア電子デバイスによるリモート電子デバイスの構成
WO2017036158A1 (zh) 一种加解密方法及装置
US11032708B2 (en) Securing public WLAN hotspot network access
Pandey et al. A system and method for authentication in wireless local area networks (wlans)
JP6527115B2 (ja) 機器リスト作成システムおよび機器リスト作成方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16840587

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16840587

Country of ref document: EP

Kind code of ref document: A1