WO2019184740A1

WO2019184740A1 - Data encryption, decryption method and device

Info

Publication number: WO2019184740A1
Application number: PCT/CN2019/078419
Authority: WO
Inventors: 尉鲁飞
Original assignee: 阿里巴巴集团控股有限公司
Priority date: 2018-03-29
Filing date: 2019-03-18
Publication date: 2019-10-03
Also published as: TWI793215B; CN110324138A; CN110324138B; TW201942784A

Abstract

An embodiment of the present application provides a data encryption, decryption method and device. The data encryption method comprises: generating, using a software trust rooter, a first secret key uniquely corresponding to a hardware device, and encrypting the data according to the first secret key. The present application can reduce the possibility that a hacker or the like directly acquires and obtains the first secret key from a code, and also ensures that even if the secret key of a certain hardware device is decrypted, the secret key in the hardware device which falls within the same category or belongs to a same hardware manufacturer of the described hardware device is secure. Therefore, the security of the data and the hardware device is effectively improved, In addition, whether the hardware device has hardware security capacities or not, a first secret key can be ensured to be generated, thereby improving the reliability of generating the first secret key.

Description

Data encryption and decryption method and device

The present application claims the priority of the Chinese Patent Application No. 20110127431, filed on Mar. 29,,,,,,,,,,,,,,,,,,,,,,,,,,,

Technical field

The present application relates to the field of computer technologies, and in particular, to a data encryption and decryption method and apparatus.

Background technique

With the development of the Internet of Things and computer technology, a large number of hardware devices with poor hardware security capabilities and limited resources have been put into use, such as various hardware devices as IoT terminal nodes, which are usually inexpensive, have no or difficult to set up. Protection, there is no hardware security capability, so the data in the hardware device is easily obtained by hackers and the like, and the security is poor.

In the prior art, a key can be written into the code of the hardware device, so that the data in the hardware device can be encrypted by the key. But the way to write the key into the code of the hardware device is difficult to achieve one machine (hardware device), that is, the key in the hardware device of the same class or the same hardware manufacturer is the same, therefore, when a hardware device When the key in the key is cracked, the keys of other hardware devices of the same type or the same hardware manufacturer will be leaked, which makes it difficult to ensure data security, resulting in low security of data and hardware devices.

Summary of the invention

In view of the above problems, the present application has been made in order to provide a data encryption and decryption method and apparatus that overcomes the above problems or at least partially solves the above problems.

The application provides a data encryption method, including:

Generating a first key uniquely corresponding to the hardware device by using a software root program;

Encrypting data according to the first key.

Optionally, the encrypting the data according to the first key includes:

Randomly generating a second key;

The data to be encrypted is encrypted by using the second key, and the first key is used to encrypt the second key.

Optionally, the method further includes:

Encrypting the second key with the first key.

Optionally, after the encrypting the second key by using the first key, the method further includes:

The encrypted second key is saved corresponding to the encrypted data to be encrypted.

Optionally, the method further includes:

Check data for verifying the integrity of the data to be encrypted is generated, and the check data is saved corresponding to the encrypted data to be encrypted.

Optionally, the generating verification data for verifying integrity of the data to be encrypted includes:

Determining a hash value of the data to be encrypted.

Optionally, before the data is encrypted according to the first key, the method further includes:

Providing a second interface for receiving data to be encrypted, and receiving the data to be encrypted by using the second interface;

After the data is encrypted according to the first key, the method further includes:

And outputting an encryption result to the data source of the data to be encrypted through the second interface.

The application also provides a data decryption method, including:

The encrypted data is decrypted according to the first key.

Optionally, the decrypting the encrypted data according to the first key includes:

Generating the first key, and acquiring an encrypted second key, where the encrypted second key is saved corresponding to the encrypted data;

Decrypting the encrypted second key with the first key to obtain a second key;

The encrypted data is decrypted using the second key.

Optionally, the method further includes:

Obtaining verification data, where the verification data is saved corresponding to the encrypted data;

The check data is used to verify the integrity of the decrypted result.

Optionally, the verification data includes a first hash value of the decryption result, and the integrity of the decryption result by using the verification data includes:

Generating a second hash value of the decrypted result;

Comparing the second hash value with the first hash value, confirming that the decrypted result has integrity.

Optionally, the method further includes:

The decryption result is output through the second interface.

The application also provides a data encryption method, including:

Generating a first key uniquely corresponding to the hardware device by using a root of trust program;

Encrypting data according to the first key.

Optionally, the generating, by using the trusted root program, the first key that uniquely corresponds to the hardware device includes:

Accessing the hardware trust root program built in the hardware device to generate the first key.

Optionally, the hardware device has a dedicated hardware root program, and the hardware root program built into the hardware device includes:

The hardware trusted root program is accessed through the first interface, and the interface type of the first interface is adapted to the program type of the hardware trusted root program.

The application also provides a data decryption method, including:

The encrypted data is decrypted according to the first key.

The application also provides a data encryption device, including:

a first key generation module, configured to generate a first key uniquely corresponding to the hardware device by using a software root program;

And a data encryption module, configured to encrypt data according to the first key.

Optionally, the data encryption module includes:

a key random generation sub-module, configured to randomly generate a second key;

a data encryption submodule, configured to encrypt data to be encrypted by using the second key, where the first key is used to encrypt the second key.

Optionally, the device further includes:

And a second key encryption module, configured to encrypt the second key by using the first key.

Optionally, the device further includes:

The verification data generating module is configured to generate verification data for verifying integrity of the data to be encrypted, and the verification data is saved corresponding to the encrypted data to be encrypted.

Optionally, the device further includes:

The data receiving module to be encrypted is configured to provide a second interface for receiving data to be encrypted, and receive the data to be encrypted through the second interface;

And an encryption result output module, configured to output an encryption result to the data source of the data to be encrypted by using the second interface.

The application also provides a data decryption device, comprising:

And a data decrypting module, configured to decrypt the encrypted data according to the first key.

Optionally, the data decryption module includes:

a key acquisition submodule, configured to generate the first key, and obtain an encrypted second key, where the encrypted second key is saved corresponding to the encrypted data;

a second key decrypting submodule, configured to decrypt the encrypted second key by using the first key to obtain a second key;

a data decryption submodule for decrypting the encrypted data using the second key.

Optionally, the device further includes:

a verification data acquisition module, configured to acquire verification data, where the verification data is saved corresponding to the encrypted data;

An integrity verification module is configured to verify the integrity of the decrypted result by using the verification data.

Optionally, the device further includes:

The decryption result output module is configured to output the decryption result through the second interface.

The application also provides a data encryption device, including:

a first key generation module, configured to generate a first key uniquely corresponding to the hardware device by using a root of trust program;

Optionally, the first key generation module includes:

The first key generation submodule is configured to access a hardware root program built in the hardware device to generate the first key.

The application also provides a data decryption device, comprising:

Optionally, the first key generation module includes:

The present application also provides a computer device comprising a memory, a processor, and a computer program stored on the memory and operable on the processor, the processor executing the computer program to implement one or more of the foregoing method.

The application also provides a computer readable storage medium having stored thereon a computer program that, when executed by a processor, implements one or more of the methods described above.

In the embodiment of the present application, first, the first root key corresponding to the hardware device is generated by using the root of the trust program, and then the data is encrypted according to the first key, thereby reducing the hacker and the like to obtain the first secret directly from the code. The possibility of the key also ensures that even if the key of a hardware device is cracked, the key in the same type of hardware device as the hardware device or the hardware device belonging to the same hardware manufacturer is still safe, effectively improving the data and hardware devices. Security. Secondly, the first key can be generated by the software trust root program, which ensures that the first key can be generated regardless of whether the hardware device has hardware security capability, and the reliability of generating the first key is improved.

The above description is only an overview of the technical solutions of the present application, and the technical means of the present application can be more clearly understood, and the above and other objects, features and advantages of the present application can be more clearly understood. The following is a specific embodiment of the present application.

DRAWINGS

Various other advantages and benefits will become apparent to those skilled in the art from a The drawings are only for the purpose of illustrating the preferred embodiments and are not intended to be limiting. Throughout the drawings, the same reference numerals are used to refer to the same parts. In the drawing:

FIG. 1 is a flowchart of a data encryption method according to a first embodiment of the present application;

FIG. 2 is a flowchart of another data encryption method according to a second embodiment of the present application;

FIG. 3 is a flowchart of another data encryption method according to a third embodiment of the present application;

4 is a flowchart of a data decryption method according to a fourth embodiment of the present application;

FIG. 5 is a flowchart of another data decryption method according to an embodiment 5 of the present application;

FIG. 6 is a flowchart of another data decryption method according to an embodiment 6 of the present application;

FIG. 7 shows a flow chart of a data processing method according to an embodiment of the present application.

FIG. 8 is a flowchart of a data encryption method according to an embodiment of the present application;

FIG. 9 is a flowchart of a data decryption method according to an embodiment of the present application;

FIG. 10 is a structural block diagram of a data encryption apparatus according to a seventh embodiment of the present application;

FIG. 11 is a structural block diagram of another data encryption apparatus according to an eighth embodiment of the present application;

FIG. 12 is a structural block diagram of a data decryption apparatus according to an embodiment 9 of the present application;

FIG. 13 is a structural block diagram of another data decryption apparatus according to an embodiment 10 of the present application;

Figure 14 shows a block diagram of an exemplary system in accordance with one embodiment of the present application.

detailed description

Exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. While the exemplary embodiments of the present invention are shown in the drawings, it is understood that the invention may be embodied in various forms and not limited by the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be more fully understood, and the scope of the application can be fully conveyed to those skilled in the art.

In order to facilitate a person skilled in the art to deeply understand the embodiments of the present application, the definitions of the technical terms involved in the embodiments of the present application will be first introduced below.

The root program of trust, also known as the root of trust, refers to a set of functions that are considered to be always trusted by operations running on the hardware device. The root of trust provides a trusted encryption and decryption service for the hardware device. The trusted root program may include at least one of a hardware trust root program and a software trust root program. The hardware root program depends on the corresponding hardware, and may include a hardware trust root program based on Intel SGX (Intel Software Guard Extensions) or TEE (Trusted Execution Environment). The root program can include KM (key manager, key management module). Of course, in practical applications, the root program of trust may also include other hardware root programs or software root programs, which are not repeated here.

The first key is derived from the trusted root program according to the device unique identifier of the hardware device, so as to uniquely correspond to the hardware device, and the first key can be used to encrypt the data in the hardware device.

The device unique identifier is used to uniquely identify an electronic device. For example, the device unique identifier may include an IMEI (International Mobile Equipment Identity) or a MAC (Media Access Control) address.

The hardware device can be various IoT terminals or devices, such as various detectors for weather or environmental monitoring, or smart home devices such as smart speakers in the home. Of course, it can also include mobile phones, smart watches, and VR (Virtual Reality, Virtual reality) devices, tablets, e-book readers, MP3 (Moving Picture Experts Group Audio Layer III), MP4 (Moving Picture Experts Group Audio Layer IV) Standard audio level 4) Players, laptops, on-board computers, desktop computers, set-top boxes, wearable devices, and more. The hardware device can interact with a remote server to obtain a client, a plug-in, a data encryption or decryption service, and can include any of the devices in FIG. 10-14 below, implementing any of the methods of FIG. 1-9 to encrypt the data. Or decrypt.

The client can include at least one application. The client can be run in the positioning device to implement the data encryption or decryption method provided by the embodiment of the present application.

The plug-in may be included in an application running in the positioning device, thereby implementing the data encryption or decryption method provided by the embodiment of the present application.

The embodiment of the present application can be applied to a scenario of encrypting or decrypting data in a hardware device such as an Internet of Things device, such as an edge gateway. Since the key is directly written in the code of the hardware device, when the key in one hardware device is cracked, the keys of other hardware devices of the same type or the same hardware manufacturer are leaked, thereby making it difficult to ensure data security, resulting in security. The security of the data and the hardware device is low. Therefore, in order to ensure the security of the data and the hardware device, the embodiment of the present application provides a data encryption method. In the embodiment of the present application, the first root key corresponding to the hardware device may be generated by using a trusted root program, and the data is encrypted according to the first key. Since the key is not required to be directly written in the code of the hardware device, On the one hand, it reduces the possibility of obtaining a key by a hacker or the like. On the other hand, even if the key of a hardware device is cracked, the key in the same type of hardware device as the hardware device or the hardware device belonging to the same hardware manufacturer is still safe. The secure storage of data through a secure key can effectively improve the security of data and hardware devices. In addition, since some hardware devices may not have hardware that the hardware trust root program depends on, that is, they do not have hardware security capabilities, therefore, in order to ensure that the hardware device capable of generating hardware or security can generate the first key, The reliability of the first key, which in turn ensures the security of the data and hardware devices, while reducing costs, can call the software root program to generate the first key. That is, the software trust root program provides a secure key management function.

The embodiment of the present application can be implemented as a client or a plug-in. The hardware device can obtain and install the client or the plug-in from the remote server, so that the data encryption or decryption method provided by the embodiment of the present application is implemented by the client or the plug-in. Of course, the embodiment of the present application may also be deployed in a form of software on a remote server, and the positioning device may obtain a data encryption or decryption service by accessing the remote server.

Embodiment 1

Referring to FIG. 1, a flowchart of a data encryption method according to an embodiment of the present application is shown. The specific steps include:

Step 101: Generate a first key uniquely corresponding to the hardware device by using a software root program.

In order to avoid the problem of one machine and one secret that is difficult to implement by directly writing the key into the code in the hardware device and the further problem of lower security of data and hardware devices, the key may not be written into the hardware code. The first root key is generated by the root of the trust program, and the generated key can uniquely correspond to the hardware device. On the one hand, the possibility of obtaining the first key directly from the code by the hacker is reduced, and on the other hand, even if some The key of the hardware device is cracked, and the key in the same type of hardware device or hardware device belonging to the same hardware manufacturer is still secure, so that the security of the data and the hardware device can be effectively improved. In addition, since some hardware devices may not have hardware that the hardware trust root program depends on, that is, they do not have hardware security capabilities, therefore, in order to ensure that the hardware device capable of generating hardware or security can generate the first key, The reliability of the first key, which in turn ensures the security of the data and hardware devices, while reducing costs, can call the software root program to generate the first key. That is, the software trust root program provides a secure key management function.

Among them, the software root program can include KM.

The device unique identifier of the hardware device can be obtained, and the first key is derived based on the unique identifier of the device by using a trusted root program. Since the unique identifiers of the devices from different hardware devices are different, the first keys obtained by different hardware devices are also different.

Step 102: Encrypt data according to the first key.

It can be seen from the foregoing that the first key is generated by the root of the trust program and uniquely corresponding to the hardware device, and can effectively improve the security of the data and the hardware device, so the data can be encrypted according to the first key.

The data to be encrypted in the hardware device can be obtained, and the data to be encrypted is encrypted by using the first key. Of course, in the actual application, the encrypted data can be encrypted according to the first key and using a more complicated encryption method. For example, in order to further improve the encryption effect, increase the complexity of cracking encrypted data, and improve the security of data and hardware devices, more keys can be generated and treated with multiple keys including the first key. Encrypt data for encryption and more.

The data to be encrypted may include data with high security requirements in the hardware device, such as user password, user fingerprint feature, user facial feature, user iris feature, application key of the application in the hardware device, and the like. Of course, in practical applications, other data in the hardware device, such as user-specified data, may be included.

The encrypted data is a result of encrypting the data to be encrypted according to the first key, and the encrypted data can be decrypted according to the first key, thereby obtaining the data to be encrypted again.

In the embodiment of the present application, first, the first root key corresponding to the hardware device is generated by using the root of the trust program, and then the data is encrypted according to the first key, thereby reducing the hacker and the like to obtain the first secret directly from the code. The possibility of the key also ensures that even if the key of a hardware device is cracked, the key in the same type of hardware device as the hardware device or the hardware device belonging to the same hardware manufacturer is still safe, effectively improving the data and hardware devices. Security. Secondly, the first key can be generated by the software root program, which ensures that the first key can be generated regardless of whether the hardware device has hardware security capability, and the reliability of generating the first key is improved.

Embodiment 2

Referring to FIG. 2, a flow chart of a data encryption method according to an embodiment of the present application is shown. The specific steps include:

Step 201: Generate a first key uniquely corresponding to the hardware device by using a software root program.

For a method of generating a first key corresponding to a hardware device by using a root program, refer to the related description in the foregoing, and details are not described herein.

Of course, in a practical application, at least one of a hardware trust root program and a software trust root program may be included in the hardware device.

In addition, the generated first key may be stored in a storage location corresponding to the trusted root program, such as in a KM protected storage area.

Step 202: Provide a second interface that receives data to be encrypted, and receives the data to be encrypted through the second interface.

It can be seen from the foregoing that the hardware device may include a hardware root program and/or a software root program, and may even include more than one hardware root program, which may result in having multiple first interfaces for the hardware root program, thereby causing The system architecture in the hardware device is confusing, and the application in the application layer needs to perform complicated and heavy adaptation, which not only increases the development cost of the application, but also may cause problems such as adaptation errors, which may make it difficult to encrypt data or other problems. Reduce the security and reliability of data and hardware devices. Therefore, a unified interface can be provided for the application in the application layer, that is, the second interface receives the number to be encrypted, thereby encapsulating the trusted root program at the bottom layer through the second interface, so that each application can use the root of trust through a unified interface. The various functions of the program, in turn, make the system architecture in the hardware device more compact, reduce the development cost of the application, and improve the security and reliability of the application and the hardware device.

The second interface facing the application layer may be provided in the form of hardware or software, the data from the application layer is received through the second interface, and the received data is converted according to the first interface or the software trusted root program, so that the converted data is converted The data conforms to the data type or standard of the first interface or software trusted root program.

The data to be encrypted is data that needs to be encrypted by a key, and the data to be encrypted may include any data of a source and any application.

Step 203: Randomly generate a second key, and encrypt the data to be encrypted by using the second key, where the first key is used to encrypt the second key.

In order to effectively improve the complexity of data cracking and further reduce the possibility of data being cracked, a second key may be generated on the basis of the first key, and the encrypted data is encrypted by the second key, and passed through A key encrypts the second key, that is, through layered key management, to improve the security of data and hardware devices. Since the possibility of multiple keys being cracked is less than the possibility of a key being cracked, of course, the security of data and hardware devices is improved. In addition, since the second key is randomly generated, it can be ensured that the keys used for each data to be encrypted are different, and even if an encrypted data in the hardware device is cracked, other encrypted data is still safe. This further enhances the security of data and hardware devices.

The second key may be generated by a key generation algorithm by using the trust root program in the foregoing.

Hierarchical key management refers to generating multiple keys in different ways. Each key is stored and managed separately. The data is encrypted by multiple keys, or the data is encrypted by some of the keys. The other key encrypts the key of the encrypted data, effectively improving the complexity of the encryption, making it difficult for the hacker to obtain all the keys, and thus it is difficult to crack the encrypted information, thereby improving the security of the encrypted information. Sex.

Of course, in practical applications, more keys can be used, and the encrypted data is encrypted by the multiple keys in a similar manner, thereby further improving the security of data and hardware devices.

Step 204: Encrypt the second key by using the first key.

In order to reduce the possibility that the second key is cracked, thereby reducing the possibility that the encrypted data is encrypted, and improving the security of the data and the hardware device, the second key may be encrypted with the first key.

Wherein, the second key encrypted by the first key can be saved.

In the embodiment of the present application, optionally, in order to ensure that a legitimate user who subsequently obtains the data can obtain the second key to decrypt the encrypted data to be encrypted, and improve the reliability of the data encryption, the encrypted first The second key is saved corresponding to the encrypted data to be encrypted.

The encrypted second key may be stored in the same storage location as the encrypted data to be encrypted, or the encrypted second key and the encrypted data to be encrypted may be separately stored to different storage locations, and the encrypted second secret may be stored. The correspondence between the storage location where the key is located and the storage location where the encrypted data to be encrypted is located. Of course, in an actual application, the encrypted second key may be correspondingly saved with the encrypted data to be encrypted.

In addition, in another optional embodiment of the embodiment of the present application, in order to improve the efficiency of encrypting data, the second key may not be generated, but the first key is directly used to encrypt the encrypted data, that is, The first key is the key used to encrypt the encrypted data. Alternatively, in another optional embodiment of the present application, the first key may be encrypted by the second key on the basis of encrypting the data to be encrypted by using the first key, and the encrypted first The key is saved corresponding to the encrypted data to be encrypted.

The manner of encrypting the data to be encrypted by using the first key may be the same as the method of encrypting the data to be encrypted by using the second key, and details are not described herein.

Step 205: Generate verification data for verifying the integrity of the data to be encrypted, and the verification data is saved corresponding to the encrypted data to be encrypted.

In order to facilitate subsequent decryption of the encrypted data to be encrypted, and verifying whether the obtained data to be encrypted is complete, to further improve the security of the data and the hardware device, the verification data of the data to be encrypted may be generated, and the verification data may be The encrypted data to be encrypted is saved correspondingly.

The verification data is used for verification of the data to be encrypted, including integrity verification.

Wherein, the verification data for integrity verification may include a hash value.

The hash value is a binary value obtained by computing data based on file data (such as data to be encrypted) for integrity verification of the file data.

In the embodiment of the present application, optionally, in order to ensure that the data to be encrypted can be integrity verified by the hash value of the data to be encrypted, thereby improving the security of the data and the hardware device, the data to be encrypted may be determined. Hash value.

Of course, in actual applications, in order to ensure that the encrypted data can be verified later, the verification information may also include other information, such as the verification information used for integrity verification, and may also include attribute information of the data to be encrypted, correspondingly, The attribute information of the data to be encrypted may be determined, and the determined attribute information is used as the check data.

The attribute information is information indicating an attribute of the data to be encrypted, for example, the attribute information may include at least one of a size and a data type of the data to be encrypted.

The size of the data to be encrypted, used to describe the amount of data included in the data to be encrypted.

The type of data to be encrypted is used to describe the format or category of the data to be encrypted.

In addition, the manner in which the verification data is saved in the encrypted data to be encrypted may be the same as the manner in which the encrypted second key is stored in the encrypted data to be encrypted, and details are not described herein again.

In addition, in practical applications, in order to improve the encryption efficiency, the verification data of the data to be encrypted may not be generated, that is, step 205 is an optional step.

Step 206: Output an encryption result to the data source of the data to be encrypted through the second interface.

In order to facilitate the application to store or perform other operations on the encrypted data to be encrypted, the encryption result may be output to the application as the data source, and the system architecture in the hardware device is simplified, the development cost of the application is lowered, and the application is improved. And the security and reliability of the hardware device, the encrypted result can be output to the data source through the unified interface, that is, the second interface.

The data source is the source of the data to be encrypted, and may include the application in the foregoing.

The result of the encryption is the result of encrypting and outputting the encrypted data, and may include the encrypted data to be encrypted. Of course, in actual applications, if the encrypted data to be encrypted is encrypted by the second key, and the second key is used first The key is encrypted, and the encryption result may further include a second key encrypted by the first key. If the verification data of the data to be encrypted is also generated in the foregoing, the verification result may further include the verification data.

In addition, it is possible to provide a unified second interface and receive encrypted data or output encrypted results through the second interface, thereby ensuring that each application can use the functions of the trusted root program through a unified interface, thereby enabling the system in the hardware device. The architecture is more concise, which also reduces the development cost of the application, and also reduces the difficulty of encrypting the data caused by the application interface error of the first interface of the hardware trust root program, and improves the reliability of encrypting the data. This in turn increases the security and reliability of data and hardware devices.

In addition, the second key can be randomly generated, the second key is used to encrypt the encrypted data, and the second key is encrypted by using the first key, since the multiple keys are less likely to be cracked, and The randomly generated second key can also ensure that the data to be encrypted is encrypted by using different keys, thereby effectively improving the complexity of the data being cracked, thereby further improving the security of the data and hardware devices.

Embodiment 3

Referring to FIG. 3, a flowchart of a data encryption method according to an embodiment of the present application is shown. The specific steps include:

Step 301: Generate a first key uniquely corresponding to the hardware device by using a root of trust program.

In order to reduce the possibility of directly obtaining the key from the code, the key of the hardware device of the same type or the hardware device of the same hardware manufacturer is cracked, and the problem of the key is solved. Density, effectively improve the security of data and hardware devices, you can use the root of trust program to generate a unique key corresponding to the hardware device.

For the method of generating the first key corresponding to the hardware device by using the root program, refer to the related description in the foregoing, and details are not described herein.

In the embodiment of the present application, optionally, the hardware device has a dedicated hardware root program. In order to improve the reliability of generating the first key, it is ensured that the machine and the device can be secured, thereby improving the security of the data and the hardware device. The first key can be generated by accessing a hardware trust root program built in the hardware device.

The hardware trust root program may include a TEE.

In the embodiment of the present application, optionally, in order to ensure that the hardware trust root program can be accessed, and the reliability of generating the key and subsequently encrypting the encrypted data is improved, the hardware trust root program may be accessed through the first interface, where The interface type of the first interface is adapted to the program type of the hardware trusted root program.

For example, if the hardware trusted root program is intel SGX, the first interface may include an interface in the linux SGX driver; if the hardware new trusted root program is TEE, the first interface may include a GP Client API, wherein the GP Client API is The name of the interface that is compatible with the TEE.

Of course, in practical applications, the hardware device may include at least one of a hardware root program and a software root program to ensure that the first key is generated regardless of whether the hardware device has hardware security capability, and the first key is generated. The reliability of the key.

Step 302: Encrypt data according to the first key.

For the manner of encrypting data according to the first key, refer to the related description in the foregoing, and details are not described herein again.

In the embodiment of the present application, first, the first root key corresponding to the hardware device is generated by using the root of the trust program, and then the data is encrypted according to the first key, thereby reducing the hacker and the like to obtain the first secret directly from the code. The possibility of the key also ensures that even if the key of a hardware device is cracked, the key in the same type of hardware device as the hardware device or the hardware device belonging to the same hardware manufacturer is still safe, effectively improving the data and hardware devices. Security.

Secondly, for a hardware device with hardware security capability, the hardware root program built into the hardware device can be accessed to generate a first key, which improves the reliability of generating the first key.

Embodiment 4

Referring to FIG. 4, a flowchart of a data decryption method according to an embodiment of the present application is shown. The specific steps include:

Step 401: Generate a first key uniquely corresponding to the hardware device by using a software root program.

In order to avoid the problem of one machine and one secret that is difficult to implement by directly writing the key into the code in the hardware device and the further problem of lower security of data and hardware devices, the key may not be written into the hardware code. The first root key is generated by the root of the trust program, and the generated key can uniquely correspond to the hardware device. On the one hand, the possibility of obtaining the first key directly from the code by the hacker is reduced, and on the other hand, even if some The key of the hardware device is cracked, and the key in the same type of hardware device or hardware device belonging to the same hardware manufacturer is still secure, so that the security of the data and the hardware device can be effectively improved. In addition, since some hardware devices may not have hardware that the hardware trust root program depends on, in order to ensure that the hardware device capable of generating hardware or the like can generate the first key, the reliability of the first key is improved. To ensure the security of data and hardware devices, while reducing costs, you can call the software root program to generate the first key.

For the manner in which the first root key corresponding to the hardware device is generated by using the root program, refer to the related description in the foregoing, and details are not described herein again.

Step 402: Decrypt the encrypted data according to the first key.

In order to ensure that the legitimate user of the encrypted data can obtain the encrypted data normally, the encrypted data can be decrypted according to the first key.

The encrypted data may be the encrypted data to be encrypted in the foregoing.

The encrypted data may be decrypted according to the first key according to the foregoing method of encrypting the data according to the first key. For example, if the data to be encrypted is encrypted by using the first key, the first secret may be adopted. The key decrypts the encrypted data; if the plurality of keys including the first key are used to encrypt the encrypted data, another key of the plurality of keys other than the first key may be generated, The plurality of keys including the first key decrypt the encrypted data.

In the embodiment of the present application, first, the first root key corresponding to the hardware device is generated by using the root of the trust program, and the data is decrypted according to the first key, thereby reducing the first secret obtained by the hacker or the like directly from the code. The possibility of the key also ensures that even if the key of a hardware device is cracked, the key in the same type of hardware device as the hardware device or the hardware device belonging to the same hardware manufacturer is still safe, effectively improving the data and hardware devices. Security. Secondly, the first key can be generated by the software trust root program, which ensures that the first key can be generated regardless of whether the hardware device has hardware security capability, and the reliability of generating the first key is improved.

Embodiment 5

Referring to FIG. 5, a flowchart of a data decryption method according to an embodiment of the present application is shown. The specific steps include:

Step 501: Generate a first key uniquely corresponding to the hardware device by using a software root program.

For the manner in which the first root key corresponding to the hardware device is generated by using the root program, refer to the related description in the foregoing, and no further details are provided herein.

Step 502: Acquire encrypted data through the second interface.

In order to simplify the system architecture in the hardware device, reduce the development cost of the application, and improve the security and reliability of the application and the hardware device, the encrypted data of each data source can be obtained through a unified interface, that is, the second interface.

Of course, in an actual application, the encrypted second key and/or check data saved corresponding to the encrypted data may also be acquired through the second interface.

The second encryption key may be a key randomly generated for the encrypted data.

If the second key and/or the check data are in the same storage location as the encrypted data, the second key and/or the check data may be obtained from the storage location; if the second key and/or the check data Corresponding relationship between the storage location and the storage location of the encrypted data, the storage location of the second key and/or the verification data may be determined according to the storage location of the encrypted data, thereby obtaining the second key and / or verify the data.

In addition, in another optional embodiment of the embodiment of the present application, the second key and/or the check data may not be acquired in the step, but when the second key and/or the check data are needed later. And then obtain the second key and / or check data.

Step 503: Decrypt the encrypted data according to the first key.

For the manner of decrypting the encrypted data according to the first key, refer to the related description in the foregoing, and details are not described herein again.

In the embodiment of the present application, optionally, as described above, since the possibility that multiple keys are cracked is smaller than the possibility that one key is cracked, in order to improve the security of data and hardware devices, it may be generated. Determining, by the first key, an encrypted second key, the encrypted second key is saved corresponding to the encrypted data, and decrypting the encrypted first by using the first key The second key obtains a second key, and the second key is used to decrypt the encrypted data. That is, to improve the security of data and hardware devices through hierarchical key management.

For the manner of generating the first key and the manner of obtaining the second key, refer to the related description in the foregoing, and details are not described herein again.

Step 504: Acquire verification data, where the verification data is saved corresponding to the encrypted data, and the verification data is used to verify the integrity of the decryption result.

In order to facilitate the decryption of the encrypted data and verify whether the obtained decryption result is complete, to further improve the security of the data and the hardware device, the verification data may be acquired to verify the decrypted result.

The decryption result is the result of decrypting the encrypted data, and the decrypted result can be the data to be encrypted in the foregoing.

The verification data may be generated according to the decryption result, and the generated verification data is compared with the obtained verification data. If they are consistent, the decryption result is determined to be complete, otherwise the decryption result is determined to have no integrity.

In the embodiment of the present application, optionally, in order to ensure that the decryption result is consistent with the data to be encrypted before encryption, that is, the integrity of the decrypted result is verified, and the security of the data and the hardware device is further improved, and the verification data is further improved. a first hash value including the decrypted result, and correspondingly, a second hash value of the decrypted result may be generated, and if the second hash value is consistent with the first hash value, confirming The decryption result is complete. If the second hash value does not coincide with the first hash value, it is confirmed that the decrypted result is not complete.

The first hash value is a hash value of the data to be encrypted determined in the process of encrypting the data to be encrypted in the foregoing; the second hash value is a hash value generated according to the decrypted data. If the data to be encrypted is consistent with the decrypted result, that is, the decrypted result has completeness, the first hash value and the second hash value should also be consistent.

The check data including the first hash value may be obtained, the second hash value of the decrypted result is generated, and the first hash value is compared with the second hash value to determine the first hash value and the second hash. Whether the values are consistent.

For the manner of obtaining the verification data, refer to the related description in the foregoing, and details are not described herein again.

In addition, in another optional embodiment of the implementation of the present application, in order to ensure that the decryption result is consistent with the data to be encrypted before encryption, that is, to ensure the integrity of the decrypted result, and further improve the security of the data and hardware devices, The first data information of the data to be encrypted is included in the test data, and correspondingly, the second attribute information of the decrypted result may be obtained, and the first attribute information is compared with the second attribute information, and if they are consistent, the decryption result is determined to be complete. Otherwise, it is determined that the decryption result is not complete.

The first attribute information is attribute information generated according to the data to be encrypted, and the second attribute information is attribute information generated according to the decryption result. If the data to be encrypted is consistent with the decrypted result, that is, the decrypted result has completeness, the first attribute information It should also be consistent with the second attribute information.

In addition, in practical applications, in order to improve the decryption efficiency, integrity verification may not be performed on the decrypted result, that is, step 504 is an optional step.

Step 505, outputting a decryption result through the second interface.

In order to facilitate the application to store or perform other operations on the encrypted data to be encrypted, the encryption result may be output to the application as the data source, and the system architecture in the hardware device is simplified, the development cost of the application is lowered, and the application is improved. And the security and reliability of the hardware device, the decryption result can be output through the unified interface, that is, the second interface.

The decryption result may be output to the data source of the encrypted data through the second interface.

Secondly, the first key can be generated by the hardware trust root program or the software trust root program, which ensures that the first key can be generated regardless of whether the hardware device has hardware security capability, and the reliability of generating the first key is improved.

In addition, a unified second interface can be provided, and the encrypted data or the output decrypted result can be obtained through the second interface, thereby ensuring that each application can use the functions of the trusted root program through a unified interface, thereby enabling the hardware device to The system architecture is more concise, which also reduces the development cost of the application, and reduces the problem that the application decrypts the data caused by the first interface adaptation error of the hardware trust root program, and improves the reliability of decrypting the data. It also improves the security and reliability of data and hardware devices.

In addition, the encrypted second key can be decrypted by using the first key, and the encrypted data is decrypted by using the second key. Since multiple keys are less likely to be cracked, the effective improvement is effective. The complexity of data being cracked further increases the security of data and hardware devices.

Embodiment 6

Referring to FIG. 6, a flowchart of a data decryption method according to an embodiment of the present application is shown. The specific steps include:

Step 601: Generate a first key uniquely corresponding to the hardware device by using a root of trust program.

In the embodiment of the present application, optionally, the hardware device has a dedicated hardware root program. In order to improve the reliability of generating the first key, it is ensured that the machine and the device can be secured, thereby improving the security of the data and the hardware device. Accessing the hardware trust root program built in the hardware device to generate the first key.

In the embodiment of the present application, optionally, in order to ensure that the hardware trusted root program can be accessed, and the reliability of generating the key and subsequently decrypting the encrypted data to be encrypted is improved, the hardware trusted root program may be accessed through the first interface. The interface type of the first interface is adapted to the program type of the hardware trusted root program.

Step 602: Decrypt the encrypted data according to the first key.

In the embodiment of the present application, first, the first root key corresponding to the hardware device is generated by using the root of the trust program, and the data is decrypted according to the first key, thereby reducing the first secret obtained by the hacker or the like directly from the code. The possibility of the key also ensures that even if the key of a hardware device is cracked, the key in the same type of hardware device as the hardware device or the hardware device belonging to the same hardware manufacturer is still safe, effectively improving the data and hardware devices. Security.

It should be understood by those skilled in the art that the method steps in the above embodiments are not indispensable, and in a specific case, one or more steps may be omitted as long as the technology for encrypting or decrypting data can be implemented. purpose. The invention is not limited to the number of steps and the order of the steps in the embodiments, and the scope of the invention is defined by the claims.

In order to facilitate a person skilled in the art to better understand the present application, a data processing, encryption and decryption method of the embodiment of the present application is described below by a specific example, and specifically includes the following steps:

Referring to FIG. 7, a flowchart of a data processing method according to an embodiment of the present application is shown. The specific steps include:

In step 701, the hardware trust root program or the software trust root program generates a root key.

The root key may include the first key in the foregoing.

If the hardware device is provided with hardware that the hardware root program relies on (that is, has hardware security capability), the root key may be generated by the hardware trust root; if the hardware device does not have the hardware that the hardware root program depends on, The root key can be generated by the software trust root.

In step 702, the root key for secure storage is saved by the hardware trust root program or the software trust root program.

In step 703, the file key is encrypted by using a root key through a hardware root program or a software root program.

The file key is a key for encrypting the data to be encrypted in the foregoing, and may include, for example, the second key in the foregoing.

Step 704, encrypting the data to be encrypted by the file key, and storing the file key encrypted by the root key.

It can be seen from the above that the root key is not directly used for encrypting the data to be encrypted, but is used for encrypting the file key for encrypting the encrypted data. Correspondingly, the root key is not directly used to decrypt the encrypted data. Instead, the file key used to decrypt the encrypted data is decrypted, which ensures that different keys can be provided for different hardware devices and different data for encryption or decryption, which reduces the possibility of data being cracked. Increased security of data and hardware devices.

Step 705: Provide a secure storage function to the application layer through a unified interface.

The data to be encrypted submitted by the application (such as sensitive data of the application) can be received through a unified interface, and the encrypted result is output to the application level; or the encrypted data submitted by the application is received, and the decrypted result is output to the application. .

The unified interface may include the second interface in the foregoing.

Referring to Figure 8, a flow diagram of a data encryption method in accordance with one embodiment of the present application is shown. The specific steps include:

Step 801: The trusted root program generates a first key, and saves the first key in a storage location corresponding to the trusted root program.

Step 802: The root program encrypts the second key by using the first key.

Step 803, encrypting the encrypted data by using the second key;

Step 804: Generate a hash value of the data to be encrypted.

Step 805: Combine the encrypted data to be encrypted, the hash value of the data to be encrypted, and the second key encrypted by the first key into one file for storage.

Referring to Figure 9, a flow diagram of a data decryption method in accordance with one embodiment of the present application is shown. The specific steps include:

Step 901: The root program is trusted to read the encrypted data.

Step 902: The root program decrypts the second key by using the first key.

Step 903, decrypting the encrypted data by using the second key;

Step 904, generating a hash value of the decrypted result;

Step 905: Determine that the generated hash value is consistent with the hash value of the previously saved data to be encrypted.

In step 906, the decryption result is output.

Example 7

Referring to FIG. 10, a block diagram of a data encryption apparatus according to an embodiment of the present application is shown. The apparatus includes:

The first key generation module 1001 is configured to generate, by using a software root program, a first key uniquely corresponding to the hardware device;

The data encryption module 1002 is configured to encrypt data according to the first key.

Optionally, the data encryption module includes:

Optionally, the device further includes:

And a second key storage module, configured to save the encrypted second key corresponding to the encrypted data to be encrypted.

Optionally, the device further includes:

Optionally, the verification data generating module includes:

A hash value determining submodule is configured to determine a hash value of the data to be encrypted.

Optionally, the device further includes:

Example eight

Referring to FIG. 11, a block diagram of a data encryption apparatus according to an embodiment of the present application is shown. The apparatus includes:

The first key generation module 1101 is configured to generate a first key uniquely corresponding to the hardware device by using a root of trust program;

The data encryption module 1102 is configured to encrypt data according to the first key.

Optionally, the first key generation module includes:

Optionally, the hardware device has a dedicated hardware root program, and the first key generation sub-module is further configured to:

In the embodiment of the present application, the first root key corresponding to the hardware device can be generated by using the root of the trust program, and the data is encrypted according to the first key, thereby reducing the hacker or the like to obtain the first key directly from the code. It is also possible to ensure that even if the key of a hardware device is cracked, the key in the same type of hardware device as the hardware device or the hardware device belonging to the same hardware manufacturer is still safe, effectively improving the security of data and hardware devices. Sex.

Example nine

Referring to FIG. 12, a block diagram of a data decryption apparatus according to an embodiment of the present application is shown. The apparatus includes:

The first key generation module 1201 is configured to generate, by using a software root program, a first key uniquely corresponding to the hardware device;

The data decryption module 1202 is configured to decrypt the encrypted data according to the first key.

Optionally, the data decryption module includes:

Optionally, the device further includes:

Optionally, the verification data includes a first hash value of the decryption result, and the integrity verification module includes:

a second hash value generating submodule, configured to generate a second hash value of the decrypted result;

The integrity verification confirmation submodule is configured to compare the second hash value with the first hash value, and confirm that the decryption result has integrity.

Optionally, the device further includes:

Example ten

Referring to FIG. 13, there is shown a structural block diagram of a data decryption apparatus according to an embodiment of the present application, the apparatus comprising:

The first key generation module 1301 is configured to generate a first key uniquely corresponding to the hardware device by using a root of trust program;

The data decryption module 1302 is configured to decrypt the encrypted data according to the first key.

Optionally, the first key generation module includes:

In the embodiment of the present application, the first root key corresponding to the hardware device can be generated by using the root program, and the data is decrypted according to the first key, thereby reducing the hacker or the like to obtain the first key directly from the code. It is also possible to ensure that even if the key of a hardware device is cracked, the key in the same type of hardware device as the hardware device or the hardware device belonging to the same hardware manufacturer is still safe, effectively improving the security of data and hardware devices. Sex.

For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.

Embodiments of the present application can be implemented as a system for performing a desired configuration using any suitable hardware, firmware, software, or any combination thereof. FIG. 14 schematically illustrates an exemplary system (or apparatus) 1400 that can be used to implement various embodiments described in this application.

For one embodiment, FIG. 14 illustrates an exemplary system 1400 having one or more processors 1402, a system control module (chipset) coupled to at least one of processor(s) 1402. 1404, system memory 1406 coupled to system control module 1404, non-volatile memory (NVM)/storage device 1408 coupled to system control module 1404, one or more inputs/outputs coupled to system control module 1404 Device 1410, and a network interface 1412 that is coupled to system control module 1406.

Processor 1402 can include one or more single or multiple core processors, and processor 1402 can comprise any combination of general purpose or special purpose processors (eg, graphics processors, application processors, baseband processors, etc.). In some embodiments, system 1400 can be implemented as a hardware device as described in embodiments of the present application.

In some embodiments, system 1400 can include one or more computer readable media having instructions (eg, system memory 1406 or NVM/storage device 1408) and in combination with the one or more computer readable media configured to One or more processors 1402 that execute instructions to implement the modules to perform the actions described herein.

For one embodiment, system control module 1404 can include any suitable interface controller to provide to at least one of processor(s) 1402 and/or any suitable device or component in communication with system control module 1404. Any suitable interface.

System control module 1404 can include a memory controller module to provide an interface to system memory 1406. The memory controller module can be a hardware module, a software module, and/or a firmware module.

System memory 1406 can be used, for example, to load and store data and/or instructions for system 1400. For one embodiment, system memory 1406 can include any suitable volatile memory, such as a suitable DRAM. In some embodiments, system memory 1406 can include double data rate type quad synchronous dynamic random access memory (DDR4 SDRAM).

For one embodiment, system control module 1404 can include one or more input/output controllers to provide an interface to NVM/storage device 1408 and input/output device(s) 1410.

For example, NVM/storage device 1408 can be used to store data and/or instructions. NVM/storage device 1408 may comprise any suitable non-volatile memory (eg, flash memory) and/or may include any suitable non-volatile storage device(s) (eg, one or more hard disk drives ( HDD), one or more compact disc (CD) drives and/or one or more digital versatile disc (DVD) drives).

NVM/storage device 1408 can include storage resources that are physically part of the device on which system 1400 is installed, or that can be accessed by the device without having to be part of the device. For example, the NVM/storage device 1408 can be accessed via the network via the input/output device(s) 1410.

The input/output device(s) 1410 can provide an interface to the system 1400 to communicate with any other suitable device, and the input/output device 1410 can include a communication component, an audio component, a sensor component, and the like. Network interface 1412 can provide an interface for system 1400 to communicate over one or more networks, and system 1400 can interact with one or more of the wireless networks in accordance with any one or more of the wireless network standards and/or protocols. The components communicate wirelessly, such as by accessing a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof for wireless communication.

For one embodiment, at least one of the processor(s) 1402 can be packaged with logic of one or more controllers (eg, memory controller modules) of the system control module 1404. For one embodiment, at least one of the processor(s) 1402 can be packaged with the logic of one or more controllers of the system control module 1404 to form a system in package (SiP). For one embodiment, at least one of the processor(s) 1402 can be integrated on the same mold as the logic of one or more controllers of the system control module 1404. For one embodiment, at least one of the processor(s) 1402 can be integrated with the logic of one or more controllers of the system control module 1404 on the same mold to form a system on a chip (SoC).

In various embodiments, system 1400 can be, but is not limited to, a workstation, a desktop computing device, or a mobile computing device (eg, a laptop computing device, a handheld computing device, a tablet, a netbook, etc.). In various embodiments, system 1400 can have more or fewer components and/or different architectures. For example, in some embodiments, system 1400 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touch screen display), a non-volatile memory port, multiple antennas, a graphics chip, an application specific integrated circuit ( ASIC) and speakers.

Wherein, if the display comprises a touch panel, the display screen can be implemented as a touch screen display to receive an input signal from the user. The touch panel includes one or more touch sensors to sense touches, slides, and gestures on the touch panel. The touch sensor may sense not only the boundary of the touch or sliding action, but also the duration and pressure associated with the touch or slide operation.

The embodiment of the present application further provides a non-volatile readable storage medium, where the storage medium stores one or more programs, and when the one or more modules are applied to the terminal device, the terminal may be The device executes the instructions of the method steps in the embodiment of the present application.

An apparatus is provided, in one example, comprising: one or more processors; and one or more machine-readable media having instructions stored thereon, when executed by the one or more processors, The apparatus is caused to perform a method performed by a hardware device as in the embodiment of the present application.

Also provided in one example is one or more machine readable medium having stored thereon instructions that, when executed by one or more processors, cause the apparatus to perform a method performed by a hardware device in an embodiment of the present application.

The embodiment of the present application discloses a data encryption and decryption method and device.

Example 1. A data encryption method, including:

Encrypting data according to the first key.

Example 2 may include the method of example 1, the encrypting data according to the first key comprising:

Randomly generating a second key;

Example 3 may include the method of example 2, the method further comprising:

Encrypting the second key with the first key.

Example 4 may include the method of example 3, after the encrypting the second key with the first key, the method further comprises:

Example 5 may include the method of example 1, the method further comprising:

Example 6 may include the method of example 5, the generating verification data for verifying integrity of data to be encrypted comprises:

Determining a hash value of the data to be encrypted.

Example 7 may include the method of example 1, before encrypting data according to the first key, the method further comprising:

Example 8, a data decryption method, comprising:

The encrypted data is decrypted according to the first key.

Example 9 may include the method of example 8, the decrypting the encrypted data according to the first key comprises:

Decrypting the encrypted second key with the first key to obtain a second key;

The encrypted data is decrypted using the second key.

Example 10 can include the method of example 8, the method further comprising:

The check data is used to verify the integrity of the decrypted result.

The example 11 may include the method of example 10, the check data includes a first hash value of the decrypted result, and the integrity of verifying the decrypted result by using the check data comprises:

Generating a second hash value of the decrypted result;

Example 12 may include the method of example 8, the method further comprising:

The decryption result is output through the second interface.

Example 13, a data encryption method, comprising:

Encrypting data according to the first key.

The example 14 may include the method of example 13, the generating the first key uniquely corresponding to the hardware device by using the root of the trust program comprises:

Example 15 may include the method of example 14, the hardware device having a dedicated hardware trust root program, the accessing the hardware trust root program built into the hardware device comprising:

Example 16, a data decryption method, comprising:

The encrypted data is decrypted according to the first key.

The example 17 may include the method of example 16, the generating the first key uniquely corresponding to the hardware device by using the root of the trust program comprises:

Example 18 may include the method of example 17, the hardware device having a dedicated hardware trust root program, the accessing the hardware trust root program built into the hardware device comprising:

Example 19: A data encryption device, comprising:

Example 20 can include the apparatus of example 19, the data encryption module comprising:

Example 21 can include the apparatus of example 20, the apparatus further comprising:

Example 22 can include the apparatus of example 19, the apparatus further comprising:

Example 23 may include the device of example 19, the device further comprising:

Example 24: A data decryption apparatus comprising:

Example 25 can include the apparatus of example 24, the data decryption module comprising:

Example 26 can include the apparatus of example 24, the apparatus further comprising:

Example 27 can include the apparatus of example 24, the apparatus further comprising:

Example 28: A data encryption device, comprising:

Example 29 may include the apparatus of example 28, the first key generation module comprising:

Example 30. A data decryption apparatus comprising:

Example 31 may include the apparatus of example 30, the first key generation module comprising:

Example 32, an apparatus comprising: one or more processors; and one or more machine-readable media having instructions stored thereon, when executed by the one or more processors, causing the device A method of one or more of Example 1 - Example 18 is performed.

Example 33, one or more machine readable medium having stored thereon instructions that, when executed by one or more processors, cause the apparatus to perform the method of one or more of Examples 1 - 18.

The present invention has been shown and described for the purposes of illustration and description, and various embodiments and embodiments The scope of implementation. This application is intended to cover any adaptations or variations of the embodiments discussed herein. Therefore, it is apparent that the embodiments described herein are limited only by the claims and their equivalents.

Claims

A data encryption method, comprising:

Generating a first key uniquely corresponding to the hardware device by using a software root program;

Encrypting data according to the first key.
The method according to claim 1, wherein said encrypting data according to said first key comprises:

Randomly generating a second key;

The data to be encrypted is encrypted by using the second key, and the first key is used to encrypt the second key.
The method of claim 2, wherein the method further comprises:

Encrypting the second key with the first key.
The method according to claim 3, wherein after the encrypting the second key by using the first key, the method further comprises:

The encrypted second key is saved corresponding to the encrypted data to be encrypted.
The method of claim 1 further comprising:

Check data for verifying the integrity of the data to be encrypted is generated, and the check data is saved corresponding to the encrypted data to be encrypted.
The method according to claim 5, wherein the generating the verification data for verifying the integrity of the data to be encrypted comprises:

Determining a hash value of the data to be encrypted.
The method of claim 1, wherein before encrypting the data according to the first key, the method further comprises:

Providing a second interface for receiving data to be encrypted, and receiving the data to be encrypted by using the second interface;

After the data is encrypted according to the first key, the method further includes:

And outputting an encryption result to the data source of the data to be encrypted through the second interface.
A data decryption method, comprising:

Generating a first key uniquely corresponding to the hardware device by using a software root program;

The encrypted data is decrypted according to the first key.
The method according to claim 8, wherein said decrypting the encrypted data according to the first key comprises:

Generating the first key, and acquiring an encrypted second key, where the encrypted second key is saved corresponding to the encrypted data;

Decrypting the encrypted second key with the first key to obtain a second key;

The encrypted data is decrypted using the second key.
The method of claim 8 further comprising:

Obtaining verification data, where the verification data is saved corresponding to the encrypted data;

The check data is used to verify the integrity of the decrypted result.
The method according to claim 10, wherein the verification data includes a first hash value of the decryption result, and the integrity of the decryption result by the verification data comprises:

Generating a second hash value of the decrypted result;

Comparing the second hash value with the first hash value, confirming that the decrypted result has integrity.
The method of claim 8 further comprising:

The decryption result is output through the second interface.
A data encryption method, comprising:

Generating a first key uniquely corresponding to the hardware device by using a root of trust program;

Encrypting data according to the first key.
The method according to claim 13, wherein the generating the first key uniquely corresponding to the hardware device by using the root of the trust program comprises:

Accessing the hardware trust root program built in the hardware device to generate the first key.
The method according to claim 14, wherein the hardware device has a dedicated hardware root program, and the hardware root program built into the hardware device includes:

The hardware trusted root program is accessed through the first interface, and the interface type of the first interface is adapted to the program type of the hardware trusted root program.
A data decryption method, comprising:

Generating a first key uniquely corresponding to the hardware device by using a root of trust program;

The encrypted data is decrypted according to the first key.
The method according to claim 16, wherein the generating the first key uniquely corresponding to the hardware device by using the root of the trust program comprises:

Accessing the hardware trust root program built in the hardware device to generate the first key.
The method according to claim 17, wherein the hardware device has a dedicated hardware root program, and the hardware root program built into the hardware device includes:

The hardware trusted root program is accessed through the first interface, and the interface type of the first interface is adapted to the program type of the hardware trusted root program.
A data encryption device, comprising:

a first key generation module, configured to generate a first key uniquely corresponding to the hardware device by using a software root program;

And a data encryption module, configured to encrypt data according to the first key.
The device according to claim 19, wherein the data encryption module comprises:

a key random generation sub-module, configured to randomly generate a second key;

a data encryption submodule, configured to encrypt data to be encrypted by using the second key, where the first key is used to encrypt the second key.
The device of claim 20, wherein the device further comprises:

And a second key encryption module, configured to encrypt the second key by using the first key.
The device of claim 19, wherein the device further comprises:

The verification data generating module is configured to generate verification data for verifying integrity of the data to be encrypted, and the verification data is saved corresponding to the encrypted data to be encrypted.
The device of claim 19, wherein the device further comprises:

The data receiving module to be encrypted is configured to provide a second interface for receiving data to be encrypted, and receive the data to be encrypted through the second interface;

And an encryption result output module, configured to output an encryption result to the data source of the data to be encrypted by using the second interface.
A data decryption device, comprising:

a first key generation module, configured to generate a first key uniquely corresponding to the hardware device by using a software root program;

And a data decrypting module, configured to decrypt the encrypted data according to the first key.
The apparatus according to claim 24, wherein said data decryption module comprises:

a key acquisition submodule, configured to generate the first key, and obtain an encrypted second key, where the encrypted second key is saved corresponding to the encrypted data;

a second key decrypting submodule, configured to decrypt the encrypted second key by using the first key to obtain a second key;

a data decryption submodule for decrypting the encrypted data using the second key.
The device according to claim 24, wherein the device further comprises:

a verification data acquisition module, configured to acquire verification data, where the verification data is saved corresponding to the encrypted data;

An integrity verification module is configured to verify the integrity of the decrypted result by using the verification data.
The device according to claim 24, wherein the device further comprises:

The decryption result output module is configured to output the decryption result through the second interface.
A data encryption device, comprising:

a first key generation module, configured to generate a first key uniquely corresponding to the hardware device by using a root of trust program;

And a data encryption module, configured to encrypt data according to the first key.
The device according to claim 28, wherein the first key generation module comprises:

The first key generation submodule is configured to access a hardware root program built in the hardware device to generate the first key.
A data decryption device, comprising:

a first key generation module, configured to generate a first key uniquely corresponding to the hardware device by using a root of trust program;

And a data decrypting module, configured to decrypt the encrypted data according to the first key.
The device according to claim 30, wherein the first key generation module comprises:

The first key generation submodule is configured to access a hardware root program built in the hardware device to generate the first key.
A computer device comprising a memory, a processor, and a computer program stored on the memory and operable on the processor, wherein the processor executes the computer program to implement any one of claims 1 to 18 The method described in the item.
A computer readable storage medium having stored thereon a computer program, wherein the computer program is executed by a processor to implement the method of any one of claims 1 to 18.