WO2021114891A1 - 密钥加密方法、解密方法及数据加密方法、解密方法 - Google Patents

密钥加密方法、解密方法及数据加密方法、解密方法 Download PDF

Info

Publication number
WO2021114891A1
WO2021114891A1 PCT/CN2020/122961 CN2020122961W WO2021114891A1 WO 2021114891 A1 WO2021114891 A1 WO 2021114891A1 CN 2020122961 W CN2020122961 W CN 2020122961W WO 2021114891 A1 WO2021114891 A1 WO 2021114891A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
data
identification information
device identification
encryption
Prior art date
Application number
PCT/CN2020/122961
Other languages
English (en)
French (fr)
Inventor
吴水华
李锐
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2021114891A1 publication Critical patent/WO2021114891A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions

Definitions

  • This application relates to the field of encryption technology, in particular to a key encryption method, a decryption method, and a data encryption method and decryption method.
  • the embodiments of the present application provide a key encryption method, a decryption method, a data encryption method, and a decryption method, which can improve the security of data encryption.
  • an embodiment of the present application also provides a key encryption method applied to an electronic device, including: acquiring a first key; acquiring device identification information of the electronic device, and generating a second key according to the device identification information Key; Use the second key to encrypt the first key to generate an encryption key.
  • an embodiment of the present application also provides a key decryption method applied to an electronic device, including: obtaining an encryption key; obtaining device identification information of the electronic device, and generating a second secret key according to the device identification information Key; use the second key to decrypt the encryption key to obtain the first key.
  • an embodiment of the present application provides a data encryption method applied to an electronic device, including: obtaining original data; obtaining a first key, and encrypting the original data by using the first key to generate encryption Data; obtain the device identification information of the electronic device, and generate a second key according to the device identification information; use the second key to encrypt the first key to generate an encryption key.
  • an embodiment of the present application also provides a data decryption method applied to an electronic device, including: obtaining encrypted data and an encryption key; obtaining device identification information of the electronic device, and generating a second data based on the device identification information Two keys; use the second key to decrypt the encryption key to obtain the first key; use the first key to decrypt the encrypted data to obtain the original data.
  • an embodiment of the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor.
  • the computer program executes the above-mentioned key encryption method when the computer program is running. , Or execute the above-mentioned key decryption method, or execute the above-mentioned data encryption method, or execute the above-mentioned data decryption method.
  • an embodiment of the present application also provides a computer-readable storage medium that stores computer-executable instructions, and the computer-executable instructions are used to execute the above-mentioned key encryption method or the above-mentioned key decryption method , Or execute the above-mentioned data encryption method, or execute the above-mentioned data decryption method.
  • FIG. 1 is a structural block diagram of a data encryption system provided by an embodiment of this application.
  • Fig. 2 is a flowchart of a key encryption method provided by an embodiment of the present application
  • FIG. 3 is a flowchart of a key decryption method provided by an embodiment of the present application.
  • FIG. 4 is a flowchart of a data encryption method provided by an embodiment of the present application.
  • FIG. 5 is a flowchart of generating a second key according to the device identification information in a data encryption method provided by an embodiment of the present application
  • FIG. 6 is a flow chart of generating the second key after one or more iterations according to the third key in a data encryption method provided by an embodiment of the present application;
  • FIG. 7 is a flow chart of performing one-way hash processing on original data in a data encryption method provided by an embodiment of the present application.
  • FIG. 8 is a flowchart of a data decryption method provided by an embodiment of the present application.
  • FIG. 9 is a flowchart of performing hash verification on original data obtained by decryption in a data decryption method provided by an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • multiple means two or more, greater than, less than, exceeding, etc. are understood to not include the number, and above, below, and within are understood to include the number. If there are descriptions of "first”, “second”, etc., which are only used to distinguish technical features, they cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the indicated The precedence of technical characteristics.
  • the embodiments of the present application provide a data encryption method, a decryption method, and a key encryption method and decryption method.
  • the data encryption method, decryption method, key encryption method, and decryption method are applied to electronic equipment.
  • electronic devices are devices that can install various communication applications or have communication functions.
  • smart phones tablet computers, PCs (Personal Computers), various wearable devices (headphones, watches, etc.), in-vehicle devices, TV set-top boxes, wireless base station devices, virtualized data devices, etc.
  • the data encryption system that implements the data encryption method, decryption method, key encryption method, and decryption method provided by the embodiment of the present application is installed in the above-mentioned electronic device.
  • 1 is a block diagram of a structure of a data encryption system in an embodiment of this application. among them:
  • the first key acquisition module 111 is used to generate a first key
  • the data encryption module 112 is configured to use the first key to encrypt the original data
  • the third key generation module 113 is configured to generate a third key according to the device identification information
  • the second key generation module 114 is configured to generate a second key according to the third key
  • the key encryption module 115 is configured to use the second key to encrypt the first key and generate a random number
  • the key decryption module 116 is configured to use the second key to decrypt the first key
  • the data decryption module 117 is configured to use the first key to decrypt the original data
  • the storage module 118 is used to store encrypted data, encryption keys, random numbers, etc.; the storage module 118 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other easy-to-use storage devices. Degenerate solid-state storage devices, or secure storage areas inside certain chips.
  • FIG. 1 does not constitute a limitation on the data encryption system.
  • the data encryption system provided by the embodiment of the present application may include more or less modules than those shown in the figure, or a combination of some Modules, or different module arrangements.
  • Fig. 2 is a flowchart of a key encryption method according to an embodiment of the application. As shown in Figure 2, the method is applied to electronic equipment, including but not limited to the following steps:
  • Step 101 Obtain the first key
  • Step 102 Obtain device identification information of the electronic device, and generate a second key according to the device identification information;
  • Step 103 Use the second key to encrypt the first key to generate an encryption key.
  • the first key is used to encrypt the original data
  • the first key can be stored in a storage medium in advance
  • the storage medium can be a hard disk, a USB flash drive, an optical disc, and the like.
  • the device identification information is used to identify a specific device and is unique.
  • the device identification information may include software device identification information and hardware device identification information.
  • Software device identification information can be one or more combinations of host name, IP address, etc. For example, in a local area network device group, each individual host has a corresponding host name and IP address, and you can quickly use the host name or IP address. To determine a certain host.
  • the hardware device identification information can be one or more combinations of CPU (Central Processing Unit) serial number, single board barcode, Ethernet port MAC (Media Access Control, media access control) address, etc., where each Each CPU has a unique CPU serial number.
  • CPU Central Processing Unit
  • the CPU serial number is put into the CPU by the manufacturer during the manufacturing process of the CPU, and the CPU serial number is unchanged for life and can be read by software; single board
  • the bar code includes BOM (Byte Order Mark) code, factory information, board version, board name, board feature code and other basic board information, which can be read by software, and each board is unique; Ethernet
  • the MAC address of the network port that is, the physical address, is used to uniquely identify a network card in the network.
  • the MAC address of the Ethernet port of each device is unique and can be read by software.
  • obtaining the identification information of the hardware device in step 102 can be realized by reading the hardware operation information of the electronic device.
  • the software for reading the hardware operation information of the electronic device is an existing technology, and will not be repeated here. . It is understandable that this embodiment does not limit the hardware device identification information to the CPU serial number, single board bar code, and Ethernet port MAC address. Those skilled in the art can choose other similar hardware devices on the basis of understanding this application. Identification information.
  • the second key is generated according to the hardware device identification information. Since the hardware device identification information corresponds to each electronic device and is unique, the second key generated by each device has correspondence and uniqueness, which greatly improves the encryption security of the first key.
  • Using the second key to encrypt the first key can be implemented using the AES-CCM (Advanced Encryption Standard-Counter with Cipher Block Chaining-Message Authentication Code) algorithm in the prior art. This embodiment is not limited to using the AES-CCM algorithm to encrypt the first key, and those skilled in the art can also use other similar algorithms in the prior art.
  • AES-CCM Advanced Encryption Standard-Counter with Cipher Block Chaining-Message Authentication Code
  • the device identification information is used to encrypt the first key, which can effectively ensure the security of the first key and improve the security of data encryption; at the same time, the device identification information is used to encrypt the first key. , Based on the uniqueness of the device identification information, the encryption security of the first key is greatly improved.
  • an embodiment of the present application also provides a key decryption method, which includes but is not limited to the following steps:
  • Step 201 Obtain an encryption key
  • Step 202 Obtain device identification information of the electronic device, and generate a second key according to the device identification information;
  • Step 203 Use the second key to decrypt the encryption key to obtain the first key.
  • the encryption key can be stored in advance through a storage medium, and the storage medium can be a hard disk, a USB flash drive, an optical disc, etc.
  • Step 202 and step 102 are the same operations, which will not be repeated here.
  • step 203 the encryption key is decrypted by using the second key, and the same algorithm as in the above-mentioned key encryption method embodiment, namely the AES-CCM algorithm is adopted. If another algorithm is used when the first key is encrypted, the same algorithm as that used for encryption should be used to decrypt the encryption key.
  • an embodiment of the present application also provides a data encryption method. As shown in Figure 4, the method includes but is not limited to the following steps:
  • Step 301 Obtain original data
  • Step 302 Obtain a first key, and use the first key to encrypt the original data to generate encrypted data;
  • Step 303 Obtain device identification information of the electronic device, and generate a second key according to the device identification information;
  • Step 304 Use the second key to encrypt the first key to generate an encryption key.
  • the original data is the data that the user needs to encrypt, which can involve identity information, confidential information, and personal privacy.
  • the electronic device is a wireless base station device
  • the original data can be the digital certificate private key, the account and password for communication between the base station and the network management, etc.
  • the electronic device is a mobile phone or PC
  • the original data can be the user's photo, various account passwords, etc. , Confidential documents, etc.
  • the electronic device is a set-top box, the original data can be the user’s viewing records, account passwords, etc.
  • the original data can be obtained based on the encryption request.
  • the encryption request may be generated by an application program running on the electronic device, and the application program may be a traditional application program that needs to be installed to be used, or it may be a small program that can be used without downloading and installing.
  • the application program when the application program newly generates original data, it can identify whether the newly generated original data needs to be encrypted according to its pre-configured encryption rules, and if necessary, generate an encryption request to obtain the original data.
  • the application can also identify the original data that needs to be encrypted according to its pre-configured encryption rules, and generate an encryption request to obtain the original data.
  • the application program receives an instruction from the user to request encryption of the original data, and generates an encryption request to obtain the original data.
  • obtaining the first key is specifically: generating a random character string, and using the random character string as the first key .
  • the combination of strings can be numbers, letters or a combination of numbers and letters; to generate a random string, the random number algorithm in the prior art can be used, and at the same time, the random string generated this time can be compared with the previous one. The generated random character strings are compared, and if they are repeated, the random character string generated this time can be discarded, and the random character string can be generated again. In this way, it is possible to make the generated and retained random string unique.
  • the original data can be encrypted by an encryption algorithm in the prior art, such as the AES-CCM algorithm.
  • the AES-CCM algorithm is an encryption algorithm well known to those skilled in the art, and will not be repeated here. It is understandable that this embodiment is not limited to using the AES-CCM algorithm to encrypt the original data.
  • those skilled in the art can also use other encryption algorithms in the prior art to encrypt the original data. Encrypted.
  • obtaining the first key may also be: obtaining a character string configured by the user, and using the character string configured by the user as the first key.
  • the character string configured by the user is a character string set by the user through the input device. Users can freely set the first key according to their own hobbies or needs.
  • the combination of character strings can be numbers, letters, or a combination of numbers and letters. After a random character string is obtained, the original data can be encrypted using the AES-CCM algorithm.
  • obtaining the first key may also be: connecting to a server, obtaining a character string dynamically generated by the server, and using the character string dynamically generated by the server as the first key.
  • the server dynamically generates a character string, which can adopt one or more combination methods such as a dynamic password card, a dynamic port token, a mobile phone dynamic password, or a DHCP (Dynamic Host Configuration Protocol, dynamic host configuration) protocol.
  • the combination of character strings can be numbers, letters, or a combination of numbers and letters.
  • the original data can be encrypted using the AES-CCM algorithm.
  • the method of obtaining the first key in the foregoing embodiment is also applicable to the embodiments of the key encryption method and the key decryption method.
  • the device identification information in this embodiment is consistent with the device identification information in the above-mentioned key encryption method embodiment, and is used to identify a specific device. It may include software device identification information and hardware device identification information, and is unique.
  • the device identification information is hardware device identification information, which can be one or more combinations of CPU serial number, single board barcode, Ethernet port MAC address, etc., CPU serial number, single board barcode, Ethernet
  • the MAC address of the network port has been described in detail in the above embodiment of the key encryption method, and will not be repeated here.
  • generating the second key according to the device identification information includes but not limited to the following steps:
  • Step 401 According to the device identification information, generate a third key after one or more iterations;
  • Step 402 According to the third key, the second key is generated after one or more iterations.
  • the SHA-256 (Secure Hash Algorithm-256) algorithm in the prior art can be used to generate the second key and the third key.
  • the SHA-256 algorithm is a well-known algorithm to those skilled in the art. Convert messages of any length into shorter, fixed-length message digests, which will not be repeated here. It is understandable that this embodiment is not limited to using the SHA-256 algorithm to generate the second key or the third key, and those skilled in the art can also use other similar algorithms in the prior art.
  • the device identification information includes multiple types, it can be processed in one or more ways, such as simple combination, exclusive OR operation, etc., and then used as the input of the SHA-256 algorithm.
  • a random number is also introduced, which specifically includes but is not limited to the following step:
  • Step 501 Obtain a random number
  • Step 502 According to the third key and the random number, the second key is generated after one or more iterations.
  • a random number algorithm in the prior art can be used to obtain a random number, which will not be repeated here.
  • the second key is generated after one or more iterations according to the third key and the random number, that is, the third key and the random number are used as the input of the SHA-256 algorithm at the same time,
  • the third key and the random number can be processed by one or more methods such as simple combination and exclusive OR operation.
  • the complexity of the second key can be increased, and the security of the encryption of the first key can be improved.
  • the random number After the random number is obtained, it can be stored in a storage medium for use in the subsequent decryption process.
  • the storage medium can be a hard disk, a USB flash drive, an optical disc, etc.
  • a data encryption method provided by the present application may further include the following steps:
  • Step 601 Perform one-way hash processing on the original data to generate corresponding first hash message verification data
  • Step 602 Use the first key to encrypt the first hash message verification data to generate encrypted hash message verification data.
  • the one-way hash processing can be implemented by using the SHA-256 algorithm in the prior art, and the first key is used to encrypt the first hash message verification data, and the AES in the prior art can be used. -CCM algorithm implementation.
  • one-way hash processing is performed on the original data to generate the corresponding first hash message verification data. The purpose is to facilitate the verification of the decrypted original data during the decryption process to verify the original data. Whether it has been tampered with to improve security.
  • Fig. 8 is a flowchart of a data decryption method in an embodiment of the application. As shown in FIG. 8, corresponding to the data encryption method of the foregoing embodiment, the data decryption method includes but is not limited to the following steps:
  • Step 701 Obtain encrypted data and encryption key
  • Step 702 Obtain device identification information of the electronic device, and generate a second key according to the device identification information;
  • Step 703 Use the second key to decrypt the encryption key to obtain the first key
  • Step 704 Use the first key to decrypt the encrypted data to obtain original data.
  • the encrypted data is obtained by encrypting the original data through the above data encryption method
  • the encryption key is obtained by encrypting the first key through the data encryption method in the above embodiment.
  • the encrypted data and the encryption key can be stored in a storage medium in advance, and the storage medium can be a hard disk, a USB flash drive, an optical disc, and the like.
  • step 702 the device identification information of the electronic device is consistent with the key encryption method in the foregoing embodiment, and will not be repeated here.
  • the hardware device identification information can be read by software.
  • This method is suitable for decrypting the original data on the original electronic device; or, the hardware device identification information can be input by the user himself, and the user can advance Write down the hardware device identification information of the original electronic device.
  • the user can decrypt the original data on another electronic device, as long as an interface is provided for the user to input the hardware device identification information of the original electronic device.
  • the original data is decrypted on the device.
  • the first key is used to encrypt the original data, by generating a random character string and using the random character string as the first key; or by obtaining a character string configured by the user, using the character configured by the user
  • the string is used as the first key; or the server is connected to obtain the string dynamically generated by the server, and the string dynamically generated by the server is used as the first key.
  • the algorithm adopted corresponds to the above data encryption method embodiment, that is, the AES-CCM algorithm is adopted .
  • the same algorithm should be used when decrypting the encrypted data or the encryption key.
  • the third key may be generated after one or more iterations based on the device identification information; Or generate the second key multiple times.
  • the SHA-256 algorithm in the prior art can be used to generate the second key and the third key. If another algorithm is used to generate the third key and the second key when the original data is encrypted, the same algorithm as that used for encryption is used to generate the third key and the second key when decrypting the encrypted data.
  • the corresponding random number needs to be obtained first.
  • the random number is stored locally, and the random number is obtained locally when the original data is decrypted; or, when the original data is encrypted, the random number is stored in the For a removable storage medium (such as a USB flash drive, etc.), when decrypting the original data, the removable storage medium is read first, and then a random number is obtained from the removable storage medium; or, when the original data is encrypted,
  • a removable storage medium such as a USB flash drive, etc.
  • Step 801 Obtain encrypted hash message verification data
  • Step 802 Use the first key to decrypt the encrypted hash message verification data to obtain the first hash message verification data
  • Step 803 Perform one-way hash processing on the original data obtained after decryption to generate corresponding second hash message verification data
  • Step 804 Verify the first hash message verification data and the second hash message verification data, and determine the integrity of the original data obtained after decryption.
  • the encrypted hash message verification data can be stored in a storage medium in advance, and the storage medium can be a hard disk, a U disk, an optical disk, and the like.
  • step 802 the encrypted hash message verification data is decrypted by using the first key.
  • the encrypted hash message verification data is decrypted by using the first key.
  • it can be implemented by using the AES-CCM algorithm in the prior art.
  • step 803 one-way hash processing is performed on the original data obtained after decryption, which corresponds to the foregoing embodiment of the data encryption method, and is consistent with the algorithm used to generate the first hash message verification data.
  • the existing technology can be used Implementation of the SHA-256 algorithm.
  • step 804 after verifying the first hash message verification data and the second hash message verification data, if it is determined that the original data obtained by decryption has been tampered with, the original data may be discarded, or Alert the user; if the decrypted original data is determined, the decrypted original data can be submitted to the user for use, thereby improving security.
  • the verification methods of the first hash message verification data and the second hash message verification data are in the prior art, and will not be repeated here.
  • the application scenario is multiple base stations.
  • Each base station is equipped with a corresponding wireless base station management computer.
  • Each management computer stores the account and password for communication between the base station and the network management. Once the management password is cracked, the account and password for the communication between the base station and the network management will be changed. Is leaked; sometimes even for ease of management, the management keys of these base stations are set to the same, so once the management key of one of the base stations is leaked, all the accounts and passwords for communication between these base stations and the network management will be leaked, which is safe Sex is not high.
  • the data encryption method of this application can greatly improve the security. First use the first key to encrypt the account and password for communication between the base station and the network management, and then generate the corresponding third key according to one or more of the management computer’s CPU serial number, single board barcode, or Ethernet port MAC address. Then generate a second key according to the third key, and use the second key to encrypt the first key.
  • the second key is generated by the identification information of the hardware device of the management computer Therefore, it is unique and the cost of being cracked is high, and even if it is cracked, based on the uniqueness of the second key, it will not affect other base stations, thereby greatly improving the security of data encryption.
  • the device identification information is then used to encrypt the first key, which can effectively ensure the security of the first key and improve the data Encryption security; at the same time, the device identification information is used to encrypt the first key.
  • the uniqueness of the device identification information "one station, one secret" can be realized, which greatly improves the encryption security of the first key.
  • FIG. 10 shows an electronic device 100 provided by an embodiment of the present application.
  • the electronic device 100 includes: a memory 102, a processor 101, and a computer program stored on the memory 102 and running on the processor 101.
  • the computer program is used to execute the above-mentioned key encryption method or execute the above-mentioned key decryption when the computer program is running. Method, or execute the above-mentioned data encryption method, or execute the above-mentioned data decryption method.
  • the processor 101 and the memory 102 may be connected by a bus or in other ways.
  • the memory 102 can be used to store non-transitory software programs and non-transitory computer-executable programs, such as the key encryption method, key decryption method, and data described in the embodiments of this application. Encryption method or data decryption method.
  • the processor 101 implements the aforementioned key encryption method, key decryption method, data encryption method, or data decryption method by running non-transitory software programs and instructions stored in the memory 102.
  • the memory 102 may include a storage program area and a storage data area.
  • the storage program area may store an operating system and an application program required by at least one function; the storage data area may store and execute the above-mentioned key encryption method, key decryption method, and data. Encryption method or data decryption method.
  • the memory 102 may include a high-speed random access memory 102, and may also include a non-transitory memory 102, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state storage devices.
  • the memory 102 includes a memory 102 remotely provided with respect to the processor 101, and these remote memories 102 may be connected to the electronic device 100 via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
  • the non-transitory software programs and instructions required to implement the above-mentioned key encryption method, key decryption method, data encryption method or data decryption method are stored in the memory 102, and when executed by one or more processors 101, the above
  • the key encryption method, key decryption method, data encryption method or data decryption method for example, execute the method steps 101 to 103 described in Figure 2, the method steps 201 to 203 described in Figure 3, and the method described in Figure 4 Steps 301 to 304, method steps 401 to 402 described in FIG. 5, method steps 501 to 502 described in FIG. 6, method steps 601 to 602 described in FIG. 7, method steps 701 to 704 described in FIG. Steps 801 to 804 of the method described in 9.
  • the embodiments of the present application also provide a computer-readable storage medium that stores computer-executable instructions, and the computer-executable instructions are used to execute the above-mentioned key encryption method, key decryption method, data encryption method, or data decryption method.
  • the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are executed by one or more control processors 101, for example, executed by one processor 101 in the aforementioned electronic device 100,
  • the above-mentioned one or more processors 101 can be caused to execute the above-mentioned key encryption method, key decryption method, data encryption method or data decryption method, for example, execute the method steps 101 to 103 described in FIG. 2 and the steps described in FIG. 3
  • the embodiment of the present application includes: obtaining a first key and device identification information of an electronic device, generating a second key according to the device identification information, and encrypting the first key by using the second key, Generate an encryption key.
  • the first key is encrypted by using the device identification information, which can effectively ensure the security of the first key and improve the security of data encryption; at the same time, the device identification information is used to encrypt the first key.
  • the key is encrypted, and based on the uniqueness of the device identification information, the encryption security of the first key is greatly improved.
  • the device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • a person of ordinary skill in the art can understand that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and appropriate combinations thereof. Some physical components or all physical components can be implemented as software executed by the processor 101, such as a central processing unit, a digital signal processor, or a microprocessor, or as hardware, or as an integrated circuit, such as a dedicated integrated circuit. Circuit. Such software may be distributed on a computer-readable medium, and the computer-readable medium may include a computer storage medium (or non-transitory medium) and a communication medium (or transitory medium).
  • computer storage medium includes volatile and non-volatile data implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data).
  • Information such as computer-readable instructions, data structures, program modules, or other data.
  • Computer storage media include but are not limited to RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or Any other medium used to store desired information and that can be accessed by a computer.
  • communication media usually include computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as carrier waves or other transmission mechanisms, and may include any information delivery media. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

一种密钥加密方法、解密方法及数据加密方法、解密方法。其中，所述密钥加密方法包括获取第一密钥(101)和所述电子设备的设备识别信息，根据所述设备识别信息生成第二密钥(102)，利用所述第二密钥对所述第一密钥进行加密，生成加密密钥(103)。

Description

密钥加密方法、解密方法及数据加密方法、解密方法
相关申请的交叉引用
本申请基于申请号为201911266698.0、申请日为2019年12月11日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本申请涉及加密技术领域，特别是涉及一种密钥加密方法、解密方法及数据加密方法、解密方法。
背景技术
随着互联网和移动网络的快速发展，各种网络安全问题随之出现，网络安全越来越成为人们关注的焦点之一。网络安全发展至今，有比较成熟的框架和理论，涉及的场景和方法也非常多，如密码学、基础设施安全、接入控制、鉴权管理、传输安全、敏感数据保护等。假如涉及身份信息、机密信息以及个人隐私等的重要数据被泄露，将对用户的资产和安全等造成极大的威胁。对于这些重要数据的保护方式，常见的就是利用密钥对这些数据进行加密。然而，现有的加密方式中，由于密钥大多数由用户管理，一旦密钥泄露，攻击者就可能很容易将重要数据解密，因此现有的加密方式安全性仍有待提高。
发明内容
以下是对本申请的主题的概述。本概述并非是为了限制权利要求的保护范围。
一方面，本申请实施例提供了一种密钥加密方法、解密方法及数据加密方法、解密方法,能够提升数据加密的安全性。
另一方面，本申请实施例还提供了一种密钥加密方法，应用于电子设备，包括：获取第一密钥；获取所述电子设备的设备识别信息，根据所述设备识别信息生成第二密钥；利用所述第二密钥对所述第一密钥进行加密，生成加密密钥。
另一方面，本申请实施例还提供了一种密钥解密方法，应用于电子设备，包括：获取加密密钥；获取所述电子设备的设备识别信息，根据所述设备识别信息生成第二密钥；利用所述第二密钥对所述加密密钥进行解密，得到第一密钥。
另一方面，本申请实施例提供了一种数据加密方法，应用于电子设备，包括：获取原始数据；获取第一密钥，利用所述第一密钥对所述原始数据进行加密，生成加密数据；获取所述电子设备的设备识别信息，根据所述设备识别信息生成第二密钥；利用所述第二密钥对所述第一密钥进行加密，生成加密密钥。
另一方面，本申请实施例还提供了一种数据解密方法，应用于电子设备，包括：获取加密数据和加密密钥；获取所述电子设备的设备识别信息，根据所述设备识别信息生成第 二密钥；利用所述第二密钥对所述加密密钥进行解密，得到第一密钥；利用所述第一密钥对所述加密数据进行解密，得到原始数据。
另一方面，本申请实施例还提供了一种电子设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述计算机程序运行时执行上述的密钥加密方法、或者执行上述的密钥解密方法、或者执行上述的数据加密方法、或者执行上述的数据解密方法。
再一方面，本申请实施例还提供了一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行上述的密钥加密方法、或者执行上述的密钥解密方法、或者执行上述的数据加密方法、或者执行上述的数据解密方法。
本申请的其他特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本申请而了解。本申请的目的和其他优点可通过在说明书、权利要求书以及附图中所特别指出的结构来实现和获得。
附图说明
附图用来提供对本申请技术方案的进一步理解，并且构成说明书的一部分，与本申请的实施例一起用于解释本申请的技术方案，并不构成对本申请技术方案的限制。
图1是适用本申请实施例提供的一种数据加密系统的结构框图；
图2是本申请实施例提供的一种密钥加密方法的流程图；
图3是本申请实施例提供的一种密钥解密方法的流程图；
图4是本申请实施例提供的一种数据加密方法的流程图；
图5是本申请实施例提供的一种数据加密方法中，根据所述设备识别信息生成第二密钥的流程图；
图6是本申请实施例提供的一种数据加密方法中，根据所述第三密钥，经过一次或者多次迭代生成所述第二密钥的流程图；
图7是本申请实施例提供的一种数据加密方法中对原始数据进行单向哈希处理的流程图；
图8是本申请实施例提供的一种数据解密方法的流程图；
图9是本申请实施例提供的一种数据解密方法中，对解密得到的原始数据进行哈希校验的流程图；
图10是本申请实施例提供的一种电子设备的结构示意图。
具体实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处所描述的具体实施例仅用以解释本申请，并不用于限定本申请。
应了解，在本申请实施例的描述中，多个(或多项)的含义是两个以上，大于、小于、 超过等理解为不包括本数，以上、以下、以内等理解为包括本数。如果有描述到“第一”、“第二”等只是用于区分技术特征为目的，而不能理解为指示或暗示相对重要性或者隐含指明所指示的技术特征的数量或者隐含指明所指示的技术特征的先后关系。
随着互联网和移动网络的快速发展，各种网络安全问题随之出现，网络安全越来越成为人们关注的焦点之一。网络安全发展至今，有比较成熟的框架和理论，涉及的场景和方法也非常多，如密码学，基础设施安全，接入控制，鉴权管理，传输安全，敏感数据保护等。假如涉及身份信息、机密信息以及个人隐私等的重要数据被泄露，将对用户的资产和安全等造成极大的威胁。对于这些重要数据的保护方式，常见的就是利用密钥对这些数据进行加密。然而，现有的加密方式中，由于密钥大多数由用户管理，一旦密钥泄露，攻击者就可能很容易将重要数据解密，因此现有的加密方式安全性仍有待提高。
本申请实施例提供一种数据加密方法、解密方法及密钥加密方法、解密方法。该数据加密方法、解密方法及密钥加密方法、解密方法应用于电子设备中。
其中，电子设备为可以安装各种通信应用，或具有通信功能的设备。例如，智能手机、平板电脑、PC机(Personal Computer，个人电脑)、各类可穿戴设备(耳机、手表等)、车载设备、电视机顶盒、无线基站设备、虚拟化数据设备等。
执行本申请实施例提供一种数据加密方法、解密方法及密钥加密方法、解密方法的数据加密系统安装于上述电子设备中。参照图1，为本申请实施例中数据加密系统的一种结构框图。其中：
第一密钥获取模块111用于生成第一密钥；
数据加密模块112用于利用第一密钥将原始数据加密；
第三密钥生成模块113用于根据设备识别信息生成第三密钥；
第二密钥生成模块114用于根据第三密钥生成第二密钥；
密钥加密模块115用于利用第二密钥将第一密钥进行加密以及生成随机数；
密钥解密模块116用于利用第二密钥将第一密钥进行解密；
数据解密模块117用于利用第一密钥将原始数据解密；
存储模块118用于存储加密数据、加密密钥和随机数等；其中存储模块118可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件或其他易失性固态存储器件，又或者是在某些芯片内部的安全存储区域。
应当理解，图1中示出的数据加密系统的结构并不构成对数据加密系统的限定，本申请实施例提供的数据加密系统可以包括比图示更多或更少的模块，或者组合某些模块，或者不同的模块布置。
图2为本申请实施例的一种密钥加密方法的流程图。如图2所示，该方法应用于电子设备，包括但不限于以下步骤：
步骤101：获取第一密钥；
步骤102：获取所述电子设备的设备识别信息，根据所述设备识别信息生成第二密钥；
步骤103：利用所述第二密钥对所述第一密钥进行加密，生成加密密钥。
其中，第一密钥用于对原始数据进行加密，第一密钥可以预先通过存储介质储存起来，所述的存储介质可以是硬盘、U盘、光碟等。
具体地，设备识别信息用于识别具体的设备，具有唯一性。其中，设备识别信息可以包括软件设备识别信息和硬件设备识别信息。软件设备识别信息可以是主机名、IP地址等一种或者多种组合，例如，在局域网设备群中，单独的每一台主机都有对应的主机名和IP地址，通过主机名或者IP地址可以迅速地确定某一台主机。而硬件设备识别信息可以是CPU(Central Processing Unit，中央处理器)序列号、单板条形码、以太网口MAC(Media Access Control，媒体存取控制)地址等一种或者多种组合，其中，每个CPU都有一个唯一的CPU序列号，CPU序列号是在CPU制造的过程中生产厂家置入到CPU中的，并且，CPU序列号是终生不变的，可以利用软件进行读取；单板条形码包括BOM(Byte Order Mark，字节顺序标记)编码、出厂信息、单板版本、单板名称以及单板特性码等单板基本信息，可以通过软件进行读取，每块单板唯一；以太网口MAC地址，即物理地址，用于在网络中唯一标示一个网卡，同样每台设备的以太网口MAC地址都是唯一的，可以通过软件进行读取。具体地，步骤102中的获取所述的硬件设备识别信息，可以通过读取所述电子设备的硬件运行信息实现，读取电子设备的硬件运行信息的软件为现有技术，在此不再赘述。可以理解的是，本实施例并不将硬件设备识别信息限定为CPU序列号、单板条形码和以太网口MAC地址，本领域技术人员可以在理解本申请的基础上选择其他相类似的硬件设备识别信息。
获取了电子设备的硬件设备识别信息后，再根据所述硬件设备识别信息生成第二密钥。由于硬件设备识别信息对应每台电子设备，并且具有唯一性，因此每台设备所生成的第二密钥均具有对应性和唯一性，使得第一密钥的加密安全性大大提高。利用第二密钥对第一密钥进行加密，可以采用现有技术中的AES-CCM(Advanced Encryption Standard-Counter with Cipher Block Chaining-Message Authentication Code)算法实现。本实施例中并非限定于采用AES-CCM算法对第一密钥进行加密，本领域技术人员还可以采用其他现有技术中相类似的算法。
在本实施例中，利用设备识别信息对第一密钥进行加密，可以有效地保证第一密钥的安全，提高了数据加密的安全性；同时，利用设备识别信息对第一密钥进行加密，基于设备识别信息的唯一性，使得第一密钥的加密安全性大大提高。
对应上述实施例中的密钥加密方法，参照图3，本申请实施例还提供了一种密钥解密方法，该方法包括但不限于以下步骤：
步骤201：获取加密密钥；
步骤202：获取所述电子设备的设备识别信息，根据所述设备识别信息生成第二密钥；
步骤203：利用所述第二密钥对所述加密密钥进行解密，得到第一密钥。
其中，加密密钥可以预先通过存储介质储存起来，所述的存储介质可以是硬盘、U盘、光碟等。
步骤202与步骤102为相同的操作，在此不再赘述。
在步骤203中，利用第二密钥对所述加密密钥进行解密，采用与上述密钥加密方法实施例中相同的算法，即AES-CCM算法实现。若在第一密钥加密时采用了另外一种算法，则对加密密钥解密时要采用与加密时相同的算法实现。
基于上述实施例中的密钥加密方法，本申请实施例还提供了一种数据加密方法。如图4所示，该方法包括但不限于以下步骤：
步骤301：获取原始数据；
步骤302：获取第一密钥，利用所述第一密钥对所述原始数据进行加密，生成加密数据；
步骤303：获取所述电子设备的设备识别信息，根据所述设备识别信息生成第二密钥；
步骤304：利用所述第二密钥对所述第一密钥进行加密，生成加密密钥。
其中，原始数据即为用户需要加密的数据，可以涉及身份信息、机密信息以及个人隐私等。例如，若电子设备为无线基站设备时，原始数据可以是数字证书私钥，基站和网管通信的账号和密码等；若电子设备为手机或者PC，原始数据可以是用户的照片、各种账号密码、机密文档等；若电子设备为机顶盒，原始数据可以是用户的观看记录、账户密码等。
具体地，获取原始数据，可以基于加密请求后进行。其中，加密请求可以由电子设备运行的应用程序产生，该应用程序可以是需要安装才能使用的传统应用程序，也可以是不需要下载安装即可使用的小程序。其中，应用程序可以在新产生原始数据时，根据其预先配置的加密规则，识别新产生的原始数据是否需要加密，若需要，则产生加密请求，获取原始数据。此外，应用程序也可以根据其预先配置的加密规则，识别出需要加密的原始数据，并产生加密请求，获取原始数据。又或者，应用程序接收到用户的指令，要求对原始数据进行加密，则产生加密请求，获取原始数据。
在本申请的一个实施例中，为上述实施例的进一步说明，所述步骤102中，获取第一密钥，具体为：生成随机的字符串，以所述随机的字符串作为第一密钥。其中，字符串的组合可以是数字、字母或者是数字和字母的组合；生成随机的字符串，可以采用现有技术中的随机数算法，同时，还可以将本次生成的随机字符串与之前生成的各随机字符串进行对比，若重复，则可以将本次生成的随机字符串丢弃，并再次生成随机字符串。通过这种方式，可以使得对于生成并保留下来的随机字符串具有唯一性。
生成随机字符串后，可以通过现有技术中的加密算法对所述原始数据进行加密，例如AES-CCM算法等。其中，AES-CCM算法为本领域技术人员熟知的加密算法，在此不再赘述。可以理解的是，本实施例中并非限定于采用AES-CCM算法对原始数据进行加密，在获取到 随机的字符串后，本领域技术人员还可以采用其他现有技术中的加密算法对原始数据进行加密。
在一实施例中，所述步骤302中，获取第一密钥，还可以为：获取用户配置的字符串，以所述用户配置的字符串作为第一密钥。具体地，用户配置的字符串，即用户通过输入设备自行设置的字符串。用户可以通过自己的爱好或者需求自由设定第一密钥。同样地，字符串的组合可以是数字、字母或者是数字和字母的组合，在获取到随机字符串后，可以通过AES-CCM算法对所述原始数据进行加密。
在一实施例中，所述步骤302中，获取第一密钥，还可以为：连接服务器，获取由服务器动态生成的字符串，以所述服务器动态生成的字符串作为第一密钥。其中，服务器动态生成字符串，可以采用动态口令卡、动态口令牌、手机动态口令或者DHCP(Dynamic Host Configuration Protocol，动态主机配置)协议等一种或者多种组合的方式。同样地，字符串的组合可以是数字、字母或者是数字和字母的组合，在获取到随机字符串后，可以通过AES-CCM算法对所述原始数据进行加密。
可以理解的是，上述实施例获取第一密钥的方式同样适用于密钥加密方法和密钥解密方法的实施例。
本实施例中的设备识别信息与上述密钥加密方法实施例中的设备识别信息一致，用于识别具体的设备，可以包括软件设备识别信息和硬件设备识别信息，具有唯一性。在本实施例中，所述的设备识别信息为硬件设备识别信息，可以是CPU序列号、单板条形码、以太网口MAC地址等一种或者多种组合，CPU序列号、单板条形码、以太网口MAC地址在上述密钥加密方法的实施例中已经进行了详细说明，在此不再赘述。
具体地，参照图5，根据所述设备识别信息生成第二密钥，包括但不限于以下步骤：
步骤401：根据所述设备识别信息，经过一次或者多次迭代生成第三密钥；
步骤402：根据所述第三密钥，经过一次或者多次迭代生成所述第二密钥。
示例性地，生成第二密钥和第三密钥均可以采用现有技术中的SHA-256(Secure Hash Algorithm-256)算法，其中，SHA-256算法为本领域技术人员熟知的算法，可以把任意长度的消息转化为较短的、固定长度的消息摘要，在此不再赘述。可以理解的是，本实施例中并非限定于采用SHA-256算法生成第二密钥或者第三密钥，本领域技术人员还可以采用其他现有技术中相类似的算法。示例性地，当设备识别信息包括多种时，可以采用可以通过简单组合、异或运算等一种或者多种方式进行处理，再作为SHA-256算法的输入。先根据设备识别信息生成第三密钥，再利用第三密钥生成第二密钥，有利于提高第二密钥的复杂度，提高对第一密钥加密的安全性；而通过多次迭代生成第三密钥和第二密钥，同样可以起到提高第二密钥的复杂度，提高对第一密钥加密的安全性的效果。
可以理解的是，本实施例中根据设备识别信息生成第二密钥的具体步骤，同样可以应用于上述密钥加密方法和密钥解密方法的实施例中。
基于上述实施例，参照图6，在一实施例中，根据所述第三密钥，经过一次或者多次迭代生成所述第二密钥时，还引入了随机数，具体包括但不限于以下步骤：
步骤501：获取随机数；
步骤502：根据所述第三密钥和所述随机数，经过一次或者多次迭代生成所述第二密钥。
具体地，在步骤501中，获取随机数可以采用现有技术中的随机数算法，在此不再赘述。而在步骤502中，根据所述第三密钥和所述随机数，经过一次或者多次迭代生成所述第二密钥，即将第三密钥和随机数同时作为SHA-256算法的输入，示例性地，第三密钥和随机数可以通过简单组合、异或运算等一种或者多种方式进行输入前的处理。通过引入随机数，可以起到提高第二密钥的复杂度，提高对第一密钥加密的安全性的效果。随机数获取后，可以被存储介质储存起来，便于后续解密过程中使用，所述的存储介质可以是硬盘、U盘、光碟等。
可以理解的是，本实施例中引入随机数生成第二密钥的具体步骤，同样可以应用于上述密钥加密方法和密钥解密方法的实施例中。
参照图7，在一实施例中，本申请提供的一种数据加密方法还可以包括以下步骤：
步骤601：对所述原始数据进行单向哈希处理，生成对应的第一哈希消息校验数据；
步骤602：利用所述第一密钥，对所述第一哈希消息校验数据进行加密，生成加密哈希消息校验数据。
其中，单向哈希处理可以采用现有技术中的SHA-256算法实现，利用所述第一密钥，对所述第一哈希消息校验数据进行加密，可以采用现有技术中的AES-CCM算法实现。本实施例中对所述原始数据进行单向哈希处理，生成对应的第一哈希消息校验数据，目的是为了便于在解密过程中可以对解密后的原始数据进行校验，验证原始数据是否有被篡改，提高安全性。
图8为本申请实施例中的一种数据解密方法的流程图。如图8所示，对应上述实施例的数据加密方法，该数据解密方法包括但不限于以下步骤：
步骤701：获取加密数据和加密密钥；
步骤702：获取所述电子设备的设备识别信息，根据所述设备识别信息生成第二密钥；
步骤703：利用所述第二密钥对所述加密密钥进行解密，得到第一密钥；
步骤704：利用所述第一密钥对所述加密数据进行解密，得到原始数据。
其中，加密数据由原始数据经过上述数据加密方法加密后得到，加密密钥由第一密钥经过上述实施例中的数据加密方法加密后得到。加密数据和加密密钥可以预先被存储介质储存起来，所述的存储介质可以是硬盘、U盘、光碟等。
在步骤702中，电子设备的设备识别信息与上述实施例中密钥加密方法的一致，在此不再赘述。
其中，在本实施例中，硬件设备识别信息可以通过软件进行读取，这种方式适用于在原电子设备上进行原始数据的解密；又或者，硬件设备识别信息可以由用户自行输入，用户可以预先记下原电子设备的硬件设备识别信息，此时用户可以在另外的电子设备上进行原始数据的解密，只要提供一个界面给用户输入原电子设备的硬件设备识别信息即可，适用于在其他电子设备上进行原始数据的解密。
同样地，第一密钥用于加密原始数据，可以通过生成随机的字符串，以所述随机的字符串作为第一密钥；或者通过获取用户配置的字符串，以所述用户配置的字符串作为第一密钥；又或者连接服务器，获取由服务器动态生成的字符串，以所述服务器动态生成的字符串作为第一密钥。
利用所述第二密钥对所述加密密钥进行解密以及利用所述第一密钥对所述加密数据进行解密，采用的算法与上述数据加密方法实施例相对应，即采用AES-CCM算法。同样地，若进行原始数据加密或者第一密钥加密时采用了另外一种算法，则对加密数据解密或者加密密钥解密时要采用与加密时相同的算法。
在一实施例中，据所述设备识别信息生成第二密钥，可以先根据所述设备识别信息，经过一次或者多次迭代生成第三密钥；再根据所述第三密钥，经过一次或者多次迭代生成所述第二密钥。与上述数据加密方法实施例对应，生成第二密钥和第三密钥均可以采用现有技术中的SHA-256算法。若在原始数据加密时采用了另外一种算法生成第三密钥和第二密钥，则对加密数据解密时要采用与加密时相同的算法生成第三密钥和第二密钥。
在上述数据加密方法的实施例中，若引入了随机数生成第二密钥，则在一实施例中，生成第二密钥时，需要先获取对应的随机数。具体可以有以下几种情况：在对原始数据加密时，随机数被储存在本地，则在对原始数据解密时从本地获取随机数；或者，在对原始数据加密时，随机数被储存在可移动的存储介质(例如U盘等)，则在对原始数据解密时，先读取可移动的存储介质，再从该可移动的存储介质获取随机数；又或者，在对原始数据加密时，用户以另外的方式记下随机数，则在对原始数据解密时，先提供输入界面供用户输入，再获取随机数。获取随机数后，再根据所述第三密钥和所述随机数，经过一次或者多次迭代生成所述第二密钥。同样地，可以采用现有技术中的SHA-256算法实现。
参照图9，在上述数据加密方法的实施例中，若对原始数据进行了单向哈希处理，则在一实施例中，对加密数据进行解密时，还可以包括以下步骤：
步骤801：获取加密哈希消息校验数据；
步骤802：利用所述第一密钥对所述加密哈希消息校验数据进行解密，得到第一哈希消息校验数据；
步骤803：对解密后得到的原始数据进行单向哈希处理，生成对应的第二哈希消息校验数据；
步骤804：校验所述第一哈希消息校验数据和第二哈希消息校验数据，判断解密后得 到的原始数据的完整性。
其中，加密哈希消息校验数据可以预先被存储介质储存起来，所述的存储介质可以是硬盘、U盘、光碟等。
在步骤802中，利用第一密钥对加密哈希消息校验数据进行解密，与上述数据加密方法实施例对应，可以采用现有技术中的AES-CCM算法实现。
在步骤803中，对解密后得到的原始数据进行单向哈希处理，与上述数据加密方法实施例对应，与生成第一哈希消息校验数据所采用的算法一致，可以采用现有技术中的SHA-256算法实现。
在步骤804中，若校验所述第一哈希消息校验数据和第二哈希消息校验数据后，若判断出解密得到的原始数据被篡改过，则可以选择丢弃该原始数据，或者向用户进行告警；若判断出解密得到的原始数据，则可以将解密后的原始数据提交用户使用，从而提高安全性。第一哈希消息校验数据和第二哈希消息校验数据的校验方式为现有技术，在此不再赘述。
下面以一个实际例子对本申请的数据加密方法作示例性说明。
应用场景为多个基站，每个基站设置有对应的无线基站管理电脑，每台管理电脑储存了基站和网管通信的账号和密码，一旦管理密码被破解，基站和网管通信的账号和密码则会被泄露；甚至有时为了便于管理，这批基站的管理密钥均设置成一样，因此一旦其中一个基站的管理密钥被泄露，这批基站和网管通信的账号和密码则会全部被泄露，安全性不高。
针对上述问题，采用本申请的数据加密方法即可大大提高安全性。首先利用第一密钥对基站和网管通信的账号和密码进行加密，然后根据管理电脑的CPU序列号、单板条形码或者以太网口MAC地址中一种或者多种生成对应的第三密钥，再根据第三密钥生成第二密钥，利用第二密钥对第一密钥进行加密。因此，即使第一密钥被泄露了，也是处于被第二密钥加密的状态，攻击者需要进行解密才能得到第一密钥；同时，第二密钥是通过管理电脑的硬件设备识别信息生成的，因此具有唯一性，被破解的成本高，并且即便被破解，基于第二密钥的唯一性，也不会对其他基站造成影响，从而大大提高了数据加密的安全性。
解密时，先利用加密时采用的相同算法生成第二密钥，利用第二密钥，采用与加密时相同算法解密出第一密钥，再利用第一密钥，采用与加密时相同算法即可解密出基站和网管通信的账号和密码。
基于上述例子，通过本申请的数据加密方法，利用第一密钥对原始数据加密后，再利用设备识别信息对第一密钥进行加密，可以有效地保证第一密钥的安全，提高了数据加密的安全性；同时，利用设备识别信息对第一密钥进行加密，基于设备识别信息的唯一性，可以实现“一站一密”，使得第一密钥的加密安全性大大提高。
还应了解，本申请实施例提供的方法的各种实施方式可以任意进行组合，以实现不同 的技术效果。
图10示出了本申请实施例提供的电子设备100。电子设备100包括：存储器102、处理器101及存储在存储器102上并可在处理器101上运行的计算机程序，计算机程序运行时用于执行上述的密钥加密方法，或者执行上述的密钥解密方法，或者执行上述的数据加密方法，或者执行上述的数据解密方法。
处理器101和存储器102可以通过总线或者其他方式连接。
存储器102作为一种非暂态计算机可读存储介质，可用于存储非暂态软件程序以及非暂态性计算机可执行程序，如本申请实施例描述的密钥加密方法、密钥解密方法、数据加密方法或者数据解密方法。处理器101通过运行存储在存储器102中的非暂态软件程序以及指令，从而实现上述的密钥加密方法、密钥解密方法、数据加密方法或者数据解密方法。
存储器102可以包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需要的应用程序；存储数据区可存储执行上述的密钥加密方法、密钥解密方法、数据加密方法或者数据解密方法。此外，存储器102可以包括高速随机存取存储器102，还可以包括非暂态存储器102，例如至少一个磁盘存储器件、闪存器件或其他非暂态固态存储器件。在一些实施方式中，存储器102包括相对于处理器101远程设置的存储器102，这些远程存储器102可以通过网络连接至该电子设备100。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
实现上述的密钥加密方法、密钥解密方法、数据加密方法或者数据解密方法所需的非暂态软件程序以及指令存储在存储器102中，当被一个或者多个处理器101执行时，执行上述的密钥加密方法、密钥解密方法、数据加密方法或者数据解密方法，例如，执行图2中描述的方法步骤101至103、图3中描述的方法步骤201至203、图4中描述的方法步骤301至304、图5中描述的方法步骤401至402、图6中描述的方法步骤501至502、图7中描述的方法步骤601至602、图8中描述的方法步骤701至704、图9中描述的方法步骤801至804。
本申请实施例还提供了计算机可读存储介质，存储有计算机可执行指令，计算机可执行指令用于执行上述的密钥加密方法、密钥解密方法、数据加密方法或者数据解密方法。
在一实施例中，该计算机可读存储介质存储有计算机可执行指令，该计算机可执行指令被一个或多个控制处理器101执行，例如，被上述电子设备100中的一个处理器101执行，可使得上述一个或多个处理器101执行上述的密钥加密方法、密钥解密方法、数据加密方法或者数据解密方法，例如，执行图2中描述的方法步骤101至103、图3中描述的方法步骤201至203、图4中描述的方法步骤301至304、图5中描述的方法步骤401至402、图6中描述的方法步骤501至502、图7中描述的方法步骤601至602、图8中描述的方法步骤701至704、图9中描述的方法步骤801至804。
本申请实施例包括：获取第一密钥和电子设备的设备识别信息，再根据所述设备识别 信息生成第二密钥，并利用所述第二密钥对所述第一密钥进行加密，生成加密密钥。基于本申请实施例的技术方案，利用设备识别信息对第一密钥进行加密，可以有效地保证第一密钥的安全，提高了数据加密的安全性；同时，利用设备识别信息对第一密钥进行加密，基于设备识别信息的唯一性，使得第一密钥的加密安全性大大提高。
以上所描述的装置实施例仅仅是示意性的，其中作为分离部件说明的单元可以是或者也可以不是物理上分开的，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。
本领域普通技术人员可以理解，上文中所公开方法中的全部或某些步骤、系统可以被实施为软件、固件、硬件及其适当的组合。某些物理组件或所有物理组件可以被实施为由处理器101，如中央处理器、数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在计算机可读介质上，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM、ROM、EEPROM、闪存或其他存储器技术、CD-ROM、数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。此外，本领域普通技术人员公知的是，通信介质通常包括计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。
以上是对本申请的较佳实施进行了具体说明，但本申请并不局限于上述实施方式，熟悉本领域的技术人员在不违背本申请精神的共享条件下还可作出种种等同的变形或替换，这些等同的变形或替换均包括在本申请权利要求所限定的范围内。

Claims (18)

  1. 一种密钥加密方法，应用于电子设备，包括：
    获取第一密钥；
    获取所述电子设备的设备识别信息，根据所述设备识别信息生成第二密钥；
    利用所述第二密钥对所述第一密钥进行加密，生成加密密钥。
  2. 根据权利要求1所述的密钥加密方法，其中，所述设备识别信息包括硬件设备识别信息，所述获取所述电子设备的设备识别信息，包括：
    读取所述电子设备的硬件运行信息，获取所述的硬件设备识别信息。
  3. 根据权利要求2所述的密钥加密方法，其中，所述硬件设备识别信息包括以下至少之一：
    中央处理器CPU序列号；
    单板条形码；
    以太网口媒体存取控制MAC地址。
  4. 根据权利要求1所述的密钥加密方法，其中，所述获取第一密钥，包括以下步骤之一：
    生成随机的字符串，以所述随机的字符串作为第一密钥；
    获取用户配置的字符串，以所述用户配置的字符串作为第一密钥；
    连接服务器，获取由服务器动态生成的字符串，以所述服务器动态生成的字符串作为第一密钥。
  5. 根据权利要求1至4任意一项所述的密钥加密方法，其中，所述的根据所述设备识别信息生成第二密钥，包括以下步骤：
    根据所述设备识别信息，经过一次或者多次迭代生成第三密钥；
    根据所述第三密钥，经过一次或者多次迭代生成所述第二密钥。
  6. 根据权利要求5所述的密钥加密方法，其中，所述的根据所述第三密钥，经过一次或者多次迭代生成所述第二密钥，包括以下步骤：
    获取随机数；
    根据所述第三密钥和所述随机数，经过一次或者多次迭代生成所述第二密钥。
  7. 一种密钥解密方法，应用于电子设备，包括：
    获取加密密钥；
    获取所述电子设备的设备识别信息，根据所述设备识别信息生成第二密钥；
    利用所述第二密钥对所述加密密钥进行解密，得到第一密钥。
  8. 根据权利要求7所述的密钥解密方法，其中，所述设备识别信息包括硬件设备识别信息，所述获取所述电子设备的设备识别信息，包括：
    读取所述电子设备的硬件运行信息，获取所述的硬件设备识别信息。
  9. 根据权利要求8所述的密钥解密方法，其中，所述硬件设备识别信息包括以下至少之一：
    中央处理器CPU序列号；
    单板条形码；
    以太网口媒体存取控制MAC地址。
  10. 根据权利要求9所述的密钥解密方法，其中，所述第一密钥通过以下步骤之一获取：
    生成随机的字符串，以所述随机的字符串作为第一密钥；
    获取用户配置的字符串，以所述用户配置的字符串作为第一密钥；
    连接服务器，获取由服务器动态生成的字符串，以所述服务器动态生成的字符串作为第一密钥。
  11. 根据权利要求7至10任意一项所述的密钥解密方法，其中，所述的根据所述设备识别信息生成第二密钥，包括以下步骤：
    根据所述设备识别信息，经过一次或者多次迭代生成第三密钥；
    根据所述第三密钥，经过一次或者多次迭代生成所述第二密钥。
  12. 根据权利要求11所述的密钥解密方法，其中，所述的根据所述第三密钥，经过一次或者多次迭代生成所述第二密钥，包括以下步骤：
    获取随机数；
    根据所述第三密钥和所述随机数，经过一次或者多次迭代生成所述第二密钥。
  13. 一种数据加密方法，应用于电子设备，包括：
    获取原始数据；
    获取第一密钥，利用所述第一密钥对所述原始数据进行加密，生成加密数据；
    获取所述电子设备的设备识别信息，根据所述设备识别信息生成第二密钥；
    利用所述第二密钥对所述第一密钥进行加密，生成加密密钥。
  14. 根据权利要求13所述的数据加密方法，还包括：
    对所述原始数据进行单向哈希处理，生成对应的第一哈希消息校验数据；
    利用所述第一密钥，对所述第一哈希消息校验数据进行加密，生成加密哈希消息校验数据。
  15. 一种数据解密方法，应用于电子设备，包括：
    获取加密数据和加密密钥；
    获取所述电子设备的设备识别信息，根据所述设备识别信息生成第二密钥；
    利用所述第二密钥对所述加密密钥进行解密，得到第一密钥；
    利用所述第一密钥对所述加密数据进行解密，得到原始数据。
  16. 根据权利要求15所述的数据解密方法，还包括：
    获取加密哈希消息校验数据；
    利用所述第一密钥对所述加密哈希消息校验数据进行解密，得到第一哈希消息校验数据；
    对解密后得到的原始数据进行单向哈希处理，生成对应的第二哈希消息校验数据；
    校验所述第一哈希消息校验数据和第二哈希消息校验数据，判断解密后得到的原始数据的完整性。
  17. 一种电子设备，包括：存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述计算机程序运行时执行如权利要求1至6任一所述的密钥加密方法，或者执行如权利要求7-12所述的密钥解密方法，或者执行如权利要求13或14所述的数据加密方法，或者执行如权利要求15或16所述的数据解密方法。
  18. 一种计算机可读存储介质，存储有计算机可执行指令，其中，所述计算机可执行指令用于执行如权利要求1至6任一所述的密钥加密方法，或者执行如权利要求7-12所述的密钥解密方法，或者执行如权利要求13或14所述的数据加密方法，或者执行如权利要求15或16所述的数据解密方法。
PCT/CN2020/122961 2019-12-11 2020-10-22 密钥加密方法、解密方法及数据加密方法、解密方法 WO2021114891A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911266698.0A CN112953707A (zh) 2019-12-11 2019-12-11 密钥加密方法、解密方法及数据加密方法、解密方法
CN201911266698.0 2019-12-11

Publications (1)

Publication Number Publication Date
WO2021114891A1 true WO2021114891A1 (zh) 2021-06-17

Family

ID=76226489

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/122961 WO2021114891A1 (zh) 2019-12-11 2020-10-22 密钥加密方法、解密方法及数据加密方法、解密方法

Country Status (2)

Country Link
CN (1) CN112953707A (zh)
WO (1) WO2021114891A1 (zh)

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113950049A (zh) * 2021-09-28 2022-01-18 天翼物联科技有限公司 基于sim卡的物联网量子安全方法、系统、装置及介质
CN114124502A (zh) * 2021-11-15 2022-03-01 兰州乐智教育科技有限责任公司 消息传输方法、装置、设备及介质
CN114189860A (zh) * 2021-12-21 2022-03-15 四川安迪科技实业有限公司 卫星网络设备固定格式数据加密、解密方法及校验方法
CN114205643A (zh) * 2021-11-15 2022-03-18 杭州当虹科技股份有限公司 基于ip直播流的广告插播鉴别方法和装置
CN114598466A (zh) * 2022-03-08 2022-06-07 山东云海国创云计算装备产业创新中心有限公司 一种生产数据处理方法、装置、计算机设备及存储介质
CN114928756A (zh) * 2022-05-27 2022-08-19 浙江大华技术股份有限公司 视频数据保护、加密、校验方法及系统、设备
CN115242485A (zh) * 2022-07-19 2022-10-25 核工业四一六医院 一种数据加密或解密的方法、系统、电子设备及存储介质
CN117609965A (zh) * 2024-01-19 2024-02-27 深圳前海深蕾半导体有限公司 智能设备的升级数据包获取方法、智能设备及存储介质
CN117609965B (zh) * 2024-01-19 2024-06-25 深圳前海深蕾半导体有限公司 智能设备的升级数据包获取方法、智能设备及存储介质

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113794706B (zh) * 2021-09-06 2023-08-15 北京百度网讯科技有限公司 数据的处理方法、装置、电子设备及可读存储介质
CN113992445B (zh) * 2021-12-28 2022-04-19 广东曜芯科技有限公司 认证装置和方法
CN114745112A (zh) * 2022-04-15 2022-07-12 北京凝思软件股份有限公司 根密钥派生方法、装置、电子设备及存储介质
CN115361168B (zh) * 2022-07-15 2023-05-23 北京海泰方圆科技股份有限公司 一种数据加密方法、装置、设备及介质
CN115174073A (zh) * 2022-07-18 2022-10-11 重庆长安汽车股份有限公司 一种秘钥存储方法、装置、设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103795547A (zh) * 2014-02-26 2014-05-14 北京金山网络科技有限公司 一种用户数据加密方法及装置
WO2018148244A1 (en) * 2017-02-08 2018-08-16 Pcms Holdings, Inc. Key provisioning and identity privacy for lpwan
CN108810022A (zh) * 2018-07-18 2018-11-13 郑州云海信息技术有限公司 一种加密方法、解密方法及装置
CN110495135A (zh) * 2017-04-14 2019-11-22 三菱电机株式会社 密钥管理系统、通信设备以及密钥共享方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103795547A (zh) * 2014-02-26 2014-05-14 北京金山网络科技有限公司 一种用户数据加密方法及装置
WO2018148244A1 (en) * 2017-02-08 2018-08-16 Pcms Holdings, Inc. Key provisioning and identity privacy for lpwan
CN110495135A (zh) * 2017-04-14 2019-11-22 三菱电机株式会社 密钥管理系统、通信设备以及密钥共享方法
CN108810022A (zh) * 2018-07-18 2018-11-13 郑州云海信息技术有限公司 一种加密方法、解密方法及装置

Cited By (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113950049A (zh) * 2021-09-28 2022-01-18 天翼物联科技有限公司 基于sim卡的物联网量子安全方法、系统、装置及介质
CN113950049B (zh) * 2021-09-28 2023-10-03 天翼物联科技有限公司 基于sim卡的物联网量子安全方法、系统、装置及介质
CN114124502A (zh) * 2021-11-15 2022-03-01 兰州乐智教育科技有限责任公司 消息传输方法、装置、设备及介质
CN114205643A (zh) * 2021-11-15 2022-03-18 杭州当虹科技股份有限公司 基于ip直播流的广告插播鉴别方法和装置
CN114124502B (zh) * 2021-11-15 2023-07-28 兰州乐智教育科技有限责任公司 消息传输方法、装置、设备及介质
CN114189860A (zh) * 2021-12-21 2022-03-15 四川安迪科技实业有限公司 卫星网络设备固定格式数据加密、解密方法及校验方法
CN114598466A (zh) * 2022-03-08 2022-06-07 山东云海国创云计算装备产业创新中心有限公司 一种生产数据处理方法、装置、计算机设备及存储介质
CN114598466B (zh) * 2022-03-08 2024-05-28 山东云海国创云计算装备产业创新中心有限公司 一种生产数据处理方法、装置、计算机设备及存储介质
CN114928756A (zh) * 2022-05-27 2022-08-19 浙江大华技术股份有限公司 视频数据保护、加密、校验方法及系统、设备
CN115242485A (zh) * 2022-07-19 2022-10-25 核工业四一六医院 一种数据加密或解密的方法、系统、电子设备及存储介质
CN117609965A (zh) * 2024-01-19 2024-02-27 深圳前海深蕾半导体有限公司 智能设备的升级数据包获取方法、智能设备及存储介质
CN117609965B (zh) * 2024-01-19 2024-06-25 深圳前海深蕾半导体有限公司 智能设备的升级数据包获取方法、智能设备及存储介质

Also Published As

Publication number Publication date
CN112953707A (zh) 2021-06-11

Similar Documents

Publication Publication Date Title
WO2021114891A1 (zh) 密钥加密方法、解密方法及数据加密方法、解密方法
US9813247B2 (en) Authenticator device facilitating file security
US11469885B2 (en) Remote grant of access to locked data storage device
US8462955B2 (en) Key protectors based on online keys
US9219722B2 (en) Unclonable ID based chip-to-chip communication
US10594479B2 (en) Method for managing smart home environment, method for joining smart home environment and method for connecting communication session with smart device
CN109714176B (zh) 口令认证方法、装置及存储介质
US8995653B2 (en) Generating a secret key from an asymmetric private key
US9165148B2 (en) Generating secure device secret key
WO2013107362A1 (zh) 一种保护数据的方法和系统
US9031238B2 (en) Data encryption and/or decryption by integrated circuit
CN103546289A (zh) 一种基于USBKey的安全传输数据的方法及系统
US11831752B2 (en) Initializing a data storage device with a manager device
WO2021129557A1 (zh) 一种文件加密方法及相关装置
CN114244508B (zh) 数据加密方法、装置、设备及存储介质
US20230289089A1 (en) Multiple authorization requests from a data storage device
KR100668446B1 (ko) 안전한 인증정보 이동방법
US11582607B2 (en) Wireless security protocol
US20230289456A1 (en) Certificates in data storage devices
US20230291548A1 (en) Authorization requests from a data storage device to multiple manager devices
US11334677B2 (en) Multi-role unlocking of a data storage device
CN109960935B (zh) 确定tpm可信状态的方法、装置及存储介质
CN114553566B (zh) 数据加密方法、装置、设备及存储介质
US20230291579A1 (en) Cryptographic keys for authorization requests from a data storage device
CN114329627A (zh) 签名方法、装置、计算机设备、存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20897953

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20897953

Country of ref document: EP

Kind code of ref document: A1