WO2023207014A1 - 加密解密方法、装置及介质 - Google Patents

加密解密方法、装置及介质 Download PDF

Info

Publication number
WO2023207014A1
WO2023207014A1 PCT/CN2022/129032 CN2022129032W WO2023207014A1 WO 2023207014 A1 WO2023207014 A1 WO 2023207014A1 CN 2022129032 W CN2022129032 W CN 2022129032W WO 2023207014 A1 WO2023207014 A1 WO 2023207014A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
encryption
ciphertext
data
initial
Prior art date
Application number
PCT/CN2022/129032
Other languages
English (en)
French (fr)
Inventor
张武荣
Original Assignee
世融能量科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 世融能量科技有限公司 filed Critical 世融能量科技有限公司
Publication of WO2023207014A1 publication Critical patent/WO2023207014A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
    • Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
    • Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
    • Y04S40/20—Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Definitions

  • the present disclosure relates to, but is not limited to, encryption and decryption methods, devices and media.
  • FIG 1 is a schematic diagram of an encryption system that realizes one-time padding by pre-storing a large number of keys.
  • this encryption method requires an unlimited number of keys, which means that the consumption of keys is equivalent to plaintext, and thus cannot be implemented in practical applications. If a large number of keys are stored at both the sending and receiving ends, the confidentiality of the system will disappear when the keys are exhausted. Especially in practical applications, the communication rate is relatively high and the amount of data is relatively large. It is impossible to store keys equal to the amount of communication data. Even if the key is updated periodically, the distribution of a large number of keys, reliable storage, and reliable Every aspect of the update not only involves huge management costs, but also poses a huge risk of key leakage.
  • a key-renewable cryptosystem consists of three parts: initial key establishment, key transmission, and data transmission.
  • the key transmission module reasonably uses the initial key to update the key
  • the data transmission module uses the key obtained from the key transmission module to encrypt and transmit data.
  • the security assessment should also include initial key establishment, key transmission, and data transmission. In actual systems, the overall security of the system ultimately depends on the security of key transmission.
  • periodically updating the session key through the root key is a typical and commonly used key updating method.
  • Figure 2 is a schematic diagram of a system for updating session keys through root keys.
  • FIG 3 is a schematic diagram of the dynamic key update system. As shown in Figure 3. In this scheme, an initial key k 0 needs to be pre-stored at both the sending and receiving ends. Its function is similar to the root key in Figure 2, except that it is only used once.
  • the key transmission and data transmission of this scheme are one-time encryption, and the ability to resist technical cracking is enhanced.
  • the present disclosure provides an encryption and decryption method, device and medium.
  • an encryption method is provided.
  • the encryption method is applied to the sending end and includes:
  • the data to be transmitted is encrypted using an encryption key, and the encrypted data ciphertext is sent to the receiving end.
  • the encryption method further includes:
  • Encrypting the encryption key based on the first key to obtain the key ciphertext includes: using the first key and the second key to encrypt the encryption key to obtain the key ciphertext.
  • using the first key and the second key to encrypt the encryption key to obtain the key ciphertext includes:
  • the first key use the first encryption algorithm to encrypt the encryption key to obtain the first key ciphertext
  • the second encryption algorithm is used to encrypt the first key ciphertext to obtain the key ciphertext.
  • selecting the second key according to the second preset rule includes:
  • the encryption key is a quantum true random number.
  • the encryption method further includes: updating the initial key set according to the third preset rule.
  • the encryption operation for encrypting the encryption key is an XOR operation.
  • a decryption method is provided.
  • the decryption method is applied to the receiving end and includes:
  • the decryption method further includes:
  • Decrypting the key ciphertext based on the third key to obtain the encryption key includes:
  • using the third key and the fourth key to decrypt the key ciphertext to obtain an encryption key includes:
  • an encryption device is provided.
  • the encryption device is applied to the sending end and includes:
  • a first selection module configured to select the first key in the initial key set according to the first preset rule
  • An encryption module configured to encrypt the encryption key based on the first key to obtain the key ciphertext; and also configured to use the encryption key to encrypt the data to be transmitted;
  • the sending module is used to send the key ciphertext to the receiving end, and is also used to send the encrypted data ciphertext to the receiving end.
  • a decryption device is provided.
  • the decryption device is applied to the receiving end and includes:
  • the receiving module is used to receive key ciphertext and data ciphertext
  • a second selection module configured to select a third key from the initial key set according to the first preset rule
  • a decryption module configured to decrypt the key ciphertext based on the third key, obtain an encryption key, and use the encryption key to decrypt the data ciphertext.
  • an encryption device including:
  • the processor is configured to execute the aforementioned encryption method.
  • a decryption device including:
  • the processor is configured to execute the aforementioned decryption method.
  • a computer-readable storage medium on which a computer program is stored.
  • the computer program is executed, the aforementioned encryption method is implemented, or the aforementioned decryption method is implemented.
  • the sending end selects the first key from the initial key set according to the first preset rule; based on the first key, the encryption key is encrypted to obtain the key ciphertext; and the key ciphertext is sent to the receiving end. ; Use the encryption key to encrypt the data to be transmitted, and send the encrypted data ciphertext to the receiving end. It can be achieved that each time the encrypted data is sent to the receiving end, a different encryption key is used, and the encryption key is based on the first key. For encryption, the first key is selected from the initial key set according to the first preset rule to ensure the security of key transmission.
  • Figure 1 is a schematic diagram of an encryption system that realizes one-time padding by pre-storing a large number of keys.
  • Figure 2 is a schematic diagram of a system for updating session keys through root keys.
  • Figure 3 is a schematic diagram of the dynamic key update system.
  • Figure 4 is a flow chart of an encryption method according to an exemplary embodiment.
  • Figure 5 is a schematic diagram of an encryption system according to an exemplary embodiment.
  • Figure 6 is a schematic diagram of a real-time encryption system using quantum random numbers according to an exemplary embodiment.
  • Figure 7 is a flow chart of a decryption method according to an exemplary embodiment.
  • Figure 8 is a block diagram of an encryption device according to an exemplary embodiment.
  • Figure 9 is a block diagram of a decryption device according to an exemplary embodiment.
  • FIG. 10 is a block diagram of a computer device 1000 for encryption and decryption according to an exemplary embodiment.
  • FIG. 4 is a flow chart of the encryption method according to an exemplary embodiment. Referring to Figure 4, the encryption method is applied to the sending end, including the following steps:
  • Step S41 Select the first key from the initial key set according to the first preset rule.
  • the initial key set is pre-established at the sender and receiver.
  • the initial key set includes M initial keys, represented by ⁇ K m ⁇ , where M is a positive integer greater than or equal to 2.
  • the M initial keys in the initial key set may be a pre-stored symmetric key group, and the symmetric key group is established at both the sending and receiving ends in a pre-stored manner.
  • the M initial keys of the initial key set may be an initial key group established through an asymmetric public encryption key system.
  • the receiving end encrypts a random number with the sending end's public key and then sends it to the sending end.
  • the sending end can decrypt it with its own private key to obtain the random number. This random number can be used as a key in the initial key set.
  • the plurality of initial keys in the initial key set may be an initial key group established through an asymmetric public encryption key system.
  • the receiving end encrypts a random number with the sending end's public key and then sends it to the sending end.
  • the sending end can decrypt it with its own private key to obtain the random number.
  • the sending end encrypts the second random number with the receiving end's public key, and then sends it to the receiving end.
  • the receiving end can decrypt it with its own private key to obtain the second random number.
  • These two random numbers can be XORed to obtain a third random number, which can be used as a key in the initial key set.
  • the method of establishing the initial key set can be determined when the encryption system is initialized, or it can be adjusted during the business execution process to increase the randomness of the keys in the initial key set and improve the security of the initial key set. This disclosure does not limit the specific method used to establish the initial key set.
  • the encryption method further includes: updating the initial key set according to a third preset rule.
  • the third preset rule can be set according to the specific dialogue cycle, the amount of data transmitted by the dialogue, etc.
  • the initial key can be updated at the end of the previous conversation and before the next conversation begins, or when the amount of data transferred reaches a preset threshold.
  • an asymmetric public encryption key system is used to establish an initial key set, and the initial key set can be updated at any time or periodically to improve the security of the encryption system.
  • the update period of the initial key set can be a session period or a preset duration. Updating the initial key set at any time or periodically can effectively prevent the initial key from being exhausted and improve the security of the key system.
  • the first preset rule is pre-established by the encryption system, and the same preset rule is used at the receiving end and the sending end. Selecting the first key from the initial key set according to the first preset rule can improve the randomness of the first key, thereby improving the security of the encryption system.
  • Each time the sending end sends the encryption key it selects the first key from the initial key set according to the first preset rule and encrypts the encryption key.
  • the first preset rule is to select the number of the first key to be the remainder of the number of the encryption key divided by M.
  • the receiving end and the sending end are provided with synchronized clocks, and the first preset rule may be to select the number of the first key as a function of the current clock.
  • Step S42 Encrypt the encryption key based on the first key to obtain the key ciphertext, and the encryption key is used to encrypt the data to be transmitted;.
  • the sending end Before sending data to the receiving end, the sending end needs to send the encryption key used for this data transmission to the receiving end, so that the sending end can use the encryption key to encrypt the transmitted data and then send the encrypted data to The receiving end is able to use the same encryption key to decrypt the encrypted data and obtain the transmitted data.
  • the first key is used for encryption, and the first key is selected from multiple keys in the initial key set according to the first preset rule.
  • the sending end and receiving end use the same initial key set and the same first preset rule, it can be ensured that before each data transmission, the sending end selects an initial key to encrypt the encryption key, and the receiving end You can also select the same initial key as the sender to decrypt the encrypted key ciphertext and decrypt the encryption key to ensure the success of data transmission.
  • the selected initial key is confidential.
  • the first key is required to crack the key ciphertext. It is necessary to know the initial key set, the first preset rule at the same time, and the result of how many times the first key is currently used. Obviously, using this encryption method, you can Greatly improve the security of encryption keys, thereby ensuring the security of transmitted data.
  • Step S43 Send the key ciphertext to the receiving end.
  • the sending end determines the encryption key used for this data transmission.
  • the encryption key is encrypted based on the first key, and the encrypted key ciphertext is sent to the receiving end.
  • the receiving end decrypts the key ciphertext and can determine the encryption key used for the data to be transmitted.
  • Step S44 Use the encryption key to encrypt the data to be transmitted, and send the encrypted data ciphertext to the receiving end.
  • step S43 after the sending end and the receiving end determine the encryption key used for this data transmission, the sending end encrypts the data to be sent using the encryption key and sends the encrypted data ciphertext to the receiving end.
  • the data is encrypted by the encryption key
  • the encryption key is encrypted by the first key to generate key ciphertext, which is sent to the receiving end before data transmission. Since the initial key set and the first preset rule do not need to be transmitted, even if the sent key ciphertext is intercepted, the cracker will not know the initial key, let alone the use of multiple initial keys for this transmission. Which one of them makes it impossible to decrypt, ensuring the security of the encryption key, which determines the security of the data.
  • the encryption method further includes: selecting a second key according to a second preset rule.
  • step S42 encrypting the encryption key based on the first key to obtain the key ciphertext includes: encrypting the encryption key using the first key and the second key to obtain the key ciphertext.
  • the second key can be selected from the initial key set.
  • the second key is the same as the first key. different.
  • the second preset rule is to add 1 to the encryption key number and divide the remainder by M as the number, and select the key with this number in the initial key set as the second key.
  • the receiving end and the sending end have synchronized clocks, and the second preset rule is to select the number of the second key as a function of the current clock. This ensures that the keys selected from the initial key set according to the first preset rule and the keys selected according to the second preset rule are different keys.
  • the second key may be selected to be different from the key in the initial key set.
  • the encryption key is encrypted using the first key and the second key at the same time, further improving the security of the encryption key. If an eavesdropper eavesdrops on the key ciphertext, and both the first key and the second key come from the initial key set, he needs to know the initial key set, the first preset rule, and the second preset rule at the same time.
  • the key ciphertext can be cracked only if the current number of transmissions is reached; and if the second key is not from the initial key set, the difficulty of cracking is further increased. Therefore, using the first key and the second key to encrypt the encryption key can effectively improve the difficulty of cracking the key ciphertext and ensure the security of the encryption key.
  • selecting the second key according to the second preset rule includes:
  • the first key when the sending end sends data to the receiving end for the first time, the first key can be selected from the initial key set according to the first preset rule, the second key can be selected from the initial key set according to the second preset rule, and the first key can be selected from the initial key set according to the second preset rule.
  • the first key and the second key encrypt the encryption key, increasing the difficulty of cracking and improving the security of the encryption key.
  • the sending end does not send data to the receiving end for the first time, it can select the encryption key used in the previous data transmission as the second key, and use the first key and the second key to encrypt the current encryption key to achieve dynamic Encrypt and reduce the number of keys in the initial key set.
  • the sending end determines the encryption key, which is used to encrypt the data to be transmitted. Therefore, before the sender sends encrypted data, the encryption key used for this transmission needs to be transmitted to the receiver first, so that the receiver can decrypt the encrypted data according to the encryption key pair after receiving the encrypted data. Get the data of this transmission.
  • the first key and the second key are used to encrypt the encryption key.
  • the first key and the second key can be the keys selected in the initial key set at the same time. Since different presets are used, The preset rules are preset in advance and do not require network transmission. Therefore, even if the initial key set is leaked, the cracker cannot determine the first key and the third key selected by the sending end in each data transmission. Second key, so the key ciphertext cannot be cracked, improving the security of the encryption key.
  • obtaining the key ciphertext includes:
  • the first key use the first encryption algorithm to encrypt the encryption key to obtain the first key ciphertext
  • the second encryption algorithm is used to encrypt the first key ciphertext to obtain the key ciphertext.
  • the first encryption algorithm can be any encryption algorithm, such as the SM4 algorithm (a block cipher algorithm) or the AES algorithm (the full name of the AES algorithm is Advanced Encryption Standard), which is a replacement for the DES algorithm and one of the most popular symmetric encryption algorithms today. )wait.
  • SM4 algorithm a block cipher algorithm
  • AES algorithm the full name of the AES algorithm is Advanced Encryption Standard
  • the sending end may encrypt the first key ciphertext encrypted by the first key for a second time. If the encryption key is transmitted for the first time, the second key used for the second encryption is selected from the initial key set through the second preset rule, and the second encryption algorithm can be any encryption algorithm, such as the SM4 algorithm or AES algorithm etc. If the encryption key is not transmitted for the first time, the second key can also be the encryption key of the last transmission.
  • the first key ciphertext is encrypted for a second time using the second key and the second encryption algorithm to obtain the second key ciphertext, and the second key ciphertext is used as the key ciphertext to be transmitted.
  • the encryption key is encrypted and sent to the receiving end, and then the encryption key is used to encrypt the data to be transmitted, and the encrypted data is sent to the receiving end.
  • the receiving end can decrypt the encrypted data based on the encryption key obtained from the sending end, and obtain the data to achieve secure transmission of data.
  • the encryption key is a quantum truly random number.
  • Quantum true random numbers are used as encryption keys, and any encryption key is only used once, destroyed after use, and never repeated. Each data transmission uses a different quantum true random number as the encryption key to achieve one-time encryption. Effect. Quantum true random numbers are generated by the sender, which avoids the increased management costs caused by managing a large number of keys at the sender and receiver at the same time, as well as the risk of a large number of key leaks.
  • FIG. 5 is a schematic diagram of an encryption system according to an exemplary embodiment.
  • an initial key set is established at the sending end and the receiving end.
  • the initial key set includes multiple initial keys. It is assumed that the multiple initial keys are k 0 , k 1 ...k m-1, a total of M.
  • the first preset rule is modular operation. The initial key for each data transmission is selected through the remainder of the modular operation.
  • the first key is expressed as k i(mod)M , which is the encryption key used for the current data transmission to be transmitted.
  • the key is k i+1
  • the encryption key used in the last data transmission is k i .
  • the algorithms can be the same or different.
  • the initial key can be cracked. As long as any of the encryption keys used in multiple data transmissions is It ensures the security of keys and data without being cracked or leaked.
  • the key data is the data after the encryption key has been encrypted twice, and during the data transmission process, the encryption key and the data adopt the one-time encryption method. If a data is used in a certain data transmission, If the key k i is leaked, the updated key k i+1 will not be leaked because this k i+1 is encrypted by k i(mod)M . If the number of initial key sets is M, the entire system must be cracked after M consecutive keys are cracked. Using the encryption method provided by this disclosure can effectively improve the security of the encryption key.
  • the encryption operation for encrypting the encryption key is an XOR operation.
  • the operation delay of the block symmetric cipher algorithm is relatively short. However, in some services, such as real-time control, the system's sensitivity to delay may even exceed the operation delay of symmetric cryptographic algorithms. In this case, the encryption operation needs to be simplified into a zero-latency XOR operation.
  • FIG. 6 is a schematic diagram of a real-time encryption system using quantum random numbers according to an exemplary embodiment.
  • the real-time encryption system includes three parts: an initial key establishment module, a key one-time pad real-time transmission module, and a data one-time pad real-time transmission module.
  • the encryption algorithm can use a standard symmetric grouping algorithm. As mentioned earlier, some real-time control systems cannot even accept the delays caused by standard symmetric grouping algorithms. In order to reduce data processing delay, encryption and decryption can use zero-delay XOR operation to replace the symmetric grouping algorithm.
  • This cryptographic system can achieve zero-delay one-time pad encrypted transmission. This cryptographic system not only resists key leakage (one-time pad), but also provides password security against brute force cracking.
  • the computing time of the asymmetric public encryption key system is much higher than that of the block symmetric cipher algorithm. If an asymmetric public encryption key system is used to establish the initial key set, the establishment of the initial key needs to be part of the system initialization, not part of the real-time communication. This can effectively reduce delays in the business process.
  • Figure 7 is a flow chart of a decryption method according to an exemplary embodiment. Referring to Figure 7, the decryption method is applied to the receiving end, including:
  • Step S71 Receive the key ciphertext.
  • the key ciphertext is generated by the sending end after encrypting the encryption key.
  • Step S72 Select a third key from the initial key set according to the first preset rule, and decrypt the key ciphertext based on the third key to obtain the encryption key.
  • the receiving end can select a third key that is the same as the first key from the local initial key set.
  • the key ciphertext is decrypted based on the third key to obtain the encryption key.
  • Step S73 Receive the data ciphertext, use the encryption key to decrypt the data ciphertext, and obtain the data transmitted by the sending end. Using the encryption key, the data ciphertext sent by the sender can be decrypted.
  • the third key is selected by the receiving end from the initial key set according to preset rules.
  • the initial key set is established in advance. During the data transmission process, the initial key set does not need to be transmitted over the network, avoiding the need for the initial key set. Reduce the risk of the centralized initial key being leaked, thereby ensuring the security of data transmission.
  • the decryption method further includes:
  • the receiving end if the first key and the second key are used to encrypt the encryption key at the sending end, the receiving end also needs to select the encryption key according to the same preset rules after receiving the key ciphertext. Only when the third key and the fourth key are the same as the first key and the fourth key is the same as the second key can the key ciphertext be decrypted.
  • the third key and the fourth key are used to decrypt the key ciphertext to obtain the encryption key, which includes:
  • the decryption process at the receiving end is opposite to the encryption process at the sending end, but the encryption and decryption algorithms are consistent and preset. Therefore, using the encryption method and decryption method provided by the present disclosure, even if the first key and the second key are cracked, the encryption algorithm used by the sender needs to be known before the key ciphertext can be processed. Decryption, has good resistance to cracking.
  • FIG 8 is a block diagram of an encryption device according to an exemplary embodiment.
  • the encryption device is applied to the sending end and includes a first selection module 801, an encryption module 802, and a sending module 803.
  • the first selection module 801 is configured to select a first key in the initial key set according to a first preset rule.
  • the encryption module 802 is configured to encrypt the encryption key based on the first key to obtain the key ciphertext; and is also configured to use the encryption key to encrypt the data to be transmitted.
  • the sending module 803 is configured to send the key ciphertext to the receiving end, and also to send the encrypted data ciphertext to the receiving end.
  • the first selection module 801 is further configured to select a second key according to a second preset rule.
  • the encryption module 802 is also configured to encrypt the encryption key using the first key and the second key to obtain the key ciphertext.
  • the encryption module 802 is further configured to use a first encryption algorithm to encrypt the encryption key according to the first key to obtain the first key ciphertext;
  • the second encryption algorithm is used to encrypt the first key ciphertext to obtain the key ciphertext.
  • Figure 9 is a block diagram of a decryption device according to an exemplary embodiment.
  • the decryption device is applied to the receiving end and includes: a receiving module 901, a second selection module 902, and a decryption module 903.
  • the receiving module 901 is configured to receive key ciphertext and data ciphertext.
  • the second selection module 902 is configured to select a third key in the initial key set according to the first preset rule.
  • the decryption module 904 is configured to decrypt the key ciphertext based on the third key, obtain the encryption key, and use the encryption key to decrypt the data ciphertext.
  • the second selection module is further configured to select a fourth key according to a second preset rule.
  • the decryption module 904 is further configured to use the third key and the fourth key to decrypt the key ciphertext to obtain the encryption key.
  • the decryption module 904 is further configured to use the fourth key to decrypt the key ciphertext to obtain the first key ciphertext; and to use the third key to decrypt the first ciphertext. Key ciphertext to get the current encryption key.
  • FIG. 10 is a block diagram of a computer device 1000 for encryption and decryption according to an exemplary embodiment.
  • computer device 1000 may be provided as a server.
  • a computer device 1000 includes a processor 1001 , and the number of processors can be set to one or more as needed.
  • Computer device 1000 also includes memory 1002 for storing instructions, such as application programs, executable by processor 1001 .
  • the number of memories can be set to one or more as needed.
  • the stored applications can be one or more.
  • the processor 1001 is configured to execute instructions to perform the above encryption method, or the decryption method.
  • embodiments of the present disclosure may be provided as methods, apparatuses (devices), or computer program products. Accordingly, the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, the present disclosure may take the form of a computer program product embodied on one or more computer-usable storage media having computer-usable program code embodied therein.
  • Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data , including but not limited to RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, Digital Versatile Disk (DVD) or other optical disk storage, magnetic cassettes, tapes, magnetic disk storage or other magnetic storage devices, or may be used Any other medium that stores the desired information and can be accessed by the computer, etc. Additionally, it is known to those of ordinary skill in the art that communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media .
  • a modulated data signal such as a carrier wave or other transport mechanism
  • These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions
  • the device implements the functions specified in a process or processes in the flowchart and/or in a block or blocks in the block diagram
  • These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device.
  • Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.
  • the sending end selects the first key from the initial key set according to the first preset rule; based on the first key, the encryption key is encrypted to obtain the key ciphertext; and the key ciphertext is sent to the receiving end. end; use the encryption key to encrypt the data to be transmitted, and send the encrypted data ciphertext to the receiving end. It can be achieved that each time the encrypted data is sent to the receiving end, a different encryption key is used, and the encryption key is based on the first encryption key. The key is encrypted.
  • the first key is selected from the initial key set according to the first preset rule to ensure the security of key transmission. Even if the encryption key that has been used is cracked, since the first key is selected according to the first Preset rules are selected from the initial key set to ensure the security of subsequent encryption keys and improve the security of the encryption system against technical cracking and key leakage.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

本公开是关于一次一密加密解密方法、装置及介质，加密方法应用于发送端，包括：按照第一预设规则在初始密钥集中选择第一密钥；基于所述第一密钥对加密密钥进行加密，得到密钥密文，所述加密密钥用于对待传输数据进行加密；将所述密钥密文发送至接收端；使用加密密钥加密所述待传输数据，将加密后的数据密文发送至接收端。可以实现每次向接收端发送加密数据时，使用不同的加密密钥，同时加密密钥基于第一密钥进行加密，第一密钥是按照第一预设规则在初始密钥集中选择的，确保密钥传输的安全性，可以确保加密密钥的安全性，提高加密系统抗技术破解安全性及抗密钥泄露安全性。

Description

加密解密方法、装置及介质
本公开基于申请号为202210458356.4，申请日为2022年04月28日，申请名称为“加密解密方法、装置及介质”的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本公开作为参考。
技术领域
本公开涉及但不限于加密解密方法、装置及介质。
背景技术
相关技术中，一次一密安全体制，要求密钥所承载的信息量等同于明文的信息量。图1是通过预存大量密钥实现一次一密的加密系统示意图。参考图1，这种加密方法需要无限数量的密钥，这意味着密钥的消耗量等同于明文，因而在实际应用的中是无法实现的。如果在收发两端预存大量的密钥，则系统的保密性在密钥耗尽时将消失。特别是实际应用中，通信速率都比较高，数据量比较大，存储与通信数据量相等的密钥是不可能的，即使周期性更行密钥，大量密钥的分发，可靠存储，和可靠更新的各个环节，不但有巨大的管理成本，还存在巨大的密钥泄露风险。
一个密钥可更新的密码体制包含三部分：初始密钥建立，密钥传输，和数据传输。密钥传输模块合理利用初始密钥更新密钥，而数据传输模块使用从密钥传输模块获得的密钥对数据加密传输。安全性评估也应该包括初始密钥建立，密钥传输，和数据传输三部分。在实际系统种，系统整体安全性最终取决于密钥传输的安全性。相关技术中，通过根密钥周期性更新会话密钥是典型和常用的一种密钥更新方法。图2是通过根密钥更新会话密钥的系统示意图。如图2所示，虽然在数据传输时，可以频繁更新会话密钥，甚至做到一次一密，数据传输的安全性似乎很高，但由于密钥传输时，采用固定的根密钥进行加密，如果根密钥被泄露或者被破解，则整个系统的安全性将会完全丧失。还有一种常用的密钥更新的方式是在业务通道中设计密钥更新通道，其实际效果等同于用目前的密钥更新未来使用的密钥。图3是动态密钥更新系统示意图。如图3所示。在这个方案中，需要在收发两端预存一个初始密钥k 0，其作用类似于图2中的根密钥，区别在于它只使用一次。这种方案的密钥传输和数据传输都是一次一密，抗技术性破解的能力增强。但是这种方案如果存在一个风险：如果系统存在一次密钥泄露，则整个密码体制的安全性丧失。例如，如果k i泄露，则下一个密钥通过k i+1＝D(x i+1,k i)很容易被破解，窃密者立即获得更新的密钥，从而失去动态更新密钥的效果。
发明内容
为克服相关技术中存在的问题，本公开提供一种加密解密方法、装置及介质。
根据本公开的第一方面，提供一种加密方法，加密方法应用于发送端，包括：
按照第一预设规则在初始密钥集中选择第一密钥；
基于所述第一密钥对加密密钥进行加密，得到密钥密文，所述加密密钥用于对待传输数据进行加密；
将所述密钥密文发送至接收端；
使用加密密钥加密所述待传输数据，将加密后的数据密文发送至接收端。
在本公开一些示例性实施例中，基于前述方案，加密方法还包括：
按照第二预设规则选择第二密钥；
基于所述第一密钥对加密密钥进行加密，得到密钥密文包括：使用所述第一密钥和第二密钥对加密密钥进行加密，得到密钥密文。
在本公开一些示例性实施例中，基于前述方案，所述使用所述第一密钥和第二密钥对加密密钥进行加密，得到密钥密文包括：
根据所述第一密钥，使用第一加密算法，对加密密钥进行加密，得到第一密钥密文；
根据所述第二密钥，使用第二加密算法，对所述第一密钥密文进行加密，得到密钥密文。
在本公开一些示例性实施例中，基于前述方案，所述按照第二预设规则选择第二密钥包括：
按照第二预设规则在初始密钥集中选择第二密钥；或者，
选择前一次数据传输中使用的加密密钥作为第二密钥。
在本公开一些示例性实施例中，基于前述方案，所述加密密钥为量子真随机数。
在本公开一些示例性实施例中，基于前述方案，加密方法还包括：根据第三预设规则，更新初始密钥集。
在本公开一些示例性实施例中，基于前述方案，所述对加密密钥进行加密的加密运算为异或运算。
根据本公开的第二方面，提供一种解密方法，解密方法应用于接收端，包括：
接收密钥密文；
按照第一预设规则在初始密钥集中选择第三密钥，基于所述第三密钥对所述密钥密文进行解密，得到加密密钥；
接收数据密文，使用所述加密密钥解密所述数据密文，获取发送端传输的数据。
在本公开一些示例性实施例中，基于前述方案，所述解密方法还包括：
按照第二预设规则选择第四密钥；
所述基于所述第三密钥对所述密钥密文进行解密，得到加密密钥包括：
使用所述第三密钥和第四密钥解密所述密钥密文，得到加密密钥。
在本公开一些示例性实施例中，基于前述方案，所述使用所述第三密钥和第四密钥解密所述密钥密文，得到加密密钥，包括：
使用所述第四密钥，解密所述密钥密文，得到第一密钥密文；
使用所述第三密钥，解密所述第一密钥密文，得到当前加密密钥。；
根据本公开的第三方面，提供一种加密装置，加密装置应用于发送端，包括：
第一选择模块，用于按照第一预设规则在初始密钥集中选择第一密钥；
加密模块，用于基于所述第一密钥对加密密钥进行加密，得到密钥密文；还用于使用加密密钥加密待传输数据；
发送模块，用于将所述密钥密文发送至接收端，还用于将加密后的数据密文发送至接收端。
根据本公开的第四方面，提供一种解密装置，解密装置应用于接收端，包括：
接收模块，用于接收密钥密文、数据密文；
第二选择模块，用于按照第一预设规则在初始密钥集中选择第三密钥；
解密模块，用于基于所述第三密钥对所述密钥密文进行解密，得到加密密钥，使用所述加密密钥解密所述数据密文。
根据本公开的第五方面，提供一种加密装置，包括：
处理器；
用于存储处理器的可执行指令的存储器；
其中，所述处理器被配置为执行前述加密方法。
根据本公开的第六方面，提供一种解密装置，包括：
处理器；
用于存储处理器的可执行指令的存储器；
其中，所述处理器被配置为执行前述解密方法。
根据本公开的第七方面，提供一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序被执行时实现前述加密方法，或者实现前述解密方法。
本公开通过发送端按照第一预设规则在初始密钥集中选择第一密钥；基于第一密钥，对 加密密钥进行加密，得到密钥密文；将密钥密文发送至接收端；使用加密密钥加密待传输数据，将加密后的数据密文发送至接收端，可以实现每次向接收端发送加密数据时，使用不同的加密密钥，同时加密密钥基于第一密钥进行加密，第一密钥是按照第一预设规则在初始密钥集中选择的，确保密钥传输的安全性，即使已经使用的加密密钥被破解，由于第一密钥是按照第一预设规则在初始密钥集中选择的，可以确保后续使用的加密密钥的安全性，提高加密系统抗技术破解安全性及抗密钥泄露安全性。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本公开。
附图说明
此处的附图被并入说明书中并构成本说明书的一部分，示出了符合本发明的实施例，并与说明书一起用于解释本发明的原理。
图1是通过预存大量密钥实现一次一密的加密系统示意图。
图2是通过根密钥更新会话密钥的系统示意图。
图3是动态密钥更新系统示意图。
图4是根据一示例性实施例示出的加密方法流程图。
图5是根据一示例性实施例示出的加密系统示意图。
图6是根据一示例性实施例示出的采用量子随机数的实时加密系统示意图。
图7是根据一示例性实施例示出的解密方法的流程图。
图8是根据一示例性实施例示出的一种加密装置的框图。
图9是根据一示例性实施例示出的一种解密装置的框图。
图10是根据一示例性实施例示出的一种加密解密的计算机装置1000的框图。
具体实施方式
为使本公开实施例的目的、技术方案和优点更加清楚，下面将结合本公开实施例中的附图，对本公开实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本公开一部分实施例，而不是全部的实施例。基于本公开中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本公开保护的范围。需要说明的是，在不冲突的情况下，本公开中的实施例及实施例中的特征可以相互任意组合。
为了提高加密系统的安全性，本公开提供一种加密方法，图4是根据一示例性实施例示出的加密方法流程图。参考图4，加密方法应用于发送端，包括以下步骤：
步骤S41，按照第一预设规则在初始密钥集中选择第一密钥。
初始密钥集是在发送端和接收端预先建立的，初始密钥集包括M个初始密钥，用{K m}来表示，M为大于等于2的正整数。
在一示例性实施例中，初始密钥集的M个初始密钥可以为预存的对称密钥组，通过预存的方式在收发两端建立对称密钥组。
在一示例性实施例中，初始密钥集的M个初始密钥可以是通过非对称公开加密密钥体系建立的初始密钥组。例如，接收端用发送端的公钥加密一个随机数，然后发送给发送端，发送端可以用自己的私钥解密获得这个随机数，这个随机数可以作为初始密钥集中的一个密钥。重复上述过程M次，就可以在发送端和接收端建立M个始密钥。
或者，用接收端和发送端交换的第一个随机数作为密钥，用这个密钥传输M个随机数，就可以在发送端和接收端各建立M个初始密钥。
或者，初始密钥集中的多个初始密钥可以是通过非对称公开加密密钥体系建立的初始密钥组。例如，接收端用发送端的公钥加密一个随机数，然后发送给发送端，发送端可以用自己的私钥解密获得这个随机数。同理，发送端用接收端的公钥加密第二个随机数，然后发送给接收端，接收端可以用自己的私钥解密获得第二个随机数。这两个随机数可以异或运算，得到第三个随机数，第三个随机数可以作为初始密钥集中的一个密钥。重复上述过程M次，就可以建立M个初始密钥。
或者，为了降低公钥体系的计算复杂度，用接收端和发送端获得的第三个随机数作为密钥，用这个密钥传输M个随机数，就可以在发送端和接收端各建立M个初始密钥。
建立初始密钥集的方法，可以在加密系统初始化时确定，也可以在业务执行过程中进行调整，以增加初始密钥集中密钥的随机性，提高初始密钥集的安全性。具体采用何种方法建立初始密钥集，本公开不作限制。
在一实例性实施例中，加密方法还包括：根据第三预设规则，更新初始密钥集。可以根据具体的对话周期，对话传输的数据量等，设置第三预设规则。可以在上一次对话结束，下一次对话开始前更新初始密钥，或者，在传输的数据数量达到预设阈值时，更新初始密钥。
例如，利用非对称公开加密密钥体系建立初始密钥集，可以随时或者周期性地更新初始密钥集，提高加密系统的安全性。初始密钥集的更新的周期可以为一个对话周期，或者一个预设的时长。随时或者周期性地更新初始密钥集，可以有效防止初始密钥被耗尽，提高密钥系统的安全性。
第一预设规则由加密系统预先建立，并在接收端和发送端使用相同的预设规则。按照第一预设规则在初始密钥集中选择第一密钥，可以提高第一密钥的随机性，进而提高加密系统的安全性。发送端每次发送加密密钥时，都按第一预设规则在初始密钥集中进行选择第一密钥，对加密密钥进行加密。在一示例性实施例中，第一预设规则为，选择第一密钥的编号为加密密钥的编号除以M的余数。在另一示例性实施例中，接收端和发送端设置有同步的时钟，第一预设规则可以为，选择第一密钥的编号为当前时钟的函数。
实现了在每次进行数据传输时，都会根据第一预设规则，在初始密钥集中选择一个第一密钥，而且每次选择的第一密钥都不会相同。即使在初始密钥集被泄露的情况下，破解者也无从确定本次数据传输中，采用了初始密钥集中哪个密钥进行了加密，从而提高抗泄密的能力。
步骤S42：基于第一密钥对加密密钥进行加密，得到密钥密文，加密密钥用于对待传输数据进行加密；。
发送端在向接收端发送数据前，需要先将本次数据传输采用的加密密钥，发送至接收端，以使发送端在使用加密密钥对传输数据进行加密后，将加密的数据发送至接收端，接收端能够使用相同的加密密钥对加密数据进行解密，并获取传输的数据。为保证加密密钥的安全性，在发送加密密钥时，使用第一密钥进行加密，第一密钥是按照第一预设规则从初始密钥集中的多个密钥中选择的。
在发送端和接收端采用了相同的初始密钥集和相同的第一预设规则的情况下，可以确保每一次数据传输前，发送端选择一个初始密钥对加密密钥进行加密，接收端也可以选择出与发送端相同的初始密钥对加密后的密钥密文进行解密，解密出加密密钥，保证数据传输的成功，同时，选择的初始密钥是保密的。破解密钥密文需要第一密钥，需要同时知道初始密钥集，第一预设规则，以及当前使用的第一密钥是第几次选择的结果，显然，采用这种加密方法，可以大大提高加密密钥的安全性，进而确保传输的数据的安全性。
步骤S43,将密钥密文发送至接收端。在发送数据前，由发送端确定本次数据传输采用的加密密钥，加密密钥基于第一密钥进行加密，将加密后的密钥密文发送给接收端。接收端对密钥密文进行解密，可以确定待传输数据采用的加密密钥。
步骤S44，使用加密密钥加密待传输数据，将加密后的数据密文发送至接收端。
经步骤S43，发送端和接收端确定了本次数据传输采用的加密密钥后，发送端将待发送的数据采用加密密钥进行加密，将加密后的数据密文发送至接收端。
在本实施例中，数据经加密密钥进行加密，而加密密钥又经第一密钥进行加密生成密钥 密文，在数据传输前发送给接收端。由于初始密钥集、第一预设规则，不需要进行传输，即使发送的密钥密文被截获，破解者由于无法获知初始密钥，更不会获知本次传输采用了多个初始密钥中的哪一个，从而无从进行解密，确保加密密钥的安全，而加密密钥的安全决定了数据的安全。
在一实例性实施例中，加密方法还包括：按照第二预设规则选择第二密钥。
在步骤S42中，基于第一密钥对加密密钥进行加密，得到密钥密文包括：使用第一密钥和第二密钥对加密密钥进行加密，得到密钥密文。
按照第二预设规则选择第二密钥，第二密钥可以在初始密钥集中选择，通过设置不同于第一预设规则的第二预设规则，使得第二密钥与第一密钥不同。例如，第二预设规则为，将加密密钥的编号加1除以M的余数作为编号，在初始密钥集中选择该编号的密钥为第二密钥。或者，接收端和发送端有同步的时钟，第二预设规则为，选择第二密钥的编号为当前时钟的函数。这样保证根据第一预设规则和根据第二预设规则从初始密钥集中选择的密钥为不同的密钥。或者，第二密钥也可以选择不同于初始密钥集中的密钥。
同时使用第一密钥和第二密钥对加密密钥进行加密，进一步提高了加密密钥的安全性。窃听者如果窃听到密钥密文，在第一密钥和第二密钥都出自初始密钥集的情况下，需要同时知道初始密钥集，第一预设规则，第二预设规则，当前传输次数的情况下，才能对密钥密文进行破解；而在第二密钥不是出自初始密钥集的情况下，则进一步增加了破解难度。因此，采用第一密钥和第二密钥对加密密钥进行加密，可以有效提高密钥密文的破解难度，保证加密密钥的安全。
在一示例性实施例中，按照第二预设规则选择第二密钥包括：
按照第二预设规则在初始密钥集中选择第二密钥；或者，
选择前一次数据传输中使用的加密密钥作为第二密钥。
例如，当发送端首次向接收端发送数据时，可以按照第一预设规则在初始密钥集中选择第一密钥，按照第二预设规则在初始密钥集中选择第二密钥，使用第一密钥和第二密钥对加密密钥进行加密，增加破解难度，提高加密密钥的安全性。当发送端非首次向接收端发送数据时，可以选择前一次数据传输中使用的加密密钥作为第二密钥，使用第一密钥和第二密钥对当前加密密钥进行加密，实现动态加密，且减少初始密钥集中的密钥数量。
发送端确定加密密钥，加密密钥用于对待传输数据进行加密。因此，在发送端发送加密的数据前，需要将本次传输采用的加密密钥先传输给接收端，以使接收端能够在接收到加密数据后，根据加密密钥对对加密数据进行解密，获取本次传输的数据。
为防止数据被非法窃听并破解，需要确保加密密钥的安全。在本实施例中，使用第一密钥和第二密钥对加密密钥进行加密,第一密钥和第二密钥可以同时为初始密钥集中选择的密钥，由于使用不同的预设规则进行选择，预设规则是提前预设的，不需要进行网络传输，因此，即使初始密钥集被泄露，破解者由于无法确定每次数据传输中，发送端选择的第一密钥和第二密钥，因此也就无法对密钥密文进行破解，提高加密密钥的安全。
在一示例性实施例中，使用第一密钥和第二密钥对加密密钥进行加密，得到密钥密文包括：
根据第一密钥，使用第一加密算法，对加密密钥进行加密，得到第一密钥密文；
根据所述第二密钥，使用第二加密算法，对第一密钥密文进行加密，得到密钥密文。
第一加密算法可以是任意一种加密算法，如SM4算法(一种分组密码算法)或者AES算法(AES算法全称Advanced Encryption Standard,是DES算法的替代者,也是当今最流行的对称加密算法之一)等。
发送端可对经第一密钥加密的第一密钥密文做第二次加密。如果加密密钥是初次传输，则第二次加密所使用的第二密钥通过第二预设规则在初始密钥集中选择，而第二加密算法可以是任意一种加密算法，如SM4算法或者AES算法等。如果加密密钥不是初次传输，则第二密钥也可以为上一次传输的加密密钥。
使用第二密钥和第二加密算法对第一密钥密文做第二次加密，获得第二密钥密文，将第二密钥密文作为待传输的密钥密文。
将加密密钥加密后发送给接收端，再使用加密密钥对待传输的数据进行加密，将加密后的数据发送至接收端。接收端可以根据从发送端获取的加密密钥，对加密后的数据进行解密，并获取到数据，实现数据的安全传输。
在一示例性实施例中，加密密钥为量子真随机数。
如果数据传输时的加密密钥是固定的，在加密机或者解密机泄露、通过暴力计算，密码数学分析，统计分析等技术破解方法，破解加密密钥是可能的。
使用量子真随机数作为加密密钥，而且任何一个加密密钥只使用一次，使用后就销毁，永不重复，每次数据传输使用不同的量子真随机数作为加密密钥，实现一次一密加密效果。量子真随机数由发送端生成，避免了在发送端和接收端同时管理大量密钥造成的管理成本增加，以及大量密钥泄露的风险。
图5是根据一示例性实施例示出的加密系统示意图。参考图5，在发送端和接收端建立 初始密钥集，初始密钥集包括多个初始密钥，假设多个初始密钥为k 0,k 1…k m-1共M个。第一预设规则为模运算，通过模运算求余的方式，选择每次数据传输时的初始密钥，第一密钥表示为k i(mod)M,当前待传输数据传输采用的加密密钥为k i+1，上一次数据传输采用的加密密钥为k i，发送端在向接收端发送加密密钥时，首先使用k i(mod)M和第一加密算法E1对当前加密密钥k i+1进行加密，得到第一密钥密文，表示为E1(k i+1,k i(mod)M)；再使用上一次的加密密钥和第二加密算法E2，对第一密钥密文进行加密，得到第二密钥密文，表示为x i+1＝E2(k i,E1(k i+1,k i(mod)M))，其中E1,E2为加密算法，可以相同，也可以不同。
以M＝2举例说明，并且我们假设加密算法E1和E2就是简单的异或运算。因为M＝2，初始密钥集中只有两个初始密钥，为k 0,k 1。假设，每次数据传输使用的加密密钥依次为k 2,k 3…k n，如果k 2被泄露或者破解，必须同时破解下一个密钥k 3才能确定k 0和k 1的唯一解。如下所示，下面的两个方程可以唯一确定k 0和k 1：
Figure PCTCN2022129032-appb-000001
Figure PCTCN2022129032-appb-000002
如果k 2被泄露或者破解，但是密钥k 3没有破解，而k 4被破解了，k 0和k 1仍然无法被唯一确定，即使有无穷的计算资源。如下所示，下面的三个方程并不可以唯一确定k 0和k 1，因为三个方程中有两个是等价的，但两个方程中有三个未知数，因而理论上无法破解整个系统的密钥：
Figure PCTCN2022129032-appb-000003
Figure PCTCN2022129032-appb-000004
Figure PCTCN2022129032-appb-000005
可见，只有连续确定每次数据传输中使用的加密密钥，且知道具体的加密算法的情况下，才能对初始密钥进行破解，只要对多次数据传输中使用的加密密钥中有任何一个没有破解或被泄露，都能够确保密钥和数据的安全。通过上述实施例，密钥数据是加密密钥经过两次加密后的数据，并在数据传输过程中，加密密钥和数据都采用一次一密的加密方法，如果某次数据传输中使用的一个密钥k i泄露，更新的密钥k i+1也不会泄露，因为这个k i+1是被k i(mod)M加密的。如果初始密钥集个数是M，则必须在破解M个连续的密钥后才能破解整个系统，采用本公开提供的加密方法，能够有效提高加密密钥的安全性。
在一示例性实施例中，对加密密钥进行加密的加密运算为异或运算。
分组对称密码算法的运算时延比较短。但在有些业务中，比如实时控制，系统对时延的 敏感度甚至会超过了对称密码算法的运算时延。在这种情况下，需要把加密运算简化为零时延的异或运算。
图6是根据一示例性实施例示出的采用量子随机数的实时加密系统示意图。参考图6，实时加密系统包括三部分：初始密钥建立模块，密钥一次一密实时传输模块，和数据一次一密实时传输模块。加密算法可以采用标准的对称分组算法。如前所述，有些实时控制系统甚至不能接受标准的对称分组算法带来的时延。为了降低数据处理时延，加解密可以采用零时延的异或运算替换对称分组算法。在初始密钥建立完成之后，密钥和数据同步开始一次一密传输，并且都采用量子随机数作为密钥。这个密码体制可以实现零时延一次一密加密传输。这个密码体制不但可以抗密钥泄露(一次一密)，还有抗暴力破解的密码安全性。
值得注意点是，非对称公开加密密钥体制的运算时间要大大高于分组对称密码算法。如果采用非对称公开加密密钥体制来建立初始密钥集，则需要把初始密钥的建立作为系统初始化的一部分，而非实时通信的一部分。这样可以有效降低业务过程中的延时。
图7是根据一示例性实施例示出的解密方法的流程图。参考图7，解密方法应用于接收端，包括：
步骤S71，接收密钥密文。密钥密文是发送端对加密密钥进行加密后生成的。
步骤S72，按照第一预设规则在初始密钥集中选择第三密钥，基于第三密钥对密钥密文进行解密，得到加密密钥。
由于发送端和接收端的初始密钥集相同，第一预设规则相同，因此，接收端能够从本地初始密钥集中选择出于第一密钥相同的第三密钥。与发送端相对应，基于第三密钥对密钥密文进行解密，得到加密密钥。
步骤S73，接收数据密文，使用加密密钥解密数据密文，获取发送端传输的数据。使用加密密钥，可以对发送端发送的数据密文进行解密。
第三密钥由接收端根据预设规则在初始密钥集中选择，初始密钥集是预先建立的，在进行数据传输的过程中，初始密钥集不需要进行网络传输，避免了初始密钥集中的初始密钥被泄露的风险，进而保证数据传输的安全。
在一示例性实施例中，解密方法还包括：
按照第二预设规则选择第四密钥；
基于第三密钥对密钥密文进行解密，得到加密密钥包括：
使用第三密钥和第四密钥解密密钥密文，得到加密密钥。
与发送端的加密方法相对应，如果在发送端使用第一密钥和第二密钥对加密密钥进行加密，接收端在接收到密钥密文后，也需要按相同的预设规则，选择第三密钥和第四密钥，且第三密钥与第一密钥相同，第四密钥与第二密钥相同，才能对密钥密文进行解密。
在一示例性实施例中，使用第三密钥和第四密钥解密密钥密文，得到加密密钥，包括：
使用第四密钥，解密密钥密文，得到第一密钥密文；
使用第三密钥，解密第一密钥密文，得到当前加密密钥。
接收端的解密过程，与发送端的加密过程相反，但加解密算法是一致的，也是预先设定好的。因此，采用本公开提供的加密方法和解密方法，即使在破解了第一密钥和第二密钥的基础上，还需要知道发送方采用的加密算法的情况下，才能对密钥密文进行解密，具有很好的抗破解能力。
图8是根据一示例性实施例示出的一种加密装置的框图。参考图8,加密装置应用于发送端，包括第一选择模块801，加密模块802，发送模块803。
该第一选择模块801被配置为用于按照第一预设规则在初始密钥集中选择第一密钥。
该加密模块802被配置为用于基于第一密钥对加密密钥进行加密，得到密钥密文；还用于使用加密密钥加密待传输数据。
该发送模块803被配置为用于将密钥密文发送至接收端，还用于将加密后的数据密文发送至接收端。
在一示例性实施例中，该第一选择模块801还被配置为用于按照第二预设规则选择第二密钥。
该加密模块802还被配置为用于使用所述第一密钥和第二密钥对加密密钥进行加密，得到密钥密文。
在一示例性实施例中，该加密模块802还被配置为用于根据所述第一密钥，使用第一加密算法，对加密密钥进行加密，得到第一密钥密文；
根据所述第二密钥，使用第二加密算法，对所述第一密钥密文进行加密，得到密钥密文。
图9是根据一示例性实施例示出的一种解密装置的框图。参考图9,解密装置应用于接收端，包括：接收模块901，第二选择模块902，解密模块903。
该接收模块901被配置为用于用于接收密钥密文、数据密文。
该第二选择模块902被配置为用于按照第一预设规则在初始密钥集中选择第三密钥。
该解密模块904被配置为用于基于第三密钥对密钥密文进行解密，得到加密密钥，使用加密密钥解密数据密文。
在一示例性实施例中，该第二选择模块还被配置为用于按照第二预设规则选择第四密钥。
该解密模块904还被配置为用于使用第三密钥和第四密钥解密密钥密文，得到加密密钥。
在一示例性实施例中，该解密模块904还被配置为用于使用第四密钥，解密所述密钥密文，得到第一密钥密文；使用第三密钥，解密第一密钥密文，得到当前加密密钥。
图10是根据一示例性实施例示出的一种加密解密的计算机装置1000的框图。例如，计算机装置1000可以被提供为一服务器。参照图10，计算机装置1000包括处理器1001，处理器的个数可以根据需要设置为一个或者多个。计算机设备1000还包括存储器1002，用于存储可由处理器1001的执行的指令，例如应用程序。存储器的个数可以根据需要设置一个或者多个。其存储的应用程序可以为一个或者多个。处理器1001被配置为执行指令，以执行上述加密方法，或者解密方法。
本领域技术人员应明白，本公开的实施例可提供为方法、装置(设备)、或计算机程序产品。因此，本公开可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本公开可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质上实施的计算机程序产品的形式。计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质,包括但不限于RAM、ROM、EEPROM、闪存或其他存储器技术、CD-ROM、数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质等。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。
本公开是参照根据本公开实施例的方法、装置(设备)和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制 造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在本公开中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括……”限定的要素，并不排除在包括所述要素的物品或者设备中还存在另外的相同要素。
尽管已描述了本公开的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本公开范围的所有变更和修改。
显然，本领域的技术人员可以对本公开进行各种改动和变型而不脱离本公开的精神和范围。这样，倘若本公开的这些修改和变型属于本公开权利要求及其等同技术的范围之内，则本公开的意图也包含这些改动和变型在内。
工业实用性
本公开中通过发送端按照第一预设规则在初始密钥集中选择第一密钥；基于第一密钥，对加密密钥进行加密，得到密钥密文；将密钥密文发送至接收端；使用加密密钥加密待传输数据，将加密后的数据密文发送至接收端，可以实现每次向接收端发送加密数据时，使用不同的加密密钥，同时加密密钥基于第一密钥进行加密，第一密钥是按照第一预设规则在初始密钥集中选择的，确保密钥传输的安全性，即使已经使用的加密密钥被破解，由于第一密钥是按照第一预设规则在初始密钥集中选择的，可以确保后续使用的加密密钥的安全性，提高加密系统抗技术破解安全性及抗密钥泄露安全性。

Claims (15)

  1. 一种加密方法，应用于发送端，其特征在于，所述加密方法包括：
    按照第一预设规则在初始密钥集中选择第一密钥；
    基于所述第一密钥对加密密钥进行加密，得到密钥密文，所述加密密钥用于对待传输数据进行加密；
    将所述密钥密文发送至接收端；
    使用加密密钥加密所述待传输数据，将加密后的数据密文发送至接收端。
  2. 根据权利要求1所述的加密方法，其特征在于，所述加密方法还包括：
    按照第二预设规则选择第二密钥；
    基于所述第一密钥对加密密钥进行加密，得到密钥密文包括：使用所述第一密钥和第二密钥对加密密钥进行加密，得到密钥密文。
  3. 根据权利要求2所述的加密方法，其特征在于，所述使用所述第一密钥和第二密钥对加密密钥进行加密，得到密钥密文包括：
    根据所述第一密钥，使用第一加密算法，对加密密钥进行加密，得到第一密钥密文；
    根据所述第二密钥，使用第二加密算法，对所述第一密钥密文进行加密，得到密钥密文。
  4. 根据权利要求1所述的加密方法，其特征在于，所述按照第二预设规则选择第二密钥包括：
    按照第二预设规则在初始密钥集中选择第二密钥；或者，
    选择前一次数据传输中使用的加密密钥作为第二密钥。
  5. 根据权利要求1-4任一所述的加密方法，其特征在于，所述加密密钥为量子真随机数。
  6. 根据权利要求1所述的加密方法，其特征在于，还包括：根据第三预设规则，更新初始密钥集。
  7. 根据权利要求1所述的加密方法，其特征在于，所述对加密密钥进行加密的加密运算为异或运算。
  8. 一种解密方法，应用于接收端，其特征在于，所述解密方法包括：
    接收密钥密文；
    按照第一预设规则在初始密钥集中选择第三密钥，基于所述第三密钥对所述密钥密文进行解密，得到加密密钥；
    接收数据密文，使用所述加密密钥解密所述数据密文，获取发送端传输的数据。
  9. 根据权利要求8所述的解密方法，其特征在于，所述解密方法还包括：
    按照第二预设规则选择第四密钥；
    所述基于所述第三密钥对所述密钥密文进行解密，得到加密密钥包括：
    使用所述第三密钥和第四密钥解密所述密钥密文，得到加密密钥。
  10. 根据权利要求8所述的解密方法，其特征在于，所述使用所述第三密钥和第四密钥解密所述密钥密文，得到加密密钥，包括：
    使用所述第四密钥，解密所述密钥密文，得到第一密钥密文；
    使用所述第三密钥，解密所述第一密钥密文，得到当前加密密钥。
  11. 一种加密装置，应用于发送端，其特征在于，所述加密装置包括：
    第一选择模块，用于按照第一预设规则在初始密钥集中选择第一密钥；
    加密模块，用于基于所述第一密钥对加密密钥进行加密，得到密钥密文；还用于使用加密密钥加密待传输数据；
    发送模块，用于将所述密钥密文发送至接收端，还用于将加密后的数据密文发送至接收端。
  12. 一种解密装置，应用于接收端，其特征在于，所述解密装置包括：
    接收模块，用于接收密钥密文、数据密文；
    第二选择模块，用于按照第一预设规则在初始密钥集中选择第三密钥；
    解密模块，用于基于所述第三密钥对所述密钥密文进行解密，得到加密密钥，使用所述加密密钥解密所述数据密文。
  13. 一种加密装置，其特征在于，包括：
    处理器；
    用于存储处理器的可执行指令的存储器；
    其中，所述处理器被配置为执行如权利要求1至7中任一项所述的加密方法。
  14. 一种解密装置，其特征在于，包括：
    处理器；
    用于存储处理器的可执行指令的存储器；
    其中，所述处理器被配置为执行如权利要求8至10所述的解密方法。
  15. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述计算机程序被执行时实现如权利要求1-7所述加密方法，或者实现如权利要求8-10所述解密方法。
PCT/CN2022/129032 2022-04-28 2022-11-01 加密解密方法、装置及介质 WO2023207014A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210458356.4A CN114884716B (zh) 2022-04-28 2022-04-28 加密解密方法、装置及介质
CN202210458356.4 2022-04-28

Publications (1)

Publication Number Publication Date
WO2023207014A1 true WO2023207014A1 (zh) 2023-11-02

Family

ID=82671778

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/129032 WO2023207014A1 (zh) 2022-04-28 2022-11-01 加密解密方法、装置及介质

Country Status (2)

Country Link
CN (1) CN114884716B (zh)
WO (1) WO2023207014A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117240604A (zh) * 2023-11-10 2023-12-15 深圳市互盟科技股份有限公司 基于云计算的数据安全存储和优化节能方法
CN117714214A (zh) * 2024-02-05 2024-03-15 国网上海能源互联网研究院有限公司 一种数据传输安全保护方法、装置、电子设备及介质

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114884716B (zh) * 2022-04-28 2024-02-27 世融能量科技有限公司 加密解密方法、装置及介质
CN115766202A (zh) * 2022-11-11 2023-03-07 之江实验室 一种数据安全传输的系统、方法、存储介质及电子设备
CN116055037A (zh) * 2022-12-21 2023-05-02 华能信息技术有限公司 一种密钥管理方法及系统
CN116150796B (zh) * 2023-04-18 2023-12-08 安羚科技(杭州)有限公司 用于数据防泄露系统的数据防护方法和装置
CN116596542A (zh) * 2023-05-24 2023-08-15 广东科谊网络技术有限公司 移动安全支付方法及系统
CN116996222B (zh) * 2023-09-27 2023-12-12 江西财经大学 数据安全传输方法、装置、可读存储介质及电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016048054A2 (ko) * 2014-09-24 2016-03-31 삼성전자 주식회사 데이터 통신 보안을 위한 방법, 장치 및 시스템
CN107770127A (zh) * 2016-08-17 2018-03-06 北京京东尚科信息技术有限公司 一种数据的传输方法和装置
CN112272174A (zh) * 2020-10-22 2021-01-26 北京海泰方圆科技股份有限公司 加密数据传输方法、装置、设备及计算机存储介质
CN112653705A (zh) * 2020-12-29 2021-04-13 中国农业银行股份有限公司 一种数据加密传输方法、装置及设备
CN114884716A (zh) * 2022-04-28 2022-08-09 世融能量科技有限公司 加密解密方法、装置及介质

Family Cites Families (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102571321A (zh) * 2010-12-30 2012-07-11 中国移动通信集团公司 一种数据加密传输的方法和设备
CN104468095A (zh) * 2014-11-28 2015-03-25 华为技术有限公司 一种数据传输方法及装置
CN105245505A (zh) * 2015-09-14 2016-01-13 深圳市优友互联有限公司 数据发送方法及装置、数据接收方法及装置、收发系统
CN106453318A (zh) * 2016-10-14 2017-02-22 北京握奇智能科技有限公司 一种基于安全模块的数据传输系统及方法
CN109510703B (zh) * 2018-11-23 2020-02-11 北京海泰方圆科技股份有限公司 一种数据加解密方法及装置
CN111385085B (zh) * 2018-12-27 2022-12-30 山东量子科学技术研究院有限公司 一种量子三级密钥体系实现方法及系统
US11533167B2 (en) * 2019-05-27 2022-12-20 BicDroid Inc. Methods and devices for optimal information-theoretically secure encryption key management
CN112187448B (zh) * 2019-07-01 2023-04-07 北京国盾量子信息技术有限公司 一种数据加密方法及系统
US11233631B2 (en) * 2019-10-09 2022-01-25 Google Llc Key management for encrypted data
CN111131270B (zh) * 2019-12-27 2021-11-16 五八有限公司 数据加密和解密方法、装置、电子设备及存储介质
CN111193741B (zh) * 2019-12-31 2022-09-13 中国银行股份有限公司 一种信息发送方法、信息获取方法、装置及设备
CN113452661A (zh) * 2020-03-27 2021-09-28 山东浪潮质量链科技有限公司 一种服务端密钥安全防护方法、设备及介质
CN111680326A (zh) * 2020-06-09 2020-09-18 联想(北京)有限公司 一种数据处理方法及装置
CN113839780A (zh) * 2020-06-24 2021-12-24 中兴通讯股份有限公司 加密方法、解密方法、服务器及存储介质
CN112291196B (zh) * 2020-09-28 2023-06-23 北京芯盾集团有限公司 适用于即时通信的端到端加密方法及系统
CN112532384B (zh) * 2020-11-20 2022-05-27 杭州国芯科技股份有限公司 基于分组密钥模式下对传输密钥快速加解密的方法
CN113037486B (zh) * 2021-05-24 2021-08-03 国网浙江省电力有限公司杭州供电公司 一种基于量子加固的配电自动化信息加密方法
CN113286297B (zh) * 2021-07-22 2021-10-12 深圳市同富信息技术有限公司 无线数据加密传输方法、装置、计算机设备和存储介质
CN113824728B (zh) * 2021-09-27 2023-07-04 南京华远时代科技有限公司 一种基于数据加密的网络通信方法及系统
CN114186264A (zh) * 2022-01-07 2022-03-15 中国工商银行股份有限公司 数据随机加密、解密方法、装置及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016048054A2 (ko) * 2014-09-24 2016-03-31 삼성전자 주식회사 데이터 통신 보안을 위한 방법, 장치 및 시스템
CN107770127A (zh) * 2016-08-17 2018-03-06 北京京东尚科信息技术有限公司 一种数据的传输方法和装置
CN112272174A (zh) * 2020-10-22 2021-01-26 北京海泰方圆科技股份有限公司 加密数据传输方法、装置、设备及计算机存储介质
CN112653705A (zh) * 2020-12-29 2021-04-13 中国农业银行股份有限公司 一种数据加密传输方法、装置及设备
CN114884716A (zh) * 2022-04-28 2022-08-09 世融能量科技有限公司 加密解密方法、装置及介质

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117240604A (zh) * 2023-11-10 2023-12-15 深圳市互盟科技股份有限公司 基于云计算的数据安全存储和优化节能方法
CN117240604B (zh) * 2023-11-10 2024-02-27 深圳市互盟科技股份有限公司 基于云计算的数据安全存储和优化节能方法
CN117714214A (zh) * 2024-02-05 2024-03-15 国网上海能源互联网研究院有限公司 一种数据传输安全保护方法、装置、电子设备及介质
CN117714214B (zh) * 2024-02-05 2024-05-03 国网上海能源互联网研究院有限公司 一种数据传输安全保护方法、装置、电子设备及介质

Also Published As

Publication number Publication date
CN114884716A (zh) 2022-08-09
CN114884716B (zh) 2024-02-27

Similar Documents

Publication Publication Date Title
WO2023207014A1 (zh) 加密解密方法、装置及介质
US10785019B2 (en) Data transmission method and apparatus
US9246674B2 (en) Generation of cryptographic keys
JP2021083076A (ja) データ伝送方法、装置およびシステム
US20150244520A1 (en) One-time-pad data encryption with media server
US20020191796A1 (en) Symmetric and asymmetric encryption method with arbitrarily selectable one-time keys
JP7353375B2 (ja) エポック鍵交換を用いたエンドツーエンドの二重ラチェット暗号化
US20230188325A1 (en) Computer-implemented system and method for highly secure, high speed encryption and transmission of data
US20150229621A1 (en) One-time-pad data encryption in communication channels
US10630476B1 (en) Obtaining keys from broadcasters in supersingular isogeny-based cryptosystems
US11528127B2 (en) Computer-implemented system and method for highly secure, high speed encryption and transmission of data
Sengupta et al. Message mapping and reverse mapping in elliptic curve cryptosystem
WO2016049053A1 (en) Facilitating encrypted communications between two parties
Harn et al. General logic-operation-based lightweight group-key distribution schemes for Internet of Vehicles
CN107147626B (zh) 一种AES算法与ElGamal算法相结合的加密文件传输方法
KR20030047148A (ko) Ｒｓａ를 이용한 클라이언트/서버 기반의 메신저 보안 방법
Naher et al. Authentication of Diffie-Hellman protocol against man-in-the-middle attack using cryptographically secure CRC
CN111488618B (zh) 基于区块链的一次一密密码方法、装置及存储介质
CN115842625A (zh) 一种基于pki系统实时协商密钥的加密方法及系统
Purevjav et al. Email encryption using hybrid cryptosystem based on Android
US10880278B1 (en) Broadcasting in supersingular isogeny-based cryptosystems
Rajarama et al. Diffie-Hellman Type Key Exchange, ElGamal Like Encryption/Decryption and Proxy Re-encryption Using Circulant Matrices.
CN114362926B (zh) 基于密钥池的量子保密通信网络密钥管理通信系统及方法
Zakir et al. A Survey on Various Encryption/Decryption Techniques Used in Mobile and Cloud Computing
HS et al. Group Key Management using Asynchronous Cipher System Based on XOR Vector Space and Pseudo Random Number Generation for Fog Environment.

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22939831

Country of ref document: EP

Kind code of ref document: A1