CN108256346B - Key data protection method, encryption protection device and embedded system device - Google Patents

Abstract

The invention discloses a method for protecting key data, comprising: obtaining a public key shared by embedded system devices; encrypting key data to be protected according to a first encryption code to obtain ciphertext data, obtaining a first decryption code; the first decryption code is used to decrypt the ciphertext data; the first decryption code is encrypted according to the public key and the second encryption code to obtain an encrypted first decryption code, and obtain a second decryption code according to the second encryption code; the second decryption code is used to decrypt the encrypted first decryption code; the ciphertext data, the encrypted first decryption code and The second decryption code is sent to the embedded system device; the invention also discloses an encryption protection device, an embedded system device and a protection system for key data.

Description

Key data protection method, encryption protection device and embedded system device

technical field

The invention relates to the field of embedded system data security, in particular to a key data protection method, an encryption protection device and an embedded system device.

Background technique

With the development of informatization, intelligence, and networking, embedded systems are widely used in home, industry, business, and office for their advantages of simple operation, small size, low power consumption, high reliability, and good portability. , medical and other aspects of society, occupy an increasingly important position; it is also particularly important to protect the key data in embedded systems.

At present, the protection methods for key data in embedded systems mainly include: using flash memory as configuration data storage or using Flash to store configuration data in blocks, establishing a flash NAND Flash embedded file system in the embedded system (Yet Another Flash File System, YAFFS2) and the method of partitioning NAND Flash, using Static Random Access Memory (SRAM) as system memory to store data and using battery backup method, using Dynamic Random Access Memory (Dynamic Random Access Memory) Access Memory, DRAM) as system memory to store data and use non-volatile memory as a permanent data storage medium; when using these methods to protect key data in embedded systems, the encryption and decryption codes are easily reversed. As a result, key data is easily obtained and the security is low.

SUMMARY OF THE INVENTION

In view of this, embodiments of the present invention are expected to provide a key data protection method, an encryption protection device, and an embedded system device, so as to protect key data in an embedded system and improve data security.

In order to achieve the above object, the technical scheme of the present invention is achieved in this way:

The present invention provides a method for protecting key data, the method comprising:

Obtain the public key shared by the embedded system device;

The key data to be protected is encrypted according to the first encryption code to obtain ciphertext data, and the first decryption code is obtained according to the first encryption code; the first decryption code is used to decrypt the ciphertext data;

The first decryption code is encrypted according to the public key and the second encryption code to obtain an encrypted first decryption code, and a second decryption code is obtained according to the second encryption code; the second decryption code uses in decrypting the encrypted first decryption code;

The ciphertext data, the encrypted first decryption code and the second decryption code are sent to the embedded system device.

In the above scheme, the second encryption code is an asymmetric encryption code;

The obtaining the public key shared by the embedded system devices includes:

Obtain the public key shared by the embedded system device through a serial port;

The sending the ciphertext data, the encrypted first decryption code and the second decryption code to the embedded system device includes:

The ciphertext data, the encrypted first decryption code and the second decryption code are programmed into the flash memory of the embedded system device.

The present invention provides a method for protecting key data, the method comprising:

Generate a private key according to its own inherent characteristic identifier, and use the asymmetric key generation method to derive the corresponding public key from the private key;

sharing the public key with the encryption protection device;

Store the ciphertext data sent by the encryption protection device, the encrypted first decryption code and the second decryption code; the second decryption code is used to decrypt the encrypted first decryption code; the first decryption code A code is used to decrypt the ciphertext data.

In the above solution, after storing the ciphertext data sent by the encryption protection device, the encrypted first decryption code and the second decryption code, the method further includes:

Decrypt the ciphertext data in the memory to obtain the key data to be protected;

After obtaining the key data to be protected, perform a clearing operation;

Decrypting the ciphertext data in the memory to obtain key data to be protected, including:

dynamically obtain the private key by calling an application programming interface API function in memory;

Perform a decryption operation on the encrypted first decryption code according to the private key and the second decryption code to obtain a first decryption code;

The ciphertext data is decrypted by using the first decryption code to obtain the key data to be protected.

In the above solution, generating a private key according to its own inherent characteristic identifier includes:

Utilize a hash algorithm to generate a private key according to its own inherent characteristic identifier; wherein, the inherent characteristic identifier includes: Vendor ID, serial number SN;

The sharing of the public key to the encryption protection device includes:

sharing the public key with the encryption protection device through the serial port;

The storage of the ciphertext data, the encrypted first decryption code and the second decryption code sent by the encryption protection device includes:

The ciphertext data burned by the encryption protection device, the encrypted first decryption code and the second decryption code are stored in the flash memory.

The present invention provides an encryption protection device, the device includes:

an acquisition module for acquiring the public key shared by the embedded system device;

The first encryption module is used to encrypt the key data to be protected according to the first encryption code to obtain ciphertext data, and obtain the first decryption code according to the first encryption code; the first decryption code is used to decrypt the ciphertext data;

A second encryption module, configured to encrypt the first decryption code according to the public key and the second encryption code, obtain an encrypted first decryption code, and obtain a second decryption code according to the second encryption code; The second decryption code is used to decrypt the encrypted first decryption code;

A sending module, configured to send the ciphertext data, the encrypted first decryption code and the second decryption code to the embedded system device.

In the above scheme, the second encryption code is an asymmetric encryption code;

The obtaining module is specifically configured to obtain the public key shared by the embedded system device through a serial port;

The sending module is specifically configured to burn the ciphertext data, the encrypted first decryption code and the second decryption code into the flash memory of the embedded system device.

The present invention provides an embedded system device, the device includes:

A generation module is used to generate a private key according to its own inherent characteristic identifier, and use the asymmetric key generation method to derive the corresponding public key from the private key;

a sharing module, used for sharing the public key to the encryption protection device;

a storage module, configured to store the ciphertext data sent by the encryption protection device, the encrypted first decryption code and the second decryption code; the second decryption code is used to decrypt the encrypted first decryption code; The first decryption code is used to decrypt the ciphertext data.

In the above scheme, the device also includes:

a decryption module for decrypting the ciphertext data in memory to obtain key data to be protected;

an emptying module for performing an emptying operation after obtaining the key data to be protected;

The decryption module is specifically used for:

dynamically obtain the private key by calling an application programming interface API function in memory;

Perform a decryption operation on the encrypted first decryption code according to the private key and the second decryption code to obtain a first decryption code;

The ciphertext data is decrypted by using the first decryption code to obtain the key data to be protected.

In the above scheme, the generation module is specifically configured to utilize a hash algorithm to generate a private key according to its own inherent characteristic identifier; wherein, the inherent characteristic identifier includes: vendor ID, serial number SN;

The sharing module is specifically configured to share the public key to the encryption protection device through a serial port;

The storage module is specifically configured to store the ciphertext data burned by the encryption protection device, the encrypted first decryption code and the second decryption code in the flash memory.

The present invention provides a key data protection system, characterized in that the system includes the encryption protection device described in the above solution and the embedded system device described in the above solution.

The key data protection method, encryption protection device, and embedded system device provided by the embodiments of the present invention obtain ciphertext data by obtaining the public key shared by the embedded system device; encrypting the key data to be protected according to the first encryption code , and obtain the first decryption code according to the first encryption code; the first decryption code is used to decrypt the ciphertext data; the first decryption code is encrypted according to the public key and the second encryption code, Obtain the encrypted first decryption code, and obtain the second decryption code according to the second encryption code; the second decryption code is used to decrypt the encrypted first decryption code; The encrypted first decryption code and the second decryption code are sent to the embedded system device; protection of key data in the embedded system is realized, and data security is improved.

Description of drawings

1 is a flowchart of Embodiment 1 of a method for protecting key data of the present invention;

2 is a flowchart of Embodiment 2 of a method for protecting key data of the present invention;

3 is a flowchart of Embodiment 3 of a method for protecting key data of the present invention;

FIG. 4 is a schematic diagram of a generation mode of a key pair in the method for protecting key data of the present invention;

Fig. 5 is the schematic diagram of the encryption operation of the key data to be protected and the data decryption code performed by the PC encryption protection platform in the embodiment of the protection method for key data of the present invention;

6 is a schematic diagram of storage of data and codes in an embedded system device in an embodiment of a method for protecting key data of the present invention;

7 is a schematic diagram of decrypting encrypted data decryption code and ciphertext data in an embedded system device memory in an embodiment of a method for protecting key data of the present invention;

8 is a schematic structural diagram of an embodiment of an encryption protection device according to the present invention;

FIG. 9 is a schematic structural diagram of an embodiment of an embedded system device according to the present invention;

FIG. 10 is a schematic structural diagram of an embodiment of a protection system for key data of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

Example 1

FIG. 1 is a flowchart of Embodiment 1 of a method for protecting key data of the present invention; as shown in FIG. 1 , the method for protecting key data provided by an embodiment of the present invention is applied to an encryption protection device, and may include the following steps:

Step 101: Obtain the public key shared by the embedded system devices.

The encryption protection device is connected to the embedded system device through the serial port, and obtains the public key shared by the embedded system device.

Step 102: Encrypt key data to be protected according to the first encryption code to obtain ciphertext data, and obtain a first decryption code according to the first encryption code; the first decryption code is used to decrypt the ciphertext data.

After acquiring the public key shared by the embedded system device, the encryption protection device firstly performs an encryption operation on the key data to be protected according to the first encryption code to obtain ciphertext data, and obtains the first decryption code according to the first encryption code; wherein , the first decryption code is used to decrypt the ciphertext data.

For example, the encryption protection device is a personal computer (Personal Computer, PC) encryption protection platform. After the PC encryption protection platform obtains the public key shared by the embedded system device, it encrypts the key data to be protected by using the first encryption code to obtain the encryption At the same time, the first decryption code for decrypting the ciphertext data is obtained from the first encryption code.

Step 103: Encrypt the first decryption code according to the public key and the second encryption code to obtain an encrypted first decryption code, and obtain a second decryption code according to the second encryption code; The decryption code is used to decrypt the encrypted first decryption code.

The encryption protection device that has obtained the public key encrypts the key data to be protected, obtains ciphertext data, and obtains the first decryption code according to the first encryption code, and then pairs the obtained first decryption code according to the obtained public key and the second encryption code. A decrypted code is encrypted to obtain an encrypted first decrypted code; at the same time, a second decrypted code is obtained from the second encrypted code; wherein, the obtained second decrypted code is used to decrypt the encrypted first decrypted code; the described The second encryption code is an asymmetric encryption code.

For example, the PC encryption protection platform that has obtained the public key performs an encryption operation on the first decryption code used to decrypt the ciphertext data according to the public key and the asymmetric encryption code, and obtains the encrypted first decryption code, which is encrypted by the asymmetric encryption code. The code determines a second decryption code, and the second decryption code is used to decrypt the encrypted first decryption code.

Step 104: Send the ciphertext data, the encrypted first decryption code and the second decryption code to the embedded system device.

After obtaining the ciphertext data, the encrypted first decryption code and the second decryption code, the encryption protection device burns the obtained ciphertext data, the encrypted first decryption code and the second decryption code into the embedded device through the serial port. In the flash memory of the system device, the ciphertext data to be obtained, the encrypted first decryption code and the second decryption code are stored in the Flash of the embedded system device.

In the method for protecting key data provided by the embodiment of the present invention, the encryption protection device obtains the public key shared by the embedded system device; encrypts the key data to be protected according to the first encryption code to obtain ciphertext data, and according to the first encryption code The encrypted code obtains a first decryption code; the first decryption code is used to decrypt the ciphertext data; the first decryption code is encrypted according to the public key and the second encryption code to obtain the encrypted first decryption code code, and obtain a second decryption code according to the second encryption code; the second decryption code is used to decrypt the encrypted first decryption code; decrypt the ciphertext data, the encrypted first decryption code The code and the second decryption code are sent to the embedded system device; not only the key data to be protected is encrypted, but also the first decryption code for decrypting the ciphertext data is encrypted and protected, which realizes the protection of the embedded system. The double protection of key data makes it more difficult to crack key data and improves data security.

Embodiment 2

FIG. 2 is a flowchart of Embodiment 2 of the method for protecting key data of the present invention; as shown in FIG. 2 , the method for protecting key data provided by the embodiment of the present invention is applied to an embedded system device, and may include the following steps:

Step 201: Generate a private key according to its own inherent characteristic identifier, and derive a corresponding public key from the private key by using an asymmetric key generation method.

The embedded system device uses a specific algorithm, such as a Hash algorithm, to generate a private key according to its own inherent characteristic identifiers, such as Vendor ID (Vendor ID), Serial Number (SN), etc., and uses asymmetric The key generation method derives the corresponding public key from the private key.

For example, the embedded system device uses the Hash algorithm to calculate and obtain a value as a private key according to its own inherent SN, and at the same time uses the asymmetric key generation method to derive the corresponding public key from the private key.

Step 202: Share the public key with the encryption protection device.

After the embedded system device generates the private key and the corresponding public key, the generated public key is shared with the encryption protection device through the serial port, so that the encryption protection device can encrypt the decryption code for decrypting the ciphertext data according to the public key.

Step 203: Store the ciphertext data sent by the encryption protection device, the encrypted first decryption code and the second decryption code; the second decryption code is used to decrypt the encrypted first decryption code; the The first decryption code is used to decrypt the ciphertext data.

After the embedded system device shares the public key with the encryption protection device, the ciphertext data burned by the encryption protection device, the encrypted first decryption code and the second decryption code are stored in the Flash; wherein the second decryption code is used for Decrypt the encrypted first decryption code; the first decryption code is used to decrypt the ciphertext data.

After the embedded system device stores the ciphertext data burned by the encryption protection device, the encrypted first decryption code and the second decryption code in the Flash, in order to obtain the key data to be protected, the ciphertext data needs to be stored in the memory. Decryption is performed, and after the key data to be protected is obtained and the data is used, the clearing operation is performed.

Specifically, when the embedded system device needs to decrypt the ciphertext data, it firstly calls the Application Programming Interface (API) function in the memory to dynamically obtain the private key generated according to its own inherent feature identifier, and then Perform a decryption operation on the encrypted first decryption code according to the private key and the second decryption code to obtain the first decryption code; then use the obtained first decryption code to decrypt the ciphertext data to obtain the key data to be protected; After the key data to be protected is obtained and the data is used, the clearing operation is performed to realize the decryption operation of the ciphertext data.

In the protection method for key data provided by the embodiment of the present invention, the embedded system device generates a private key according to its own inherent characteristic identifier, and uses the asymmetric key generation method to derive the corresponding public key from the private key; The public key is shared with the encryption protection device; the ciphertext data sent by the encryption protection device, the encrypted first decryption code and the second decryption code are stored; the second decryption code is used to decrypt the encrypted first decryption code. a decryption code; the first decryption code is used to decrypt the ciphertext data; the protection of key data in the embedded system is realized, and the first decryption code used to decrypt the ciphertext data is displayed in the Flash in the form of ciphertext Storage makes it more difficult to crack key data and improves data security.

Embodiment 3

3 is a flowchart of Embodiment 3 of the protection method for key data of the present invention; it is applied to the interaction between an encryption protection device and an embedded system device, and the encryption protection device is a PC encryption protection platform, wherein the PC encryption protection platform and the embedded system The system devices are independent of each other, and the two exchange data through the serial port; the first encryption code in this embodiment is a data encryption code, which is represented by Code; the key data to be protected is represented by Data, and the ciphertext data is represented by EData; the first decryption code is represented by EData; The code is the data decryption code, which is represented by DCode; the second encryption code is the asymmetric encryption code, which is represented by EC; the encrypted data decryption code is represented by EDCode; the second decryption code is the decryption code used to decrypt the EDCode, which is called decryption The code is represented by DEC; as shown in FIG. 3 , the method for protecting key data provided by the embodiment of the present invention may include the following steps:

Step 301 : The embedded system device generates a private key Skey according to its own inherent characteristic identifier, and uses an asymmetric key generation method to derive the corresponding public key Pkey from the private key Skey.

Each embedded system device has some software and hardware identifiers that are different from other devices, such as vendor ID, SN, etc. The embedded system device first uses a specific algorithm, such as Hash algorithm, to generate private key, and use the asymmetric key generation method to derive the corresponding public key from the private key.

FIG. 4 is a schematic diagram of the generation method of the key pair in the method for protecting key data of the present invention; as shown in FIG. 4 , in the embedded system device, the operating system uses the inherent feature identifier of the embedded system device to pass a specific algorithm, such as Hash Algorithm, calculate and obtain a value as the private key Skey in the asymmetric encryption algorithm; then obtain the public key Pkey corresponding to the Skey according to the asymmetric key generation method, and complete the generation of the key pair (ie Skey and Pkey).

Step 302: The embedded system device shares the public key Pkey to the PC encryption protection platform.

After the embedded system device uses its own inherent characteristic identifier to generate the private key Skey and derives the public key Pkey, it is connected to the PC encryption protection platform through the serial port, and the generated Pkey is shared with the PC encryption protection platform, while the generated Skey is Stored directly in the embedded system device.

Step 303: The PC encryption protection platform encrypts the key data Data to be protected according to the data encryption code Code to obtain the ciphertext data EData, and obtains the data decryption code DCode according to the data encryption code Code.

The PC encryption protection platform that obtains the Pkey first performs encryption operation on the key data Data that needs to be protected according to the data encryption code Code (first encryption code), and obtains the key data to be protected in the form of ciphertext, namely the ciphertext data EData; At the same time, the PC encryption protection platform determines the data decryption code DCode (first decryption code) for decrypting the EData according to the data encryption code Code.

Step 304: The PC encryption protection platform encrypts the data decryption code DCode according to the public key Pkey and the asymmetric encryption code EC, obtains the encrypted data decryption code EDCode, and obtains the decryption code DEC according to the asymmetric encryption code EC.

The PC encryption protection platform that obtains the Pkey uses the Pkey, and encrypts the data decryption code DCode (the first decryption code) according to the asymmetric encryption algorithm according to the asymmetric encryption code EC (the second encryption code), and obtains the encrypted data. Data decryption code EDCode; at the same time, the PC encryption protection platform obtains the decryption code DEC (second decryption code) for decrypting the EDCode according to the asymmetric encryption code EC.

Fig. 5 is the schematic diagram that the PC encryption protection platform performs encryption operation on the key data to be protected and the data decryption code in the protection method embodiment of the key data of the present invention; The key data to be protected, that is, the key data to be protected, is encrypted through the data encryption code Code to obtain data in the form of ciphertext, that is, the ciphertext data EData; after encrypting the key data to be protected, the public key Pkey is obtained. The PC encryption protection platform uses this key, and uses the selected asymmetric encryption code EC to encrypt the data decryption code DCode to obtain the encrypted data decryption code EDCode, that is, using the selected asymmetric encryption algorithm, such as RSA The encryption algorithm, the Elgamal algorithm, the knapsack algorithm, etc. perform encryption operations on the data decryption code DCode; wherein, the decryption code corresponding to the asymmetric encryption code EC is DEC.

Step 305: The PC encryption protection platform burns the obtained ciphertext data EData, the encrypted data decryption code EDCode and the decryption code DEC into the Flash of the embedded system device.

The PC encryption protection platform performs encryption operations on the key data Data to be protected and the data decryption code DCode, and obtains the ciphertext data EData, the encrypted data decryption code EDCode and the decryption code DEC, and then encrypts the ciphertext data EData and encrypted data. The decryption code EDCode and the decryption code DEC are burned into the Flash of the embedded system device through the serial port for storage.

Step 306: The embedded system device dynamically obtains the private key Skey by calling an API function in the memory.

After the PC encryption protection platform burns the ciphertext data EData, the encrypted data decryption code EDCode and the decryption code DEC to the embedded system device, in order to obtain the original key data, that is, in order to obtain the key data Data to be protected, embedded The embedded system device first needs to call the API function in the memory to dynamically obtain the private key Skey stored in the embedded system device.

Step 307: The embedded system device performs a decryption operation on the encrypted data decryption code EDCode according to the private key Skey and the decryption code DEC to obtain the data decryption code DCode.

After acquiring the private key Skey, the embedded system device calls the decryption code DEC in the memory and uses the private key Skey to decrypt the encrypted data decryption code EDCode to obtain the data decryption code DCode before encryption.

Step 308: The embedded system device uses the data decryption code DCode to decrypt the ciphertext data EData to obtain the key data Data to be protected.

After obtaining the data decryption code DCode, the embedded system device calls the ciphertext data EData in the memory, and uses the data decryption code DCode to decrypt the ciphertext data EData to obtain the key data Data to be protected.

Step 309: The embedded system device performs a clearing operation.

After the embedded system device obtains the key data Data to be protected, the memory immediately performs an emptying operation after using the Data, and does not retain the Data.

6 is a schematic diagram of storage of data and codes in an embedded system device in an embodiment of a method for protecting key data of the present invention; as shown in FIG. 6 , there are two storage media of memory and Flash in the embedded system device, and the memory is stored in the embedded system The device can be used as the storage medium of the file system. It cannot keep the original data unchanged in the case of power failure, so the memory-based file system can only be a temporary file system, which is used to save temporary files; the benefits of memory There are only dynamic changes in memory, and restarting the system will not generate garbage; Flash is also the most commonly used file system storage medium in embedded system devices. Unlike memory, it can keep files from being lost when power is lost; Therefore, in the present invention, the ciphertext data EData, the encrypted data decryption code EDCode and the decryption code DEC are all stored in the Flash, and when the code and data are decrypted, they are all run in the memory, and the operation is completed. Immediately after the clearing operation is performed.

7 is a schematic diagram of decrypting encrypted data decryption code and ciphertext data in the memory of an embedded system device in an embodiment of a method for protecting key data of the present invention; as shown in FIG. 7 , in order to obtain the original key data, That is, the key data Data to be protected, first, call the API function in the memory to obtain the private key Skey; then call the decryption code DEC and decrypt the encrypted data decryption code EDCode according to the obtained private key Skey to obtain the encrypted data The previous data decryption code is obtained DCode; then, the ciphertext data EData is decrypted by calling the data decryption code DCode in the memory to obtain plaintext data, that is, the key data to be protected Data; after the key data to be protected is used up After Data, the memory will be emptied, and Data will not be retained.

In the above process, the PC encryption protection platform not only encrypts and protects the key data to be protected, but also performs an asymmetric encryption operation on the data decryption code (ie DCode) for decrypting the ciphertext data, so that the data decryption code can be displayed in Flash as At the same time, the private key generation method used in the asymmetric encryption operation is directly generated by its specific software and hardware identifier according to a certain algorithm in the embedded system device, and only in the embedded system When the ciphertext data needs to be decrypted in the device memory, it can be dynamically obtained from the embedded system device by calling the relevant API functions; therefore, it is not easy for an attacker to obtain the value of the private key, and the encrypted The security and confidentiality of the key are high, which increases the difficulty of cracking key data.

In the method for protecting key data provided by the embodiment of the present invention, a private key Skey is generated by an embedded system device according to its own inherent characteristic identifier, and a corresponding public key Pkey is derived from the private key Skey by using an asymmetric key generation method; The system device shares the public key Pkey to the PC encryption protection platform; the PC encryption protection platform encrypts the key data Data to be protected according to the data encryption code Code, and obtains the ciphertext data EData and data decryption code DCode; PC encryption protection platform Encrypt the data decryption code DCode according to the public key Pkey and the asymmetric encryption code EC, and obtain the encrypted data decryption code EDCode and decryption code DEC; the PC encryption protection platform will obtain the ciphertext data EData and encrypted data decryption code. The EDCode and the decryption code DEC are burned into the Flash of the embedded system device; the embedded system device calls the API function in the memory to dynamically obtain the private key Skey; the embedded system device decrypts the encrypted data according to the private key Skey and the decryption code DEC The code EDCode is decrypted to obtain the data decryption code DCode; the embedded system device uses the data decryption code DCode to decrypt the ciphertext data EData to obtain the key data Data to be protected; the embedded system device performs an emptying operation; The key data is encrypted, and the data decryption code for decrypting the ciphertext data is encrypted. The double encryption protection of the data is realized by software, and the security of the data is improved, and the implementation cost is lower than that of hardware implementation.

Embodiment 4

FIG. 8 is a schematic structural diagram of an embodiment of an encryption protection device according to the present invention; as shown in FIG. 8 , an encryption protection device 08 provided by an embodiment of the present invention includes: an acquisition module 81 , a first encryption module 82 , a second encryption module 83 , and a sending module 84; of which,

The obtaining module 81 is used to obtain the public key shared by the embedded system devices;

The first encryption module 82 is configured to encrypt the key data to be protected according to the first encryption code to obtain ciphertext data, and obtain the first decryption code according to the first encryption code; the first decryption code is used for decrypt the ciphertext data;

The second encryption module 83 is configured to encrypt the first decryption code according to the public key and the second encryption code to obtain the encrypted first decryption code, and obtain the second decryption code according to the second encryption code. decryption code; the second decryption code is used to decrypt the encrypted first decryption code;

The sending module 84 is configured to send the ciphertext data, the encrypted first decryption code and the second decryption code to the embedded system device.

Further, the second encryption code is an asymmetric encryption code;

The obtaining module 81 is specifically configured to obtain the public key shared by the embedded system device through a serial port;

The sending module 84 is specifically configured to burn the ciphertext data, the encrypted first decryption code and the second decryption code into the flash memory of the embedded system device.

The encryption protection device in this embodiment can be used to implement the technical solutions of the method embodiments shown above, and the implementation principles and technical effects thereof are similar, which will not be repeated here.

In practical applications, the acquisition module 81 , the first encryption module 82 , the second encryption module 83 , and the sending module 84 of the encryption protection device 08 can all be composed of a central processing unit (Central Processing Unit, CPU) located in the encryption protection device 08 , A microprocessor (Micro Processor Unit, MPU), a digital signal processor (Digital Signal Processor, DSP) or a Field Programmable Gate Array (Field Programmable Gate Array, FPGA) etc. are implemented.

Embodiment 5

FIG. 9 is a schematic structural diagram of an embodiment of an embedded system device of the present invention; as shown in FIG. 9 , an embedded system device 09 provided by an embodiment of the present invention includes: a generation module 91 , a sharing module 92 , and a storage module 93 ; wherein,

The generating module 91 is used to generate a private key according to its own inherent characteristic identifier, and use the asymmetric key generation method to derive the corresponding public key from the private key;

The sharing module 92 is configured to share the public key with an encryption protection device;

The storage module 93 is used to store the ciphertext data sent by the encryption protection device, the encrypted first decryption code and the second decryption code; the second decryption code is used to decrypt the encrypted first decryption code. Decryption code; the first decryption code is used to decrypt the ciphertext data.

Further, the device 09 further includes: a decryption module 94 and an emptying module 95; wherein,

The decryption module 94 is used to decrypt the ciphertext data in the memory to obtain the key data to be protected;

The clearing module 95 is used to perform clearing operation after obtaining the key data to be protected;

The decryption module 94 is specifically used for:

dynamically obtain the private key by calling an application programming interface API function in memory;

Perform a decryption operation on the encrypted first decryption code according to the private key and the second decryption code to obtain a first decryption code;

The ciphertext data is decrypted by using the first decryption code to obtain the key data to be protected.

Further, the generation module 91 is specifically configured to utilize a hash algorithm to generate a private key according to its own inherent characteristic identifier; wherein, the inherent characteristic identifier includes: a vendor ID, a serial number SN;

The sharing module 92 is specifically configured to share the public key with the encryption protection device through a serial port;

The storage module 93 is specifically configured to store the ciphertext data burned by the encryption protection device, the encrypted first decryption code and the second decryption code in the flash memory.

The embedded system apparatus of this embodiment can be used to execute the technical solutions of the method embodiments shown above, and the implementation principles and technical effects thereof are similar, and details are not described herein again.

In practical applications, the generation module 91 , the sharing module 92 , the storage module 93 , the decryption module 94 , and the clearing module 95 of the embedded system device 09 can all be controlled by a central processing unit (Central Processing Unit, CPU) located in the embedded system device 09 ), Micro Processor Unit (MPU), Digital Signal Processor (Digital Signal Processor, DSP) or Field Programmable Gate Array (Field Programmable Gate Array, FPGA) etc.

Embodiment 6

FIG. 10 is a schematic structural diagram of an embodiment of a protection system for key data of the present invention; as shown in FIG. 10 , a protection system 010 for key data provided by an embodiment of the present invention includes: an encryption protection device 0101 and an embedded system device 0102; wherein,

The encryption protection device 0101 adopts the encryption protection device described in the above embodiment;

The embedded system device 0102 adopts the embedded system device described in the above embodiments.

The key data protection system in this embodiment can be used to implement the technical solutions of the method embodiments shown above, and its implementation principles and technical effects are similar, and details are not described herein again.

As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the invention may take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media having computer-usable program code embodied therein, including but not limited to disk storage, optical storage, and the like.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention.

Claims (9)

1. A method for protecting critical data, the method comprising:

acquiring a public key shared by an embedded system device;

encrypting key data to be protected according to a first encryption code to obtain ciphertext data, and obtaining a first decryption code according to the first encryption code; the first decryption code is used for decrypting the ciphertext data;

encrypting the first decryption code according to the public key and a second encryption code to obtain an encrypted first decryption code, and obtaining a second decryption code according to the second encryption code; the second decryption code is used for decrypting the encrypted first decryption code; the second encrypted code is an asymmetric encrypted code;

sending the ciphertext data, the encrypted first decryption code and the second decryption code to the embedded system device, including:

and burning the ciphertext data, the encrypted first decryption code and the second decryption code into a Flash memory Flash of the embedded system device.

2. The method of claim 1,

the acquiring the public key shared by the embedded system device comprises the following steps:

and acquiring the public key shared by the embedded system device through a serial port.

3. A method for protecting critical data, the method comprising:

generating a private key according to the inherent characteristic identifier of the private key, and deriving a corresponding public key from the private key by using an asymmetric key generation method;

sharing the public key to an encryption protection device;

the encrypted data sent by the encryption protection device, the encrypted first decryption code and the encrypted second decryption code are stored; the second decryption code is used for decrypting the encrypted first decryption code; the first decryption code is used for decrypting the ciphertext data;

decrypting the ciphertext data in the memory to obtain key data to be protected;

after the key data to be protected are obtained, performing emptying operation;

the decrypting the ciphertext data in the memory to obtain the key data to be protected includes:

calling an Application Programming Interface (API) function in a memory to dynamically acquire the private key;

decrypting the encrypted first decryption code according to the private key and the second decryption code to obtain a first decryption code;

and carrying out decryption operation on the ciphertext data by using the first decryption code to obtain the key data to be protected.

4. The method of claim 3, wherein generating the private key according to the intrinsic characteristic identifier of the private key comprises:

generating a private key by utilizing a Hash algorithm according to the inherent characteristic identifier of the private key; wherein the inherent feature identifier comprises: supplier identity identifier (Vendor ID) and Serial Number (SN);

the sharing the public key to the encryption protection device includes:

sharing the public key to the encryption protection device through a serial port;

the storing of the ciphertext data sent by the encryption protection device, the encrypted first decryption code and the encrypted second decryption code includes:

and storing the ciphertext data burned by the encryption protection device, the encrypted first decryption code and the encrypted second decryption code in a Flash memory Flash.

5. An encryption protection apparatus, comprising:

the acquisition module is used for acquiring a public key shared by the embedded system device;

the first encryption module is used for encrypting the key data to be protected according to a first encryption code to obtain ciphertext data and obtaining a first decryption code according to the first encryption code; the first decryption code is used for decrypting the ciphertext data;

the second encryption module is used for encrypting the first decryption code according to the public key and the second encryption code to obtain an encrypted first decryption code and obtaining a second decryption code according to the second encryption code; the second decryption code is used for decrypting the encrypted first decryption code; the second encrypted code is an asymmetric encrypted code;

and the sending module is used for sending the ciphertext data, the encrypted first decryption code and the second decryption code to the embedded system device, and is specifically used for burning the ciphertext data, the encrypted first decryption code and the second decryption code into a Flash memory Flash of the embedded system device.

6. The apparatus of claim 5,

the obtaining module is specifically configured to obtain the public key shared by the embedded system device through a serial port.

7. An embedded system apparatus, the apparatus comprising:

the generating module is used for generating a private key according to the inherent characteristic identifier of the generating module and deriving a corresponding public key from the private key by using an asymmetric key generating method;

the sharing module is used for sharing the public key to the encryption protection device;

the storage module is used for storing the ciphertext data sent by the encryption protection device, the encrypted first decryption code and the encrypted second decryption code; the second decryption code is used for decrypting the encrypted first decryption code; the first decryption code is used for decrypting the ciphertext data;

the decryption module is used for decrypting the ciphertext data in the memory to obtain key data to be protected;

the clearing module is used for executing clearing operation after the key data to be protected are obtained;

the decryption module is specifically configured to:

calling an Application Programming Interface (API) function in a memory to dynamically acquire the private key;

decrypting the encrypted first decryption code according to the private key and the second decryption code to obtain a first decryption code;

and carrying out decryption operation on the ciphertext data by using the first decryption code to obtain the key data to be protected.

8. The apparatus according to claim 7, wherein the generating module is specifically configured to generate a private key according to its own inherent characteristic identifier by using a hash algorithm; wherein the inherent feature identifier comprises: supplier identity identifier (Vendor ID) and Serial Number (SN);

the sharing module is specifically configured to share the public key to the encryption protection device through a serial port;

the storage module is specifically configured to store the ciphertext data burned by the encryption protection device, the encrypted first decryption code, and the encrypted second decryption code in a Flash memory Flash.

9. A system for the protection of critical data, the system comprising an encryption protection device according to claim 5 or 6 and an embedded system device according to any one of claims 7 to 8.

Images