Identity authentication method based on dynamic key

Abstract

The invention discloses an identity authentication method based on a dynamic key, and particularly relates to the technical field of identity authentication. The method comprises the following steps of: generating a public and private key pair by using an asymmetric encryption algorithm through a communication initiating node, digitally signing identity information of the public and private key pair, and issuing the identity information to a distributed hash table network; the communication receiving node queries and verifies the validity of the identity information of the communication initiating node from the distributed hash table network; single data packet information is collected in the communication process to generate dynamic secret data, and a dynamic communication key is formed through Hash calculation; symmetrically encrypting the communication data by using the dynamic communication key, and updating the dynamic communication key; the communication receiving node decrypts the encrypted data packet based on the updated dynamic communication key, and verifies the data integrity and the identity authenticity of the communication initiating node; and the two communication parties execute corresponding control logic or service response according to the data integrity and identity authenticity verification result to realize safe communication and identity authentication.

Description

Technical Field

[0001] The present invention relates to the technical field of identity authentication, and more particularly to an identity authentication method based on a dynamic key. Background Art

[0002] With the rapid development and widespread application of network communication technology, identity authentication has become an important basis for ensuring the security of the communication process.

[0003] Traditional authentication methods based on static keys typically retain fixed keys for extended periods of time. Once the keys are leaked or acquired by attackers, they can lead to security issues such as identity theft, communication data tampering, or theft. Furthermore, traditional centralized authentication mechanisms rely heavily on third-party authentication servers, which can easily create single points of failure and present a high level of risk. Furthermore, traditional authentication methods lack effective mechanisms for dynamically updating keys, making them vulnerable to increasingly complex cyberattacks and unable to meet the increasing demands for security and robustness in current network communication scenarios. Summary of the Invention

[0004] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides an identity authentication method based on a dynamic key to solve the problems raised in the above-mentioned background technology.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] An identity authentication method based on a dynamic key comprises the following steps:

[0007] S1: The communication initiating node obtains the local network address, generates a public-private key pair using an asymmetric encryption algorithm, signs the identity information with the private key, and publishes the identity information to the distributed hash table network;

[0008] S2: The communication receiving node queries the identity information from the distributed hash table network and verifies the signature through the included public key to determine the validity of the identity information;

[0009] S3: The communicating parties generate dynamic secret data based on the single data packet information collected during the communication process, and generate a dynamic communication key for the current session;

[0010] S4: The communicating parties use the dynamic communication key to symmetrically encrypt the data to be sent and transmit the encrypted data packet according to the set protocol;

[0011] S5: The communicating parties integrate the received encrypted data packet and the local dynamic secret data and update the dynamic communication key of the communication session;

[0012] S6: The communication receiving node decrypts the encrypted data packet using the updated dynamic communication key and verifies the integrity and identity authenticity of the communication initiating node;

[0013] S7: The communicating parties complete the control logic or business response based on the verification results of the integrity of the encrypted data packet and the authenticity of the identity of the communication initiating node.

[0014] In a preferred embodiment, S1 is specifically:

[0015] Obtain the local network address of the communication initiating node's own device, and use an asymmetric encryption algorithm to generate an asymmetric key pair locally on the communication initiating node's own device, including an asymmetric public key and an asymmetric private key;

[0016] The identity information of the communication initiating node is digitally signed using an asymmetric private key to obtain an identity digital signature;

[0017] The communication initiating node's own identity information and identity digital signature are combined and published to the distributed hash table network.

[0018] In a preferred embodiment, S2 is specifically:

[0019] Query the identity information and identity digital signature issued by the communication initiating node from the distributed hash table network;

[0020] Perform digital signature verification on the identity digital signature based on the asymmetric public key contained in the identity information published by the communication initiating node;

[0021] By comparing the matching relationship between the identity information and the identity digital signature, confirm whether the identity digital signature is consistent with the identity information to determine the validity of the identity information.

[0022] In a preferred embodiment, S3 is specifically:

[0023] The communication initiating node and the communication receiving node respectively detect the data packets transmitted during the communication process and determine whether each data packet is a single data packet;

[0024] Collect the data packet sets determined as single data packets respectively, and splice the data contents to form dynamic secret original data of the communication initiating node and the communication receiving node;

[0025] The dynamic secret original data of the communication initiating node and the communication receiving node are hashed to generate corresponding dynamic secret hash data as the dynamic communication key.

[0026] In a preferred embodiment, S4 is specifically:

[0027] The communication initiating node and the communication receiving node respectively obtain the dynamic communication key and input the dynamic communication key into the symmetric encryption algorithm to form a symmetric encryption key;

[0028] The communication initiating node and the communication receiving node respectively symmetrically encrypt the data to be sent based on the symmetric encryption key to obtain a symmetrically encrypted data packet;

[0029] According to the pre-set communication protocol, the symmetrically encrypted data packets are sent to each other through the communication link, and the data packet sequence number is marked when sending.

[0030] In a preferred embodiment, S5 is specifically:

[0031] The communication initiating node and the communication receiving node respectively receive the symmetrically encrypted data packets from the communication link, and respectively determine the correspondence between the received data packets and the data packets based on the data packet sequence numbers;

[0032] The communication initiating node and the communication receiving node respectively use the dynamic secret original data to integrate the received symmetrically encrypted data packet with the dynamic secret original data;

[0033] Perform hash calculations on the symmetrically encrypted data packet and the dynamic secret original data after data integration, and update the dynamic communication key.

[0034] In a preferred embodiment, S6 is specifically:

[0035] The communication receiving node obtains the updated dynamic communication key and inputs it into the symmetric encryption algorithm to form a symmetric decryption key for decrypting the current data packet;

[0036] Decrypt the received symmetrically encrypted data packet using the symmetric decryption key to obtain the decrypted data content of the data packet;

[0037] Perform data integrity verification based on the decrypted data content and packet sequence number to determine whether the decrypted data content is consistent with the data content sent by the communication initiating node;

[0038] The authenticity of the identity of the communication initiating node is determined by matching and verifying the data content after decryption of the data packet with the identity digital signature of the communication initiating node.

[0039] In a preferred embodiment, S7 is specifically:

[0040] The communication initiating node and the communication receiving node respectively obtain the data content after decryption of the data packet and the identity authenticity verification result of the communication initiating node;

[0041] Based on the decrypted data content of the data packet and the identity authenticity verification result of the communication initiating node, the consistency relationship between the decrypted data content of the data packet and the pre-set business rules or control instructions is determined;

[0042] According to the consistency relationship, the business operation or communication control logic corresponding to the data content after decryption of the data packet is executed to complete the data interaction of the communication session.

[0043] The technical effects and advantages of the dynamic key-based identity authentication method of the present invention are as follows:

[0044] The secure publication and trusted verification of identity information are achieved through a distributed hash table network, avoiding the single point of failure and security vulnerabilities that may exist in a centralized authentication server; at the same time, the communication key is dynamically generated using the single data packet information collected during the communication process, ensuring the continuous dynamic update of the key, thereby effectively preventing key leakage, replay attacks and data theft, and improving the security and reliability of the communication process; in addition, the present invention uses a symmetric encryption algorithm to achieve secure data transmission, ensuring the high consistency and anti-interference ability of the communicating parties during the identity authentication and data interaction process. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a schematic diagram of an identity authentication method based on dynamic keys according to the present invention. DETAILED DESCRIPTION

[0046] The following will provide a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0047] Example

[0048] Figure 1 The present invention provides an identity authentication method based on a dynamic key, which includes the following steps:

[0049] S1: The communication initiating node obtains the local network address, generates a public-private key pair using an asymmetric encryption algorithm, signs the identity information with the private key, and publishes the identity information to the distributed hash table network;

[0050] S2: The communication receiving node queries the identity information from the distributed hash table network and verifies the signature through the included public key to determine the validity of the identity information;

[0051] S3: The communicating parties generate dynamic secret data based on the single data packet information collected during the communication process, and generate a dynamic communication key for the current session;

[0052] S4: The communicating parties use the dynamic communication key to symmetrically encrypt the data to be sent and transmit the encrypted data packet according to the set protocol;

[0053] S5: The communicating parties integrate the received encrypted data packet and the local dynamic secret data and update the dynamic communication key of the communication session;

[0054] S6: The communication receiving node decrypts the encrypted data packet using the updated dynamic communication key and verifies the integrity and identity authenticity of the communication initiating node;

[0055] S7: The communicating parties complete the control logic or business response based on the verification results of the integrity of the encrypted data packet and the authenticity of the identity of the communication initiating node.

[0056] S1: The communication initiating node obtains the local network address, generates a public-private key pair using an asymmetric encryption algorithm, signs the identity information with the private key, and publishes the identity information to the distributed hash table network, including:

[0057] Obtain the local network address of the communication initiating node's own device, and use an asymmetric encryption algorithm to generate an asymmetric key pair locally on the communication initiating node's own device, including an asymmetric public key and an asymmetric private key;

[0058] A communication initiating node refers to a network device that is responsible for initiating communication requests and transmitting data to other communication nodes during the communication process; a communication initiating node can be a smartphone, a personal computer, a server, or other device with network communication functions and computing capabilities. In actual implementation, for example, a smartphone serves as a communication initiating node, and an application that can implement dynamic key-based identity authentication functions is installed and run on the smartphone. After running the application, the smartphone first needs to determine the local network address of the device in the current network environment. The local network address refers to the unique network address information used by the communication initiating node to identify itself in the connected network, usually the IP address of the communication initiating node, such as an IPv4 address or an IPv6 address. The communication initiating node can use a network interface query program to initiate a query request to its own network interface. Specifically, it can use a network interface query function, such as the network interface traversal function provided by the operating system, to traverse all available network interfaces of the communication initiating node device, check whether each network interface is active, and check whether each active network interface is associated with a valid network address to determine the local network address. For example, when the communication initiating node is connected to a local area network, the query determines a valid IPv4 address such as 192.168.0.100 or an IPv6 address such as FE80:0202:B3FF:FE1E:8329 as the local network address. After obtaining the local network address, the communication initiating node uses an asymmetric encryption algorithm to generate an asymmetric key pair locally on its own device. An asymmetric encryption algorithm refers to a cryptographic algorithm that uses different keys for encryption and decryption. In actual implementation, for example, the elliptic curve cryptography algorithm can be used as the asymmetric encryption algorithm, and in particular, the elliptic curve digital signature algorithm can be used. The communication initiating node's own device, based on the elliptic curve digital signature algorithm, uses a cryptographically secure random number generator to generate a set of random large integers that meet pre-set security requirements as an asymmetric private key. The communication initiating node then uses the asymmetric private key to derive the corresponding asymmetric public key according to the key generation rules of the elliptic curve digital signature algorithm. The generated asymmetric public key and asymmetric private key together constitute an asymmetric key pair. For example, the communication initiating node uses the P-256 elliptic curve digital signature algorithm to generate a key pair on the device: first, a random private key is generated using the cryptographically secure random number generator built into the communication initiating node device, such as a 256-bit random bit string. Then, according to the elliptic curve digital signature algorithm, the corresponding asymmetric public key is calculated based on the generated random private key, such as a public key represented as a point on an elliptic curve. The resulting asymmetric key pair includes the asymmetric public key and the asymmetric private key.

[0059] The identity information of the communication initiating node is digitally signed using an asymmetric private key to obtain an identity digital signature;

[0060] The identity information of the communication initiating node refers to the data set used to identify the communication initiating node during network communications, including the communication initiating node's username, local network address, and asymmetric public key. For example, the communication initiating node's identity information can be presented in a structured data format such as JSON or XML. For example, it can be stored in JSON format as a key-value pair consisting of the username, IPv4 or IPv6 address, and asymmetric public key. This ensures that the identity information is clearly structured and easy to parse. After forming its own identity information, the communication initiating node uses a previously generated asymmetric private key to digitally sign the identity information. A digital signature operation involves performing a cryptographic operation on the identity information using the asymmetric private key to obtain a signature that indicates the identity information originated from the communication initiating node itself. For example, the SHA-256 hash algorithm can be used to hash the communication initiating node's identity information to generate a fixed-length hash digest. Subsequently, the communication initiating node uses the asymmetric private key to perform a signature operation on the hash digest using the elliptic curve digital signature algorithm to generate a digital signature that verifies the authenticity of the identity information. For example, the signature data can be presented as a fixed-length bit string. The signature data is used by the communication receiving node to verify the authenticity of the identity information of the communication initiating node to prevent the identity information from being maliciously tampered with or forged.

[0061] The identity information and digital signature of the communication initiating node are combined and published to the distributed hash table network;

[0062] After obtaining the identity information and digital signature, the communication initiating node combines the identity information and digital signature data to form a complete data set, encapsulating it in a specific data structure, such as JSON or XML, to ensure the stability of the data structure and ease of parsing during network transmission. The communication initiating node then publishes the combined data to the distributed hash table network using a distributed hash table network. A distributed hash table network is a decentralized network structure composed of multiple network nodes, each of which is responsible for storing a portion of the data. Data storage and location within the network are achieved through hash mapping relationships. Specifically, the communication initiating node first performs a hash calculation on the combined data as a whole to generate a distributed hash table network key value; the distributed hash table network key value is used to determine the network node location where the combined data as a whole is stored in the distributed hash table network, for example, generating a 160-bit hash key value, and selecting the network node responsible for storing the data based on the distributed hash table network key value. The communication initiating node sends a data release request to the network node through the network communication protocol, and explicitly stores the data as a whole, which is the combination of identity information and identity digital signature, on the network node; other network nodes can quickly and accurately query the identity information and signature data released by the communication initiating node through the data positioning mechanism of the distributed hash table network for identity authentication. For example, the communication initiating node selects a distributed hash table network constructed using the Kademlia protocol, stores the data as a whole on multiple nodes in the network, and stores redundant data copies through the data replication mechanism specified by the protocol to enhance data availability and ensure that other communication nodes can accurately and efficiently obtain the data as a whole released by the communication initiating node, which is used to implement the dynamic key-based identity authentication process.

[0063] S2: The receiving node queries the identity information from the distributed hash table network and verifies the signature using the included public key to determine the validity of the identity information, including:

[0064] Query the identity information and identity digital signature issued by the communication initiating node from the distributed hash table network;

[0065] Specifically, for example, a receiving node is a server running software modules that support dynamic key-based identity authentication methods. When a receiving node receives a communication request from an initiating node, it must first verify the authenticity of the initiating node by querying its identity information and digital signature published on a distributed hash table network. A distributed hash table network consists of multiple decentralized nodes, each responsible for distributing and storing different data within the network. Using hash mapping algorithms and specific data storage rules, it achieves decentralized and efficient network data access. For example, a receiving node might explicitly utilize a distributed hash table network constructed using the Kademlia protocol. Multiple nodes exist within the network, each locating and storing different data fragments based on key values. To determine the storage location of the identity information and digital signature published by the initiating node within the distributed hash table network, the receiving node first hashes the initiating node's identity information using a hashing algorithm to obtain a network location key. After obtaining the network location key, the receiving node uses a distributed hash table (DHT) network data query protocol, such as Kademlia, and network routing and data search algorithms to search multiple network nodes for the data set containing the identity information and digital signature published by the initiating node. This data set is a data structure consisting of the initiating node's username, local network address, asymmetric public key, and digital signature data. It is encapsulated in a data format such as JSON or XML to ensure data parsability within the network. When performing a network query, the receiving node uses the node routing mechanism within the DHT network to initiate a query request, starting with locally known network nodes and gradually moving towards the nodes closest to the network location key in the network topology until it locates the network node responsible for storing the target data. After determining the location of the network node responsible for storing the target data, the receiving node sends a data retrieval request to the network node using a network protocol, such as UDP or TCP. Upon receiving the data retrieval request, the target network node encapsulates the identity information and digital signature data set published by the initiating node, stored in its local storage area, and transmits it back to the receiving node via a network link. After receiving the entire data returned by the network node, the receiving node will perform data parsing operations, such as structural parsing of the entire data in JSON or XML format, to extract the identity information and identity digital signature data issued by the communication initiating node for authentication. Therefore, the process of the receiving node querying the identity information and identity digital signature issued by the communication initiating node from the distributed hash table network ensures that the receiving node can accurately obtain the identity information of the communication initiating node.

[0066] Perform digital signature verification on the identity digital signature based on the asymmetric public key contained in the identity information published by the communication initiating node;

[0067] By comparing the identity information with the identity digital signature, confirm whether the identity digital signature is consistent with the identity information to determine the validity of the identity information;

[0068] When parsing identity information data, the receiving node obtains the asymmetric public key of the communication initiating node. The asymmetric public key is the public key portion of the asymmetric key pair generated by the communication initiating node and is used to verify the identity digital signature. Digital signature verification is a cryptographic operation that requires calculating a hash summary of the identity information using a cryptographic hash algorithm based on the identity information data published by the communication initiating node. The receiving node uses the asymmetric public key of the communication initiating node and an asymmetric encryption algorithm, such as the elliptic curve digital signature algorithm, to decrypt the identity digital signature retrieved from the distributed hash table network, obtaining the hash summary corresponding to the signature. The receiving node then compares the hash summary obtained by decrypting the signature with the identity information hash summary calculated locally by the receiving node to determine whether the two hash summaries match. Specifically, for example, the receiving node selects the SHA-256 hash algorithm to perform a hash operation on the identity information obtained from the distributed hash table network, generating a 256-bit hash summary. The receiving node then uses the asymmetric public key published by the communication initiating node to execute the elliptic curve digital signature algorithm to decrypt the identity digital signature, obtaining the hash summary corresponding to the signature. The receiving node compares the two hash digests for consistency; if they are identical, the identity digital signature was generated by the initiating node using its own asymmetric private key. This ensures that the identity information has not been maliciously tampered with and indeed originated from the initiating node, thereby verifying the validity of the identity digital signature. Through digital signature verification, the receiving node obtains the credibility of the initiating node's identity information, providing the data foundation and technical support for the final confirmation of the identity information's authenticity.

[0069] The communication receiving node obtains the result of the matching relationship between the identity information and the identity digital signature through digital signature verification. The matching relationship between the identity information and the identity digital signature refers to the corresponding relationship between the two hash summary data obtained through the cryptographic digital signature verification operation. If the two hash summary data obtained through the digital signature verification process are consistent, it means that the identity digital signature data corresponds to the current identity information data, and then determines that the identity information data is authentic and valid; on the contrary, if the comparison results are inconsistent, it means that the identity digital signature does not match the current identity information data, which means that the identity information may have been tampered with or forged, and the communication receiving node needs to reject this communication connection request. By judging the matching relationship between the identity information and the identity digital signature, the communication receiving node confirms whether the identity information released by the communication initiating node is credible, thereby ensuring the security of the communication connection and the reliability of the identity authentication process.

[0070] S3: The communicating parties generate dynamic secret data based on the single data packet information collected during the communication process, and generate a dynamic communication key for the current session, including:

[0071] The communication initiating node and the communication receiving node respectively detect the data packets transmitted during the communication process and determine whether each data packet is a single data packet;

[0072] The communication receiving node is a network device responsible for receiving and responding to requests initiated by the communication initiating node during the communication process. It can also be a server, personal computer, or smart mobile terminal device. The data packet transmitted during the communication process is the basic information unit transmitted through the network protocol. The communication initiating node and the communication receiving node both send and receive data packets through the network link. Each data packet consists of a specific data structure, including the data packet sequence number, data payload content, the sender's network address, and the receiver's network address. In order to generate dynamic secret data for dynamic key identity authentication, the communication initiating node and the communication receiving node need to detect each data packet transmitted on the communication link separately to determine whether each data packet is a single data packet. A single data packet is a data packet that is transmitted only once during the entire communication process and is not retransmitted. This means that the specific data packet sequence number is not reused during transmission and is only transmitted once on the network link. The communication initiating node and the communication receiving node each perform data packet detection during the communication process. Specifically, for example, the communication initiating node and the communication receiving node each maintain a sequence number list or data structure for recording the sequence numbers of sent or received data packets. Whenever a new data packet is sent or received, the sequence number of the data packet is added to the sequence number list to track the sending or receiving status of the data packet in real time. At the same time, the communication initiating node and the communication receiving node specify a data packet confirmation mechanism in the communication protocol, for example, by defining an ACK confirmation data packet to feedback the data packet reception status, thereby detecting whether the data packet has been retransmitted. If the data packet sent by the communication initiating node does not receive confirmation information from the communication receiving node within a predetermined time, the communication initiating node will send the data packet again and mark the data packet as a non-single data packet in the sequence number list. For data packets that have not been retransmitted, the communication initiating node marks them as single data packets. Similarly, when receiving data packets, the communication receiving node determines whether the data packet has been received repeatedly based on the data packet sequence number. If the data packet sequence number does not appear repeatedly and no retransmission request for the data packet is received from the communication initiating node, the communication receiving node marks the data packet as a single data packet; otherwise, it is marked as a non-single data packet. The communication initiating node and the communication receiving node each use a packet detection and marking mechanism to accurately distinguish between single-shot and non-single-shot packets in real time throughout the communication process, providing basic data support for the generation of dynamic secret data. For example, if the communication initiating node sends a packet with sequence number 1001 to the communication receiving node and receives an acknowledgment packet from the communication receiving node within the specified time, the packet is marked as a single-shot packet. If the communication initiating node sends a packet with sequence number 1002 but does not receive an acknowledgment from the communication receiving node, it resends the packet, and the packet with sequence number 1002 is marked as a non-single-shot packet.

[0073] Collect the data packet sets determined as single data packets respectively, and splice the data contents to form dynamic secret original data of the communication initiating node and the communication receiving node;

[0074] The communication initiating node and the communication receiving node each collect and form their own data packet sets based on the marking results of the packets identified as single packets. Specifically, the communication initiating node collects the sequence of packets it has sent during the communication process and marked as single packets to form the communication initiating node single packet set; the communication receiving node collects the sequence of packets it has received during the communication process and marked as single packets to form the communication receiving node single packet set. The communication initiating node and the communication receiving node each perform data concatenation on the data packet contents in the single packet set. Data concatenation involves concatenating the data payload contents of each single packet in the data packet set in the order of the packet sequence numbers to form continuous original data content, referred to as dynamic secret original data. The communication initiating node concatenates the data payload contents of all identified single packets in ascending sequence number order, for example, concatenating the payload contents of packets with sequence numbers 1001, 1003, and 1005 in sequence to obtain the communication initiating node's dynamic secret original data. Similarly, the communication receiving node performs similar data concatenation on its own collected single packet set to generate the communication receiving node's dynamic secret original data. Dynamic secret original data is an important input data source for generating dynamic communication keys. Therefore, the data content splicing process follows the order of the data packet sequence numbers to ensure the consistency and accuracy of the dynamic secret original data spliced ​​by the communicating parties. For example, in a communication session, the communication initiating node sends data packets with sequence numbers 1001, 1002, and 1003 respectively. Data packet 1002 is retransmitted and marked as a non-single data packet. Therefore, the communication initiating node only splices the payload content of the data packets with sequence numbers 1001 and 1003 to form the dynamic secret original data. The communication receiving node also only collects data packets with sequence numbers 1001 and 1003 and splices the packet payload content in the same order to form the dynamic secret original data corresponding to the communication receiving node, thereby ensuring the consistency of the dynamic secret original data.

[0075] Perform hash calculations on the dynamic secret original data of the communication initiating node and the communication receiving node respectively to generate corresponding dynamic secret hash data as the dynamic communication key;

[0076] The communication initiating node and the communication receiving node each perform a hash calculation on their respective generated dynamic secret original data to generate corresponding dynamic secret hash data. Hashing is a cryptographic hash function operation that uses a cryptographic hash function, such as the SHA-256 hash function, to process the dynamic secret original data, converting data input of any length into hash output data of a fixed length. The communication initiating node uses the SHA-256 hash algorithm to hash the concatenated dynamic secret original data, generating 256-bit dynamic secret hash data. The communication receiving node performs the same hash calculation on its own concatenated dynamic secret original data, also generating 256-bit dynamic secret hash data. The generated dynamic secret hash data is data content-sensitive. Any slight difference in the dynamic secret original data will result in a completely different hash output, thus ensuring the security and uniqueness of the generated dynamic secret hash data. The generated dynamic secret hash data is used as the dynamic communication key for the current communication session, used in data encryption, decryption, and authentication processes, ensuring the security of data exchange between the communicating parties.

[0077] S4: The communicating parties use the dynamic communication key to symmetrically encrypt the data to be sent and transmit the encrypted data packet according to the set protocol, including:

[0078] The communication initiating node and the communication receiving node respectively obtain the dynamic communication key and input the dynamic communication key into the symmetric encryption algorithm to form a symmetric encryption key;

[0079] A symmetric encryption key is a cryptographic key that is identical in the encryption and decryption processes. In a symmetric encryption algorithm, both the sender and receiver use the same key to encrypt or decrypt data, thereby ensuring secure data transmission. The initiating and receiving nodes each use a dynamic communication key as an input parameter to the symmetric encryption algorithm. Based on the algorithm's key derivation rules, they perform operations to obtain a symmetric encryption key that meets the algorithm's requirements. For example, the initiating and receiving nodes can choose to use the Advanced Encryption Standard (AES) as a symmetric encryption algorithm. Specifically, taking the AES-256 algorithm as an example, the required symmetric encryption key length is 256 bits. The initiating and receiving nodes each input the dynamic communication key into the AES algorithm's key derivation function and perform key normalization. This ensures that the processed symmetric encryption key fully meets the key length and key security requirements of the AES-256 algorithm, forming a standard symmetric encryption key. The resulting symmetric encryption key ensures cryptographic security and compliance, avoiding potential security vulnerabilities caused by key normalization flaws. This improves communication security and prevents risks such as man-in-the-middle attacks and key leaks.

[0080] The communication initiating node and the communication receiving node respectively symmetrically encrypt the data to be sent based on the symmetric encryption key to obtain a symmetrically encrypted data packet;

[0081] Data encryption is the process of converting original plaintext data into ciphertext using a specific cryptographic algorithm. The goal is to prevent unauthorized access to the actual data content during data transmission. When a communication initiating node needs to send data to a communication receiving node, it first encrypts the plaintext data using a symmetric encryption key. This encryption process is based on a symmetric encryption algorithm. For example, the data to be transmitted by the communication initiating node could be text, digital data, or file contents. To ensure that the data content cannot be intercepted and sensitive information obtained by a third party during network transmission, the communication initiating node inputs the plaintext data into the encryption function of the AES-256 algorithm and performs an operation using the obtained symmetric encryption key to generate a ciphertext data packet. Specifically, for example, if the data content to be transmitted by the communication initiating node is the string "Device A issues an authentication request," the communication initiating node converts this string into a computer-readable data bit stream, then inputs it into the AES-256 encryption algorithm and performs an encryption operation using the symmetric encryption key. The resulting randomized data content is completely unrecognizable, representing the symmetric encrypted data packet. Similarly, when the communication receiving node needs to send data to the communication initiating node, the communication receiving node will also perform the same processing on the data content to be sent, using the symmetric encryption key to symmetrically encrypt its plaintext data to generate a symmetrically encrypted data packet. The encryption process can be completed through a standardized data encryption function, ensuring that the encrypted data packet meets specific format requirements and has strong security during network transmission. In this way, the communication initiating node and the communication receiving node can ensure that the data they transmit is always in an encrypted and protected state throughout the communication process, thereby effectively preventing third parties from obtaining valid information when intercepting the data content during transmission, ensuring the security and confidentiality of data exchange between the two communicating parties, and meeting the high standards for secure data transmission in identity authentication scenarios.

[0082] According to the pre-set communication protocol, the symmetrically encrypted data packets are sent to each other through the communication link, and the data packet sequence number is marked when sending;

[0083] A communication link refers to the network path used for data transmission between a communication initiating node and a communication receiving node. It can be a local area network, the Internet, or a specific wireless network, ensuring the efficiency and reliability of data transmission within the network. The communication initiating and receiving nodes transmit data packets using a pre-defined communication protocol. This protocol can be a standard protocol such as UDP (User Datagram Protocol) or TCP (Transmission Control Protocol), or a custom protocol specifically designed to meet the specific requirements of this authentication method, ensuring the standardization and reliability of data packet transmission. The communication protocol also specifies a marking method for data packet transmission: each transmitted data packet is assigned a unique packet sequence number. The packet sequence number is used to identify the order in which each data packet is sent during communication. For example, it is a 32-bit unsigned integer that increments continuously from the initial number. Each time a data packet is transmitted, the communication initiating or receiving node marks the currently transmitted data packet with the current sequence number and records this sequence number after transmission for transmission confirmation or data integrity verification.

[0084] S5: The communicating parties integrate the received encrypted data packet and the local dynamic secret data and update the dynamic communication key for the communication session, including:

[0085] The communication initiating node and the communication receiving node respectively receive the symmetrically encrypted data packets from the communication link, and respectively determine the correspondence between the received data packets and the data packets based on the data packet sequence numbers;

[0086] After encrypting data and sending it back and forth over the communication link, the initiating and receiving nodes need to receive symmetrically encrypted data packets from each other. The communication link provides a reliable and stable network channel for the accurate transmission of data packets, ensuring stable and orderly transmission according to the predefined rules of the communication protocol. When receiving data packets, the initiating and receiving nodes receive them encrypted with a symmetric encryption key. During network transmission, these packets are transmitted in ciphertext. Without decryption, no useful information can be directly obtained from the packet contents. This ensures data security and confidentiality during transmission and prevents man-in-the-middle attacks or eavesdropping threats along the network transmission path. Upon receiving these symmetrically encrypted data packets, the initiating and receiving nodes need to determine the exact correspondence between the received data packets and the data packets sent during the communication process based on the packet sequence number defined in the communication protocol. The packet sequence number is a unique numerical number assigned to each transmitted data packet during the data transmission process. It increments continuously throughout the communication process and does not repeat, ensuring that both communicating parties can accurately track and record the sending and transmission order of each data packet. For example, when sending data packets, the initiating node increments the sequence number starting with 1. Each data packet is accompanied by a corresponding sequence number, 1, 2, 3, and so on. When receiving a data packet, the receiving node first parses the sequence number to determine the received packet's sequence number, ensuring that both communicating parties can match and identify each other based on the packet's sequence number. The initiating and receiving nodes each maintain a data structure, such as a queue or list, that records the packet's sequence number to enable detailed tracking of the transmission and reception status of each packet. Upon receiving a data packet, the receiving node searches its locally recorded packet transmission history based on the sequence number in the packet to determine whether the packet is newly transmitted during the communication process or a retransmission of an already transmitted packet. This ensures the accurate correspondence between the received and transmitted data packets. Furthermore, if data packets are out of order or lost, the receiving node can request the initiating node to retransmit the missing data packet based on the packet's sequence number record, ensuring the integrity and reliability of the communication process.

[0087] The communication initiating node and the communication receiving node respectively use the dynamic secret original data to integrate the received symmetrically encrypted data packet with the dynamic secret original data;

[0088] The data consolidation operation specifically involves concatenating or merging the data content of the received symmetrically encrypted data packet with the dynamic secret original data sequence to form a new data sequence for key update operations. For example, the dynamic secret original data sequence currently stored locally at the communication initiating node is a bit string formed by concatenating the contents of individual data packets with sequence numbers 1001, 1003, and 1005. When the communication initiating node receives a symmetrically encrypted data packet with sequence number 2001 from the communication receiving node, the communication initiating node concatenates the data content of the symmetrically encrypted data packet with sequence number 2001 with the local dynamic secret original data sequence, thereby appending the received data packet content to the local dynamic secret original data sequence to form a new data sequence for dynamic communication key update. The same process is also performed independently and symmetrically on the communication receiving node. When the communication receiving node receives a symmetrically encrypted data packet with sequence number 1001 from the communication initiating node, it concatenates the data content of the data packet with the local dynamic secret original data sequence stored at the communication receiving node to form a new data sequence. Therefore, after the communication initiating node and the communication receiving node independently complete the data integration locally, they respectively obtain new data sequences.

[0089] Perform hash calculations on the symmetrically encrypted data packets and dynamic secret original data after data integration, and update the dynamic communication key;

[0090] The communication initiating node and the communication receiving node each hold a new data sequence formed by integrating the locally stored dynamic secret original data sequence with the received symmetric encrypted data packet. During the communication process, the new data sequence is formed by concatenating or combining the dynamic secret original data sequence with the data content of the received symmetric encrypted data packet in a preset order according to the rules defined in the communication protocol. The communicating parties each apply a cryptographically secure hash calculation method to this new data sequence, generating a fixed-length, highly random, and irreversible hash digest data, which is then used to update the dynamic communication key.

[0091] For example, the data sequence after integration of the data held by the communication initiating node is "the ciphertext of the data packet with sequence number 1001" spliced ​​with the "dynamic secret original data sequence of the communication initiating node"; the data sequence after integration of the data held by the communication receiving node is "the ciphertext of the data packet with sequence number 2001" spliced ​​with the "dynamic secret original data sequence of the communication receiving node". The communication initiating node and the communication receiving node each input these data sequences into the SHA-256 algorithm, and calculate their own hash digest data to form a consistent new dynamic communication key. This ensures that both communicating parties simultaneously obtain and update the same latest dynamic communication key without directly transmitting the dynamic communication key.

[0092] The communication initiating node and the communication receiving node respectively store the newly generated dynamic communication key in the local storage area, replacing the previously used dynamic communication key as the new basic cryptographic key for the communication process to support the encryption and decryption process of the data.

[0093] S6: The receiving node decrypts the encrypted data packet using the updated dynamic communication key and verifies the integrity and authenticity of the communication initiating node, including:

[0094] The communication receiving node obtains the updated dynamic communication key and inputs it into the symmetric encryption algorithm to form a symmetric decryption key for decrypting the current data packet;

[0095] After obtaining the updated dynamic communication key, the receiving node uses it as an input parameter into a pre-selected symmetric encryption algorithm to derive a symmetric decryption key. A symmetric encryption algorithm is a cryptographic algorithm used to encrypt and decrypt data during communication. Both the encrypting and decrypting parties use the same key.

[0096] Specifically, for example, the receiving and initiating nodes select the Advanced Encryption Standard (AES) algorithm as the symmetric encryption algorithm for this communication. The AES algorithm is a widely used standard symmetric cryptographic algorithm with proven security and stability, making it widely applicable in secure network communication scenarios. The receiving node uses the updated dynamic communication key as input to the AES-256 key derivation function. The key derivation function performs computational processing to ensure that the generated symmetric decryption key fully meets the key length and security strength requirements of the AES-256 algorithm.

[0097] The process by which the receiving node generates the symmetric decryption key follows predetermined cryptographic specifications and standards. All operations are performed independently within the receiving node's local device, eliminating the need for additional key information exchange with the initiating node. This improves communication security and eliminates security risks that may arise from key transmission during communication. Furthermore, the initiating node simultaneously performs the exact same operations on its own device and generates the same symmetric decryption key. This allows the initiating and receiving nodes to simultaneously obtain the exact same symmetric decryption key without directly exchanging key information, ensuring that both communicating parties maintain synchronized and consistent key updates within their respective independent environments.

[0098] Decrypt the received symmetrically encrypted data packet using the symmetric decryption key to obtain the decrypted data content of the data packet;

[0099] The data decryption operation is the reverse process of the data encryption operation. The communication receiving node performs the inverse operation of the symmetric decryption algorithm by inputting the symmetric decryption key and the received data packet ciphertext, thereby restoring the symmetrically encrypted data packet ciphertext to the original plaintext data content.

[0100] The receiving node uses the AES-256 symmetric decryption algorithm and symmetric decryption key to decrypt the symmetric encrypted data packet sent from the initiating node. Specifically, assuming the receiving node receives a randomized data packet (ciphertext) encrypted using the AES-256 algorithm, it inputs the ciphertext into the AES-256 algorithm's decryption function and performs the algorithmic operations using the symmetric decryption key. The AES-256 algorithm then performs multiple rounds of standardized nonlinear transformations, gradually inverting the ciphertext data to ultimately restore the original data content (plaintext) of the packet. For example, assuming the receiving node receives a ciphertext data packet from the initiating node, which is a bitstream encrypted using the AES-256 algorithm, it inputs the symmetric decryption key and ciphertext data. After multiple rounds of AES-256 operations, the receiving node ultimately recovers the original plaintext content of the packet, such as the string "Device A issues an authentication request."

[0101] Perform data integrity verification based on the decrypted data content and packet sequence number to determine whether the decrypted data content is consistent with the data content sent by the communication initiating node;

[0102] Data integrity verification refers to the verification process performed by the communication receiving node using the data packet sequence number, decrypted data content and pre-defined communication protocol specifications to determine whether the data content of the data packet received on the communication link is completely consistent with the data content originally sent by the communication initiating node after decryption.

[0103] Specifically, the receiving node records the correspondence between the packet sequence number and the expected content of the corresponding packet in the packet transmission sequence number list. After receiving and decrypting the packet, the receiving node compares the decrypted data content with the expected data content corresponding to the sequence number word by word and bit by bit to verify whether the content matches. If the decrypted data content is completely consistent with the expected content, the receiving node confirms that the packet content integrity meets the requirements; if the content is different, it determines that the packet may have been tampered with or an error occurred during transmission or encryption and decryption.

[0104] The authenticity of the communication initiating node is confirmed by matching the decrypted data content of the data packet with the identity digital signature of the communication initiating node;

[0105] After completing data integrity verification, the receiving node matches the decrypted data content of the data packet with the identity digital signature previously issued by the communication initiating node. The receiving node hashes the decrypted data content and compares it with the hash digest of the decrypted identity digital signature of the communication initiating node to determine whether the hash digest data is completely consistent. If they are completely consistent, the identity of the communication initiating node is determined to be authentic and the identity authentication of the two communicating parties is successful. Otherwise, the identity authentication is considered to have failed.

[0106] S7: Based on the verification results of the integrity of the encrypted data packet and the authenticity of the identity of the communication initiating node, the communicating parties complete the control logic or business response, including:

[0107] The communication initiating node and the communication receiving node respectively obtain the data content after decryption of the data packet and the identity authenticity verification result of the communication initiating node;

[0108] The initiating and receiving nodes each record and store the decrypted data content and identity verification results. These serve as the basis for both parties to determine the validity of service logic or control instructions. The data content is used for service execution, while the identity verification results ensure the legality, security, and reliability of service execution.

[0109] Based on the decrypted data content of the data packet and the identity authenticity verification result of the communication initiating node, the consistency relationship between the decrypted data content of the data packet and the pre-set business rules or control instructions is determined;

[0110] After the communication initiating node and receiving node respectively obtain the decrypted data content and identity verification results of the data packet, they will begin business logic analysis. The communicating parties compare the decrypted data content of the data packet according to pre-defined business rules or control instructions to determine whether the obtained data information is consistent with the pre-defined business rules or control instructions. Pre-defined business rules or control instructions are defined and jointly confirmed by both communicating parties before the communication process begins based on specific business needs. They may include but are not limited to requirements for data format, data content restrictions, instruction code accuracy, or data transmission legitimacy. After receiving and decrypting the data packet, the receiving node will compare and verify the data content according to the locally pre-defined business rules or control instructions. For example, if the communication receiving node pre-defines a business rule of "only accepting file permission requests from communication nodes that have passed identity authentication", then when obtaining the data content of the decrypted data packet from the communication initiating node (for example, "requesting file system access permissions"), the communication receiving node will first verify whether the identity authenticity verification result of the communication initiating node is "passed". Only when the identity authenticity verification result is "passed" and the data content of the decrypted data packet meets the format, content and logic requirements of the preset business rules, can the communication receiving node determine that there is a complete consistency relationship between the received data packet content and the business rules or control instructions. The communication receiving node can use local computer program modules to perform automated business logic verification, including but not limited to: first, using the data parsing module to parse the decrypted data content of the data packet into verifiable structured information in detail; and using the business rule matching module to compare the parsed data item by item with the predetermined rules to determine whether there is any violation of the business rules or control instructions. For example, in a specific implementation, the receiving node parses the data packet content into a structured instruction code such as "REQUEST_FILE_ACCESS." Combined with the identity authenticity verification result (e.g., identity verification passed), it then performs a business logic comparison to determine whether the instruction content complies with the predetermined business rule requirement that "only nodes that have passed identity authentication may initiate file access requests." Therefore, through this business logic and instruction consistency verification process, both communicating parties can ensure the security and reliability of the communication process.

[0111] Based on the consistency relationship, the service operation or communication control logic corresponding to the data content after decryption of the data packet is executed to complete the data interaction of the communication session;

[0112] When the receiving node verifies, through business rules or control instructions, that the decrypted data content of the data packet is completely consistent with the pre-defined business rules or control instructions, it can then execute specific business operations or communication control logic based on the data packet content. For example, if the decrypted data content of the data packet is "Communication initiating node device A requests file system access rights," and business rules verify that this request is consistent with the identity verification results of communication node A and meets the business logic requirements defined by the communication protocol, the receiving node will execute specific business logic, such as granting communication initiating node device A access rights to the file system, and record the execution process and results of this business operation. Similarly, the initiating node will also perform business processing or execute communication control logic based on the data content and identity verification results returned by the receiving node. After completing the business operation or communication control logic execution, both communicating parties will record all operation processes and results for audit and retrospective review of the communication process. Ultimately, the communicating parties complete the data exchange process of the entire communication session and properly preserve the business data, communication logs, and all operation records after the communication is complete.

[0113] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters and thresholds in the formulas are set by technicians in this field according to actual conditions.

[0114] The above embodiments can be implemented in whole or in part via software, hardware, firmware, or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product comprises one or more computer instructions or computer programs. When loaded or executed on a computer, the processes or functions described in the embodiments of this application are fully or partially performed. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired means (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium accessible by a computer or a data storage device such as a server or data center that contains a collection of one or more available media. The available medium can be magnetic media (e.g., floppy disks, hard disks, tapes), optical media (e.g., DVDs), or semiconductor media. The semiconductor media can be a solid-state drive.

[0115] Those skilled in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0116] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0117] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. In actual implementation, there may be other division methods, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0118] The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, and may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected to achieve the purpose of this embodiment according to actual needs.

[0119] In addition, each functional module in each embodiment of the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0120] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0121] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0122] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. An identity authentication method based on dynamic keys, characterized in that: The steps include: S1: The communication initiating node obtains the local network address, generates a public-private key pair using an asymmetric encryption algorithm, signs the identity information with the private key, and publishes the identity information to the distributed hash table network; S2: The communication receiving node queries the identity information from the distributed hash table network and verifies the signature through the included public key to determine the validity of the identity information; S3: The communicating parties generate dynamic secret data based on the single data packet information collected during the communication process, and generate a dynamic communication key for the current session; S4: The communicating parties use the dynamic communication key to symmetrically encrypt the data to be sent and transmit the encrypted data packet according to the set protocol; S5: The communicating parties integrate the received encrypted data packet and the local dynamic secret data and update the dynamic communication key of the communication session; S6: The communication receiving node decrypts the encrypted data packet using the updated dynamic communication key and verifies the integrity and identity authenticity of the communication initiating node; S7: The communicating parties complete the control logic or business response based on the verification results of the integrity of the encrypted data packet and the authenticity of the identity of the communication initiating node.

2. The identity authentication method based on dynamic keys according to claim 1, characterized in that: S1, specifically: Obtain the local network address of the communication initiating node's own device, and use an asymmetric encryption algorithm to generate an asymmetric key pair locally on the communication initiating node's own device, including an asymmetric public key and an asymmetric private key; The identity information of the communication initiating node is digitally signed using an asymmetric private key to obtain an identity digital signature; The communication initiating node's own identity information and identity digital signature are combined and published to the distributed hash table network.

3. The identity authentication method based on dynamic keys according to claim 2, characterized in that: S2, specifically: Query the identity information and identity digital signature issued by the communication initiating node from the distributed hash table network; Perform digital signature verification on the identity digital signature based on the asymmetric public key contained in the identity information published by the communication initiating node; By comparing the matching relationship between the identity information and the identity digital signature, confirm whether the identity digital signature is consistent with the identity information to determine the validity of the identity information.

4. The identity authentication method based on dynamic keys according to claim 3, characterized in that: S3, specifically: The communication initiating node and the communication receiving node respectively detect the data packets transmitted during the communication process and determine whether each data packet is a single data packet; Collect the data packet sets determined as single data packets respectively, and splice the data contents to form dynamic secret original data of the communication initiating node and the communication receiving node; The dynamic secret original data of the communication initiating node and the communication receiving node are hashed to generate corresponding dynamic secret hash data as the dynamic communication key.

5. The identity authentication method based on dynamic keys according to claim 4, characterized in that: S4, specifically: The communication initiating node and the communication receiving node respectively obtain the dynamic communication key and input the dynamic communication key into the symmetric encryption algorithm to form a symmetric encryption key; The communication initiating node and the communication receiving node respectively symmetrically encrypt the data to be sent based on the symmetric encryption key to obtain a symmetrically encrypted data packet; According to the pre-set communication protocol, the symmetrically encrypted data packets are sent to each other through the communication link, and the data packet sequence number is marked when sending.

6. The identity authentication method based on dynamic keys according to claim 5, characterized in that: S5, specifically: The communication initiating node and the communication receiving node respectively receive the symmetrically encrypted data packets from the communication link, and respectively determine the correspondence between the received data packets and the data packets based on the data packet sequence numbers; The communication initiating node and the communication receiving node respectively use the dynamic secret original data to integrate the received symmetrically encrypted data packet with the dynamic secret original data; Perform hash calculations on the symmetrically encrypted data packet and the dynamic secret original data after data integration, and update the dynamic communication key.

7. The identity authentication method based on dynamic keys according to claim 6, characterized in that: S6, specifically: The communication receiving node obtains the updated dynamic communication key and inputs it into the symmetric encryption algorithm to form a symmetric decryption key for decrypting the current data packet; Decrypt the received symmetrically encrypted data packet using the symmetric decryption key to obtain the decrypted data content of the data packet; Perform data integrity verification based on the decrypted data content and packet sequence number to determine whether the decrypted data content is consistent with the data content sent by the communication initiating node; The authenticity of the identity of the communication initiating node is determined by matching and verifying the data content after decryption of the data packet with the identity digital signature of the communication initiating node.

8. The identity authentication method based on dynamic keys according to claim 7, characterized in that: S7, specifically: The communication initiating node and the communication receiving node respectively obtain the data content after decryption of the data packet and the identity authenticity verification result of the communication initiating node; Based on the decrypted data content of the data packet and the identity authenticity verification result of the communication initiating node, the consistency relationship between the decrypted data content of the data packet and the pre-set business rules or control instructions is determined; According to the consistency relationship, the business operation or communication control logic corresponding to the data content after decryption of the data packet is executed to complete the data interaction of the communication session.

Images