Network information security encryption method

Abstract

The invention relates to the technical field of network security, and discloses a network information security encryption method, which comprises the following steps: step 1, a sender generates a pair of post-quantum asymmetric keys including a public key and a private key, the public key is used for encrypting a symmetric key, and the private key is used for decrypting the encrypted symmetric key; the sender sends the public key to the receiver through the secure channel, and verifies the authenticity of the public key of the receiver; and step 2, the sender generates a dynamic symmetric key based on a device identifier and a current timestamp, and the device identifier is used for uniquely identifying the device generating the key. A unique and unpredictable dynamic symmetric key is generated by combining a device identifier and a timestamp, the security problem that a traditional static key is easy to crack and abuse in long-term use is solved, in addition, a dynamic update triggering mechanism based on a time interval and a data volume is supported, key management has high flexibility and security, and the security of the key management is improved. And the encryption requirements in different network environments are met.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network information security encryption method. Background Art

[0002] With the rapid development of Internet technology, the transmission and storage of network information plays a vital role in various fields. The accompanying network security issues are becoming more and more serious, including various security threats such as data theft, tampering, and man-in-the-middle attacks, which put forward higher requirements for the security and reliability of network information encryption methods. Especially with the development of quantum computing technology, traditional encryption systems based on algorithms such as RSA and ECC have gradually exposed potential security risks.

[0003] Traditional encryption methods generally use static symmetric keys or asymmetric keys for data encryption and decryption operations. However, static keys are easily cracked or leaked in long-term use. Once the keys are stolen, the security of the system will be completely lost. At the same time, the key update frequency is low and the operation is complicated, which cannot meet the needs of efficient and secure key management in a dynamic network environment.

[0004] The security of widely used public key encryption algorithms such as RSA and ECC depends on the computational complexity of decomposition or discrete logarithm problems. The emergence of quantum computers has enabled quantum computing methods based on Shor's algorithm to crack algorithms in polynomial time, resulting in challenges to existing encryption systems. Therefore, it is urgent to develop new encryption methods that are resistant to quantum computing attacks to ensure the long-term security of the system.

[0005] In the process of data transmission, existing technologies focus more on data encryption and decryption, but ignore the importance of data integrity verification. Once the transmitted data is maliciously tampered with, the receiver cannot accurately identify it, which will lead to security vulnerabilities. The existing data integrity verification mechanism is still insufficient in performance and reliability and needs to be optimized urgently.

[0006] In traditional encryption methods, if the initial vector is not set properly, the same data will generate the same ciphertext in the encryption operation, increasing the possibility of attackers deciphering by analyzing repeated patterns. In addition, the weak ability to resist replay attacks is the shortcoming of existing encryption methods, which cannot effectively defend against data packet reuse attacks.

[0007] Therefore, those skilled in the art provide a network information security encryption method to solve the above-mentioned problems. Summary of the invention

[0008] In view of the deficiencies in the prior art, the present invention provides a network information security encryption method to solve the problems raised in the above background technology.

[0009] To achieve the above objectives, the present invention is implemented through the following technical solutions: a network information security encryption method, comprising:

[0010] Step 1: The sender generates a pair of post-quantum asymmetric keys, including a public key and a private key, where the public key is used to encrypt the symmetric key and the private key is used to decrypt the encrypted symmetric key;

[0011] The sender sends the public key to the receiver through a secure channel and verifies the authenticity of the receiver's public key;

[0012] Step 2: The sender generates a dynamic symmetric key based on the device identification and the current timestamp, wherein the device identification is used to uniquely identify the device generating the key, and the timestamp is used to ensure the time sensitivity of the key and generate a unique dynamic symmetric key;

[0013] Step 3: The sender uses a dynamic symmetric key to encrypt the plaintext data and generates an initialization vector and an integrity tag. The initialization vector is used to ensure the uniqueness of the encryption operation, and the integrity tag is used to verify whether the ciphertext data has been tampered with.

[0014] The ciphertext data, integrity tag and initialization vector generated after encryption are encapsulated in the data packet;

[0015] Step 4: The sender encrypts the dynamic symmetric key with the receiver's public key to generate an encrypted symmetric key, and encapsulates the encrypted symmetric key, ciphertext data, integrity tag, and initialization vector into a data packet.

[0016] Step 5: After receiving the data packet, the receiver uses the private key to decrypt and obtain the dynamic symmetric key before encryption, and extracts the initial vector and ciphertext data in the data packet to perform the decryption operation;

[0017] Step 6: The receiver uses the dynamic symmetric key obtained by decryption and the initial vector in the data packet to decrypt the ciphertext data to restore the plaintext data. At the same time, it verifies whether the integrity tag in the data packet is consistent with the tag generated by the decrypted data.

[0018] If the integrity tags are consistent, it is confirmed that the data has not been tampered with and the recovery of the plaintext data is complete.

[0019] Preferably, the dynamic symmetric key is generated by the following formula:

[0020] K sym =Hash(DeviceID∥TS∥Rand),

[0021] Among them, K sym is a dynamic symmetric key, Hash is a collision-resistant hash function, and DeviceID is the unique identifier of the sender device, which is used to distinguish the device that generates the key;

[0022] TS is the current timestamp, which is used to ensure that the key is time-sensitive;

[0023] Rand is a high-entropy random number used to improve the unpredictability of the key;

[0024] The value range of Rand is:

[0025] Rand∈[0,2 128 -1],

[0026] Among them, Rand is a high entropy random number used to improve the unpredictability of the key.

[0027] Preferably, the length of the initial vector is 96 bits, which is used to ensure the uniqueness of the encryption operation and satisfies the following formula:

[0028] IV=Rand(Length=96 bits),

[0029] Among them, IV is the initial vector, bits is the unit vector bit, Length is the length,

[0030] Rand is a high-entropy random number used to improve the unpredictability of the key.

[0031] Preferably, the integrity tag is generated based on a dynamic symmetric key and encrypted data, and is used to verify whether the ciphertext has been tampered with, satisfying the following formula:

[0032] T=Tag(K sym , C),

[0033] Among them, T is the integrity label, K sym is a dynamic symmetric key, C is the encrypted ciphertext data, and Tag is the message authentication code generation function;

[0034] The encrypted ciphertext data, integrity tag and initial vector are encapsulated into a data packet together using the following formula:

[0035] Packet = {C, T, IV},

[0036] Among them, Packet is the data packet, C is the ciphertext data, T is the integrity tag, and IV is the initial vector.

[0037] Preferably, the encryption key generated by the sender encrypting the dynamic symmetric key using the receiver's public key satisfies the following formula:

[0038] K enc =Encrypt PK (K sym ),

[0039] Among them, K enc is the encrypted dynamic symmetric key, PK is the public key of the recipient, K sym is a dynamic symmetric key;

[0040] The receiver uses its private key to decrypt the encrypted dynamic symmetric key to satisfy the following formula:

[0041] K sym =Decrypt SK (K enc ),

[0042] Among them, K sym is a dynamic symmetric key, SK is the recipient’s private key, K enc It is the encrypted dynamic symmetric key.

[0043] Preferably, the dynamic symmetric key decrypted by the receiver is used together with the initial vector to decrypt the ciphertext data and satisfies the following formula:

[0044] P=Decrypt(K sym , IV, C),

[0045] Among them, P is the decrypted plaintext data, K sym is a dynamic symmetric key, IV is the initial vector, and C is the ciphertext data;

[0046] The integrity tag generated by the receiver after decrypting the plaintext data is compared with the integrity tag in the data packet to satisfy the following formula:

[0047] Valid(Packet)if T received =T generated ,

[0048] Among them, T received is the integrity tag provided in the data packet, T generated The integrity tag generated by the receiver for the decrypted plaintext data.

[0049] Valid(Packet) indicates the validity of the data packet (Packet).

[0050] Preferably, the update of the dynamic symmetric key is based on the following triggering conditions:

[0051] The time interval is updated when the following conditions are met:

[0052] Update(K sym )if TS current -TS last >Δt,

[0053] Among them, TScurrent is the current timestamp, TS last The timestamp for when the key was generated or updated,

[0054] Δt is the preset time interval used to periodically update the dynamic symmetric key, K sym is a dynamic symmetric key;

[0055] Update when the data volume meets the following conditions:

[0056] Update(K sym )if D transferred >T data ,

[0057] Among them, D transferred The amount of data transmitted for key update, T data is the preset data volume threshold, K sym A dynamic symmetric key.

[0058] Preferably, the timestamp TS and the amount of transmitted data D transferred The sender and the receiver negotiate and update synchronously to ensure the consistency of the key update. The negotiation formula is:

[0059] TS sync =max(TS sender , TS receiver ),

[0060] D sync =D sender +D receiver ,

[0061] Among them, TS sync It is the synchronization timestamp negotiated by both parties.

[0062] TS sender and TS receiver is the timestamp of the sender and the receiver,

[0063] D sync The amount of data transmitted synchronously by both parties.

[0064] D sender and D receiver The amount of data transmitted between the sender and the receiver.

[0065] Preferably, the integrity tag T is generated by using a message authentication code algorithm of encrypted data and a dynamic symmetric key and satisfies the following formula:

[0066] T=MAC(K sym , C∥IV),

[0067] Among them, T is the integrity label, Ksym is a dynamic symmetric key, C is ciphertext data, IV is the initial vector, and MAC represents a function based on a message authentication code algorithm.

[0068] Preferably, the receiver verifies that the consistency of the integrity tag T satisfies the following formula:

[0069] Valid(T)if MAC(K sym ,C||IV)=T received ,

[0070] Among them, T received is the integrity tag contained in the data packet, Valid(T) is the condition for determining whether the integrity check is passed, and K sym is a dynamic symmetric key, C is ciphertext data, IV is the initial vector, and MAC represents a function based on a message authentication code algorithm.

[0071] The present invention provides a network information security encryption method, which has the following beneficial effects:

[0072] 1. The present invention generates a unique and unpredictable dynamic symmetric key by combining device identification and timestamp, thereby solving the security problem that traditional static keys are easily cracked and abused in long-term use. In addition, it supports a dynamic update trigger mechanism based on time intervals and data volume, making key management highly flexible and secure, and adapting to encryption requirements in different network environments.

[0073] 2. The present invention adopts post-quantum encryption algorithm to protect dynamic symmetric keys, which can effectively defend against the threat of future quantum computing technology to crack traditional RSA and ECC algorithms. The introduction of post-quantum encryption technology ensures the security of key transmission and enhances the long-term applicability of the system in quantum computing environments.

[0074] 3. The present invention generates an integrity tag through a dynamic symmetric key and ciphertext data, and uses a message authentication code algorithm to perform data integrity verification to ensure that the recipient can verify whether the data has been tampered with, effectively protecting the integrity of the transmitted data and enhancing the data's anti-tampering capability during transmission.

[0075] 4. The initial vector generated in the encryption operation of the present invention is used to ensure the uniqueness of the encryption operation. The initial vector generation mechanism avoids the risk of repeated ciphertexts generated in multiple encryptions of the same data, enhances the encryption's ability to resist replay attacks, and at the same time, improves the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0077] In order to make the technical personnel in the technical field understand the scheme of the present invention, the technical scheme in the embodiment of the present invention will be clearly and completely described below in combination with the drawings in the embodiment of the present invention. Obviously, the described embodiment is a partial embodiment of the present invention, not a complete embodiment. Based on the embodiment of the present invention, other embodiments obtained by ordinary technicians in the field without creative work should fall within the scope of protection of the present invention.

[0078] The present invention is described in detail below in conjunction with the accompanying drawings:

[0079] Example:

[0080] Please refer to the attached Figure 1 The embodiment of the present invention provides a network information security encryption method, comprising:

[0081] Step 1: The sender generates a pair of post-quantum asymmetric keys, including a public key and a private key, where the public key is used to encrypt the symmetric key and the private key is used to decrypt the encrypted symmetric key;

[0082] The sender sends the public key to the receiver through a secure channel and verifies the authenticity of the receiver's public key;

[0083] Step 2: The sender generates a dynamic symmetric key based on the device identification and the current timestamp, wherein the device identification is used to uniquely identify the device generating the key, and the timestamp is used to ensure the time sensitivity of the key and generate a unique dynamic symmetric key;

[0084] Step 3: The sender uses a dynamic symmetric key to encrypt the plaintext data and generates an initialization vector and an integrity tag. The initialization vector is used to ensure the uniqueness of the encryption operation, and the integrity tag is used to verify whether the ciphertext data has been tampered with.

[0085] The ciphertext data, integrity tag and initialization vector generated after encryption are encapsulated in the data packet;

[0086] Step 4: The sender encrypts the dynamic symmetric key with the receiver's public key to generate an encrypted symmetric key, and encapsulates the encrypted symmetric key, ciphertext data, integrity tag, and initialization vector into a data packet.

[0087] Step 5: After receiving the data packet, the receiver uses the private key to decrypt and obtain the dynamic symmetric key before encryption, and extracts the initial vector and ciphertext data in the data packet to perform the decryption operation;

[0088] Step 6: The receiver uses the dynamic symmetric key obtained by decryption and the initial vector in the data packet to decrypt the ciphertext data to restore the plaintext data. At the same time, it verifies whether the integrity tag in the data packet is consistent with the tag generated by the decrypted data.

[0089] If the integrity tags are consistent, it is confirmed that the data has not been tampered with and the recovery of the plaintext data is complete.

[0090] Benefits of step 1 Ensure the security of dynamic symmetric keys during transmission. Sending public keys through secure channels and verifying the authenticity of the recipient's public key effectively prevents the risks of man-in-the-middle attacks and forged public keys, ensuring the reliability of encrypted communications;

[0091] The benefits of step 2 are to solve the problem that traditional static keys are easily cracked or abused after long-term use. At the same time, it supports flexible key update strategies, allowing the system to adapt to complex and changing network environments.

[0092] Benefits of step 3: The generation of integrity tags enables the ciphertext data to be verified for tampering during transmission, thereby enhancing the integrity and anti-tampering capabilities of the data and providing double protection for the confidentiality and integrity of the data;

[0093] The benefits of step 4 protect the security of the dynamic symmetric key during transmission and ensure that the receiver can correctly obtain the dynamic symmetric key. In addition, the ciphertext data, integrity tag and initial vector are encapsulated into the data packet together, so that the receiver has complete information required for the operation during the decryption process, which simplifies the decryption operation process and improves communication efficiency;

[0094] The benefits of step 5 are that the private key decryption operation ensures that the legitimate recipient can obtain the dynamic symmetric key, preventing the key from being leaked or used by unauthorized parties. At the same time, the separation and extraction of the initial vector and ciphertext data simplifies the decryption operation and improves the processing efficiency of the system;

[0095] Benefits of step 6: By checking the consistency of the integrity tag, it is ensured that the transmitted data has not been tampered with or forged, thereby improving the security and reliability of the data transmission process. If the integrity check passes, the receiver can safely obtain the plaintext data and complete the data recovery process.

[0096] In summary, each step has a clear division of labor in the system, covering key generation, encryption, transmission and decryption, improving the confidentiality, integrity and anti-attack capabilities of network information security encryption, and providing comprehensive security protection for information transmission in complex network environments.

[0097] The dynamic symmetric key is generated by the following formula:

[0098] K sym =Hash(DeviceID∥TS∥Rand),

[0099] Among them, K sym is a dynamic symmetric key, Hash is a collision-resistant hash function, and DeviceID is the unique identifier of the sender device, which is used to distinguish the device that generates the key;

[0100] TS is the current timestamp, which is used to ensure that the key is time-sensitive;

[0101] Rand is a high-entropy random number used to improve the unpredictability of the key;

[0102] The range of rand values ​​is:

[0103] Rand∈[0,2 128 -1],

[0104] Among them, Rand is a high entropy random number used to improve the unpredictability of the key.

[0105] By combining the unique identifier DeviceID of the sender's device to generate a key, the key generated by the device is ensured to be independent. When performing encryption operations at the same time, the generated key is unique due to the difference in device identifiers. This can effectively prevent key conflicts or duplications, and improve the security of key management;

[0106] The use of high entropy number Rand improves the randomness of the key, enhances the unpredictability of the key, and greatly increases the difficulty of brute force cracking by attackers. The value range of high entropy number provides key space to ensure that the key generation has strong anti-collision and anti-guessing capabilities;

[0107] Use collision-resistant hash functions for key generation to ensure that the generated dynamic symmetric key cannot be reversed or forged. The collision-resistant characteristics of the hash function avoid differences in input parameters and can generate completely different keys, further improving the security of the system;

[0108] By combining device identifiers and timestamps, the generated dynamic symmetric keys can adapt to various needs in complex network environments, such as regular key updates, real-time encryption, and device communications. This significantly improves the flexibility and adaptability of the system.

[0109] The dynamic key generation formula integrates the characteristics of device identifiers and timestamps. The generation process is simple, efficient, and secure. The core lies in the diversity of input parameters, so that the generated dynamic key can meet the requirements of high-security scenarios and prevent the key from being maliciously cracked or tampered with.

[0110] In summary, the above dynamic symmetric key generation formula ensures the uniqueness, time sensitivity and unpredictability of the key generation process. At the same time, it improves the dynamic update capability and security reliability of the key, providing an efficient and flexible key management solution for network information encryption.

[0111] The length of the initial vector is 96 bits, which is used to ensure the uniqueness of the encryption operation and satisfies the following formula:

[0112] IV=Rand(Length=96 bits),

[0113] Among them, IV is the initial vector, bits is the unit vector bit, Length is the length,

[0114] Rand is a high-entropy random number used to improve the unpredictability of the key.

[0115] The length of the initial vector IV is set to 96 bits, and each encryption operation generates a unique value. The unique design ensures that when encrypting the same plaintext data, the generated ciphertext will be completely different due to different initial vectors, which effectively prevents the duplication of ciphertext patterns and prevents attackers from cracking the encrypted content by analyzing the same ciphertext;

[0116] The uniqueness of the initial vector effectively defends against replay attacks. When an attacker intercepts a data packet, the decryption process will fail during subsequent replay due to a different initial vector, thus ensuring the security of the transmitted data.

[0117] The initial vector avoids security vulnerabilities caused by fixed or repeated vectors. Attackers cannot crack the data by analyzing the ciphertext pattern generated by encrypting the same data multiple times. Each encryption operation generates a different initial vector, which effectively improves the encryption strength.

[0118] The length of the initial vector is set to 96 bits, which can meet the requirements of randomness and security, and avoid additional burden on storage and computing resources. It is used in low-power environments such as IoT devices to ensure the universality of the encryption system.

[0119] In summary, setting the initial vector length to 96 bits and generating it through high entropy numbers ensures the uniqueness and anti-attack capability of encryption operations, greatly improves the security and compatibility of the system, and at the same time meets the requirements of the use of modern encryption algorithms, providing reliable protection for data encryption in complex network environments.

[0120] The integrity tag is generated based on the dynamic symmetric key and encrypted data, and is used to verify whether the ciphertext has been tampered with, satisfying the following formula:

[0121] T=Tag(K sym , C),

[0122] Among them, T is the integrity label, K sym is a dynamic symmetric key, C is the encrypted ciphertext data, and Tag is the message authentication code generation function;

[0123] The encrypted ciphertext data, integrity tag and initial vector are encapsulated into the data packet together using the following formula:

[0124] Packet = {C, T, IV},

[0125] Among them, Packet is the data packet, C is the ciphertext data, T is the integrity tag, and IV is the initial vector.

[0126] Benefits of integrity labeling:

[0127] The integrity tag is generated by using the dynamic symmetric key and the encrypted ciphertext data, and the encrypted data is verified using the message authentication code generation function to ensure that the data has not been tampered with during transmission. Once the data is tampered with, the integrity tag generated by the receiver after decryption will be inconsistent with the tag in the transmitted data, effectively detecting and preventing malicious tampering;

[0128] The integrity tag is generated by combining the dynamic symmetric key and ciphertext data through the message authentication code algorithm to ensure that the generated tag is bound to the specific data. If an attacker attempts to tamper with the ciphertext data or initial vector in the data packet, the verification will fail, thus enhancing the anti-tampering capability of the data packet.

[0129] Use dynamic symmetric keys to generate integrity tags, avoiding the security risks of fixed parameters or static keys in the tag generation process, ensuring that the generated tags are dynamic and unique, and improving the security of the overall system.

[0130] Benefits of packet encapsulation:

[0131] The encrypted ciphertext data, integrity tag and initial vector are encapsulated into the data packet together and managed uniformly during the transmission process. The encapsulation structure reduces the complexity of transmission and improves the efficiency of data transmission.

[0132] The data packet contains all the information required for decryption. The receiver can extract the relevant content in the data packet and complete decryption and integrity verification to ensure the integrity of the decryption process.

[0133] In summary, integrity tags are generated in combination with dynamic symmetric keys and ciphertext data to ensure the integrity and authenticity of data during transmission. By uniformly encapsulating encrypted data, integrity tags and initial vectors in data packets, the efficiency of data transmission and decryption is improved, and the system's anti-tampering and anti-attack capabilities are enhanced, providing strong support for data encryption and secure transmission in complex network environments.

[0134] The encryption key generated by the sender using the receiver's public key to encrypt the dynamic symmetric key satisfies the following formula:

[0135] K enc =Encrypt PK (K sym ),

[0136] Among them, K enc is the encrypted dynamic symmetric key, PK is the public key of the recipient, K sym is a dynamic symmetric key;

[0137] The receiver uses its private key to decrypt the encrypted dynamic symmetric key to satisfy the following formula:

[0138] K sym =Decrypt SK (K enc ),

[0139] Among them, K sym is a dynamic symmetric key, SK is the recipient’s private key, K enc It is the encrypted dynamic symmetric key.

[0140] The benefits of using the receiver's public key to encrypt a dynamic symmetric key are:

[0141] The dynamic symmetric key is encrypted with the public key of the recipient to generate an encrypted dynamic symmetric key. Due to the characteristics of public key encryption, if the data packet is intercepted during transmission, the attacker cannot decrypt and restore the original dynamic symmetric key, thus protecting the security of key transmission;

[0142] The secure distribution of dynamic symmetric keys is achieved through the receiver's public key encryption, avoiding the risks of leakage and tampering in the traditional static key sharing process. A new dynamic symmetric key is generated for each communication, ensuring that the key distribution process has high security and flexibility;

[0143] The dynamic symmetric key is encrypted with the receiver's public key to ensure that the receiver holding the corresponding private key can decrypt and recover the key. Even if an attacker pretends to be the sender or receiver, he cannot obtain the legitimate private key and cannot decrypt, effectively preventing man-in-the-middle attacks.

[0144] The benefits of the receiver using its private key to decrypt the encrypted dynamic symmetric key are:

[0145] The receiver uses its private key to decrypt the encrypted dynamic symmetric key. The receiver can successfully recover the original dynamic symmetric key, ensuring that the key can be used by the legitimate receiver and preventing unauthorized parties from accessing the key.

[0146] The dynamic symmetric key is restored through private key decryption to ensure that the keys used for data encryption and decryption during communication are consistent, preventing communication failures and data leakage caused by key transmission errors or tampering, thereby enhancing the security and credibility of the system.

[0147] In summary, the design of the sender using the receiver's public key to encrypt the dynamic symmetric key and the receiver using the private key to decrypt ensures the security of the key during transmission and the exclusivity of the decryption operation. This mechanism effectively prevents key leakage, tampering and unauthorized access, enhances the security and credibility of both parties in communication, and is both flexible and efficient, suitable for encryption application scenarios in future complex network environments.

[0148] The dynamic symmetric key decrypted by the receiver is used together with the initial vector to decrypt the ciphertext data and satisfies the following formula:

[0149] P=Decrypt(K sym , IV, C),

[0150] Among them, P is the decrypted plaintext data, K sym is a dynamic symmetric key, IV is the initial vector, and C is the ciphertext data;

[0151] The integrity tag generated by the receiver after decrypting the plaintext data is compared with the integrity tag in the data packet to satisfy the following formula:

[0152] Valid(Packet)if T received =T generated ,

[0153] Among them, T received is the integrity tag provided in the data packet, T generated The integrity tag generated by the receiver for the decrypted plaintext data.

[0154] Valid(Packet) indicates the validity of the data packet (Packet).

[0155] The receiver decrypts the dynamic symmetric key and the initial vector to decrypt the ciphertext data:

[0156] The receiver uses the dynamic symmetric key and initial vector obtained by decryption to decrypt the ciphertext data and restore the plaintext data. The combination of the dynamic symmetric key and the initial vector ensures the accuracy of data decryption, so that the receiver can correctly restore the original plaintext data encrypted by the sender;

[0157] The dynamic symmetric key and initial vector are parameters dynamically generated during the encryption process. The decryption process requires both parameters to be completed correctly, preventing attackers from cracking ciphertext data by obtaining part of the parameters.

[0158] The initial vector is generated during the encryption operation, so that the ciphertext generated after the same plaintext data is encrypted in different communication sessions will be completely different, enhancing the decryption's ability to resist pattern analysis and is suitable for complex network encryption scenarios that require high security;

[0159] The benefits of the receiver verifying the decrypted integrity tag are:

[0160] The receiver generates a new integrity tag for the decrypted plaintext data and compares it with the integrity tag provided in the data packet. If the two are consistent, it indicates that the data has not been tampered with during transmission, ensuring the integrity of the data and preventing malicious attackers from modifying the data packet;

[0161] The integrity tag comparison process of the data packet verifies whether the ciphertext data and the initial vector are consistent, ensuring that the data packet received by the receiver is indeed generated by the legitimate sender and has not been tampered with, thereby enhancing the credibility of data transmission.

[0162] In summary, the receiver decrypts the dynamic symmetric key and initial vector to restore the plaintext data, ensuring the accuracy and security of the decryption operation. The generation and comparison of integrity tags provide tampering detection capabilities and credibility assurance for data packets, preventing data from being maliciously modified or forged during transmission. It enhances the security, reliability and anti-attack capabilities of the encrypted communication system, and is suitable for data transmission needs in various complex network environments.

[0163] The dynamic symmetric key is updated based on the following trigger conditions:

[0164] The time interval is updated when the following conditions are met:

[0165] Update(K sym )if TS current -TS last >Δt,

[0166] Among them, TS current is the current timestamp, TS last The timestamp for when the key was generated or updated,

[0167] Δt is the preset time interval used to periodically update the dynamic symmetric key, K sym is a dynamic symmetric key;

[0168] Update when the data volume meets the following conditions:

[0169] Update(K sym )if D transferred >T data ,

[0170] Among them, D transferred The amount of data transmitted for key update, T data is the preset data volume threshold, K sym is a dynamic symmetric key;

[0171] Timestamp TS and amount of data transferred D transferred The sender and the receiver negotiate and update synchronously to ensure the consistency of the key update. The negotiation formula is:

[0172] TS sync =max(TS sender , TS receiver ),

[0173] Dsync =D sender +D receiver ,

[0174] Among them, TS sync It is the synchronization timestamp negotiated by both parties.

[0175] TS sender and TS receiver is the timestamp of the sender and the receiver,

[0176] D sync The amount of data transmitted synchronously by both parties.

[0177] D sender and D receiver The amount of data transmitted between the sender and the receiver.

[0178] Benefits of updating based on time interval:

[0179] The update of dynamic symmetric keys is triggered by time intervals, ensuring that the keys are automatically replaced after a period of use, reducing the risk of key leakage or cracking due to long-term use. By setting a predetermined time interval, dynamic symmetric keys have a short validity period in communication, enhancing the system's anti-attack capabilities;

[0180] The time interval update mechanism ensures that key generation and update have a predictable periodicity, which is suitable for the regular security update requirements in real-time communication scenarios, while avoiding potential security issues caused by key aging;

[0181] Dynamic symmetric keys are automatically updated at fixed time intervals, eliminating the need for manual intervention in key management, reducing the complexity of key updates and simplifying system operations, which has significant advantages, especially in large-scale devices.

[0182] Benefits of updating based on data volume:

[0183] If the amount of encrypted transmission data exceeds the preset threshold, the dynamic symmetric key is automatically updated to ensure that different parts of the data transmitted in high data traffic scenarios use different keys, thereby enhancing the encryption's ability to resist pattern analysis;

[0184] As the amount of data transmitted increases, repeated use of the same key will increase the possibility of ciphertext patterns being analyzed by attackers. Triggering key updates through data volume thresholds effectively avoids the risk of key reuse and improves the security of data transmission;

[0185] Benefits of synchronous update of timestamp and amount of data transferred:

[0186] The sender and receiver negotiate to synchronize the timestamp and the amount of data transmitted to ensure that the key updates of both parties are consistent in the triggering conditions of time and data volume, avoiding encryption and decryption failures due to asynchrony.

[0187] In summary, the dynamic symmetric key update mechanism combines the trigger conditions of time interval and data volume, and at the same time, through the negotiation and synchronization of timestamp and data volume, ensures that the key update is dynamic, secure and consistent. This mechanism can prevent key reuse and data pattern analysis attacks, can adapt to real-time communication and large data transmission scenarios, enhance the security, flexibility and reliability of the system, and provide comprehensive protection for network information encryption.

[0188] The integrity tag T is generated using a message authentication code algorithm that uses encrypted data and a dynamic symmetric key and satisfies the following formula:

[0189] T=MAC(K sym , C||IV),

[0190] Among them, T is the integrity label, K sym is a dynamic symmetric key, C is ciphertext data, IV is the initialization vector, and MAC represents a function based on a message authentication code algorithm;

[0191] The receiver verifies that the consistency of the integrity tag T satisfies the following formula:

[0192] Valid(T)if MAC(K sym ,C||IV)=T received ,

[0193] Among them, T received is the integrity tag contained in the data packet, Valid(T) is the condition for determining whether the integrity check is passed, and K sym is a dynamic symmetric key, C is ciphertext data, IV is the initial vector, and MAC represents a function based on a message authentication code algorithm.

[0194] The integrity tag generation and verification mechanism combines dynamic symmetric keys, ciphertext data, and initial vectors to ensure the integrity and tamper resistance of data during transmission. The receiver can quickly detect the authenticity and validity of the data packet through integrity verification to prevent malicious tampering or replay attacks. This mechanism provides important security guarantees for network information encryption methods and is suitable for complex network scenarios with high security requirements.

[0195] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A network information security encryption method, characterized in that: include: Step 1: The sender generates a pair of post-quantum asymmetric keys, including a public key and a private key, where the public key is used to encrypt the symmetric key and the private key is used to decrypt the encrypted symmetric key; The sender sends the public key to the receiver through a secure channel and verifies the authenticity of the receiver's public key; Step 2: The sender generates a dynamic symmetric key based on the device identification and the current timestamp, wherein the device identification is used to uniquely identify the device generating the key, and the timestamp is used to ensure the time sensitivity of the key and generate a unique dynamic symmetric key; Step 3: The sender uses a dynamic symmetric key to encrypt the plaintext data and generates an initialization vector and an integrity tag. The initialization vector is used to ensure the uniqueness of the encryption operation, and the integrity tag is used to verify whether the ciphertext data has been tampered with. The ciphertext data, integrity tag and initialization vector generated after encryption are encapsulated in the data packet; Step 4: The sender encrypts the dynamic symmetric key with the receiver's public key to generate an encrypted symmetric key, and encapsulates the encrypted symmetric key, ciphertext data, integrity tag, and initialization vector into a data packet. Step 5: After receiving the data packet, the receiver uses the private key to decrypt and obtain the dynamic symmetric key before encryption, and extracts the initial vector and ciphertext data in the data packet to perform the decryption operation; Step 6: The receiver uses the dynamic symmetric key obtained by decryption and the initial vector in the data packet to decrypt the ciphertext data to restore the plaintext data. At the same time, it verifies whether the integrity tag in the data packet is consistent with the tag generated by the decrypted data. If the integrity tags are consistent, it is confirmed that the data has not been tampered with and the recovery of the plaintext data is complete.

2. A network information security encryption method according to claim 1, characterized in that: The dynamic symmetric key is generated by the following formula: K sym =Hash(DeviceID∥TS∥Rand), Among them, K sym is a dynamic symmetric key, Hash is a collision-resistant hash function, and DeviceID is the unique identifier of the sender device, which is used to distinguish the device that generates the key; TS is the current timestamp, which is used to ensure that the key is time-sensitive; Rand is a high-entropy random number used to improve the unpredictability of the key; The value range of Rand is: Rand∈[0,2 128 -1], Among them, Rand is a high entropy random number used to improve the unpredictability of the key.

3. A network information security encryption method according to claim 1, characterized in that: The length of the initial vector is 96 bits, which is used to ensure the uniqueness of the encryption operation and satisfies the following formula: IV=Rand(Length=96bits), Among them, IV is the initial vector, bits is the unit vector bit, Length is the length, Rand is a high-entropy random number used to improve the unpredictability of the key.

4. A network information security encryption method according to claim 1, characterized in that: The integrity tag is generated based on the dynamic symmetric key and encrypted data, and is used to verify whether the ciphertext has been tampered with, satisfying the following formula: T=Tag(K sym ,C), Among them, T is the integrity label, K sym is a dynamic symmetric key, C is the encrypted ciphertext data, and Tag is the message authentication code generation function; The encrypted ciphertext data, integrity tag and initial vector are encapsulated into a data packet together using the following formula: Packet = {C, T, IV}, Among them, Packet is the data packet, C is the ciphertext data, T is the integrity tag, and IV is the initial vector.

5. A network information security encryption method according to claim 1, characterized in that: The encryption key generated by the sender using the receiver's public key to encrypt the dynamic symmetric key satisfies the following formula: K enc =Encrypt PK (K sym ), Among them, K enc is the encrypted dynamic symmetric key, PK is the public key of the recipient, K sym is a dynamic symmetric key; The receiver uses its private key to decrypt the encrypted dynamic symmetric key to satisfy the following formula: K sym =Decrypt SK (K enc ), Among them, K sym is a dynamic symmetric key, SK is the recipient’s private key, K enc It is the encrypted dynamic symmetric key.

6. A network information security encryption method according to claim 1, characterized in that: The dynamic symmetric key decrypted by the receiver is used together with the initial vector to decrypt the ciphertext data and satisfies the following formula: P=Decrypt(K sym ,IV,C), Among them, P is the decrypted plaintext data, K sym is a dynamic symmetric key, IV is the initial vector, and C is the ciphertext data; The integrity tag generated by the receiver after decrypting the plaintext data is compared with the integrity tag in the data packet to satisfy the following formula: Valid(Packet)if T received =T generated , Among them, T received is the integrity tag provided in the data packet, T generated The integrity tag generated by the receiver for the decrypted plaintext data. Valid(Packet) indicates the validity of the data packet (Packet).

7. A network information security encryption method according to claim 1, characterized in that: The update of the dynamic symmetric key is based on the following triggering conditions: The time interval is updated when the following conditions are met: Update(K sym )if TS current -TS last >Δt, Among them, TS current is the current timestamp, TS last The timestamp for when the key was generated or updated, Δt is the preset time interval used to periodically update the dynamic symmetric key, K sym is a dynamic symmetric key; Update when the data volume meets the following conditions: Update(K sym )if D transferred >T data , Among them, D transferred The amount of data transmitted for key update, T data is the preset data volume threshold, K sym A dynamic symmetric key.

8. A network information security encryption method according to claim 7, characterized in that: The timestamp TS and the amount of transmitted data D transferred The sender and the receiver negotiate and update synchronously to ensure the consistency of the key update. The negotiation formula is: TS sync =max(TS sender ,TS receiver ), D sync =D sender +D receiver , Among them, TS sync It is the synchronization timestamp after negotiation between the two parties. TS sender and TS receiver is the timestamp of the sender and the receiver, D sync The amount of data transmitted synchronously by both parties. D sender and D receiver The amount of data transmitted between the sender and the receiver.

9. A network information security encryption method according to claim 1, characterized in that: The integrity tag T is generated by using a message authentication code algorithm using encrypted data and a dynamic symmetric key and satisfies the following formula: T=MAC(K sym ,C∥IV), Among them, T is the integrity label, K sym is a dynamic symmetric key, C is ciphertext data, IV is the initial vector, and MAC represents a function based on a message authentication code algorithm.

10. A network information security encryption method according to claim 9, characterized in that: The receiver verifies that the consistency of the integrity tag T satisfies the following formula: Valid(T)if MAC(K sym ,C∥IV)=T received , Among them, T received is the integrity tag contained in the data packet, Valid(T) is the condition for determining whether the integrity check is passed, and K sym is a dynamic symmetric key, C is ciphertext data, IV is the initial vector, and MAC represents a function based on a message authentication code algorithm.

Images