Encrypted data transmission method based on dynamic key and server

Abstract

The invention discloses an encrypted data transmission method and server based on a dynamic key, and relates to the field of data transmission security, and the method comprises the steps: generating a first private key through a quantum random number generator; receiving an encrypted public key data packet sent by the client, and decrypting the encrypted public key data packet based on the one-time key to obtain a client public key; performing key operation on the client public key and the first private key to generate a first temporary key; generating a confirmation message based on the one-time key encryption, and establishing an encrypted communication connection with the client based on the first temporary key after the confirmation message is sent to the client; after a preset time interval, generating a second private key through the quantum random number generator, and updating the first temporary key based on the second private key to obtain a second temporary key; and after synchronizing the second temporary key to the client, maintaining encrypted communication connection with the client based on the second temporary key. By implementing the application, the security of data transmission can be improved in a complex network environment.

Description

Technical Field

[0001] The present application relates to the field of data transmission security, and in particular to a method and server for encrypted data transmission based on a dynamic key. Background Art

[0002] With the rapid development of information technology and the popularization of Internet applications, data transmission security has become an important basis for ensuring the stable operation of information systems. Especially in key areas such as financial payment, telemedicine, and intelligent manufacturing, security protection during data transmission directly affects user privacy and corporate core interests. Therefore, establishing a reliable data transmission encryption mechanism has become an urgent need for industry development.

[0003] In related technologies, data transmission security solutions are mainly based on key encryption technology. Among them, the Diffie-Hellman key exchange algorithm negotiates shared keys by exchanging public parameters between the two parties, and the public key infrastructure (PKI) uses digital certificates to manage and distribute keys. These technologies complete the key exchange at the beginning of communication establishment, and then use the key to encrypt and protect the transmitted data.

[0004] However, in complex network environments, related technologies still face the problem that keys are vulnerable to man-in-the-middle attacks. Summary of the invention

[0005] The present application provides a dynamic key-based encrypted data transmission method and server for improving the security of data transmission in a complex network environment.

[0006] In a first aspect, the present application provides an encrypted data transmission method based on a dynamic key, which is applied to a server, and the method includes: generating a first private key through a quantum random number generator; receiving an encrypted public key data packet sent by a client, and decrypting the encrypted public key data packet based on a preset one-time key to obtain a client public key; the client public key is calculated by the client based on a client private key generated by a corresponding quantum random number generator; performing a key operation on the client public key and the first private key to generate a first temporary key for this session; encrypting and generating a confirmation message based on the one-time key, and after sending the confirmation message to the client, establishing an encrypted communication connection with the client based on the first temporary key; after a preset time interval, generating a second private key through a quantum random number generator, and updating the first temporary key based on the second private key to obtain a second temporary key; after synchronizing the second temporary key to the client, maintaining an encrypted communication connection with the client based on the second temporary key.

[0007] In the above embodiment, the server generates a private key through a quantum random number generator, and combines a one-time key with a dynamically updated temporary key mechanism to achieve the dynamic and unpredictable nature of the key during encrypted communication. The randomness of the private key is guaranteed by quantum random numbers, and the security of the communication process is enhanced by the regular update mechanism of the temporary key, effectively preventing man-in-the-middle attacks and key leakage risks.

[0008] In combination with some embodiments of the first aspect, in some embodiments, the step of generating a first private key through a quantum random number generator specifically includes: establishing a connection with a distributed key management center and performing identity registration; after the identity registration is successful, sending a first key acquisition request to the distributed key management center to obtain the first private key and an authorization identifier.

[0009] In the above embodiment, the server uses a distributed key management center to perform identity registration and key acquisition, establishes a trusted identity authentication and key distribution mechanism, and ensures the legitimacy of the key acquisition request through the introduction of the authorization identifier, thereby improving the security and reliability of the entire system.

[0010] In combination with some embodiments of the first aspect, in some embodiments, after a preset time interval, a second private key is generated by a quantum random number generator, and the first temporary key is updated based on the second private key to obtain the second temporary key. The step specifically includes: after the preset time interval, based on the authorization identifier, generating a second key acquisition request; sending the second key acquisition request to a distributed key management center to obtain a temporary key set; determining a second private key based on the temporary key set, and updating the first temporary key based on the second private key to obtain the second temporary key.

[0011] In the above embodiment, the server dynamically obtains a temporary key set based on the authorization identifier, and realizes dynamic update and secure distribution of keys through a multi-level key update mechanism. The introduction of the temporary key set increases the flexibility of key management while ensuring the security and reliability of the key update process.

[0012] In combination with some embodiments of the first aspect, in some embodiments, the step of generating a first private key through a quantum random number generator specifically includes: generating an initial quantum random number according to the quantum random number generator; iteratively operating the initial quantum random number based on one or more preset mathematical transformation functions to construct a composite key; and processing the composite key based on a random salt and a hash function to generate a first private key.

[0013] In the above embodiment, the server converts the initial quantum random number into a composite key and finally generates a private key through multiple mathematical transformations and hash processing, thereby increasing the complexity and security strength of the key. Combined with the use of random salt, the randomness and anti-attack capability of the key generation process are enhanced.

[0014] In combination with some embodiments of the first aspect, in some embodiments, a confirmation message is generated based on a one-time key encryption, and after sending the confirmation message to the client, an encrypted communication connection is established with the client based on a first temporary key. The steps specifically include: generating a confirmation message based on a one-time key encryption; after sending the confirmation message to the client, sending an encrypted communication connection request to the client; carrying communication parameters and a session identifier in the encrypted communication connection request; receiving a connection confirmation message returned by the client; encrypting the session identifier based on the first temporary key to generate an encrypted session token; sending the encrypted session token to the client, and establishing an encrypted communication connection after receiving a token verification success message returned by the client.

[0015] In the above embodiment, the server has established a complete set of encrypted communication connection establishment processes, including multiple security mechanisms such as confirmation messages, connection requests, and session identification encryption. Through the verification of encrypted session tokens, the legitimacy of the identities of the communicating parties and the security of the connection establishment process are ensured.

[0016] In combination with some embodiments of the first aspect, in some embodiments, after synchronizing the second temporary key to the client, after the step of maintaining an encrypted communication connection with the client based on the second temporary key, the method also includes: calculating the usage time of the second temporary key, and evaluating the current security strength of the second temporary key based on a preset key strength evaluation model; when the usage time exceeds a preset time threshold or the current security strength is lower than a preset security threshold, adjusting the key generation parameters of the quantum random number generator based on the current state of the quantum random number generator and historical key usage records; regenerating a third temporary key based on the adjusted key generation parameters, and using the third temporary key to maintain an encrypted communication connection with the client.

[0017] In the above embodiment, the server introduces a key strength assessment model and a usage duration monitoring mechanism to achieve a dynamic assessment of the security of temporary keys. Through parameter adjustment and key regeneration mechanisms, the continued validity and security of the keys during encrypted communications are ensured.

[0018] In combination with some embodiments of the first aspect, in some embodiments, when the usage time exceeds a preset time threshold or the current security strength is lower than a preset security threshold, the step of adjusting the key generation parameters of the quantum random number generator based on the current state of the quantum random number generator and the historical key usage record specifically includes: when the usage time exceeds the preset time threshold or the current security strength is lower than the preset security threshold, collecting the operating status data of the quantum random number generator; the operating status data includes the entropy source quality, the random number output rate and the quantum state stability index; according to the historical key usage record, extracting the key feature data including the key update frequency, the key life cycle and the security event correlation; inputting the operating status data and the key feature data into the parameter optimization model to obtain the key optimization parameters; based on the key optimization parameters, adjusting the key generation parameters of the quantum random number generator.

[0019] In the above embodiment, the server collects the operating status data and historical key usage records of the quantum random number generator, and combines them with the parameter optimization model to realize intelligent adjustment of the key generation parameters, thereby improving the reliability and security of the system.

[0020] In a second aspect, an embodiment of the present application provides a server, comprising: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to enable the server to execute the method described in the first aspect and any possible implementation method of the first aspect.

[0021] In a third aspect, an embodiment of the present application provides a computer program product comprising instructions, which, when executed on a server, enables the server to execute the method described in the first aspect and any possible implementation of the first aspect.

[0022] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, comprising instructions, which, when executed on a server, enable the server to execute the method described in the first aspect and any possible implementation of the first aspect.

[0023] It is understandable that the server provided in the second aspect, the computer program product provided in the third aspect, and the computer storage medium provided in the fourth aspect are all used to execute the method provided in the embodiment of the present application. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method, which will not be repeated here.

[0024] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: 1. Due to the use of a quantum random number generator to generate the basic private key and the combination of a dynamic update mechanism for temporary keys, the key is highly random and has dynamic change characteristics. The multi-level encrypted transmission based on one-time keys ensures the security of the key exchange process, effectively solving the problem of fixed keys being easily cracked and attacked by man-in-the-middle in the prior art, thereby achieving the continuous validity of the key and strong anti-attack capability during encrypted communication, and improving the security of data transmission.

[0025] 2. Due to the use of multiple mathematical transformations and hash processing mechanisms based on quantum random numbers, combined with the introduction of random salts and iterative calculation processes, a more complex key structure is constructed based on the initial quantum random numbers, which effectively solves the problems of simple keys being easily cracked and insufficient key entropy in the existing technology, thereby achieving a high degree of randomness and complexity in the private key generation process, and enhancing the security strength of the key and its ability to resist quantum computing attacks.

[0026] 3. Due to the adoption of a dynamic evaluation mechanism based on usage time and security strength, combined with the adaptive adjustment of quantum random number generator parameters and the dynamic generation process of new keys, a complete key lifecycle management system has been established, which effectively solves the problems of untimely key updates and difficult to ensure security performance in the existing technology, and thus realizes the continuous optimization and dynamic adjustment of key security performance, ensuring the continuous security and reliability of the encrypted communication process. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a flowchart of a method for transmitting encrypted data based on a dynamic key in an embodiment of the present application; Figure 2 is another flowchart of the method for transmitting encrypted data based on a dynamic key in an embodiment of the present application; Figure 3 It is a schematic diagram of a physical device structure of a server in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The terms used in the following embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to be used as limitations to the present application. As used in the specification of the present application, the singular expressions "one", "a kind of", "above", "the" and "this" are intended to also include plural expressions, unless there is a clear indication to the contrary in the context. It should also be understood that the term "and / or" used in the present application refers to any or all possible combinations comprising one or more of the listed items.

[0029] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

[0030] For ease of understanding, the application scenarios of the embodiments of the present application are introduced below.

[0031] In the data center of a large multinational enterprise, millions of sensitive data transmissions need to be processed every day, including customer privacy information, financial data, and business secrets. Traditional data encryption methods use fixed keys, which are replaced regularly, but the replacement cycle is long (usually several days or weeks). With the development of quantum computing technology, fixed keys are easy to crack. The enterprise has experienced security incidents in which hackers obtained keys and decrypted historical data through long-term monitoring. Therefore, the enterprise urgently needs a dynamic key solution that can be frequently updated and is difficult to predict and crack.

[0032] In the related art, key management of encrypted communication can be achieved by adopting Diffie-Hellman key exchange and PKI certificate system. The following introduces the scenario of using the dynamic key-based encrypted data transmission method in the related art.

[0033] A financial institution uses the Diffie-Hellman key exchange algorithm for data transmission encryption. At the beginning of each transaction session, the client and server generate a shared key by exchanging public parameters. However, in high-concurrency situations, frequent key negotiations lead to degraded system performance and are vulnerable to man-in-the-middle attacks. At the same time, due to the lack of a centralized key management mechanism, when the key needs to be updated, it is necessary to re-establish the connection and renegotiate, resulting in business interruption and increased delays.

[0034] The method for encrypted data transmission based on dynamic keys in the embodiments of the present application generates high-quality random numbers in real time and combines a multi-level encryption mechanism to achieve continuous key updates and high-intensity protection, which not only improves encryption strength but also reduces the risk of key cracking. The following describes the scenario in which the method for encrypted data transmission based on dynamic keys in the present application is used.

[0035] An e-commerce platform has introduced an encrypted transmission system based on dynamic keys. In the payment process, when a user submits an order, the client starts the quantum random number generator to generate a high-strength private key, and the server also generates a corresponding key. The two parties complete the initial key exchange through the preset one-time key to establish a secure channel. During the payment process, the system automatically updates the temporary key every 5 minutes, and all transaction data is encrypted with the latest key. Even if a hacker intercepts the key at a certain moment, it cannot decrypt data in other time periods. The system also realizes the rapid distribution and synchronization of keys through a distributed key management center, ensuring performance and security in large-scale concurrent payment scenarios.

[0036] It can be seen that the use of the dynamic key-based encrypted data transmission method in the embodiment of the present application can not only achieve secure encrypted transmission, but also effectively solve the problems of low key update efficiency and vulnerability in traditional solutions, thereby realizing a more efficient and reliable data protection mechanism.

[0037] For ease of understanding, the following describes the process of the method provided by this implementation in combination with the above scenario. Figure 1 , which is a flow chart of an encrypted data transmission method based on a dynamic key in an embodiment of the present application.

[0038] S101. Generate a first private key using a quantum random number generator.

[0039] Among them, the quantum random number generator refers to a device that uses the principles of quantum mechanics to generate true random numbers, and is used to generate high-quality random number sequences; the first private key refers to the key generated by the quantum random number generator for initial encrypted communication.

[0040] Before starting an encrypted communication session, the server needs to obtain a secure private key. Specifically, the server will start the quantum random number generator, collect the uncertainty of the quantum state to generate a random bit stream, and then convert the random bit stream into the first private key suitable for encryption through the key derivation function, while securely storing and protecting the integrity of the private key.

[0041] S102: Receive an encrypted public key data packet sent by the client, and decrypt the encrypted public key data packet based on a preset one-time key to obtain a client public key.

[0042] Among them, the encrypted public key data packet represents the data structure formed after the client encrypts its public key; the one-time key refers to a key that is shared in advance between the server and the client and is used only once; the client public key represents the public key calculated by the client based on its private key through a specific algorithm, which is calculated by the client private key; the client private key refers to the key independently generated by the client through a quantum random number generator.

[0043] After generating the first private key, the server needs to obtain the client's public key to achieve key negotiation. Specifically, the server listens to the designated port and waits for the client to connect. After receiving the encrypted public key data packet, it uses the preset one-time key to decrypt the data packet, extract the client's public key information, and verify the legitimacy and integrity of the public key.

[0044] S103: Perform a key operation on the client public key and the first private key to generate a first temporary key for this session.

[0045] Among them, key operation refers to the process of calculating the public key and private key through a specific algorithm; the first temporary key refers to the temporary encryption key used for this session; and the session refers to a complete encrypted communication process.

[0046] After the server obtains the client public key, it needs to generate a session key for actual communication. Specifically, the server substitutes the client public key and its own first private key into a predetermined key derivation algorithm, and generates a first temporary key through multiple rounds of operations to ensure that the generated key has sufficient entropy and randomness.

[0047] In some embodiments, the generation of temporary keys can be achieved in a variety of ways: optionally, the shared key is calculated using the ECDH algorithm, the key length is extended using the HKDF key derivation function, and security strength verification is performed; optionally, the shared random bits are generated using the quantum key distribution protocol, and the temporary session key is constructed through cryptographic hash function processing. It is understandable that other key negotiation or derivation methods can also be used to achieve the generation of temporary keys, which are not limited here.

[0048] S104: Generate a confirmation message based on the one-time key encryption, and after sending the confirmation message to the client, establish an encrypted communication connection with the client based on the first temporary key.

[0049] The confirmation message indicates a data packet confirming to the client that the key negotiation is successful; the encrypted communication connection indicates a secure communication channel established based on the negotiated key.

[0050] After the server generates the first temporary key, it needs to establish an encrypted communication connection with the client. Specifically, the server generates a confirmation message using a one-time key and sends it to the client. After the client confirms receipt, it uses the first temporary key to establish an encrypted channel to complete the establishment of the communication connection.

[0051] In some embodiments, the establishment of an encrypted communication connection can be achieved in a variety of ways: optionally, generating a confirmation message containing a timestamp, establishing a TLS encrypted channel, and performing a key verification handshake process; optionally, constructing confirmation data with a random challenge value, establishing an IPSec VPN tunnel, and completing key synchronization confirmation. It is understandable that other secure communication protocols can also be used to establish an encrypted connection, which is not limited here.

[0052] S105. After a preset time interval, generate a second private key through a quantum random number generator, and update the first temporary key based on the second private key to obtain a second temporary key.

[0053] Among them, the preset time interval represents the period of key update; the second private key refers to the private key regenerated after the update period arrives; and the second temporary key represents the session key updated based on the new private key.

[0054] During the communication process, the server needs to regularly update the key to ensure security. Specifically, after the preset time is reached, the server starts the quantum random number generator again to generate a second private key, and then updates the currently used temporary key based on the new private key to obtain the second temporary key for subsequent communications.

[0055] In some embodiments, the key update can be implemented in a variety of ways: optionally, detecting the time interval, generating a new quantum random number, and applying the key update algorithm to derive a new temporary key; optionally, monitoring the key usage time, generating new private key materials, and updating the session key through the key rolling mechanism. It is understandable that other trigger mechanisms or update methods can also be used to implement dynamic key updates, which are not limited here.

[0056] S106: After synchronizing the second temporary key to the client, maintain an encrypted communication connection with the client based on the second temporary key.

[0057] Among them, synchronization means ensuring that the server and the client are updated to use the new key at the same time; maintaining the encrypted communication connection means continuing secure communication after the key is updated.

[0058] After the server updates the key, it needs to ensure that the communication with the client is not interrupted. Specifically, the server synchronizes the second temporary key to the client through a secure channel, waits for the client to confirm receipt and switch the key, and then uses the new key to continue the encrypted communication connection.

[0059] In some embodiments, key synchronization and communication maintenance can be achieved in a variety of ways: optionally, a secure key distribution protocol is used to transmit new keys, verify the client's receiving status, and smoothly switch the encryption channel; optionally, a key synchronization mechanism with a version number is used to confirm the key consistency of both parties and maintain the continuity of the connection. It is understandable that other synchronization mechanisms or switching strategies can also be used to achieve communication maintenance after the key update, which is not limited here.

[0060] In the above embodiment, the randomness and unpredictability of the key are ensured by the quantum random number generator. In practical applications, the key update strategy and security parameters can also be adjusted according to specific scenarios. The following is a supplement to the scenario of this embodiment.

[0061] An upgraded dynamic key system has been deployed in the IoT data transmission of smart cities. The system introduces an adaptive key update mechanism, which can dynamically adjust the key update frequency according to network conditions and security threat levels. For example, the update frequency is automatically increased when abnormal traffic is detected; the update frequency is appropriately reduced when the network is congested. At the same time, the system adopts a multi-level key structure, and data with different security levels use keys of different complexity. Through the distributed deployment and load balancing of quantum random number generators, the key generation capacity of millions per second is achieved, meeting the encryption requirements of massive IoT devices.

[0062] After combining the above scenarios, the following is a more detailed description of the process of the method provided by this implementation. Figure 2 , is another flow chart of the encrypted data transmission method based on dynamic keys in an embodiment of the present application.

[0063] S201. Establish a connection with a distributed key management center to perform identity registration.

[0064] Among them, the distributed key management center (DKMC) refers to a distributed system platform used to centrally manage and distribute keys; establishing a connection refers to establishing a communication link with the key management center through a secure channel; identity registration refers to the process in which the server provides identity credentials to the key management center and completes authentication.

[0065] Before using the quantum random number generator for the first time, the server needs to complete identity authentication. Specifically, the server initiates a connection request to the distributed key management center, provides the necessary identity credential information, verifies the legitimacy of the identity through multi-factor authentication, completes the registration process and obtains access rights.

[0066] In some embodiments, the identity authentication and registration process can be implemented in a variety of ways: optionally, generate a digital certificate request, submit identity authentication materials, verify through a certificate authority, and establish an encrypted communication channel; optionally, construct a registration request with a hardware identifier, complete two-way identity authentication, and execute a key pre-sharing protocol. It is understandable that other authentication mechanisms or registration methods can also be used to implement secure identity verification, which is not limited here.

[0067] S202: After the identity registration is successful, a first key acquisition request is sent to a distributed key management center to obtain a first private key and an authorization identifier.

[0068] Among them, the key acquisition request refers to a data packet that applies to the key management center for obtaining a key; the first private key refers to the private key obtained by the first application; and the authorization identifier represents the identity certificate and authority proof used for subsequent key applications.

[0069] After the server completes identity registration, it needs to obtain initial key materials. Specifically, the server constructs a key acquisition request containing identity information and purpose description, sends it to the distributed key management center, receives and verifies the validity of the returned first private key and authorization identifier, and stores them securely for subsequent operations.

[0070] In some embodiments, the acquisition of keys and authorization identifiers can be achieved in a variety of ways: optionally, generating a request message with a timestamp, executing a secure handshake protocol, and receiving keys and authorization data through an encrypted channel; optionally, constructing a request package containing a session identifier, verifying the server authority level, and obtaining the corresponding key material and authorization information. It is understandable that other request methods or authorization mechanisms can also be used to achieve secure acquisition of keys, which are not limited here.

[0071] In some embodiments, the server generates an initial quantum random number based on a quantum random number generator; performs iterative operations on the initial quantum random number based on one or more preset mathematical transformation functions to construct a composite key; and processes the composite key based on a random salt and a hash function to generate a first private key.

[0072] Among them, the initial quantum random number refers to the original random data obtained directly from the quantum random number generator; the mathematical transformation function refers to the set of mathematical operation functions used to process random numbers; the composite key refers to the intermediate key form after multiple transformations; the random salt refers to the additional random value used to increase the randomness of the key; the hash function refers to a one-way function that maps input data to a fixed-length output.

[0073] When the server needs to generate a high-security private key, it needs to perform multiple processing on the quantum random number. Specifically, the server starts the quantum random number generator to obtain the initial random number, inputs it into the preset mathematical transformation function chain for multiple rounds of iterative calculations, obtains a composite key, and then combines it with the randomly generated salt value for hash operation, and finally generates the first private key with good cryptographic properties.

[0074] In some embodiments, the secure generation of private keys can be achieved in a variety of ways: optionally, collecting quantum state measurement values, applying elliptic curve transformations, performing multiple rounds of iterative calculations, adding random salt values, and completing SHA-3 hash processing; optionally, obtaining quantum random bit streams, using polynomial function transformations, performing matrix operations, mixing in environmental entropy values, and applying the Blake2 hash algorithm. It is understandable that other mathematical transformations or hash algorithms can also be used to achieve secure generation of private keys, which is not limited here.

[0075] S203: Receive the encrypted public key data packet sent by the client, decrypt the encrypted public key data packet based on a preset one-time key, and obtain the client public key.

[0076] Referring to step S102, the server generates a client public key.

[0077] S204: Perform a key operation on the client public key and the first private key to generate a first temporary key for this session.

[0078] Referring to step S103, the server generates a first temporary key.

[0079] S205: Generate a confirmation message based on the one-time key encryption, and after sending the confirmation message to the client, establish an encrypted communication connection with the client based on the first temporary key.

[0080] Referring to step S104, the server establishes an encrypted communication connection with the client based on the first temporary key.

[0081] In some embodiments, the server generates a confirmation message based on a one-time key encryption; after sending the confirmation message to the client, the server sends an encrypted communication connection request to the client; the encrypted communication connection request carries communication parameters and session identifiers; receives a connection confirmation message returned by the client; encrypts the session identifier based on a first temporary key to generate an encrypted session token; sends the encrypted session token to the client, and establishes an encrypted communication connection after receiving a token verification success message returned by the client.

[0082] Among them, the encrypted communication connection request refers to the request data for initiating the establishment of a secure channel; the communication parameters represent the configuration information required to establish the connection; the session identifier refers to the string used to uniquely identify the current communication session; and the encrypted session token represents the security credential after the session identifier is encrypted.

[0083] After completing the key negotiation, the server needs to establish a secure communication channel. Specifically, the server generates a confirmation message using a one-time key encryption and sends it, then constructs a connection request containing necessary communication parameters and a session identifier, verifies the client's confirmation response, encrypts the session identifier using the first temporary key to generate a session token, and finally verifies the token to confirm that both parties can communicate securely.

[0084] In some embodiments, the establishment of a secure communication connection can be achieved in a variety of ways: optionally, constructing a confirmation message with a timestamp, sending encrypted connection parameters, verifying the validity of the client response, generating a session security token, and completing two-way authentication; optionally, generating a confirmation package containing a random challenge, transmitting encrypted configuration information, checking the correctness of the client response, creating an encrypted session credential, and establishing a secure channel. It is understandable that other authentication mechanisms or connection protocols can also be used to achieve the establishment of secure communication, which is not limited here.

[0085] S206: After a preset time interval, generate a second key acquisition request based on the authorization identifier.

[0086] The preset time interval represents the minimum time difference between two key acquisition requests; and the second key acquisition request refers to a subsequent key update request initiated based on the authorization identifier.

[0087] After using the first private key for a period of time, the server needs to update the key to ensure security. Specifically, the server detects the usage time of the current key, and when the preset time interval is reached, it constructs a new key acquisition request using the previously obtained authorization identifier to prepare to obtain the updated key material.

[0088] In some embodiments, the generation of a key acquisition request can be implemented in a variety of ways: optionally, checking the key usage timer, verifying the validity of the authorization identifier, and constructing an update request with a serial number; optionally, monitoring the key usage cycle, confirming the authorization status, and generating request data including usage statistics. It is understandable that other trigger mechanisms or request methods can also be used to implement key update applications, which are not limited here.

[0089] S207: Send a second key acquisition request to the distributed key management center to obtain a temporary key set.

[0090] The temporary key set refers to a set of multiple key candidates returned by the key management center that can be used for updating; the acquisition process refers to the operation of securely receiving and verifying the temporary key set.

[0091] After the server generates the acquisition request, it needs to obtain new key material from the key management center. Specifically, the server sends the second key acquisition request to the distributed key management center through a secure channel, receives the returned temporary key set, and performs integrity verification and decryption processing on the key set.

[0092] In some embodiments, the acquisition of the temporary key set can be achieved in a variety of ways: optionally, establishing a dedicated encryption channel, sending key request data, and verifying the integrity of the received key set; optionally, using a session key to encrypt the request, executing a secure transmission protocol, decrypting and storing the obtained key set. It is understandable that other transmission methods or verification mechanisms can also be used to achieve secure acquisition of the key set, which is not limited here.

[0093] S208. Determine a second private key based on the temporary key set, and update the first temporary key based on the second private key to obtain a second temporary key.

[0094] The second private key represents a new private key selected from the temporary key set; and the temporary key update process refers to an operation of regenerating a session key using the new private key.

[0095] After the server obtains the temporary key set, it needs to update the currently used session key. Specifically, the server selects a suitable key from the temporary key set as the second private key, combines it with the current communication parameters, and generates a new second temporary key through a key derivation function.

[0096] In some embodiments, private key selection and key update can be implemented in a variety of ways: optionally, evaluating the strength of each key in the key set, selecting the optimal private key, and executing the key derivation algorithm to generate a new temporary key; optionally, analyzing the entropy distribution of the key set, determining the appropriate private key, and refreshing the session key through the key update function. It is understandable that other selection strategies or update algorithms can also be used to implement dynamic key updates, which are not limited here.

[0097] S209: After synchronizing the second temporary key to the client, maintain an encrypted communication connection with the client based on the second temporary key.

[0098] Referring to step S106, the server maintains an encrypted communication connection with the client based on the second temporary key.

[0099] S210: Calculate the usage duration of the second temporary key, and evaluate the current security strength of the second temporary key based on a preset key strength evaluation model.

[0100] Among them, the usage duration refers to the usage time of the second temporary key from activation to the current time; the key strength assessment model refers to a mathematical model used to assess the security of the key; and the current security strength refers to the key's anti-attack capability indicator in the current network environment.

[0101] During the use of the second temporary key, the server needs to continuously monitor the security status of the key. Specifically, the server records and calculates the actual usage time of the key, and inputs the key characteristics into a preset evaluation model to calculate the security strength value of the current key to determine whether the key needs to be updated.

[0102] It should be noted that the key strength assessment model is trained by collecting historical key usage data, known attack cases and security event records. The input data includes key length, randomness index, usage time, historical attack success rate and other features; the output is the security strength score of the key. The training standard is based on the historical data of whether the key has been successfully cracked, using cross entropy as the loss function, and optimizing the model parameters through back propagation. The goal is to accurately predict the current security strength of the key. The key strength assessment model adopts a multi-layer neural network architecture, including a feature extraction layer, multiple hidden layers and an output layer. The feature extraction layer processes the basic attributes and usage status of the key, the hidden layer captures the complex relationship between features through nonlinear transformation, and the output layer gives a security strength score between 0 and 1. During the key usage process, the key strength assessment model collects data such as the key usage time, current network environment characteristics, quantum randomness indicators and other data input into the model in real time, and the model outputs the security strength score of the current key. When the score is lower than the preset threshold, the key update mechanism is triggered.

[0103] S211. When the usage duration exceeds a preset time threshold or the current security strength is lower than a preset security threshold, adjust the key generation parameters of the quantum random number generator based on the current state of the quantum random number generator and the historical key usage record.

[0104] Among them, the preset time threshold indicates the maximum allowed usage time of the key; the preset security threshold refers to the minimum acceptable security strength value; and the historical key usage record refers to the statistical data of past key usage.

[0105] When the server detects that the key security is reduced, it needs to optimize the random number generation process. Specifically, the server compares the key usage time and security strength with the preset threshold. When it exceeds the safety range, it analyzes the operating status and historical data of the quantum random number generator, calculates the optimal parameter configuration, and adjusts the working parameters of the random number generator.

[0106] In some embodiments, parameter optimization and adjustment can be achieved in a variety of ways: optionally, analyzing quantum state stability data, evaluating historical key strength distribution, calculating parameter adjustment schemes, and executing generator configuration updates; optionally, monitoring random number quality indicators, statistically analyzing key life laws, constructing optimization model parameters, and implementing device parameter adjustments. It is understandable that other analysis methods or tuning strategies can also be used to achieve dynamic optimization of generator parameters, which are not limited here.

[0107] In some embodiments, the server collects operating status data of the quantum random number generator when the usage time exceeds a preset time threshold or the current security strength is lower than a preset security threshold; the operating status data includes entropy source quality, random number output rate and quantum state stability index; based on historical key usage records, key feature data including key update frequency, key life cycle and security event correlation are extracted; the operating status data and key feature data are input into a parameter optimization model to obtain key optimization parameters; based on the key optimization parameters, the key generation parameters of the quantum random number generator are adjusted.

[0108] Among them, the entropy source quality refers to the randomness degree index of the random number source; the random number output rate refers to the time efficiency of generating random numbers; the quantum state stability index represents the reliability parameter of the quantum system; the key update frequency refers to the time interval statistics of key replacement; the key life cycle represents the usage period of the key from generation to abandonment; the security event correlation refers to the statistical correlation between key use and security events; the key optimization parameter represents the configuration parameter set used to improve key generation.

[0109] When the server detects that the key security is reduced, it needs to optimize the operating parameters of the random number generator. Specifically, the server collects the operating status data of the generator, including indicators such as randomness quality, generation efficiency, and system stability, and analyzes the update rules, usage cycles, and security associations in the historical key usage data. These data are input into the optimization model to calculate the improved parameters for adjusting the working status of the generator.

[0110] It should be noted that the parameter optimization model is trained based on the operation data of the quantum random number generator and the key usage effect during training. The input data includes characteristics such as entropy source quality, random number output rate, quantum state stability, key update frequency, key life cycle, etc.; the output is the optimal operation parameter configuration of the quantum random number generator. The training adopts the reinforcement learning method to optimize the model by maximizing the comprehensive score of key security and system performance. The parameter optimization model combines a hybrid model of decision trees and neural networks. The decision tree is used to process discrete configuration options, and the neural network processes continuous parameter adjustments. The model includes a parameter evaluation module, an optimization strategy generation module, and an effect prediction module. When it is detected that the key security strength has decreased or the system performance is abnormal, the parameter optimization model will collect the current operation status data and historical key usage records to input the model. The model outputs a set of optimized operation parameters, including quantum state sampling rate, random number generation frequency, key update cycle and other configurations, which are used to adjust the working state of the quantum random number generator.

[0111] S212. Regenerate a third temporary key based on the adjusted key generation parameters, and use the third temporary key to maintain an encrypted communication connection with the client.

[0112] Among them, the key generation parameters refer to the configuration parameters that control the random number generation process; the third temporary key refers to the new session key generated using the optimized parameters; and maintaining the encrypted communication connection means ensuring that the communication process is not interrupted when the key is updated.

[0113] After the server completes the parameter adjustment, it needs to use the new parameters to update the communication key. Specifically, the server restarts the quantum random number generator with the adjusted parameter configuration, generates a new third temporary key, and synchronizes the key information with the client to ensure the continuity and security of the encrypted communication connection.

[0114] In some embodiments, key updates and connection maintenance can be achieved in a variety of ways: optionally, enabling new parameter configurations, generating high-quality random numbers, deriving a third temporary key, and executing a secure key switching protocol; optionally, applying optimized parameters, generating temporary key materials, constructing a session key update package, and completing seamless key replacement. It is understandable that other generation methods or switching mechanisms can also be used to achieve secure key updates and communication maintenance, which are not limited here.

[0115] In the embodiments of the present application, due to the adoption of a dynamic key generation mechanism based on quantum random numbers and a distributed key management architecture, combined with a multi-level encryption strategy and an adaptive update mechanism, efficient key distribution and synchronization are achieved while ensuring key randomness and security, effectively solving the problems of fixed and easy-to-crack keys, low update efficiency, and difficulty in large-scale distribution in traditional technologies, thereby achieving more secure and reliable encrypted data transmission.

[0116] The following describes the server in the embodiment of the present invention from the perspective of hardware processing. Figure 3 , is a schematic diagram of a physical device structure of a server in an embodiment of the present application.

[0117] It should be noted that Figure 3 The structure of the server shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0118] like Figure 3 As shown, the server includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 302 or the program loaded from the storage part 308 to the random access memory (RAM) 303, such as executing the method described in the above embodiment. In RAM 303, various programs and data required for system operation are also stored. CPU 301, ROM 302 and RAM 303 are connected to each other through bus 304. Input / output (I / O) interface 305 is also connected to bus 304.

[0119] The following components are connected to the I / O interface 305: an input section 306 including an audio input device, a button switch, etc.; an output section 307 including a liquid crystal display (LCD) and an audio output device, an indicator light, etc.; a storage section 308 including a hard disk, etc.; and a communication section 309 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as needed. A removable medium 311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 310 as needed so that a computer program read therefrom is installed into the storage section 308 as needed.

[0120] In particular, according to an embodiment of the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through the communication part 309, and / or installed from a removable medium 311. When the computer program is executed by the central processing unit (CPU) 301, various functions defined in the present invention are performed.

[0121] It should be noted that specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus, or device.

[0122] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. Each box in the flowchart or block diagram may represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the box may also occur in an order different from that marked in the accompanying drawings.

[0123] Specifically, the server of this embodiment includes a processor and a memory. The memory stores a computer program. When the computer program is executed by the processor, the dynamic key-based encrypted data transmission method provided in the above embodiment is implemented.

[0124] As another aspect, the present invention further provides a computer-readable storage medium, which may be included in the server described in the above embodiment; or may exist independently without being assembled into the server. The above storage medium carries one or more computer programs, and when the above one or more computer programs are executed by a processor of the server, the server implements the encrypted data transmission method based on dynamic keys provided in the above embodiment.

[0125] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0126] As used in the above embodiments, the term "when..." may be interpreted to mean "if..." or "after..." or "in response to determining..." or "in response to detecting...", depending on the context. Similarly, the phrases "upon determining..." or "if (the stated condition or event) is detected" may be interpreted to mean "if determining..." or "in response to determining..." or "upon detecting (the stated condition or event)" or "in response to detecting (the stated condition or event)", depending on the context.

[0127] Those skilled in the art can understand that to implement all or part of the processes in the above-mentioned embodiments, the processes can be completed by computer programs to instruct related hardware, and the programs can be stored in computer-readable storage media. When the programs are executed, they can include the processes of the above-mentioned method embodiments. The aforementioned storage media include: ROM or random access memory RAM, magnetic disk or optical disk and other media that can store program codes.

Claims

1. A method for transmitting encrypted data based on a dynamic key, characterized in that: Applied to a server, the method comprises: Generate a first private key through a quantum random number generator; Receive an encrypted public key data packet sent by a client, decrypt the encrypted public key data packet based on a preset one-time key, and obtain a client public key; the client public key is calculated by the client based on a client private key generated by a corresponding quantum random number generator; Perform a key operation on the client public key and the first private key to generate a first temporary key for this session; Encrypting and generating a confirmation message based on the one-time key, and after sending the confirmation message to the client, establishing an encrypted communication connection with the client based on the first temporary key; After a preset time interval, a second private key is generated by a quantum random number generator, and the first temporary key is updated based on the second private key to obtain a second temporary key; After synchronizing the second temporary key to the client, an encrypted communication connection is maintained with the client based on the second temporary key.

2. The method according to claim 1, characterized in that: The step of generating the first private key by means of a quantum random number generator specifically includes: Establish a connection with the distributed key management center to register your identity; After the identity registration is successful, a first key acquisition request is sent to the distributed key management center to obtain the first private key and the authorization identifier.

3. The method according to claim 2, characterized in that The step of generating a second private key by a quantum random number generator after a preset time interval, and updating the first temporary key based on the second private key to obtain a second temporary key specifically includes: After a preset time interval, generating a second key acquisition request based on the authorization identifier; Sending a second key acquisition request to the distributed key management center to obtain a temporary key set; A second private key is determined based on the temporary key set, and the first temporary key is updated based on the second private key to obtain a second temporary key.

4. The method according to claim 1, characterized in that: The step of generating the first private key by means of a quantum random number generator specifically includes: Generate an initial quantum random number according to a quantum random number generator; Based on one or more preset mathematical transformation functions, the initial quantum random number is iteratively calculated to construct a composite key; The composite key is processed based on a random salt and a hash function to generate a first private key.

5. The method according to claim 1, characterized in that The step of generating a confirmation message based on the one-time key encryption, and after sending the confirmation message to the client, establishing an encrypted communication connection with the client based on the first temporary key specifically includes: Encrypting and generating a confirmation message based on the one-time key; After sending the confirmation message to the client, sending an encrypted communication connection request to the client; the encrypted communication connection request carries communication parameters and a session identifier; Receive a connection confirmation message returned by the client; Encrypting the session identifier based on the first temporary key to generate an encrypted session token; The encrypted session token is sent to the client, and after receiving a token verification success message returned by the client, an encrypted communication connection is established.

6. The method according to claim 1, characterized in that After synchronizing the second temporary key to the client, and after the step of maintaining an encrypted communication connection with the client based on the second temporary key, the method further includes: Calculate the usage duration of the second temporary key, and evaluate the current security strength of the second temporary key based on a preset key strength evaluation model; When the usage time exceeds a preset time threshold or the current security strength is lower than a preset security threshold, adjusting the key generation parameters of the quantum random number generator based on the current state of the quantum random number generator and the historical key usage record; A third temporary key is regenerated based on the adjusted key generation parameter, and the third temporary key is used to maintain an encrypted communication connection with the client.

7. The method according to claim 6, characterized in that The step of adjusting the key generation parameters of the quantum random number generator based on the current state of the quantum random number generator and the historical key usage record when the usage time exceeds the preset time threshold or the current security strength is lower than the preset security threshold specifically includes: When the usage time exceeds a preset time threshold or the current security strength is lower than a preset security threshold, collecting operation status data of the quantum random number generator; the operation status data includes entropy source quality, random number output rate and quantum state stability index; Extract key feature data including key update frequency, key life cycle and security event correlation based on historical key usage records; Inputting the operation status data and the key characteristic data into a parameter optimization model to obtain key optimization parameters; Based on the key optimization parameter, the key generation parameter of the quantum random number generator is adjusted.

8. A server, characterized in that: The server includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to enable the server to execute the method described in any one of claims 1-7.

9. A computer-readable storage medium comprising instructions, characterized in that: When the instructions are executed on a server, the server is caused to execute the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that When the computer program product is run on a server, the server is caused to execute the method according to any one of claims 1 to 7.

Images