Dynamic data encryption transmission method and system and storage medium
By dynamically generating encryption keys for data blocks and self-evolving encryption chains, the security vulnerabilities and key management overhead of static key encryption transmission schemes are solved, achieving high-security, low-overhead, and replay-attack-resistant data transmission effects.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-11
- Publication Date
- 2026-04-10
AI Technical Summary
Existing static key encryption transmission schemes have security vulnerabilities and high key management overhead, and are prone to large-scale data leakage when keys are leaked, making them unsuitable for effective application in high-frequency, low-latency communication scenarios.
A dynamic data encryption transmission method is adopted, which generates dynamic keys at the sending and receiving ends, uses the initial key and hash operation to generate the encryption key for each data block, and uses the AES algorithm for encryption and decryption to form a self-evolving encryption chain to ensure the security of each data packet.
It achieves high security, low communication overhead, and resistance to replay attacks, enhancing the overall security of data transmission. Even if a single data packet is compromised, it will not affect the security of other data packets, providing strong data integrity protection.
Smart Images
Figure CN121841608A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data communication security technology, and in particular to a dynamic data encryption transmission method, system, and storage medium for ensuring data confidentiality and integrity in network communication. Background Technology
[0002] With the rapid development of the internet and information technology, data transmission on networks is becoming increasingly frequent, and data security issues are becoming more prominent. To prevent data from being stolen, tampered with, or forged during transmission, encryption technology has become a core means of ensuring data security.
[0003] Traditional data encryption transmission schemes, such as those using SSL / TLS protocols or directly applying symmetric encryption algorithms like AES and DES, typically employ static keys or periodically changed keys. In this model, if the encryption key is leaked during transmission or at any end, an attacker can decrypt all data packets encrypted with that key, causing a large-scale data breach. Furthermore, the process of key negotiation, distribution, and management itself increases system complexity and communication overhead, and the security of the key distribution channel becomes a new vulnerability.
[0004] To address the risks posed by key leaks, some technologies have proposed the "one-time pad" approach, such as using stream ciphers. However, if the key stream generation in a stream cipher is not complex enough, it can be predicted and cracked. Other solutions update the key by frequently exchanging keys (such as Diffie-Hellman-based protocols), but this incurs significant additional computational and communication overhead, making it unsuitable for high-frequency, low-latency communication scenarios.
[0005] Therefore, how to provide a data encryption transmission scheme that can ensure high security, reduce key management overhead, and effectively resist the risk of key leakage is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention
[0006] The main objective of this invention is to overcome the security risks and high key management overhead of existing static key encryption transmission schemes, and to provide a dynamic data encryption transmission method, system and storage medium. The aim is to realize the dynamism and self-evolution of the encryption process, so that even if the encryption information of a single data packet is cracked, it will not affect the security of other data packets, thereby greatly improving the overall security of data transmission.
[0007] To achieve the above objectives, the present invention provides the following technical solution: A method for dynamic data encryption transmission includes steps executed by the sending end and steps executed by the receiving end; The steps performed by the sending end include: S1. Determine the initial key K0 and an initial vector IV to be pre-shared with the receiver; S2. Divide the data to be transmitted into N data blocks, denoted as P1, P2, ..., PN; S3. Generate ciphertext blocks C1, C2, ..., CN corresponding to P1, P2, ..., PN in sequence, i∈1……N. The method for generating the ciphertext block Ci corresponding to the i-th data block Pi is as follows: Generate the current dynamic key Ki based on the (i-1)th ciphertext block Ci-1, and encrypt the data block Pi using the current dynamic key Ki and the preset core encryption algorithm to generate the current ciphertext block Ci; when i=1, Ci-0 is the initialization vector IV; S4, transmit all ciphertext blocks C1, C2, ..., CN to the receiving end in sequence; The receiving end performs the following steps: T1. Receive ciphertext blocks C1, C2, ..., CN from the sender in sequence; T2. Decrypt the ciphertext blocks C1, C2, ..., CN in sequence. The method for decrypting the i-th ciphertext block Ci is as follows: Generate the current dynamic key Ki based on the locally stored (i-1)-th ciphertext block Ci-1. Decrypt the ciphertext block Ci using the current dynamic key Ki and the same core encryption algorithm as the sender to recover the data block Pi. When i=1, Ci-0 is the initial vector IV.
[0008] Furthermore, in steps S3 and T2, the method for generating the current dynamic key Ki based on the (i-1)th ciphertext block Ci-1 specifically includes the following steps: Perform a hash operation on the (i-1)th ciphertext block Ci-1 to obtain the hash value Hi; Using the key derivation function, with the initial key K0 as the salt value, the hash value Hi is processed to generate the current dynamic key Ki.
[0009] Furthermore, the hash operation is the SHA-256 algorithm, and the key derivation function is the HKDF algorithm.
[0010] Furthermore, the core encryption algorithm is the AES algorithm.
[0011] A dynamic data encryption transmission system includes a sender and a receiver; The sending end includes a first pre-sharing module, a data segmentation module, a sending end dynamic key generation module, a sending end encryption module, and a sending module: The first pre-sharing module is used to pre-share the initial key K0 and the initial vector IV with the receiving end; The data segmentation module is used to divide the data to be transmitted into N data blocks; The sending end dynamic key generation module is used to generate the current dynamic key Ki based on the previous ciphertext block Ci-1 or the initialization vector IV; The sending end encryption module is used to encrypt the current data block Pi using the current dynamic key Ki and the core encryption algorithm to obtain the ciphertext block Ci; The sending module is used to transmit all ciphertext blocks in sequence. The receiving end includes: The second pre-sharing module is used to pre-share the initial key K0 and the initial vector IV with the sender; The receiving module is used to sequentially receive ciphertext blocks from the sending end; The receiving end dynamic key generation module is used to generate the current dynamic key Ki based on the previously stored ciphertext block Ci-1 or initialization vector IV. The receiving end decryption module is used to decrypt the current ciphertext block Ci using the current dynamic key Ki and the core encryption algorithm to recover the data block Pi.
[0012] Furthermore, the sending end dynamic key generation module and the receiving end dynamic key generation module are used to perform a hash operation on the previous ciphertext block Ci-1 or the initial vector IV to obtain a hash value Hi, and use the key derivation function to process the hash value Hi with the initial key K0 as the salt value to generate the current dynamic key Ki.
[0013] Furthermore, the hash operation is the SHA-256 algorithm, and the key derivation function is the HKDF algorithm.
[0014] Furthermore, the core encryption algorithm is the AES algorithm.
[0015] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the dynamic data encryption transmission method as described in any one of claims 1-4.
[0016] The present invention has the following beneficial effects: 1. Extremely high security: The encryption key for each data block is dynamically generated and depends on the content of the previous ciphertext block. This chain dependency ensures that even if an attacker cracks a certain ciphertext block Ci, they cannot deduce the key used to encrypt other data blocks (such as Ci+1 or Ci-1), effectively limiting the scope of security attacks and achieving the "one-time pad" security effect.
[0017] 2. Built-in integrity verification: Since key generation depends on the previous ciphertext block, if any ciphertext block is tampered with during transmission, it will cause errors in the dynamic key generation of all subsequent data blocks, making proper decryption impossible. The receiving end can easily detect data tampering through decryption failures, providing robust data integrity protection.
[0018] 3. Low communication overhead: The dynamic key is generated synchronously on both sides of the communication based on the transmitted data. There is no need to transmit the key separately for each data packet, nor is there a need for frequent and complex key exchange handshake protocols, which greatly saves network bandwidth and communication overhead.
[0019] 4. Replay Attack Resistance: Even if an attacker intercepts and replays a ciphertext block Ci, the dynamic key Ki generated by the receiver when processing Ci is based on the previous ciphertext block Ci-1. Since the attacker cannot reproduce the correct context, the replayed data packet cannot be decrypted correctly, effectively resisting replay attacks.
[0020] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description
[0021] Figure 1 This is a schematic diagram of the architecture of a dynamic data encryption transmission system provided in an embodiment of the present invention; Figure 2 This is a flowchart of a dynamic data encryption transmission method provided in an embodiment of the present invention. Detailed Implementation
[0022] In the description of this invention, it should also be noted that, unless otherwise expressly specified and limited, these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, it should be understood that after reading the teachings of this invention, those skilled in the art can make various alterations or modifications to the invention, and these equivalent forms also fall within the scope defined by the appended claims. Example
[0023] See Figure 1 This embodiment provides a dynamic data encryption transmission system, including a sending end 100 and a receiving end 200, which exchange data through a communication channel 300.
[0024] The sender 100 internally includes a first pre-sharing module 101, a data segmentation module 102, a sender dynamic key generation module 103, a sender encryption module 104, and a sending module 105.
[0025] The receiver 200 internally includes a second pre-shared module 201, a receiving module 202, a receiver dynamic key generation module 203, and a receiver decryption module 204.
[0026] Before communication begins, sender 100 and receiver 200 pre-share an initial key K0 and an initialization vector IV in a secure out-of-band manner (such as face-to-face configuration, using other secure channels, etc.). For example, K0 can be a 256-bit random string, and IV can be a 128-bit random string. This information is only used to initiate the encryption process and is not transmitted on communication channel 300.
[0027] See Figure 2 The dynamic data encryption transmission method in this embodiment is as follows: Sending process: Step 201: The sender 100 and receiver 200 pre-share the initial key K0 and the initial vector IV.
[0028] Step 202: The data segmentation module 102 of the transmitting end 100 divides the plaintext data M to be transmitted into N fixed-size data blocks, denoted as P1, P2, ..., PN. If the last data block is not large enough, padding can be added.
[0029] Step 203: For the i-th data block Pi (i cycles from 1 to N): Step 203a: The sending end dynamic key generation module 103 determines whether i is 1.
[0030] If i=1, then the initial vector IV is used as input.
[0031] If i > 1, then the ciphertext block Ci-1 generated by the previous encryption operation is used as input.
[0032] Step 203b: The sending end dynamic key generation module 103 performs a hash operation on the input (IV or Ci-1). In this embodiment, the SHA-256 algorithm is used to obtain a 256-bit hash value Hi.
[0033] Step 203c: The sending end dynamic key generation module 103 generates the current dynamic key Ki using the key derivation function KDF.
[0034] In this embodiment, HKDF (HMAC-based key derivation function) is used, with the initial key K0 as the salt, to process the hash value Hi and generate a key Ki with a length matching the core encryption algorithm. For example, if the core encryption algorithm is AES-256, then Ki is 256 bits. The formula is: Ki = HKDF-SHA256(salt=K0, IKM=Hi).
[0035] Step 203d: The sending end encryption module 104 encrypts the data block Pi using the current dynamic key Ki and the core encryption algorithm. In this embodiment, the core encryption algorithm adopts AES-256-CBC mode (or other suitable mode) to generate ciphertext block Ci. The formula is: Ci = AES-256-Encrypt(Pi, Ki).
[0036] Step 204: The sending module 105 of the sending end 100 sends all the generated ciphertext blocks C1, C2, ..., CN to the receiving end 200 in sequence through the communication channel 300.
[0037] Receiver process: Step 205: Receiver 200 and sender 100 pre-share the same initial key K0 and initial vector IV.
[0038] Step 206: The receiving module 202 of the receiving end 200 sequentially receives the ciphertext blocks C1, C2,..., CN from the sending end 100.
[0039] Step 207: For the i-th ciphertext block Ci (i cycles from 1 to N): Step 207a: The receiving end dynamic key generation module 203 determines whether i is 1.
[0040] If i=1, then the initial vector IV is used as input.
[0041] If i > 1, then the previous ciphertext block Ci-1, which has been correctly received and stored locally, is taken as input.
[0042] Step 207b: The receiving end dynamic key generation module 203 performs the exact same operation as the sending end: it performs a SHA-256 hash operation on the input to obtain Hi, and then uses HKDF-SHA256 (salt=K0, IKM=Hi) to generate the current dynamic key Ki. Since the input and algorithm are completely identical, the Ki generated by the receiving end is exactly the same as the Ki used for encryption by the sending end.
[0043] Step 207c: The receiving end decryption module 204 uses the current dynamic key Ki and the AES-256 decryption algorithm to decrypt the ciphertext block Ci, recovering the data block Pi. The formula is: Pi = AES-256-Decrypt(Ci, Ki).
[0044] Step 208: The receiving end 200 concatenates all the decrypted data blocks P1, P2, ..., PN, removes any possible padding, and recovers the complete original plaintext data M.
[0045] Through the above process, the entire encrypted transmission link forms a closed-loop, self-evolving dynamic key system. The encryption of each data packet is built upon the encryption result of the previous data packet, forming an indivisible "encryption chain." Any error or attack at any link will cause the entire chain to break, which will be easily detected by the system, greatly improving the security of data transmission.
[0046] The above description provides examples of the preferred embodiments of the present invention. Parts not detailed herein are common knowledge to those skilled in the art. The scope of protection of the present invention is determined by the claims. Any equivalent modifications based on the technical teachings of the present invention are also within the scope of protection of the present invention.
Claims
1. A method for dynamic data encryption transmission, characterized in that, This includes the steps executed at the sending end and the steps executed at the receiving end; The steps performed by the sending end include: S1. Determine the initial key K0 and an initial vector IV to be pre-shared with the receiver; S2. Divide the data to be transmitted into N data blocks, denoted as P1, P2, ..., PN; S3. Generate ciphertext blocks C1, C2, ..., CN corresponding to P1, P2, ..., PN in sequence, i∈1……N. The method for generating the ciphertext block Ci corresponding to the i-th data block Pi is as follows: Generate the current dynamic key Ki based on the (i-1)th ciphertext block Ci-1, and encrypt the data block Pi using the current dynamic key Ki and the preset core encryption algorithm to generate the current ciphertext block Ci; when i=1, Ci-0 is the initialization vector IV; S4, transmit all ciphertext blocks C1, C2, ..., CN to the receiving end in sequence; The receiving end performs the following steps: T1. Receive ciphertext blocks C1, C2, ..., CN from the sender in sequence; T2. Decrypt the ciphertext blocks C1, C2, ..., CN in sequence. The method for decrypting the i-th ciphertext block Ci is as follows: Generate the current dynamic key Ki based on the locally stored (i-1)-th ciphertext block Ci-1. Decrypt the ciphertext block Ci using the current dynamic key Ki and the same core encryption algorithm as the sender to recover the data block Pi. When i=1, Ci-0 is the initial vector IV.
2. The dynamic data encryption transmission method according to claim 1, characterized in that, In steps S3 and T2, the method for generating the current dynamic key Ki based on the (i-1)th ciphertext block Ci-1 specifically includes the following steps: Perform a hash operation on the (i-1)th ciphertext block Ci-1 to obtain the hash value Hi; Using the key derivation function, with the initial key K0 as the salt value, the hash value Hi is processed to generate the current dynamic key Ki.
3. The dynamic data encryption transmission method according to claim 2, characterized in that, The hash operation is the SHA-256 algorithm, and the key derivation function is the HKDF algorithm.
4. The dynamic data encryption transmission method according to claim 1, characterized in that, The core encryption algorithm is the AES algorithm.
5. A dynamic data encryption transmission system, characterized in that, Includes the sending end and the receiving end; The sending end includes a first pre-sharing module, a data segmentation module, a sending end dynamic key generation module, a sending end encryption module, and a sending module: The first pre-sharing module is used to pre-share the initial key K0 and the initial vector IV with the receiving end; The data segmentation module is used to divide the data to be transmitted into N data blocks; The sending end dynamic key generation module is used to generate the current dynamic key Ki based on the previous ciphertext block Ci-1 or the initialization vector IV; The sending end encryption module is used to encrypt the current data block Pi using the current dynamic key Ki and the core encryption algorithm to obtain the ciphertext block Ci; The sending module is used to transmit all ciphertext blocks in sequence. The receiving end includes: The second pre-sharing module is used to pre-share the initial key K0 and the initial vector IV with the sender; The receiving module is used to sequentially receive ciphertext blocks from the sending end; The receiving end dynamic key generation module is used to generate the current dynamic key Ki based on the previously stored ciphertext block Ci-1 or initialization vector IV. The receiving end decryption module is used to decrypt the current ciphertext block Ci using the current dynamic key Ki and the core encryption algorithm to recover the data block Pi.
6. The dynamic data encryption transmission system according to claim 5, characterized in that, The sending end dynamic key generation module and the receiving end dynamic key generation module are used to perform a hash operation on the previous ciphertext block Ci-1 or the initial vector IV to obtain a hash value Hi, and use the key derivation function to process the hash value Hi with the initial key K0 as the salt value to generate the current dynamic key Ki.
7. The dynamic data encryption transmission system according to claim 6, characterized in that, The hash operation is the SHA-256 algorithm, and the key derivation function is the HKDF algorithm.
8. The dynamic data encryption transmission system according to claim 5, characterized in that, The core encryption algorithm is the AES algorithm.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the dynamic data encryption transmission method as described in any one of claims 1-4.