Terminal information security protection system and method
By dynamically determining the number of encryption rounds and the size of data blocks in the terminal information security protection system, and combining chaotic mapping and neural networks to generate keys, multi-layer permutation and shift operations are performed. This solves the problem of balancing security and performance of encryption algorithms on resource-constrained terminals, and improves anti-analysis capabilities and system reliability.
Patent Information
- Application Number
- CN202610249012.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-03-03
- Publication Date
- 2026-05-19
AI Technical Summary
In existing terminal information security protection methods, there is a lack of an effective adaptive mechanism between the security strength of encryption algorithms and terminal hardware resources, and lightweight design makes it difficult to take into account the ability to resist cryptanalysis.
By acquiring the hardware status data of the terminal and the attribute data of the data to be protected, the number of encryption rounds and the data block size are dynamically determined. The key is generated by combining chaotic mapping and neural networks. Encryption is performed using multi-layer permutation, substitution, shifting and nonlinear operations of quantum logic gates, and a multi-key cyclic calling mechanism is introduced.
It achieves dynamic adaptation between encryption strength and terminal resource capabilities, improves resistance to cryptanalysis, enhances the flexibility and reliability of terminal information security protection, and resists differential, linear analysis, and side-channel attacks.
Smart Images
Figure CN122069029A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of information security technology, specifically to a terminal information security protection system and method. Background Technology
[0002] With the rapid development of mobile internet and IoT technologies, a massive number of resource-constrained nodes, such as smart sensors and embedded devices, form the foundation of data acquisition and transmission networks. These terminals carry various types of information, from ordinary measurement data to sensitive control commands, making their security crucial. However, existing information security technologies, especially encryption methods, applicable to such terminals face a series of structural contradictions and limitations.
[0003] One issue lies in the imbalance between the limited hardware resources of the terminal and the high computational cost of the algorithm. Traditional strong encryption algorithms (such as AES) perform well on general-purpose computing platforms, but their fixed and complex round functions, large memory footprint, and high power consumption directly exceed the capacity of many microcontroller units or low-power chips, making them difficult to apply in actual deployments or severely sacrificing device performance and battery life. Furthermore, there is a lack of effective adaptive mechanisms between the security strength of the encryption algorithm and the terminal's hardware resources.
[0004] On the other hand, existing lightweight encryption schemes have significant security flaws. In pursuit of efficiency, many schemes adopt highly simplified or even static designs, such as fixed S-box and P-box permutation rules. While this static structure reduces computational burden, it is difficult to effectively improve resistance to cryptanalysis while maintaining lightweightness. This makes the algorithm vulnerable to cryptanalysis techniques such as differential analysis and linear analysis, and it lacks effective resistance to side-channel attacks. Summary of the Invention
[0005] The purpose of this invention is to address the problems mentioned in the background art, namely, the lack of an effective adaptive mechanism between the security strength of encryption algorithms and terminal hardware resources in existing terminal information security protection methods, and the difficulty in taking into account the resistance to cryptanalysis in lightweight design. Therefore, this invention proposes a terminal information security protection system and method.
[0006] A first aspect of this invention provides a terminal information security protection method, the method comprising: Obtain the hardware status data of the terminal and the attribute data of the data to be protected, and determine the number of encryption rounds based on the hardware status data and the attribute data; Generate an initial key and secret parameters based on preset key materials; The data block size is determined based on the secret parameters, and the initial key is expanded to obtain a first key that fits the data block size. Using a preset encryption strategy, the data to be protected is encrypted according to the first key, the secret parameter, the data block size, and the number of encryption rounds to obtain the ciphertext result; Meta-information is added to the header of the ciphertext, and the ciphertext with meta-information is structured according to a storage format or terminal communication protocol for storage or transmission; the meta-information includes the hash value of the secret parameter and the number of encryption rounds.
[0007] By implementing this technical solution, dynamic adaptation between encryption strength and terminal resource capabilities is achieved, effectively solving the problem of balancing performance and security when traditional encryption algorithms are deployed on resource-constrained terminals. By intelligently determining the number of encryption rounds by combining hardware status and data attributes, resource overload is avoided while ensuring the security of critical data, thus improving the practicality and flexibility of terminal protection.
[0008] Optionally, the key material includes the initial value x0 and control parameters u of a one-dimensional discrete chaotic map, as well as the weights of a fully connected network; the generation of the initial key and secret parameters based on the preset key material includes: The chaotic sequence X is generated iteratively based on the initial value x0 and the control parameter u: ;where x i Let X be the i-th value of sequence X; This is the chaos enhancement factor; mod() is the modulo operator; dec() is the decimal operator; Take a subsequence at a fixed position in the chaotic sequence X, input it into a preset fully connected network, and output a pseudo-random seed sequence, with a total of 32 seeds; The pseudo-random seed is mapped to an integer within a preset range to obtain an integer seed sequence; Take four consecutive integer seeds, perform a bitwise XOR operation on each seed, and take the modulo 256 to get 8 bytes. Concatenate two adjacent bytes to get four key segments, denoted as SK0, SK1, SK2, and SK3. Concatenate these four segments to get the initial key SK. Calculate three secret parameters p1, p2, and p3 based on the four key fragments, as follows: ; where ⊕ represents the XOR operation.
[0009] By implementing this technical solution, a combination of chaotic mapping and neural networks is used to generate keys, enhancing the randomness and unpredictability of the keys and effectively resisting analytical attacks based on mathematical models. Simultaneously, generating secret parameters from key fragments provides a dynamically adjustable parameter basis for subsequent encryption processes, improving the overall security of the system.
[0010] Optionally, determining the data block size based on the secret parameters and expanding the initial key to obtain a first key adapted to the data block size includes: Based on the secret parameters p1, p2, and p3, the data block size BS is calculated as follows: ; If the length of the initial key SK is inconsistent with the data block size BS, then the initial key is concatenated in a loop to obtain the first key EK.
[0011] By implementing this technical solution, the data block size can be dynamically determined and the key can be adaptively expanded. This allows the encryption structure to be flexibly adjusted according to the secret parameters, avoiding dependence on fixed block size and key length, and enhancing the algorithm's dynamism and resistance to analysis.
[0012] Optionally, the encryption strategy includes: Step 1: Convert the protected data into a binary stream and split it into multiple data blocks according to the data block size; if the last block is not long enough, use dynamic padding, with the padding bits taken from the secret parameter; The secret parameters are cyclically concatenated to a length equal to the size of the data block to obtain the second key; Step 2: Iterate through the encryption rounds. Each round of encryption includes: Take a certain number of bits from the first key and the secret parameter, concatenate them to convert them into a decimal number, and take the remainder of the data block size to obtain the first shift number; perform a cyclic left shift on the current data block according to the first shift number to obtain the first permutation block; XOR the first permutation block with the second key to obtain the first obfuscation sequence; Shift the first obfuscated sequence one position to the left to obtain the second obfuscated sequence; The second obfuscated sequence is split into multiple sub-blocks according to a preset sub-block length. The average value of the secret parameter is modulo the preset sub-block length to obtain a second shift number. Each sub-block is cyclically shifted left according to the second shift number. The shifted sub-blocks are then concatenated to obtain a second permutation block. The second permutation block is XORed with the second key to obtain a third obfuscated sequence. Step 3: Using the first key and the second key as control bits, and the final second obfuscation sequence S as the target bit, input them into the CCNOT gate, flip the bits of S that meet the conditions, and obtain the flipped sequence; The ciphertext block is obtained by shifting the flipped sequence left by one bit and then XORing it with the corresponding key.
[0013] By implementing this technical solution, a high-strength confusion and diffusion mechanism is constructed through multi-layered permutations, substitutions, shifts, and nonlinear operations using quantum logic gates, significantly improving the randomness of the ciphertext and its resistance to differential and linear analysis. Dynamic padding and parameter-driven encryption processes further enhance the algorithm's unpredictability, making it suitable for terminal environments that require both security and lightweight design.
[0014] Optionally, the step of shifting the flipped sequence left by one bit and then XORing it with the corresponding key to obtain the ciphertext block includes: If the number of data blocks exceeds a preset threshold, the first key and the second key are XORed to obtain the third key; A key set is formed by arranging the first key, the second key, and the third key in sequence. Based on the sequence number of the original data block corresponding to the flipped sequence, a corresponding key is selected from the key set for XOR operation, specifically: For the data block with sequence number i, the position index of its corresponding key is: .
[0015] By implementing this technical solution and introducing a multi-key cyclic calling mechanism, the diversified use of keys is achieved without adding extra key materials, thereby enhancing the system's resistance to statistical analysis and its practical performance.
[0016] A second aspect of this invention provides a terminal information security protection system, the system comprising: The round number determination module is used to acquire the hardware status data of the terminal and the attribute data of the data to be protected, and determine the encryption round number based on the hardware status data and the attribute data. The key initialization module is used to generate an initial key and secret parameters based on preset key materials; A block size determination module is used to determine the data block size based on the secret parameters and to expand the initial key to obtain a first key that is adapted to the data block size. An encryption execution module is used to encrypt the data to be protected using a preset encryption strategy, based on the first key, the secret parameter, the data block size, and the number of encryption rounds, to obtain a ciphertext result. The ciphertext structuring module is used to add metadata to the ciphertext header and structure the ciphertext with metadata according to a storage format or terminal communication protocol for storage or transmission; the metadata includes the hash value of the secret parameter and the number of encryption rounds.
[0017] Optionally, the key material includes the initial value x0 and control parameters u of a one-dimensional discrete chaotic map, as well as the weights of a fully connected network; the key initialization module includes: The chaotic sequence generation module is used to iteratively generate a chaotic sequence X based on the initial value x0 and the control parameter u. ;where x i Let X be the i-th value of sequence X; This is the chaos enhancement factor; mod() is the modulo operator; dec() is the decimal operator; The pseudo-random mapping module is used to take a subsequence at a fixed position in the chaotic sequence X, input it into a preset fully connected network, and output a pseudo-random seed sequence, with a total of 32 seeds; The initial key determination module is used to map the pseudo-random seed to an integer within a preset range to obtain an integer seed sequence; after performing a bitwise XOR operation on four consecutive integer seeds and taking the modulo 256, eight bytes are obtained; adjacent two bytes are concatenated to obtain four key fragments, denoted as SK0, SK1, SK2, and SK3; these four fragments are concatenated to obtain the initial key SK. The secret parameter generation module is used to calculate three secret parameters p1, p2, and p3 based on four key fragments, which are as follows: ; where ⊕ represents the XOR operation.
[0018] Optionally, the block size determination module includes: The block size calculation module is used to calculate the data block size BS based on the secret parameters p1, p2, and p3. ; The key adaptation module is used to perform self-cyclic concatenation of the initial key SK to obtain the first key EK if the length of the initial key SK is inconsistent with the data block size BS.
[0019] Optionally, the encryption execution module includes: The preprocessing module is used to convert the protected data into a binary stream and split it into multiple data blocks according to the data block size; if the last block is not long enough, dynamic padding is used, and the padding bits are taken from the secret parameter; the secret parameter is cyclically concatenated to the same length as the data block size to obtain the second key; The iterative permutation and replacement module is used to iterate through the encryption rounds. Each round of encryption includes: Take a certain number of bits from the first key and the secret parameter, concatenate them to convert them into a decimal number, and take the remainder of the data block size to obtain the first shift number; perform a cyclic left shift on the current data block according to the first shift number to obtain the first permutation block; XOR the first permutation block with the second key to obtain the first obfuscation sequence; Shift the first obfuscated sequence one position to the left to obtain the second obfuscated sequence; The second obfuscated sequence is split into multiple sub-blocks according to a preset sub-block length. The average value of the secret parameter is modulo the preset sub-block length to obtain a second shift number. Each sub-block is cyclically shifted left according to the second shift number. The shifted sub-blocks are then concatenated to obtain a second permutation block. The second permutation block is XORed with the second key to obtain a third obfuscated sequence. The nonlinear transformation module is used to take the first key and the second key as control bits, take the final second confusion sequence S as target bits, input the CCNOT gate, flip the bits of S that meet the conditions to obtain the flipped sequence; shift the flipped sequence left by one bit and XOR it with the corresponding key to obtain the ciphertext block.
[0020] Optionally, the nonlinear transformation module includes: The key set module is used to perform an XOR operation on the first key and the second key to obtain a third key if the number of data blocks exceeds a preset threshold; the first key, the second key and the third key are arranged in order to form a key set; The key loop calling module is used to select the corresponding key from the key set and perform an XOR operation based on the sequence number of the original data block corresponding to the flip sequence. Specifically: For the data block with sequence number i, the position index of its corresponding key is: . Attached Figure Description
[0021] Figure 1 A flowchart illustrating a terminal information security protection method provided in an embodiment of the present invention; Figure 2 This is an architecture diagram of a terminal information security protection system provided in an embodiment of the present invention. Detailed Implementation
[0022] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features and effects of the present invention is provided in conjunction with the accompanying drawings and preferred embodiments.
[0023] This invention provides a method for protecting terminal information security. See also... Figure 1 , Figure 1 A flowchart illustrating a terminal information security protection method provided in an embodiment of the present invention. The method includes the following steps: S101, Obtain the hardware status data of the terminal and the attribute data of the data to be protected, and determine the number of encryption rounds based on the hardware status data and attribute data; S102, Generate an initial key and secret parameters based on preset key materials; S103, determine the data block size according to the secret parameters, and expand the initial key to obtain a first key that fits the data block size; S104: Using a preset encryption strategy, the data to be protected is encrypted according to the first key, secret parameters, data block size and number of encryption rounds to obtain the ciphertext result; S105, add metadata to the ciphertext header, and structure the ciphertext with metadata according to the storage format or terminal communication protocol for storage or transmission.
[0024] The hardware status data includes memory capacity, processor computing power, and remaining battery power. Attribute data includes data type and sensitivity. Meta-information includes the hash value of the secret parameter and the number of encryption rounds.
[0025] The terminal information security protection method provided in this invention introduces a joint sensing mechanism of terminal hardware status and data attributes to dynamically determine the number of encryption rounds and data block size, achieving adaptive matching between encryption strength and terminal resource capabilities. This ensures lightweight operation while avoiding insufficient security or performance overload. Simultaneously, by utilizing secret parameters to drive key expansion and encryption structure configuration, the algorithm's dynamism and unpredictability are enhanced, effectively improving resistance to differential analysis, linear analysis, and side-channel attacks, thereby improving the overall reliability and practicality of terminal information security protection.
[0026] In one implementation, the number of encryption rounds is determined by a preset rule matching method. For example, when computing power is sufficient and the data is highly sensitive, three rounds of encryption are selected; when computing power is insufficient and the data is low-sensitivity, one round of encryption is selected.
[0027] In one embodiment, the key material includes the initial value x0 of a one-dimensional discrete chaotic map, control parameters u, and weights of a fully connected network.
[0028] Step S102, generating an initial key based on preset key materials includes: Step 1: Iteratively generate a chaotic sequence X based on the initial value x0 and the control parameter u: ;where x i Let X be the i-th value of sequence X; This is the chaos enhancement factor, which can take the value 0.001; mod() is the modulo operation; dec() is the decimal operation; Step two: Take a subsequence at a fixed position in the chaotic sequence X (e.g., from position 60 to position 91), input it into a pre-defined fully connected network, and output a pseudo-random seed sequence Y, with a total of 32 seeds. The fully connected network contains 3 fully connected layers, each with 32 neurons.
[0029] Step 3: Map the pseudo-random seed to an integer within a preset range to obtain the integer seed sequence. Specifically, ; where min(Y) and max(Y) represent the minimum and maximum values of Y, respectively; INT() is the floor function.
[0030] Step 4: Take four consecutive integer seeds, perform a bitwise XOR operation on each seed, and take the modulo 256 to obtain 8 bytes; concatenate these 8 bytes to obtain the initial key SK.
[0031] In this embodiment, a one-dimensional discrete chaotic mapping with a chaos enhancement factor is first introduced to enhance the initial value sensitivity of the chaotic sequence, providing a high-quality entropy source for key generation. Subsequently, a specific segment of the chaotic sequence is input into a fully connected network. Utilizing the powerful nonlinear mapping capability of neural networks, the chaotic sequence is subjected to secondary confusion and diffusion, making the correlation between the output pseudo-random seed sequence and the original chaotic sequence more concealed, effectively resisting prediction attacks based on chaotic system reconstruction. Finally, the initial key and secret parameters are obtained through integer mapping, XOR, and concatenation. The entire process constitutes a multi-level, nonlinear key generator, greatly increasing the complexity of the key space and its resistance to analysis. In one embodiment, multiple secret parameters are generated using an initial key SK to dynamically determine the block size and permutation / replacement parameters. Specifically: Step 1: Divide the initial key SK into 4 segments, denoted as SK0, SK1, SK2, and SK3; Step two: Calculate three 16-bit secret parameters p1, p2, and p3 based on the four key fragments. The calculation formula is as follows: ; where ⊕ represents the XOR operation.
[0032] Step 3: Calculate the data block size BS based on the secret parameters p1, p2, and p3. ; Step four: If the length of the initial key SK is inconsistent with the data block size BS, then the initial key is concatenated cyclically to obtain the first key EK. For example, the initial key is d0d1...d 63 If the calculated data block size is 96, then the first key is d0d1...d 63 d0d1...d 31 .
[0033] This embodiment dynamically determines the data block size by deriving multiple secret parameters from the initial key and adapting them to the padding key, making the encryption process more unpredictable and flexible.
[0034] In one embodiment, step S104 involves using a preset encryption strategy to encrypt the data to be protected based on the first key, secret parameters, data block size, and number of encryption rounds, resulting in ciphertext: S1041, Data Preprocessing: The protected data is converted into a binary stream and split into multiple data blocks according to their size. If the last block is not long enough, it is filled in sequentially using secret parameters p1, p2, and p3. This dynamic padding method eliminates the regular tail of the data and enhances its resistance to chosen-plaintext attacks.
[0035] S1042, Calculate the substitution parameters: Step 1, calculate the permutation parameters: Take a certain number of bits from the first key and the secret parameter (for example, take the first eight bits of the first key and the last eight bits of the secret parameter p1), concatenate them and convert them into a decimal number. Take the remainder of the data block size to obtain the first shift bit, which is used for shifting and swapping the data block.
[0036] The average value of the secret parameters p1, p2, and p3 is moduloed by the preset sub-block length (e.g., 16 bits) to obtain the second shift bit, which is used for shifting and swapping sub-blocks.
[0037] Step 2, calculate the replacement parameters: Circularly concatenate the secret parameters p1, p2, and p3 to the same length as the data block size to obtain the second key, which is used for the data block replacement operation.
[0038] S1043, perform iterative encryption rounds, each round of encryption includes: The current data block is cyclically shifted left according to the first shift number to obtain the first permutation block; the first permutation block is XORed with the second key to obtain the first confusion sequence; Shift the first obfuscated sequence one position to the left to obtain the second obfuscated sequence; The second obfuscated sequence is split into multiple sub-blocks according to a preset sub-block length; each sub-block is cyclically shifted to the left according to the second shift number, and the shifted sub-blocks are concatenated to obtain the second permutation block; the second permutation block is XORed with the second key to obtain the third obfuscated sequence.
[0039] S1044: Using the first and second keys as control bits and the final second confusion sequence (denoted as S) as the target bit, input the CCNOT gate to flip the bits of S that meet the conditions, obtaining the flipped sequence; shift the flipped sequence left by one bit and XOR it with the corresponding key to obtain the ciphertext block. Specifically, the calculation logic of the CCNOT gate is to flip the target bit when all control bits are 1.
[0040] This embodiment, on the one hand, combines dynamic permutation, substitution, cyclic shifting, and multi-round iterative encryption to subject data to multiple layers of obfuscation at both the block and sub-block levels. Simultaneously, it introduces CCNOT gates to achieve controllable bit flipping, thereby significantly enhancing the nonlinearity and randomness of the ciphertext and improving its resistance to differential analysis, linear analysis, and statistical attacks. On the other hand, it relies only on basic operations such as XOR, cyclic shifting, and CCNOT gates, greatly reducing computational power consumption.
[0041] In one implementation, if the number of data blocks exceeds a preset threshold (e.g., 2), the first and second keys can be XORed to obtain a third key, and the first, second, and third keys can be applied cyclically. Specifically, a key set {EK0, EK1, EK2} is formed by sequentially arranging the first, second, and third keys. For a data block with index i, the position index of its corresponding key is... If the number of data blocks exceeds a preset threshold, the first key and the second key will be used sequentially for the final XOR operation.
[0042] This embodiment effectively increases key diversity and non-linear complexity by using multiple keys alternately, thereby enhancing the system's resistance to ciphertext analysis and attacks, while avoiding the security risks associated with reusing a single key. Furthermore, generating the third key requires only one XOR operation, resulting in minimal computational overhead and improving security with almost no increase in computational burden.
[0043] In one embodiment, the decryption process is the reverse of the encryption process. The decryption end regenerates the initial key and secret parameters using the same key materials as the encryption end, calculates the hash value of the secret parameters and compares it with the hash value of the ciphertext header. After successful verification, the decryption end performs the corresponding inverse operation in the reverse order of the encryption process using the same secret parameters, data block size and encryption rounds, and finally recovers the plaintext data.
[0044] This invention provides a terminal information security protection system. See also... Figure 2 , Figure 2 This is an architecture diagram of a terminal information security protection system provided in an embodiment of the present invention. The system includes: The round number determination module is used to obtain the hardware status data of the terminal and the attribute data of the data to be protected, and determine the number of encryption rounds based on the hardware status data and attribute data.
[0045] The key initialization module is used to generate an initial key and secret parameters based on preset key materials.
[0046] The block size determination module is used to determine the data block size based on the secret parameters and to expand the initial key to obtain a first key that is adapted to the data block size.
[0047] The encryption execution module is used to encrypt the data to be protected using a preset encryption strategy, based on the first key, secret parameters, data block size, and number of encryption rounds, to obtain the ciphertext result.
[0048] The ciphertext structuring module is used to add metadata to the ciphertext header and structure the ciphertext with metadata according to the storage format or terminal communication protocol for storage or transmission.
[0049] The terminal information security protection system provided in this invention introduces a joint sensing mechanism of terminal hardware status and data attributes to dynamically determine the number of encryption rounds and data block size, achieving adaptive matching between encryption strength and terminal resource capabilities. This ensures lightweight design while avoiding insufficient security or performance overload. Simultaneously, by utilizing secret parameters to drive key expansion and encryption structure configuration, the dynamics and unpredictability of the algorithm are enhanced, effectively improving resistance to differential analysis, linear analysis, and side-channel attacks, thereby improving the overall reliability and practicality of terminal information security protection.
[0050] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention are within the scope of the claims of the present invention.
Claims
1. A terminal information security protection method, characterized in that, The method includes: Obtain the hardware status data of the terminal and the attribute data of the data to be protected, and determine the number of encryption rounds based on the hardware status data and the attribute data; Generate an initial key and secret parameters based on preset key materials; The data block size is determined based on the secret parameters, and the initial key is expanded to obtain a first key that fits the data block size. Using a preset encryption strategy, the data to be protected is encrypted according to the first key, the secret parameter, the data block size, and the number of encryption rounds to obtain the ciphertext result; Meta-information is added to the header of the ciphertext, and the ciphertext with meta-information is structured according to a storage format or terminal communication protocol for storage or transmission; the meta-information includes the hash value of the secret parameter and the number of encryption rounds.
2. The terminal information security protection method according to claim 1, characterized in that, The key material includes the initial value x0 and control parameter u of a one-dimensional discrete chaotic map, as well as the weights of a fully connected network. The process of generating the initial key and secret parameters based on preset key materials includes: The chaotic sequence X is generated iteratively based on the initial value x0 and the control parameter u: ; where x i Let X be the i-th value of sequence X; This is the chaos enhancement factor; mod() is the modulo operator; dec() is the decimal operator; Take a subsequence at a fixed position in the chaotic sequence X, input it into a preset fully connected network, and output a pseudo-random seed sequence, with a total of 32 seeds; The pseudo-random seed is mapped to an integer within a preset range to obtain an integer seed sequence; Take four consecutive integer seeds, perform a bitwise XOR operation on each seed, and take the modulo 256 to get 8 bytes. Concatenate two adjacent bytes to get four key segments, denoted as SK0, SK1, SK2, and SK3. Concatenate these four segments to get the initial key SK. Calculate three secret parameters p1, p2, and p3 based on the four key fragments, as follows: ; where ⊕ represents the XOR operation.
3. The terminal information security protection method according to claim 2, characterized in that, The data block size is determined based on the secret parameters, and the initial key is expanded to obtain a first key adapted to the data block size, including: Based on the secret parameters p1, p2, and p3, the data block size BS is calculated as follows: ； If the length of the initial key SK is inconsistent with the data block size BS, then the initial key is concatenated in a loop to obtain the first key EK.
4. The terminal information security protection method according to claim 3, characterized in that, The encryption strategy includes: Step 1: Convert the protected data into a binary stream and split it into multiple data blocks according to the data block size; if the last block is not long enough, use dynamic padding, with the padding bits taken from the secret parameter; The secret parameters are cyclically concatenated to a length equal to the size of the data block to obtain the second key; Step 2: Iterate through the encryption rounds. Each round of encryption includes: Take a certain number of bits from the first key and the secret parameter, concatenate them to convert them into a decimal number, and take the remainder of the data block size to obtain the first shift number; perform a cyclic left shift on the current data block according to the first shift number to obtain the first permutation block; XOR the first permutation block with the second key to obtain the first obfuscation sequence; Shift the first obfuscated sequence one position to the left to obtain the second obfuscated sequence; The second obfuscated sequence is split into multiple sub-blocks according to a preset sub-block length. The average value of the secret parameter is modulo the preset sub-block length to obtain a second shift number. Each sub-block is cyclically shifted left according to the second shift number. The shifted sub-blocks are then concatenated to obtain a second permutation block. The second permutation block is XORed with the second key to obtain a third obfuscated sequence. Step 3: Using the first key and the second key as control bits, and the final second obfuscation sequence S as the target bit, input them into the CCNOT gate, flip the bits of S that meet the conditions, and obtain the flipped sequence; The ciphertext block is obtained by shifting the flipped sequence left by one bit and then XORing it with the corresponding key.
5. A terminal information security protection method according to claim 4, characterized in that, The step of shifting the flipped sequence left by one bit and then XORing it with the corresponding key to obtain the ciphertext block includes: If the number of data blocks exceeds a preset threshold, the first key and the second key are XORed to obtain the third key; A key set is formed by arranging the first key, the second key, and the third key in sequence. Based on the sequence number of the original data block corresponding to the flipped sequence, a corresponding key is selected from the key set for XOR operation, specifically: For the data block with sequence number i, the position index of its corresponding key is: .
6. A terminal information security protection system, characterized in that, The system includes: The round number determination module is used to acquire the hardware status data of the terminal and the attribute data of the data to be protected, and determine the encryption round number based on the hardware status data and the attribute data. The key initialization module is used to generate an initial key and secret parameters based on preset key materials; A block size determination module is used to determine the data block size based on the secret parameters and to expand the initial key to obtain a first key that is adapted to the data block size. An encryption execution module is used to encrypt the data to be protected using a preset encryption strategy, based on the first key, the secret parameter, the data block size, and the number of encryption rounds, to obtain a ciphertext result. The ciphertext structuring module is used to add metadata to the ciphertext header and structure the ciphertext with metadata according to a storage format or terminal communication protocol for storage or transmission; the metadata includes the hash value of the secret parameter and the number of encryption rounds.
7. A terminal information security protection system according to claim 6, characterized in that, The key material includes the initial value x0 and control parameter u of a one-dimensional discrete chaotic map, as well as the weights of a fully connected network. The key initialization module includes: The chaotic sequence generation module is used to iteratively generate a chaotic sequence X based on the initial value x0 and the control parameter u. ; where x i Let X be the i-th value of sequence X; This is the chaos enhancement factor; mod() is the modulo operator; dec() is the decimal operator; The pseudo-random mapping module is used to take a subsequence at a fixed position in the chaotic sequence X, input it into a preset fully connected network, and output a pseudo-random seed sequence, with a total of 32 seeds; The initial key determination module is used to map the pseudo-random seed to an integer within a preset range to obtain an integer seed sequence; after performing a bitwise XOR operation on four consecutive integer seeds and taking the modulo 256, eight bytes are obtained; adjacent two bytes are concatenated to obtain four key fragments, denoted as SK0, SK1, SK2, and SK3; these four fragments are concatenated to obtain the initial key SK. The secret parameter generation module is used to calculate three secret parameters p1, p2, and p3 based on four key fragments, which are as follows: ; where ⊕ represents the XOR operation.
8. A terminal information security protection system according to claim 7, characterized in that, The block size determination module includes: The block size calculation module is used to calculate the data block size BS based on the secret parameters p1, p2, and p3. ； The key adaptation module is used to perform self-cyclic concatenation of the initial key SK to obtain the first key EK if the length of the initial key SK is inconsistent with the data block size BS.
9. A terminal information security protection system according to claim 8, characterized in that, The encryption execution module includes: The preprocessing module is used to convert the protected data into a binary stream and split it into multiple data blocks according to the data block size; if the last block is not long enough, dynamic padding is used, and the padding bits are taken from the secret parameter; the secret parameter is cyclically concatenated to the same length as the data block size to obtain the second key; The iterative permutation and replacement module is used to iterate through the encryption rounds. Each round of encryption includes: Take a certain number of bits from the first key and the secret parameter, concatenate them to convert them into a decimal number, and take the remainder of the data block size to obtain the first shift number; perform a cyclic left shift on the current data block according to the first shift number to obtain the first permutation block; XOR the first permutation block with the second key to obtain the first obfuscation sequence; Shift the first obfuscated sequence one position to the left to obtain the second obfuscated sequence; The second obfuscated sequence is split into multiple sub-blocks according to a preset sub-block length. The average value of the secret parameter is modulo the preset sub-block length to obtain a second shift number. Each sub-block is cyclically shifted left according to the second shift number. The shifted sub-blocks are then concatenated to obtain a second permutation block. The second permutation block is XORed with the second key to obtain a third obfuscated sequence. The nonlinear transformation module is used to take the first key and the second key as control bits, take the final second confusion sequence S as target bits, input the CCNOT gate, flip the bits of S that meet the conditions to obtain the flipped sequence; shift the flipped sequence left by one bit and XOR it with the corresponding key to obtain the ciphertext block.
10. A terminal information security protection system according to claim 9, characterized in that, The nonlinear transformation module includes: The key set module is used to perform an XOR operation on the first key and the second key to obtain a third key if the number of data blocks exceeds a preset threshold; the first key, the second key and the third key are arranged in order to form a key set; The key loop calling module is used to select the corresponding key from the key set and perform an XOR operation based on the sequence number of the original data block corresponding to the flip sequence. Specifically: For the data block with sequence number i, the position index of its corresponding key is: .