Dynamic key rotation encryption method and system based on byte permutation and date driving

Abstract

The application relates to the technical field of information security, and particularly discloses a dynamic key rotation encryption method and system based on byte replacement and date driving. The technical scheme of the application generates a basic key byte array by splicing the current date and a fixed password, performs byte position replacement confusion on the basic key byte array according to a sorting array to generate a daily encryption key, checks a date prefix during the encryption and decryption process, and automatically regenerates the key when the date prefix is inconsistent, thereby solving the problems of increased leakage risk caused by long-term use of a fixed key in a traditional encryption mode, complex manual key replacement operation process and easy errors, lack of automatic periodic rotation, and insufficient forward security, achieving daily automatic rotation and dynamic update of the encryption key, improving the security level of data encryption protection, and reducing the risk of batch decryption of historical data after key leakage.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a dynamic key rotation encryption method and system based on byte substitution and date-driven encryption. Background Technology

[0002] In the field of information system security, data encryption is a core means of ensuring that sensitive information is not illegally obtained. Currently, most traditional information systems use symmetric encryption algorithms such as AES (Advanced Encryption Standard) to encrypt and protect business data. Their encryption keys are usually stored as fixed strings in configuration files or hard-coded directly into the application source code. The system continuously uses the same key for encryption and decryption operations throughout long-term operation. Although some systems have maintenance personnel manually modify the keys in the configuration files monthly or quarterly and notify relevant system modules and external partners to update them synchronously, this practice has revealed many problems in actual operation.

[0003] The long-term use of fixed keys significantly increases the risk of data leakage. Once a key is leaked by internal personnel or obtained by external attackers through reverse engineering, configuration file theft, or other means, all historical encrypted data is at risk of being decrypted in bulk. Manually changing keys requires modifying configuration files, restarting application services, and coordinating simultaneous updates across multiple systems, making the process complex and prone to errors. Furthermore, key replacement relies entirely on manual execution, lacking an automated, periodic rotation mechanism, which is prone to omissions or delays and fails to meet the key management requirements of high-security scenarios. In addition, the forward security of the fixed-key mechanism is insufficient; if a key is cracked at some point, an attacker can use it to decrypt all previously accumulated historical data, resulting in a very large data exposure scope. Storing keys in plaintext or simply encoded form in configuration files has low storage security; once the configuration file is illegally accessed, the key is immediately exposed.

[0004] Therefore, there is an urgent need for an encryption method that can achieve automated dynamic key rotation, enhance forward security, and improve the security level of key storage, in order to solve the above-mentioned defects of existing technologies. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides a dynamic key rotation encryption method and system based on byte substitution and date-driven principles.

[0006] In a first aspect, the present invention provides a dynamic key rotation encryption method based on byte substitution and date-driven methods, the technical solution of which is as follows: Retrieve pre-stored fixed passwords and sorted arrays; Obtain the current date and format it as a date string; concatenate the date string with the fixed password to generate a basic key byte array. The basic key byte array is byte-positioned and obfuscated according to the sorted array to generate the encryption key for the day, and the encryption key for the day is used as the obfuscated key currently in use. Receive encryption or decryption requests initiated by the business system, and extract the date prefix from the currently used obfuscation key; Determine whether the date prefix is ​​consistent with the date string. If the date prefix is ​​inconsistent with the date string, regenerate the encryption key for the day and update the regenerated encryption key for the day with the currently used obfuscation key. The updated, currently used obfuscation key is used to perform AES encryption or decryption on the requested data, and the encryption or decryption result is returned to the business system.

[0007] The beneficial effects of the dynamic key rotation encryption method based on byte substitution and date-driven approach of the present invention are as follows: The method of this invention generates a basic key byte array by concatenating the current date with a fixed password, and performs byte position permutation and obfuscation on the basic key byte array according to a sorted array to generate the encryption key for the day. At the same time, the date prefix is ​​verified during the encryption and decryption process, and the key is automatically regenerated when there is a discrepancy. This solves the problems of traditional encryption methods, such as the increased risk of leakage due to the long-term use of fixed keys, the complexity and error-proneness of manual key replacement, the lack of automated periodic rotation, and insufficient forward security. It realizes daily automatic rotation and dynamic updating of encryption keys, improves the security level of data encryption protection, and reduces the risk of batch decryption of historical data after key leakage.

[0008] Based on the above scheme, the dynamic key rotation encryption method based on byte substitution and date driving of the present invention can be further improved as follows.

[0009] In one alternative approach, the step of obfuscating the base key byte array by byte position permutation according to the sorted array to generate a current day encryption key, and using the current day encryption key as the currently used obfuscated key, includes: The basic key byte array is divided into multiple preset groups, and the number of bytes contained in each preset group is the same as the length of the sorted array; The positions of each byte in each preset group are rearranged according to the byte position order defined by the sorting array. The replaced byte array is used as the encryption key for the day, and the encryption key for the day is assigned to the currently used obfuscation key.

[0010] The advantages of adopting the above optional method are: further dividing the basic key byte array into multiple groups according to the length of the sorted array, and rearranging the byte positions in each group according to the order defined by the sorted array, so as to introduce a group-level obfuscation mechanism into the key generation process, thereby improving the complexity and anti-analysis capability of the encryption key.

[0011] In one alternative approach, the step of rearranging the positions of each byte within each preset group according to the byte position order defined by the sorted array is performed using the following substitution formula: Wherein, data represents the basic key byte array before the substitution, arr represents the byte array after the substitution, sort represents the sorting array, n represents the length of the sorting array, k represents the group number, and j represents the index within the group.

[0012] The advantages of adopting the above optional method are: further clarifying the mapping relationship between the group number and the index within the group through the substitution formula, so that the byte position substitution process has a clear mathematical expression and calculation basis, which facilitates code writing and logic verification in engineering implementation.

[0013] In one alternative approach, after the step of rearranging the positions of the bytes within each preset group according to the byte position order defined by the sorted array, the method further includes: The permuted byte array is restored to the basic key byte array according to the inverse mapping relationship of the sorted array.

[0014] The advantages of using the above optional method are: further utilizing the inverse mapping relationship of the sorted array to restore the permuted byte array to the basic key byte array, making the key obfuscation operation reversible, and providing a restoration basis for subsequent decryption or key verification.

[0015] In one alternative approach, the fixed password includes a private key fixed password, a public key fixed password, and a default key fixed password; the step of obtaining the pre-stored fixed password includes: Based on the application scenario corresponding to the encryption or decryption request, one of the following is selected as the currently used fixed password: the private key fixed password, the public key fixed password, and the default key fixed password.

[0016] The advantages of adopting the above optional method are: further setting the fixed password into three types: private, public, and default, and selecting one according to the application scenario corresponding to the encryption or decryption request, so that different business scenarios can use differentiated key generation bases, and realize the hierarchical isolation of key management.

[0017] In one alternative approach, after generating the encryption key for the day using the private key fixed password, the Hex-encoded AES ciphertext is read from the configuration file, the encryption key for the day is used to perform AES decryption on the ciphertext to obtain the plaintext ciphertext, and the plaintext ciphertext is then passed to the database connection pool.

[0018] The advantages of adopting the above optional method are as follows: after generating the encryption key for the day using a private key fixed password, this key is used to decrypt the AES ciphertext password encoded by Hex in the configuration file, and the resulting plaintext password is transmitted to the database connection pool, thus avoiding the database password being stored directly in plaintext in the configuration file.

[0019] In one alternative approach, the step of regenerating the encryption key for the day includes: The current date is retrieved again and formatted as the date string. The retrieved date string is concatenated with the fixed password to generate a new basic key byte array. The new basic key byte array is then scrambled by byte position substitution according to the sorted array to generate a new encryption key for the current day.

[0020] The advantages of adopting the above optional method are as follows: when the date prefix verification is inconsistent, the current date is obtained again, the new date string is concatenated with the fixed password to generate a new basic key byte array, and then a new encryption key for the current day is generated by byte position substitution and obfuscation, so that the key can be automatically updated as the date changes.

[0021] Secondly, the present invention provides a dynamic key rotation encryption system based on byte substitution and date-driven methods. The technical solution of the system is as follows: The acquisition module is used to retrieve pre-stored fixed passwords and sorted arrays; The concatenation module is used to obtain the current date and format it as a date string, and concatenate the date string with the fixed password to generate a basic key byte array; The generation module is used to perform byte position permutation and obfuscation on the basic key byte array according to the sorted array, generate the encryption key of the day, and use the encryption key of the day as the obfuscated key currently in use. The extraction module is used to receive encryption or decryption requests initiated by the business system and extract the date prefix from the currently used obfuscation key; The update module is used to determine whether the date prefix is ​​consistent with the date string. If the date prefix is ​​inconsistent with the date string, the encryption key for the day is regenerated and the regenerated encryption key for the day is updated to the currently used obfuscation key. The return module is used to perform AES encryption or decryption operations on the requested data using the updated currently used obfuscation key, and return the encryption or decryption result to the business system.

[0022] The beneficial effects of the dynamic key rotation encryption system based on byte substitution and date-driven methods of the present invention are as follows: The system of this invention generates a basic key byte array by concatenating the current date with a fixed password, and performs byte position permutation and obfuscation on the basic key byte array according to a sorted array to generate the encryption key for the day. At the same time, the system verifies the date prefix during the encryption and decryption process and automatically regenerates the key when there is a discrepancy. This solves the problems of traditional encryption methods, such as the increased risk of leakage due to the long-term use of fixed keys, the complexity and error-proneness of manual key replacement, the lack of automated periodic rotation, and insufficient forward security. It realizes daily automatic rotation and dynamic updating of encryption keys, improves the security level of data encryption protection, and reduces the risk of batch decryption of historical data after key leakage.

[0023] Thirdly, the technical solution of an electronic device according to the present invention is as follows: It includes a memory, a processor, and a program stored in the memory and running on the processor, wherein the processor executes the program to implement the steps of the dynamic key rotation encryption method based on byte permutation and date driving of the present invention.

[0024] Fourthly, the technical solution of a computer-readable storage medium provided by the present invention is as follows: The computer-readable storage medium stores instructions that, when read, cause the computer-readable storage medium to perform the steps of the byte-swapping and date-driven dynamic key rotation encryption method of the present invention.

[0025] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other objects, features and advantages of the present invention more obvious and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0026] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 This is a flowchart illustrating an embodiment of a dynamic key rotation encryption method based on byte substitution and date-driven encryption according to the present invention. Figure 2 This is a schematic diagram of the overall architecture; Figure 3This is a schematic diagram of the dynamic key generation process; Figure 4 A diagram illustrating the data encryption or decryption process; Figure 5 This is a schematic diagram of an embodiment of the dynamic key rotation encryption system based on byte substitution and date-driven encryption according to the present invention; Figure 6 This is a schematic diagram of an embodiment of an electronic device according to the present invention. Detailed Implementation

[0027] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0028] Figure 1 This diagram illustrates a flowchart of an embodiment of a dynamic key rotation encryption method based on byte permutation and date-driven principles provided by the present invention. This method can be executed by electronic devices such as terminal devices or servers. The terminal device can be any fixed or mobile terminal, such as user equipment (UE), mobile device, user terminal, terminal, cellular phone, cordless phone, personal digital assistant (PDA), handheld device, computing device, in-vehicle device, or wearable device. The server can be a single server or a server cluster consisting of multiple servers. Any electronic device can implement the dynamic key rotation encryption method based on byte permutation and date-driven principles by having its processor call computer-readable instructions stored in its memory. Figure 1 As shown, it includes the following steps: S1. Obtain the pre-stored fixed password and sorted array.

[0029] The fixed password refers to a pre-stored fixed string in the system, which serves as the basic constant for generating the dynamic key. It is not used directly as the encryption key but participates in the key generation process along with the date information. For example, the fixed password is set to "A1B2C3D4E5F6G7H8", with a length of 16 characters. The sorted array refers to a predefined sequence of integers used to define the mapping rules for byte position permutations. The length of the sorted array determines the number of bytes contained in each group during byte permutations. For example, the sorted array is set to {3, 7, 1, 5, 2, 6, 0, 4}, with a length of 8, indicating that the 8 bytes in each group will be rearranged according to this order.

[0030] S2. Obtain the current date and format it as a date string. Concatenate the date string with the fixed password to generate a basic key byte array.

[0031] Here, the current date refers to the date obtained from the operating system when the encryption or decryption operation is performed; for example, the date on which the encryption operation is performed is set to July 1, 2026. The date string refers to an 8-character sequence obtained by converting the current date according to a specific format; for example, the current date July 1, 2026 is formatted as "20260701" as the date string.

[0032] The base key byte array refers to the byte sequence obtained by concatenating the date string and the fixed password in sequence, which serves as the original data before performing the byte substitution and obfuscation operation. For example, the date string "20260701" and the fixed password string "A1B2C3D4E5F6G7H8" are concatenated in sequence to obtain the concatenated string "20260701A1B2C3D4E5F6G7H8", and the concatenated string is converted into a byte array as the base key byte array.

[0033] S3. Obfuscate the basic key byte array by byte position permutation according to the sorted array to generate the encryption key of the day, and use the encryption key of the day as the obfuscation key currently in use.

[0034] The encryption key for the day refers to the byte array output after performing a byte position permutation obfuscation operation on the base key byte array, which serves as the actual key used for AES encryption or decryption operations that day. For example, the base key byte array is obfuscated using a sorted array {3, 7, 1, 5, 2, 6, 0, 4}, and the obfuscated byte array is used as the encryption key for the day. The currently used obfuscated key refers to the key variable held during runtime and used for encryption or decryption operations, which is assigned the encryption key for the day during key initialization or update. For example, after startup, a key variable is maintained in memory, and the encryption key for the day generated by obfuscation is assigned to this variable as the currently used obfuscated key.

[0035] S4. Receive an encryption or decryption request initiated by the business system, and extract the date prefix from the currently used obfuscation key.

[0036] In this context, "business system" refers to an external system or application that invokes the data encryption service to initiate encryption or decryption requests. For example, the order management system needs to encrypt and store users' delivery address information in the database; as a business system, the order management system initiates an encryption request to the encryption service. An encryption or decryption request refers to an instruction issued by the business system to the encryption service to perform data encryption conversion or data decryption and restoration. For example, the order management system sends an encryption request to the encryption service, requesting that the plaintext delivery address "Delivery Address: No. 123, D Road, C District, City B, Province A" be encrypted into ciphertext data.

[0037] The date prefix refers to the first 8 characters extracted from the original concatenated string corresponding to the currently used obfuscation key, which are used to verify whether the current key matches the current date. For example, the first 8 characters "20260701" are extracted from the original concatenated string corresponding to the currently used obfuscation key as the date prefix.

[0038] S5. Determine whether the date prefix is ​​consistent with the date string. If the date prefix is ​​inconsistent with the date string, regenerate the encryption key for the day and update the regenerated encryption key for the day to the currently used obfuscation key.

[0039] S6. Perform AES encryption or decryption on the request data using the updated currently used obfuscation key, and return the encryption or decryption result to the business system.

[0040] The updated currently used obfuscation key refers to the key value obtained after regenerating the encryption key for the current day and reassigning the newly generated key to the currently used obfuscation key variable when the date prefix is ​​inconsistent with the current date. For example, if the date prefix is ​​detected as "20260701" after running across days and the current date is July 2, 2026, the encryption key for July 2, 2026 is regenerated and the currently used obfuscation key is updated to this new key.

[0041] The request data refers to the target data to be processed carried by the business system in the encryption or decryption request. In the encryption request, it is in plaintext form, and in the decryption request, it is in ciphertext form. For example, the order management system carries the plaintext address "Delivery Address: No. 123, D Road, C District, City B, Province A" in the encryption request. The encryption or decryption result refers to the processing result data output after performing AES encryption or decryption on the request data. After encryption, it is ciphertext data, and after decryption, it is plaintext data. For example, after performing AES encryption on the plaintext address, a ciphertext byte sequence is output, and this ciphertext byte sequence is returned to the order management system as the encryption result.

[0042] The technical solution of this embodiment generates a basic key byte array by concatenating the current date with a fixed password, and performs byte position permutation and obfuscation on the basic key byte array according to the sorted array to generate the encryption key for the day. At the same time, the date prefix is ​​verified during the encryption and decryption process, and the key is automatically regenerated when there is a discrepancy. This solves the problems of increased leakage risk due to long-term use of fixed keys in traditional encryption methods, complex and error-prone manual key replacement procedures, lack of automated periodic rotation, and insufficient forward security. It realizes daily automatic rotation and dynamic updating of encryption keys, improves the security level of data encryption protection, and reduces the risk of batch decryption of historical data after key leakage.

[0043] In one alternative approach, the step of obfuscating the base key byte array by byte position permutation according to the sorted array to generate a current day encryption key, and using the current day encryption key as the currently used obfuscated key, includes: The basic key byte array is divided into multiple preset groups, and the number of bytes contained in each preset group is the same as the length of the sorted array.

[0044] The preset group refers to the division of the basic key byte array into several byte groups according to the length of the sorted array during byte position substitution obfuscation. Each group is independently rearranged in terms of byte position. For example, the length of the basic key byte array is 32 bytes, the length of the sorted array is 8, and the basic key byte array is divided into 4 preset groups, each of which contains 8 bytes.

[0045] The number of bytes refers to the number of bytes contained in each preset group, and the value is equal to the length of the sorted array; for example, if the length of the sorted array is 8, then the number of bytes contained in each preset group is 8 bytes.

[0046] The positions of each byte in each preset group are rearranged according to the byte position order defined by the sorting array. The replaced byte array is used as the encryption key for the day, and the encryption key for the day is assigned to the currently used obfuscation key.

[0047] The byte position order refers to the target position sequence of bytes rearranged according to the values ​​of each element in the sorted array. For example, if the sorted array is {3, 7, 1, 5, 2, 6, 0, 4}, it means moving the byte at position 0 in each preset group to position 3, the byte at position 1 to position 7, the byte at position 2 to position 1, the byte at position 3 to position 5, the byte at position 4 to position 2, the byte at position 5 to position 6, the byte at position 6 to position 0, and the byte at position 7 to position 4. The permuted byte array refers to the byte array obtained after the basic key byte array has undergone a byte position permutation and obfuscation operation, which is used as the encryption key output for the day. For example, the basic key byte array is permuted using the sorted array {3, 7, 1, 5, 2, 6, 0, 4} to obtain a new byte sequence, which is used as the permuted byte array.

[0048] In the above optional methods, the basic key byte array is further divided into multiple groups according to the length of the sorted array, and the byte positions are rearranged in each group according to the order defined by the sorted array. This introduces a group-level obfuscation mechanism into the key generation process, thereby improving the complexity and anti-analysis capability of the encryption key.

[0049] In one alternative approach, the step of rearranging the positions of each byte within each preset group according to the byte position order defined by the sorted array is performed using the following substitution formula: Wherein, data represents the basic key byte array before the substitution, arr represents the byte array after the substitution, sort represents the sorting array, n represents the length of the sorting array, k represents the group number, and j represents the index within the group.

[0050] In the above optional methods, the mapping relationship between the group number and the index within the group is further clarified through the substitution formula, so that the byte position substitution process has a clear mathematical expression and calculation basis, which facilitates code writing and logic verification in engineering implementation.

[0051] In one alternative approach, after the step of rearranging the positions of the bytes within each preset group according to the byte position order defined by the sorted array, the method further includes: The permuted byte array is restored to the basic key byte array according to the inverse mapping relationship of the sorted array.

[0052] The inverse mapping relationship refers to the reverse mapping rule of the sorted array, which is used to restore the replaced byte array to the original byte sequence. It is determined by the correspondence between the value of each element in the sorted array and the index position of the element. For example, when the sorted array is {3, 7, 1, 5, 2, 6, 0, 4}, the inverse mapping relationship is that index 0 corresponds to the original position 6, index 1 corresponds to the original position 2, index 2 corresponds to the original position 4, index 3 corresponds to the original position 0, index 4 corresponds to the original position 7, index 5 corresponds to the original position 3, index 6 corresponds to the original position 5, and index 7 corresponds to the original position 1.

[0053] In the above optional methods, the reverse mapping relationship of the sorted array is further utilized to restore the permuted byte array to the base key byte array, making the key obfuscation operation reversible and providing a restoration basis for subsequent decryption or key verification.

[0054] In one alternative approach, the fixed password includes a private key fixed password, a public key fixed password, and a default key fixed password; the step of obtaining the pre-stored fixed password includes: Based on the application scenario corresponding to the encryption or decryption request, one of the following is selected as the currently used fixed password: the private key fixed password, the public key fixed password, and the default key fixed password.

[0055] The private key fixed password refers to a fixed password used for core business data encryption scenarios, for internal use only. It is generated by concatenating a date string with the date string and performing byte substitution obfuscation to create the encryption key for the current day, used to protect core sensitive data. For example, the private key fixed password is set to "P1R2I3V4A5T6E7K8" for encrypting core sensitive data such as database connection passwords. The public key fixed password refers to a fixed password used for external interaction scenarios, balancing security with ease of integration with external systems. For example, the public key fixed password is set to "PUBLICKEY2026" for encrypting data transmitted as URL parameters in external API interfaces. The default key fixed password refers to a fixed password used for compatibility scenarios and downgrade processing. It is stored in a configuration file and is used directly as the AES encryption key without byte substitution obfuscation. For example, the default key fixed password is set to "DEFAULTKEY16" and used as a fixed key when running in downgraded mode or integrating with older versions.

[0056] The application scenario refers to the specific business context in which the business system initiates an encryption or decryption request. Different application scenarios correspond to different data security levels and key management strategies. For example, when the order management system initiates an encryption request, the application scenario is marked as "core data encryption," and the corresponding private key is a fixed password.

[0057] Among the above optional methods, the fixed password is further set to three types: private, public, and default. One type is selected according to the application scenario corresponding to the encryption or decryption request, so that different business scenarios can use differentiated key generation bases, thus realizing the hierarchical isolation of key management.

[0058] In one alternative approach, after generating the encryption key for the day using the private key fixed password, the Hex-encoded AES ciphertext is read from the configuration file, the encryption key for the day is used to perform AES decryption on the ciphertext to obtain the plaintext ciphertext, and the plaintext ciphertext is then passed to the database connection pool.

[0059] Hex encoding refers to the encoding method that converts binary data into a readable hexadecimal string according to hexadecimal rules. This is used to store the encrypted ciphertext binary data as text in the configuration file. For example, the ciphertext byte array is converted to the hexadecimal string "A1B2C3D4E5F60718" and stored in the password field of the configuration file. AES ciphertext password refers to the ciphertext data obtained after the database connection password is encrypted using AES, and stored in the configuration file in Hex encoding format. For example, the plaintext database password "ROOT1234" is encrypted using AES and then Hex encoded to obtain the ciphertext string "E4D909C290D0FB1CA068FFADDF22CBD0" which is stored in the configuration file.

[0060] AES decryption refers to the inverse operation of restoring ciphertext data to plaintext data using the AES algorithm, performing the inverse transformation on the ciphertext using the same key as during encryption. For example, the encryption key used that day is used to perform AES decryption on the Hex-encoded ciphertext string "E4D909C290D0FB1CA068FFADDF22CBD0". Plaintext ciphertext refers to the original unencrypted ciphertext string required for database connection, obtained after decryption, and used by the database connection pool when establishing a database connection. For example, performing AES decryption on the ciphertext yields the plaintext ciphertext "ROOT1234".

[0061] In this context, a database connection pool refers to a technical component that manages database connection objects, maintains a set of reusable database connections, and allows applications to obtain connections from the pool when needed. For example, using a database connection pool component, the decrypted plaintext password is passed to the parent connection pool by overriding the password setting method during initialization.

[0062] In the above optional methods, after generating the encryption key for the day using a private key fixed password, this key is used to decrypt the AES ciphertext password encoded in the configuration file using Hex, and the resulting plaintext password is transmitted to the database connection pool, thus avoiding the database password being stored directly in plaintext in the configuration file.

[0063] In one alternative approach, the step of regenerating the encryption key for the day includes: The current date is retrieved again and formatted as the date string. The retrieved date string is concatenated with the fixed password to generate a new basic key byte array. The new basic key byte array is then scrambled by byte position substitution according to the sorted array to generate a new encryption key for the current day.

[0064] The new base key byte array refers to the base key byte array generated by re-acquiring the current date and concatenating it with a fixed password when regenerating the encryption key for the current day. For example, after running across days, the date "20260702" is re-acquired on July 2, 2026, and concatenated with the fixed password "A1B2C3D4E5F6G7H8" to generate a new base key byte array. The new encryption key for the current day refers to the byte array output after performing a byte position permutation obfuscation operation on the new base key byte array when regenerating the encryption key for the current day. This byte array is used to replace the expired encryption key for the current day. For example, the base key byte array for July 2, 2026, is subjected to byte position permutation obfuscation to generate a new encryption key for the current day, which is then updated to the currently used obfuscated key.

[0065] In the above optional methods, when the date prefix verification is inconsistent, the current date is obtained again, the new date string is concatenated with the fixed password to generate a new basic key byte array, and then a new encryption key for the current day is generated by byte position substitution and obfuscation, so that the key can be automatically updated as the date changes.

[0066] Figure 2 The overall architecture diagram of the technical solution in this embodiment is shown. Figure 2 As shown, the key configuration library 105 stores the fixed password, sorted array, and configuration parameters for three key systems. The three key systems include a private key fixed password, a public key fixed password, and a default key fixed password.

[0067] The date key generator 102 obtains a fixed password from the key configuration library 105 and the current date of the server. It formats the current date into an 8-digit date string, concatenates the date string with the fixed password to generate a basic key byte array, and then calls the Mix byte substitution module 101 to perform byte position substitution obfuscation on the basic key byte array, outputting the obfuscated byte array as the encryption key for the day. The Mix byte substitution module 101 implements custom byte grouping substitution obfuscation and restoration based on a sorted array. After performing byte position substitution obfuscation on the basic key byte array, it outputs the encryption key for the day and restores the byte array to the basic key byte array according to the inverse mapping relationship of the sorted array. The AES encryption module 103 obtains the encryption key for the day from the date key generator 102 as the currently used obfuscation key and performs standard AES encryption or decryption operations using the currently used obfuscation key. The key rotation manager 104 automatically verifies the date prefix in the currently used obfuscation key before each encryption or decryption operation. When the date prefix is ​​inconsistent with the current date, it triggers the date key generator 102 to regenerate the encryption key for the day and updates the regenerated encryption key to the currently used obfuscation key. The data encryption service 106 provides a unified encryption and decryption interface. Business systems initiate encryption or decryption requests by calling the data encryption service 106. Upon receiving a request, the data encryption service 106 calls the key rotation manager 104 to verify and update the key, then calls the AES encryption module 103 to perform encryption or decryption operations, and returns the encryption or decryption result to the business system. All components communicate through a standard application programming interface, and the key rotation process is completely transparent to the business system.

[0068] Figure 3 The flowchart for dynamic key generation is shown, which includes: S201, Date key generator 102 obtains a fixed password from key configuration library 105.

[0069] S202, Date key generator 102 obtains the current date of the server and formats the current date into an 8-digit date string. The format of the date string is yyyyMMdd, for example, "20260701".

[0070] S203, Date key generator 102 concatenates the date string and the fixed password in sequence to obtain a basic key byte array, with the 8-digit date string first and the fixed password last.

[0071] S204. Date key generator 102 calls Mix byte substitution module 101. Mix byte substitution module 101 uses a preset sorting array to perform byte position substitution and obfuscation on the basic key byte array, dividing the basic key byte array into multiple preset groups. The number of bytes in each preset group is the same as the length of the sorting array. The positions of each byte in each preset group are rearranged according to the byte position order defined by the sorting array.

[0072] S205, the Mix byte replacement module 101 outputs the replaced byte array as the encryption key for the day, and the key is automatically rotated daily as the date changes.

[0073] Figure 4 The flowchart for data encryption and decryption is shown, specifically including: S301, The business system calls the data encryption service 106 to initiate an encryption request or decryption request.

[0074] S302, Key rotation manager 104 extracts the first 8 characters of the original concatenated string corresponding to the currently used obfuscated key as a date prefix.

[0075] S303, Key Rotation Manager 104 checks whether the date prefix matches the 8-digit date string of the current date. If the date prefix does not match the current date, Key Rotation Manager 104 triggers Date Key Generator 102 to re-execute. Figure 3 The dynamic key generation process shown involves the date key generator 102 re-acquiring the current date and formatting it as a date string. The re-acquiring date string is then concatenated with a fixed password to generate a new basic key byte array. The Mix byte substitution module 101 is called to perform byte position substitution and obfuscation on the new basic key byte array to generate a new encryption key for the day. The key rotation manager 104 updates the new encryption key for the day to the currently used obfuscated key. When the date prefix is ​​the same as the current date, the currently used obfuscated key is used directly.

[0076] S304, AES encryption module 103 uses the currently used obfuscation key after verification to perform AES encryption or AES decryption on the request data. When the request is an encryption request, AES encryption is performed, and when the request is a decryption request, AES decryption is performed.

[0077] S305, Data Encryption Service 106 returns the encryption or decryption result to the business system.

[0078] In another embodiment of the dynamic key rotation encryption method based on byte substitution and date-driven methods of the present invention, it includes: S10. Obtain the pre-configured fixed password and sorted array in the insurance business system. The fixed password is the string of the database connection driver class name of the insurance core system, and the sorted array is an integer sequence with a length of 8.

[0079] S20. Obtain the current date when the encryption operation is performed and format it as an 8-digit date string. Concatenate the 8-digit date string with the fixed password in the order of date first and fixed password last to generate a basic key byte array.

[0080] S30. Perform byte position permutation obfuscation on the basic key byte array according to the sorted array to generate the encryption key for the day, and use the encryption key for the day as the obfuscation key currently in use; wherein, when performing byte position permutation obfuscation, the bytes in each group of the basic key byte array at the specified position in the sorted array are extracted and rearranged sequentially, and the group permutation adopts the following formula: Where, data represents the base key byte array before the substitution, arr represents the byte array after the substitution, sort represents the sorting array, n represents the length of the sorting array (n=8), k represents the group number, and j represents the index within the group; after generating the encryption key for the day, a key verification value is generated based on the encryption key for the day, the sorting array, and the 8-digit date string. The key verification value is used to verify the binding relationship between the encryption key for the day and the current date. The key verification value is generated using the following formula: Where V represents the key verification value, arr represents the permuted byte array, i.e., the encryption key for that day, sort represents the sorted array, n represents the length of the sorted array and n=8, and L represents the length of arr. This indicates a bitwise XOR operation. Indicates byte index, This represents the result of taking the integer value obtained by converting the 8-digit date string modulo the prime number p. It is a prime number and p=257. Let x be the i-th power. This indicates the modulo operation.

[0081] It should be noted that the above formula establishes a connection between the key verification value and the permutation rule used in the key generation process by performing a byte-by-byte XOR operation between the permuted byte array (i.e., the encryption key for the day) and the sorted array. The XOR result is then multiplied by a power of the value obtained from the date string and accumulated, making the date information participate in the verification value calculation as a polynomial coefficient. Finally, modulo the prime number ensures that the verification value falls within a fixed range. This formula generates a key verification value that simultaneously binds the encryption key for the day, the sorted array, and the date string. This value is used to verify the correct binding relationship between the encryption key for the day and the current date before encryption or decryption operations. If the key is accidentally tampered with or the date prefix verification passes but the key content does not match the date, an alarm will be triggered if the recalculated verification value is inconsistent with the historically stored verification value, thus preventing the use of an incorrect key to process requested data.

[0082] S40. Receive an encryption request initiated by the insurance business system. The encryption request carries sensitive customer information as request data. Extract the first 8 characters from the original concatenated string corresponding to the currently used obfuscation key as a date prefix.

[0083] S50. Determine whether the date prefix is ​​consistent with the 8-digit date string of the current date. If the date prefix is ​​inconsistent with the 8-digit date string of the current date, re-obtain the current date and regenerate the encryption key for the day. Update the regenerated encryption key for the day to the currently used obfuscation key. Recalculate the key verification value after each regeneration of the encryption key for the day. Compare the recalculated key verification value with the historically stored key verification value. Trigger an alarm when the two are inconsistent.

[0084] S60. Perform Advanced Encryption Standard (AES) encryption on the customer sensitive information using the updated currently used obfuscation key to generate encrypted customer sensitive information ciphertext, and associate the key verification value as additional authentication information with the encrypted customer sensitive information ciphertext and store it in the database of the insurance business system.

[0085] The technical solution of this embodiment generates a key verification value by binding it with the encryption key of the day, the sorted array, and the date string. After each key regeneration, the verification value is recalculated and compared with the historical stored value. This solves the problem that the key content cannot be detected in time when it does not match the current date during dynamic key rotation. The correctness of the key is verified before the encryption or decryption operation is performed. At the same time, the key verification value is stored as additional authentication information associated with the ciphertext, providing a basis for verifying the consistency of the key during decryption. This reduces the risk of data processing failure due to key generation errors and improves the reliability of data encryption protection in the scenario of automatic key rotation.

[0086] Figure 5 This diagram illustrates the structure of an embodiment of a dynamic key rotation encryption system 400 based on byte permutation and date-driven encryption provided by the present invention. Figure 5 As shown, the dynamic key rotation encryption system 400 based on byte substitution and date-driven methods includes: Module 401 is used to retrieve pre-stored fixed passwords and sorted arrays; The splicing module 402 is used to obtain the current date and format it as a date string, and splice the date string with the fixed password to generate a basic key byte array; The generation module 403 is used to perform byte position substitution and obfuscation on the basic key byte array according to the sorted array, generate the encryption key of the day, and use the encryption key of the day as the obfuscation key currently in use; Extraction module 404 is used to receive encryption or decryption requests initiated by the business system and extract the date prefix from the currently used obfuscation key; Update module 405 is used to determine whether the date prefix is ​​consistent with the date string. If the date prefix is ​​inconsistent with the date string, the encryption key for the day is regenerated and the regenerated encryption key for the day is updated to the currently used obfuscation key. The return module 406 is used to perform AES encryption or decryption operations on the request data using the updated currently used obfuscation key, and return the encryption or decryption result to the business system.

[0087] In an alternative embodiment, the generation module 403 is specifically used for: The basic key byte array is divided into multiple preset groups, and the number of bytes contained in each preset group is the same as the length of the sorted array; The positions of each byte in each preset group are rearranged according to the byte position order defined by the sorting array. The replaced byte array is used as the encryption key for the day, and the encryption key for the day is assigned to the currently used obfuscation key.

[0088] In one alternative approach, the step of rearranging the positions of each byte within each preset group according to the byte position order defined by the sorted array is performed using the following substitution formula: Wherein, data represents the basic key byte array before the substitution, arr represents the byte array after the substitution, sort represents the sorting array, n represents the length of the sorting array, k represents the group number, and j represents the index within the group.

[0089] In an alternative embodiment, the generation module 403 is further configured to: The permuted byte array is restored to the basic key byte array according to the inverse mapping relationship of the sorted array.

[0090] In one alternative approach, the fixed password includes a private key fixed password, a public key fixed password, and a default key fixed password; the acquisition module 401 is specifically used for: Based on the application scenario corresponding to the encryption or decryption request, one of the following is selected as the currently used fixed password: the private key fixed password, the public key fixed password, and the default key fixed password.

[0091] In one alternative approach, after generating the encryption key for the day using the private key fixed password, the Hex-encoded AES ciphertext is read from the configuration file, the encryption key for the day is used to perform AES decryption on the ciphertext to obtain the plaintext ciphertext, and the plaintext ciphertext is then passed to the database connection pool.

[0092] In an alternative embodiment, the update module 405 is specifically used for: The current date is retrieved again and formatted as the date string. The retrieved date string is concatenated with the fixed password to generate a new basic key byte array. The new basic key byte array is then scrambled by byte position substitution according to the sorted array to generate a new encryption key for the current day.

[0093] It should be noted that the beneficial effects of the byte-substitution and date-driven dynamic key rotation encryption system 400 provided in the above embodiments are the same as those of the byte-substitution and date-driven dynamic key rotation encryption method described above, and will not be repeated here. Furthermore, the system provided in the above embodiments is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the system can be divided into different functional modules according to the actual situation to complete all or part of the functions described above. In addition, the system and method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process is detailed in the method embodiments, and will not be repeated here.

[0094] The byte-substitution and date-driven dynamic key rotation encryption system 400 of the present invention can be a computer program (including program code) running on a computer device. For example, the byte-substitution and date-driven dynamic key rotation encryption system 400 of the present invention is an application software that can be used to execute the corresponding steps in the byte-substitution and date-driven dynamic key rotation encryption method of the present invention.

[0095] In some embodiments, the byte-substitution and date-driven dynamic key rotation encryption system 400 of the present invention can be implemented in a combination of hardware and software. As an example, the byte-substitution and date-driven dynamic key rotation encryption system 400 of the present invention can be a processor in the form of a hardware decoding processor, which is programmed to execute the byte-substitution and date-driven dynamic key rotation encryption method of the present invention. For example, the processor in the form of a hardware decoding processor can be one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0096] The modules described in the embodiments of this invention can be implemented in software or hardware. The names of the modules are not, in some cases, limiting the scope of the module itself.

[0097] An electronic device according to an embodiment of the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the above-mentioned dynamic key rotation encryption methods based on byte substitution and date driving. That is, an electronic device according to an embodiment of the present invention may include, but is not limited to: a processor and a memory; the memory is used to store the computer program; the processor is used to execute the dynamic key rotation encryption method based on byte substitution and date driving shown in any embodiment of the present invention by calling the computer program.

[0098] In one alternative embodiment, an electronic device is provided, such as Figure 6 As shown, Figure 6 The illustrated electronic device 5000 includes a processor 5001 and a memory 5003. The processor 5001 and the memory 5003 are connected, for example, via a bus 5002. Optionally, the electronic device 5000 may further include a transceiver 5004, which can be used for data interaction between the electronic device and other electronic devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver 5004 is not limited to one type, and the structure of the electronic device 5000 does not constitute a limitation on the embodiments of the present invention.

[0099] Processor 5001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this invention. Processor 5001 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0100] Bus 5002 may include a path for transmitting information between the aforementioned components. Bus 5002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 5002 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 6 The bus 5002 is represented by only one thick line, but this does not mean that there is only one bus or one type of bus.

[0101] The memory 5003 may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0102] The memory 5003 stores application code (computer program) for executing the present invention, and its execution is controlled by the processor 5001. The processor 5001 executes the application code stored in the memory 5003 to implement the content shown in the foregoing method embodiments.

[0103] Among them, electronic devices can also be terminal devices. A terminal device can be any terminal device that can install applications and access web pages through applications, including at least one of smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, smart TVs, and smart in-vehicle devices.

[0104] It should be noted that, Figure 6 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0105] An embodiment of the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the above-mentioned dynamic key rotation encryption methods based on byte substitution and date driving.

[0106] Alternatively, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), magnetic tape, a floppy disk, and an optical data storage device, etc.

[0107] In an exemplary embodiment, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the aforementioned dynamic key rotation encryption method based on byte substitution and date driving.

[0108] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0109] It should be understood that the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of methods and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0110] The computer-readable storage medium provided in this invention can be, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0111] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the method shown in the above embodiments.

[0112] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-disclosed concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

[0113] It should be noted that the terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and represent a limitation on a specific order or sequence. Where appropriate, the order of use for similar objects can be interchanged so that the embodiments of this application described herein can be implemented in an order other than that shown or described.

[0114] Those skilled in the art will recognize that this invention can be implemented as a system, method, or computer program product. Therefore, this invention can be specifically implemented in the following forms: it can be entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software, generally referred to herein as a "circuit," "module," or "system." Furthermore, in some embodiments, this invention can also be implemented as a computer program product contained in one or more computer-readable media, which includes computer-readable program code.

[0115] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A dynamic key rotation encryption method based on byte substitution and date-driven encryption, characterized in that, include: Retrieve pre-stored fixed passwords and sorted arrays; Obtain the current date and format it as a date string; concatenate the date string with the fixed password to generate a basic key byte array. The basic key byte array is byte-positioned and obfuscated according to the sorted array to generate the encryption key for the day, and the encryption key for the day is used as the obfuscated key currently in use. Receive encryption or decryption requests initiated by the business system, and extract the date prefix from the currently used obfuscation key; Determine whether the date prefix is ​​consistent with the date string. If the date prefix is ​​inconsistent with the date string, regenerate the encryption key for the day and update the regenerated encryption key for the day with the currently used obfuscation key. The updated, currently used obfuscation key is used to perform AES encryption or decryption on the requested data, and the encryption or decryption result is returned to the business system.

2. The dynamic key rotation encryption method based on byte substitution and date-driven encryption according to claim 1, characterized in that, The steps of performing byte position permutation and obfuscation on the basic key byte array based on the sorted array to generate the encryption key for the day, and using the encryption key for the day as the currently used obfuscation key, include: The basic key byte array is divided into multiple preset groups, and the number of bytes contained in each preset group is the same as the length of the sorted array; The positions of each byte in each preset group are rearranged according to the byte position order defined by the sorting array. The replaced byte array is used as the encryption key for the day, and the encryption key for the day is assigned to the currently used obfuscation key.

3. The dynamic key rotation encryption method based on byte substitution and date-driven encryption according to claim 2, characterized in that, The step of rearranging the positions of each byte within each preset group according to the byte position order defined in the sorted array uses the following substitution formula: Wherein, data represents the basic key byte array before the substitution, arr represents the byte array after the substitution, sort represents the sorting array, n represents the length of the sorting array, k represents the group number, and j represents the index within the group.

4. The dynamic key rotation encryption method based on byte substitution and date-driven encryption according to claim 2, characterized in that, After the step of rearranging the positions of each byte within each preset group according to the byte position order defined by the sorting array, the method further includes: The permuted byte array is restored to the basic key byte array according to the inverse mapping relationship of the sorted array.

5. The dynamic key rotation encryption method based on byte substitution and date-driven encryption according to claim 1, characterized in that, The fixed password includes a private key fixed password, a public key fixed password, and a default key fixed password; the steps for obtaining the pre-stored fixed password include: Based on the application scenario corresponding to the encryption or decryption request, one of the following is selected as the currently used fixed password: the private key fixed password, the public key fixed password, and the default key fixed password.

6. The dynamic key rotation encryption method based on byte substitution and date-driven encryption according to claim 5, characterized in that, After generating the encryption key for the day using the private key fixed password, the Hex-encoded AES ciphertext password is read from the configuration file, the encryption key for the day is used to perform AES decryption on the ciphertext password to obtain the plaintext password, and the plaintext password is passed to the database connection pool.

7. The dynamic key rotation encryption method based on byte substitution and date-driven encryption according to claim 1, characterized in that, The step of regenerating the encryption key for that day includes: The current date is retrieved again and formatted as the date string. The retrieved date string is concatenated with the fixed password to generate a new basic key byte array. The new basic key byte array is then scrambled by byte position substitution according to the sorted array to generate a new encryption key for the current day.

8. A dynamic key rotation encryption system based on byte substitution and date-driven methods, characterized in that, include: The acquisition module is used to retrieve pre-stored fixed passwords and sorted arrays; The concatenation module is used to obtain the current date and format it as a date string, and concatenate the date string with the fixed password to generate a basic key byte array; The generation module is used to perform byte position permutation and obfuscation on the basic key byte array according to the sorted array, generate the encryption key of the day, and use the encryption key of the day as the obfuscated key currently in use. The extraction module is used to receive encryption or decryption requests initiated by the business system and extract the date prefix from the currently used obfuscation key; The update module is used to determine whether the date prefix is ​​consistent with the date string. If the date prefix is ​​inconsistent with the date string, the encryption key for the day is regenerated, and the regenerated encryption key for the day is updated to the currently used obfuscation key. The return module is used to perform AES encryption or decryption operations on the requested data using the updated currently used obfuscation key, and return the encryption or decryption result to the business system.

9. An electronic device, characterized in that, The electronic device includes a processor coupled to a memory, the memory storing at least one computer program, the at least one computer program being loaded and executed by the processor to enable the electronic device to implement the dynamic key rotation encryption method based on byte permutation and date driving as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer program, which, when executed by a processor, implements the dynamic key rotation encryption method based on byte substitution and date-driven encryption as described in any one of claims 1 to 7.

Images