A dynamic password file encryption and decryption protection method and system based on near field broadcasting
Patent Information
- Application Number
- CN202611274302.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-08-21
- Publication Date
- 2026-10-27
AI Technical Summary
[0005]因此，亟需一种无需内核驱动、不依赖外置硬件、无需建立蓝牙连接即可实现文件自动加解密的方案，以解决现有技术中兼容性差、携带不便及密钥管理复杂的问题
[0039]1. 安全性极高：硬件设备利用PUF等物理指纹材料在上电时动态生成随机种子，每次上电规则空间极大且动态重置，无需存储固定密钥，有效抵御物理提取与逆向分析攻击。
Smart Images
Figure FT_1 
Figure FT_2 
Figure FT_3
Abstract
Description
Technical Field
[0001] This invention relates to the field of information security technology, and in particular to a dynamic cryptographic file encryption and decryption protection method and system based on near-field broadcast, which is applicable to scenarios where key is derived through a physically unclonable function (PUF) and file encryption and decryption control is triggered by Bluetooth Low Energy (BLE) or Star Flash (SLE) near-field broadcast. Background Technology
[0002] In existing technologies, transparent encryption and decryption of computer files typically rely on kernel-level file system filter drivers (such as Windows Minifilter drivers) or external hardware encryption devices (such as USB keys). However, kernel-level drivers suffer from poor compatibility, are prone to causing system blue screens, and require digital signatures; while external USB keys are prone to loss, inconvenient to carry, and cannot automatically sense the user's physical distance.
[0003] Furthermore, existing Bluetooth proximity encryption schemes (such as pairing-based Bluetooth locks) typically require establishing a GATT connection and performing two-way authentication or key negotiation, which carries risks of high connection latency, high power consumption, and vulnerability to sniffing attacks. Some schemes use Physically Unclonable Functions (PUFs) to generate keys, but these often store the PUF values in a fixed location or rely on the cloud for key distribution. If the device is stolen or the network is interrupted, the security is compromised.
[0004] Compared with existing technologies such as counter-based KeeLoq rolling code schemes, PUF-based fixed key derivation schemes, and minifilter kernel driver-based USB Key schemes, this invention adopts physical fingerprint dynamic derivation encoding parameters, one-way handshakeless broadcasting, and application layer hook encryption and decryption, fundamentally solving inherent problems such as storage wear, cross-power supply comparability, poor kernel driver compatibility, and external hardware dependence.
[0005] Therefore, there is an urgent need for a solution that can automatically encrypt and decrypt files without kernel drivers, external hardware, or Bluetooth connections, in order to solve the problems of poor compatibility, inconvenience of carrying, and complex key management in existing technologies. Summary of the Invention
[0006] The purpose of this invention is to provide a dynamic cryptographic file encryption and decryption protection method and system based on near-field broadcast, which realizes automatic and seamless file encryption and decryption without pairing connection and without relying on kernel driver and external key hardware.
[0007] To achieve the above objectives, the present invention adopts the following technical solution:
[0008] A dynamic cryptographic file encryption / decryption protection method based on near-field broadcast is executed collaboratively by an independent hardware device and computer-side software. The two communicate only through one-way near-field connectionless broadcast, without pairing, handshaking, or key exchange. The method includes:
[0009] S1: After the hardware device is powered on, physical fingerprint material is collected to generate a random seed; the physical fingerprint material includes one or more of the following: Physical Unclonable Function (PUF) response, SRAM power-on uninitialized noise pattern, oscillator frequency offset, ADC offset and reset timing jitter.
[0010] S2: Derive a set of broadcast frame encoding parameters based on different segments of the random seed to construct a broadcast frame carrying key material;
[0011] S3: The hardware device sends the broadcast frame in a non-connectable, non-directional broadcast mode via Bluetooth Low Energy (BLE) or Star Flash (SLE), without establishing a GATT connection, pairing, or negotiating a key with the receiving end.
[0012] S4: The computer software passively listens to capture the broadcast frame, extracts the encoding parameter set, and reversely performs deobfuscation and key restoration to obtain a unique key and verify its legitimacy; the restoration process is a pure computational operation and does not involve two-way authentication, challenge-response protocols, or key exchange algorithms.
[0013] S5: After successful verification, the computer software intercepts the opening, reading, writing, and closing operations of the specified process on the protected file through the application layer file API hook, and performs transparent encryption and decryption at the application layer. It does not rely on the operating system kernel-mode file system filter driver, does not create virtual disk volumes, and does not use an external USB key; the file is automatically encrypted after the broadcast signal disappears for more than a preset time.
[0014] Furthermore, the encoding parameter set includes radix rule parameters, codebook index, obfuscation rule parameters, key slice position, key derived salt value, and padding mask; the broadcast frame length is 200 bytes, divided into 20 segments, each segment being 10 bytes; the first two segments store basic broadcast information, the second and third segments store salt value check bits, and the last 16 segments carry key material after variable radix encoding, codebook mapping, and obfuscation processing.
[0015] Furthermore, the value range of the base rule parameter is 0-1023, where 0-31 is the commonly used base and 32-1023 is the user-defined base; the number of pre-stored password books is 256, and each password book is a random arrangement of 94 printable ASCII characters; the confusion rule parameter includes one or more of the following: XOR mask offset value, byte permutation order table index, and linear transformation matrix index.
[0016] Furthermore, the unique key is 192 bits, which is padded with zeros or processed by the key derivation function to obtain a 256-bit encryption key; the key is stored in a slicing manner in 16 segments after the broadcast frame, and there are 16 preset slice templates to indicate the segment offset position and byte offset position of each slice in the broadcast frame.
[0017] Furthermore, the salt value check bit includes a high 16-bit range identifier of the 32-bit salt value and a low 16-bit CRC16-CCITT checksum, which is used to reduce the exhaustive space of the salt value from 2^32 to approximately 2^16.
[0018] Furthermore, the encryption and decryption keys are restored in real time from the broadcast frames by computer software and reside only in memory, not in local persistent storage.
[0019] Furthermore, the user-specified file remains decrypted after successful verification, allowing the user to read and write it normally; when the broadcast signal disappears for more than a preset time, it automatically returns to the encrypted state, with the preset time ranging from 5 to 300 seconds and a default value of 30 seconds.
[0020] This invention also provides a dynamic cryptographic file encryption / decryption protection system based on near-field broadcasting, comprising:
[0021] Independent hardware device, including:
[0022] 1) Near-field communication device for unidirectional transmission of broadcast frames in a non-connectable, non-directional broadcast mode;
[0023] 2) Physical fingerprint acquisition unit, used to acquire physical fingerprint material and generate random seeds upon power-up;
[0024] 3) A dynamic rule derivation unit, used to derive a set of broadcast frame coding parameters based on different segments of the random seed;
[0025] 4) A broadcast frame construction unit, used to construct a broadcast frame according to the set of encoding parameters;
[0026] 5) Storage unit, used to store the device's unique key and multiple pre-stored password books;
[0027] 6) Power supply unit, used to supply power to each unit;
[0028] And computer software, including:
[0029] 1) A broadcast listening module, used to passively listen to receive the broadcast frames without initiating a connection request;
[0030] 2) Frame parsing module, used to extract device identifier, salt check bit and encrypted payload data from broadcast frames;
[0031] 3) Rule restoration module, used to restore the broadcast frame encoding parameter set;
[0032] 4) Key recovery module, used to recover the device's unique key from the broadcast frame. The recovery process is a pure computational operation and does not involve two-way authentication or key negotiation.
[0033] 5) Verification module, used to verify the validity of the key;
[0034] 6) Device registration management module, used for users to manually enter or scan a code to enter the device identifier to complete the initial registration, and bind the device identifier with the unique key and store it in the local whitelist registry;
[0035] 7) The encryption / decryption control module is used to intercept the opening, reading, writing, and closing operations of specified processes on protected files, and to perform transparent encryption / decryption at the application layer. It does not rely on the operating system kernel-mode file system filter driver, does not create virtual disk volumes, and does not use an external USB key.
[0036] 8) Configuration management module, used by users to configure protected paths, signal disappearance determination time and encryption algorithms;
[0037] The structure of the broadcast frame is as described in claim 2.
[0038] Beneficial effects:
[0039] 1. Extremely high security: The hardware device uses physical fingerprint materials such as PUF to dynamically generate random seeds when powered on. The rule space is extremely large and dynamically reset each time it is powered on, without the need to store a fixed key, effectively resisting physical extraction and reverse analysis attacks.
[0040] 2. Seamless Zero-Interaction Experience: Adopting the non-connectable non-directional broadcast (ADV_NONCONN_IND) mode, no pairing, handshake or GATT connection establishment is required, eliminating connection delay and the risk of being sniffed; the hardware device is automatically decrypted when the user brings it near the computer and automatically encrypted when the user leaves, with no sense of connection at all.
[0041] 3. Strong system compatibility: The computer-side software uses application-layer file API hooks to achieve transparent encryption and decryption, completely abandoning the traditional kernel-mode file system filtering driver, avoiding driver signature, system blue screen and compatibility issues, and eliminating the need to create virtual disk volumes.
[0042] 4. Simplified key management: The key is dynamically transmitted only in the broadcast frame and restored in real time by the computer. It is not stored locally and no external USB key is used, which reduces hardware costs and avoids the risk of key loss. Attached Figure Description
[0043] Figure 1This is a schematic diagram of the system architecture in an embodiment of the present invention;
[0044] Figure 2 This is a schematic diagram of the 200-byte broadcast frame segmentation structure in an embodiment of the present invention;
[0045] Figure 3 This is a flowchart illustrating the workflow of the sending end (independent hardware device) in an embodiment of the present invention.
[0046] Figure 4 This is a flowchart of the receiving end (computer software) in an embodiment of the present invention. Detailed Implementation
[0047] The present invention will be further described in detail below with reference to specific embodiments.
[0048] Example 1: Hardware Device Implementation
[0049] In this embodiment, the standalone hardware device uses a development board with an integrated ESP32-C3 chip. Upon power-up, the physical fingerprint acquisition unit starts. Because SRAM loses data after power failure, its uninitialized area exhibits a unique noise pattern upon power-up. Simultaneously, the chip's internal ADC module has inherent offset voltage, and the oscillator exhibits frequency deviation. These microscopic physical differences constitute the physical fingerprint material. The dynamic rule derivation unit reads this material and generates a 512-bit random seed through hash operations.
[0050] Based on this random seed, the dynamic rule derivation unit derives a set of encoding parameters, including: radix rule parameters (e.g., set to 100, representing a custom radix), cipherbook index (e.g., selecting cipherbook number 8), obfuscation rule parameters (e.g., XOR mask offset value is 0x55), and key slice position information (e.g., selecting slice template number 3). The broadcast frame construction unit, according to these parameters, slices, encodes, maps, and obfuscates the 192-bit unique key, filling it into the last 16 segments of the 200-byte broadcast frame. Finally, the near-field communication device broadcasts the frame at 100ms intervals in ADV_NONCONN_IND type.
[0051] Example 2: Computer-side software implementation
[0052] The computer-side software runs on a Windows operating system. The broadcast monitoring module calls the system's Bluetooth API to passively scan for BLE broadcasts in the environment. Upon capturing a broadcast frame from the hardware device in Example 1, the frame parsing module extracts the device identifier and encoding parameter set from the first two segments. The rule restoration module and the key restoration module work together to reverse-engineer deobfuscation, inverse mapping, and variable-base decoding using the extracted parameters to restore the 192-bit unique key, and derive a 256-bit AES encryption key through HMAC-SHA256 operations.
[0053] After the verification module confirms the key's validity, the encryption / decryption control module loads. In this embodiment, the encryption / decryption control module employs application-layer file API hook technology. Specifically, it monitors file operations within the protected folder by intercepting the CreateFileW, ReadFile, WriteFile, and CloseHandle functions in the Win32 API. When a user double-clicks to open an encrypted file, the hook function prioritizes capturing this operation and calls the AES algorithm in memory to decrypt the file content for the user to read and write. When the user saves and closes the file, the hook function intercepts the operation again, re-encrypts the updated content, and writes it to the disk.
[0054] Example 3: Existence Triggering Mechanism
[0055] The configuration management module is set to determine signal loss time by default to 30 seconds. When the hardware device moves away from the computer, and the broadcast signal weakens to the point of being unreceiveable for more than 30 seconds, the encryption / decryption control module immediately clears the 256-bit AES encryption key residing in memory and calls the encryption logic to re-encrypt all decrypted files in the protected folder. When the hardware device moves back closer and the broadcast resumes, the software restores the key and decrypts the files again.
[0056] Example 4: Registration and Whitelist Mechanism
[0057] Upon first use, the user manually enters an identifier from the hardware device or scans a QR code through the configuration management module. The device registration management module binds this identifier to the restored unique key and stores it in the local whitelist registry. Thereafter, the computer software only responds to broadcast frames from devices on the whitelist, discarding broadcast frames from other devices to effectively prevent interference from malicious broadcasts.
[0058] Example 5: Verification of Technical Effect
[0059] To verify the effectiveness of the technical solution of this invention, the applicant built a prototype system based on the above embodiments for testing. The test environment included a standalone hardware device integrating an ESP32-C3 chip and computer software running the Windows 11 operating system. Test results showed that after power-on, the hardware device could complete physical fingerprint acquisition, random seed generation, and 200-byte broadcast frame construction within 200 milliseconds; broadcast frames were continuously sent at 100-millisecond intervals, with an effective communication distance greater than 10 meters; the computer software could complete key restoration and legitimacy verification within 50 milliseconds after capturing the broadcast frame. During continuous 24-hour operation testing, the system did not experience file encryption / decryption errors or broadcast frame parsing failures. Furthermore, by simulating an attacker intercepting and replaying broadcast frames, the effective defense capability against replay attacks of this invention was verified—because the encoding parameter set for each power-on is dynamically derived from the physical fingerprint and does not rely on a counter, the intercepted broadcast frames are completely invalidated after the next power-on.
[0060] Through the implementation of the above embodiments, this invention constructs a complete technical closed loop of "physical fingerprint → dynamic encoding → one-way broadcast → pure computational reconstruction → application layer hook encryption and decryption". Since the encoding parameter set is entirely dynamically derived from the hardware physical fingerprint, and the broadcast frame does not carry any fixed key information, even if an attacker intercepts thousands of broadcast data frames, they cannot deduce the subsequent key rules. Simultaneously, the application layer hook scheme avoids the development barriers and stability risks associated with kernel drivers, making this scheme highly universal and commercially viable.
Claims
1. A dynamic cryptographic file encryption / decryption protection method based on near-field broadcasting, characterized in that, It is executed collaboratively by independent hardware devices and computer-side software, and the two communicate only through near-field connectionless broadcast one-way communication, without pairing, handshaking, or exchanging keys, including: S1: After the hardware device is powered on, physical fingerprint material is collected to generate a random seed; the physical fingerprint material includes one or more of the following: Physical Unclonable Function (PUF) response, SRAM power-on uninitialized noise pattern, oscillator frequency offset, ADC offset and reset timing jitter. S2: Derive a set of broadcast frame encoding parameters based on different segments of the random seed to construct a broadcast frame carrying key material; S3: The hardware device sends the broadcast frame in a non-connectable, non-directional broadcast mode via Bluetooth Low Energy (BLE) or Star Flash (SLE), without establishing a GATT connection, pairing, or negotiating a key with the receiving end. S4: The computer software passively listens to capture the broadcast frame, extracts the encoding parameter set, and reversely performs deobfuscation and key restoration to obtain a unique key and verify its legitimacy; the restoration process is a pure computational operation and does not involve two-way authentication, challenge-response protocols, or key exchange algorithms. S5: After successful verification, the computer software intercepts the opening, reading, writing, and closing operations of the specified process on the protected file through the application layer file API hook, and performs transparent encryption and decryption at the application layer. It does not rely on the operating system kernel-mode file system filter driver, does not create virtual disk volumes, and does not use an external USB key; the file is automatically encrypted after the broadcast signal disappears for more than a preset time.
2. The method according to claim 1, characterized in that, The encoding parameter set includes radix rule parameters, codebook index, confusion rule parameters, key slice position, key derived salt value, and padding mask; The broadcast frame is 200 bytes long and divided into 20 segments, each segment being 10 bytes. The first two segments store basic broadcast information, the second and third segments store salt check bits, and the last 16 segments carry key material that has been encoded in variable base, mapped from the codebook, and obfuscated.
3. The method according to claim 2, characterized in that, The value range of the number system rule parameter is 0-1023, where 0-31 is the commonly used number system and 32-1023 is the user-defined number system; there are 256 pre-stored password books, each of which is a random arrangement of 94 printable ASCII characters; the confusion rule parameter includes one or more of the following: XOR mask offset value, byte permutation order table index, and linear transformation matrix index.
4. The method according to claim 1, characterized in that, The unique key is 192 bits, which is padded with zeros or processed by the key derivation function to obtain a 256-bit encryption key. The key is stored in a slicing manner in 16 segments after the broadcast frame. There are 16 preset slice templates to indicate the segment offset position and byte offset position of each slice in the broadcast frame.
5. The method according to claim 2, characterized in that, The salt value check bit includes a high 16-bit range identifier of the 32-bit salt value and a low 16-bit CRC16-CCITT checksum, which is used to reduce the exhaustive space of the salt value from 2^32 to approximately 2^16.
6. The method according to claim 1, characterized in that, The encryption and decryption keys are restored in real time from the broadcast frames by computer software and reside only in memory, not in local persistent storage.
7. The method according to claim 1, characterized in that, The user-specified file remains decrypted after successful verification, allowing the user to read and write it normally. When the broadcast signal disappears for more than a preset time, the encrypted state is automatically restored. The preset time range is 5 to 300 seconds, with a default value of 30 seconds.
8. A dynamic cryptographic file encryption / decryption protection system based on near-field broadcasting, characterized in that, include: Independent hardware device, including: 1) Near-field communication device for unidirectional transmission of broadcast frames in a non-connectable, non-directional broadcast mode; 2) Physical fingerprint acquisition unit, used to acquire physical fingerprint material and generate random seeds upon power-up; 3) A dynamic rule derivation unit, used to derive a set of broadcast frame coding parameters based on different segments of the random seed; 4) A broadcast frame construction unit, used to construct a broadcast frame according to the set of encoding parameters; 5) Storage unit, used to store the device's unique key and multiple pre-stored password books; 6) Power supply unit, used to supply power to each unit; And computer software, including: 1) A broadcast listening module, used to passively listen to receive the broadcast frames without initiating a connection request; 2) Frame parsing module, used to extract device identifier, salt check bit and encrypted payload data from broadcast frames; 3) Rule restoration module, used to restore the broadcast frame encoding parameter set; 4) Key recovery module, used to recover the device's unique key from the broadcast frame. The recovery process is a pure computational operation and does not involve two-way authentication or key negotiation. 5) Verification module, used to verify the validity of the key; 6) Device registration management module, which allows users to manually input or scan a code to enter the device identifier to complete the initial registration, and binds the device identifier with the fixed key derivation parameter and stores it in the local whitelist registry; After receiving a broadcast frame, the computer software restores the device's unique key in real time based on the fixed derived parameters bound to the device identifier in the registry and the temporary encoding parameters extracted from the broadcast frame. The restored key resides only in memory and is not persistently stored on the computer. 7) The encryption / decryption control module is used to intercept the opening, reading, writing, and closing operations of specified processes on protected files, and to perform transparent encryption / decryption at the application layer. It does not rely on the operating system kernel-mode file system filter driver, does not create virtual disk volumes, and does not use an external USB key. 8) Configuration management module, used by users to configure protected paths, signal disappearance determination time and encryption algorithms; The structure of the broadcast frame is as described in claim 2.