WO2019242645A1

WO2019242645A1 - Key generation apparatus, encryption and decryption apparatus, key generation and distribution system and information secure transmission system

Info

Publication number: WO2019242645A1
Application number: PCT/CN2019/091899
Authority: WO
Inventors: 蔡利锋; 蔡嘉禾; 王艳
Original assignee: 蔡利锋
Priority date: 2018-06-21
Filing date: 2019-06-19
Publication date: 2019-12-26
Also published as: CN110636028A; CN110636028B

Abstract

Provided in the present invention are a key generation apparatus (100), an encryption and decryption apparatus (700), a key generation and distribution system, and an information secure transmission system. The key generation apparatus (100) comprises: a system information module (101) configured to store system information of the key generation apparatus; a key generation module (102) configured to orderly and controllably generate, according to the system information, unpredictable information as a key, and use same to generate a serial number as the corresponding key serial number; and a transmission module (103) configured to send the key serial number to a paired key generation apparatus (200), wherein the paired key generation apparatus (200) stores second system information corresponding to the system information.

Description

Key generation device, encryption and decryption device, key generation and distribution system, and information security delivery system

This disclosure claims priority from Chinese Patent Application No. 201810643471.2, filed on June 21, 2018, and the contents of the above-mentioned Chinese patent application disclosure are incorporated herein by reference in its entirety as part of this application.

Technical field

The present invention relates to the field of information security, and more particularly, the present invention relates to a key generation device, an encryption and decryption device, a key generation and distribution system, and an information security delivery system.

Background technique

The importance of information security is beyond doubt. Today, with the highly developed computer and global interconnected communication technology, the secure transmission and storage of information is of vital importance. Information encryption is an important means to achieve information security. Documents are converted into cipher text using information encryption technology. If the cipher text can only be cracked by the authorized party to ensure that it has no meaning to the illegal interceptor, the information can be in cipher text form, making full use of the existing communication technology to facilitate the targeted communication subject. Safely passed between. Therefore, having a ciphertext theoretically unbreakable encryption method is the core of information security. Under the premise of meeting security, the convenience of the encryption-decryption and information transfer process and the universality of the methods also affect the application scope of specific information security systems.

Shannon, an important founder of modern cryptography, proves that a file is encrypted with a key that is not less than the amount of file information, and the ciphertext generated by a suitable method can faithfully carry the file information, ensuring that key information is not leaked and the same key is not reused. Under the premise, the above ciphertext is theoretically unbreakable. The above method is called the One-time Pad method (OTP), that is, the one-time garbled book method.

OTP is currently the only realistic and absolutely secure encryption scheme in theory. Quantum encryption schemes are theoretically unbreakable, but technical breakthroughs are still needed before widespread application. Limited by the key cannot be reused, the amount of information that OTP can safely transmit cannot be greater than the amount of information contained in the key book, which limits its use. Therefore, a method that can generate a large number of security keys and distribute them conveniently and securely will overcome the inherent limitations and solve the fundamental problems of information security on the basis of making full use of the theoretically absolute security of the OTP scheme.

Summary of the Invention

The present invention will focus on solving the problem of generating and distributing unpredictable information as a security key, and based on this, establish an information security delivery scheme and an information security system.

Before describing the embodiments of the present invention, the following concepts are first defined:

Information: Information is a certain kind of symbol or signal, which can be detected, perceived, and identified by specific subjects, and used for interaction and communication between subjects. For information used for communication, its symbols or signals should also satisfy the purpose of being able to be communicated by the subject. Generate, send, receive, identify, and reproduce. At the material level, information is some kind of signal, including sound waves, light waves, electromagnetic, electronic, radiation signals, etc., which can be generated, sent, detected, sensed, and identified by specific subjects in a suitable way. At the technical level, identifiable signals can be decomposed into different signal primitives determined and distinguished by intensity, spatiotemporal distribution, and other distinguishable finite attributes. Signals can be expressed as an ordered combination of signal primitives and can be identified as information . The concept of signal primitives can be used to abstract information. Signal primitives are abstracted into symbols. They are carried and represented by signals in a uniform format that can be easily perceived and distinguished, such as graphics and interval pulse waves. A set of orthogonal symbols, each symbol representing a kind of information primitive, and finally transforming the signal in physical form into a one-to-one corresponding sequence of abstract symbols. The sequence of symbols can be further accurately represented by a sequence of non-negative integers. The range of the number of elements in the sequence corresponds to the number N of independent orthogonal symbols. The number of elements in the sequence is an integer between 0 and N-1. The sequence can be represented by a binary sequence and received by the computer. , Identify, store, process, and send to become digital information.

Unpredictable information: In cryptography, any published information, or information generated by known rules based on known information or easily inferred limited information, may be used for prediction purposes no matter how limited the scope of public and corresponding laws is; Therefore, unpredictable information can be defined as information that is not disclosed and that is not generated by known rules. Methodologically, no purely random information is disclosed, that is, no purely random symbol sequence is disclosed, or a random sequence of signal primitives that has not been detected, identified, or used by a communicable subject, which meets the unpredictable requirements and is also the only information that meets the unpredictable requirements. . In cryptography, a key with an information volume of N bytes has a different key space of 256 ^N ; similarly, an information space is defined, and the information space with an information volume of N bytes is 256 ^N. Methodologically, if the randomness of an information, that is, its possible value, is projected onto its entire information space without preference, then the information is technically considered unpredictable. In the present invention, the unpredictable information includes the unpredictable information defined in accordance with the actual application of cryptography, and the pseudo-random information that meets the unpredictable requirements is much larger than the corresponding key information space is regarded as unpredictable information , So as to achieve the initial unpredictable information relying on a limited capacity, and generate an amount of unpredictable information that can be expanded as needed as a key. In cryptography, any used key may be disclosed in the future because of the information it carries, which can effectively predict the information by intercepting the ciphertext. Therefore, the unpredictability implies that the key can only be used once. Therefore, in the present invention, undisclosed pure random information and unpredictable information are used as synonyms and are replaced with each other according to different contexts.

Sequence: In modern informatics, identifiable information can be represented by a sequence of non-negative integers. The elements of the sequence can be integers between 0 and n-1, and n is defined as the value range of the sequence elements. The number of different sequences consisting of m elements with a value range of n is n ^m , containing N bytes of information, N is determined by n ^m = 256 ^N ; following the definition of the information space, n ^{m is} defined as the sequence of the corresponding sequence space. In the description of the present invention, the sequence is limited to a non-negative integer sequence. Since any sequence can correspond one-to-one with a non-negative integer sequence, the above limitation does not affect the representativeness of the description of the invention. A sequence consists of the same element sequence with the same value range. The number of elements and the range of element values are defined as the format of the sequence. Sequences of the same format carry the same amount of information and have the same sequence space. Correspondingly, in the discussion of the present invention, the undisclosed pure random number sequence and the unpredictable number sequence are used as synonyms and can be replaced with each other according to different contexts. Information in the form of numbers can be converted into binary information to facilitate computer processing.

Based on the above definitions, the present invention first solves the problems of generating and distributing unpredictable information that can be used as a security key.

According to an embodiment of the present invention, a key generation and sending device is provided, including:

A system information module configured to store system information of the key generation device;

A key generation module configured to controllably and orderly generate unpredictable information as a key and use the generated serial number as a corresponding key serial number according to the system information; and

The transmission module is configured to send the key serial number to a paired key generation device, wherein the paired key generation device stores second system information corresponding to the system information.

Specifically, the present invention proposes the concept of controllable and orderly generation of unpredictable information. Based on this, a controllable and orderly generation device for information is designed to enable the orderly generation of serial numbers through the serial number control based on system information. Forecast information. Then, the unpredictable information is used as a key to form a controllable and orderly key generation device. Use the device to sequentially generate keys according to requirements and use them to generate serial number tags, and generate or reproduce corresponding keys synchronously between the same or corresponding key generation devices that are separated in space and time by serial numbers, so that keys can be used in Exclusively share the same or corresponding key generation devices with secure distribution among the subjects, and build a key generation and secure distribution system.

Optionally, the system information module further includes a database module configured to store unpredictable information, a control module configured to control key generation and other system processes through fixed programs and parameters, and the key generation module is in the control module Orderly extract the stored unpredictable information from the database module as the key under the control, and use its generated serial number as the key serial number, and feed it back to the control module to update the serial number control parameters, and can be based on the same or corresponding key paired The key serial number generated by the generating device depends on the database information to generate a key corresponding to the serial number.

Optionally, the paired key generation device and its system information are completely the same as the key generation device and its system information.

In another embodiment, the system information stored in the database of the paired key generation device may be in a mirror relationship with the information system stored in the database of the key generation device.

In another embodiment, the system information stored in the database of the paired key generation device may be offset from the information system stored in the database of the key generation device in a predetermined manner.

Optionally, the system information module further includes:

A control module configured to control the generation of unpredictable information through a fixed program or parameter;

Dynamic information module configured to provide pending input information;

The information processing module is configured to convert the input information provided by the dynamic information module into generated information through a predetermined algorithm according to the control of the control module, and extract part of the information from the generated information as unpredictable information for generating a key, and other information The feedback information is provided to the dynamic information module to keep it updated steadily.

In another embodiment of the present application, it has been initially proved that the irreversible one-way evolution of dynamic information can be achieved through the above feedback mechanism, that is, by selecting an appropriate information processing method, all subsequent dynamic information can be evolved from the initial dynamic information. Dynamic information and all public key information cannot be determined and derived from previous dynamic information in a reasonable number of steps. The irreversible one-way evolution characteristics of the unpredictable dynamic information lay the foundation for the continuous generation of security keys.

Optionally, the dynamic information module includes an input information sub-module configured to receive unpredictable information as initial input information,

The information processing module converts the input information into generated information that can be expanded by an amount of information determined by the input information through an iterative information processing method, and extracts a first portion of the non-overlapping portion from the generated information in an equal amount as the input information in a predetermined manner. The information is fed back to the input information sub-module as iterative information as input information for the next step, and the second part that does not overlap with each other is extracted as unpredictable information for generating a key.

Optionally, the dynamic information module includes a database sub-module configured to store a predetermined amount of unpredictable information, and the information processing module is controlled by the control module and relies on the information in the database sub-module to controllably and orderly generate the advance information. Determine a certain amount of unpredictable information as a key, and use its generated serial number as the corresponding key serial number, and then generate additional unpredictable information as database regeneration information and feed it back to the database submodule to update the information in the database submodule. The information processing module relies on the update The information in the subsequent database submodules continues to generate keys.

The embodiment of the present application introduces the concept of proliferative encoding information: the encoding information is generated through a database; the specific form and content of the encoding information is determined by the information stored in the database, and all data structure relationships corresponding to the encoding determination information generation process can be obtained through encoding. Rely on the same database to completely restore the corresponding information; the specific form and content of the coding and information are independent of each other, and the information can be generated and controlled in an orderly manner through the limited information amount of coding tracking and manipulation of unrestricted form and content information;

Further introduce the concept of proliferative information, and generate an expanded number of progeny information through a random combination of database information, so that the information can be proliferated through the database to become proliferable information, and the value space of the progeny information can be expanded through continuous random passage of proliferation. Make the value space reach the information space of the corresponding format information, so that the child information selected in a random manner is unpredictable, and the proliferated child information is randomly selected to replace the original database information to achieve unpredictable information in the database Effective regeneration

On the basis of the encoding information and the concept of breedable information, the concept of breedable coding information is introduced, and the breedable information is encoded according to the combination of database information and all related data structure relationships when it is generated, and becomes the breedable encoded information; The coding information concept design database includes a main database and a coding database. The main database provides information in a specific format to be processed. Through coding tracking and manipulation of information generation and generation, the controllable and orderly generation of unpredictable information and the unpredictable database are realized. Spontaneous controlled regeneration.

Optionally, the dynamic information module includes a database submodule, the database submodule includes a main database storing a predetermined number of unpredictable information units, and a coding database formed by coding a predetermined number of unpredictable information, wherein the number of codes is Greater than the number of unpredictable information units stored in the database submodule,

The control module sequentially extracts codes from the coding database, extracts a plurality of unpredictable information units from the main database according to the coding information, and passes them as a set of input information to the information processing module. The codes are not repeatedly used and the sequence number control information is sequentially updated. ,

The information processing module combines a group of input information to generate a secondary information.

The information processing module can control the orderly generation of a predetermined number of secondary information as unpredictable information for generating a key, and use the generation sequence number of each unpredictable information as the key sequence number.

After the predetermined number of keys are generated, the information processing module generates the secondary information in the same amount as the unpredictable information stored in the database sub-module in an orderly and controllable manner as database regeneration information and feeds it back to the database sub-module to update the information in the database sub-module.

Another embodiment of the present application preliminarily and theoretically proved the correct use of the concept of the proliferative coding information. When the initial information in the database submodule is kept unpredictable, each secondary information generated is for the non-initial information owner. It is unpredictable and cannot detect the information in the database submodule effectively based on all the published secondary information.

Optionally, the transmission module is further configured to receive a key sequence number sent from the paired key generation device,

The key generation module is further configured to generate a decryption key corresponding to the serial number through the system information according to the received serial number of the key.

According to another embodiment of the present application, an encryption and decryption device is provided, including:

The key generation device according to the previous embodiment is configured to generate a one-time key, wherein the control module adds functions and simultaneously functions as a control module of the entire encryption device;

Input port, configured to read or enter data to be encrypted;

A formatting unit configured to convert the data to be encrypted input from the input port into a formatted plain text that matches the key format;

The encryption module is configured to convert the formatted plain text generated by the formatting unit into a main cipher text using the generated one-time key, use the serial number of the one-time key as the cipher text title, and merge the main cipher text and the cipher text title to Generate ciphertext;

The sending port is configured to send the generated ciphertext to a paired decryption device.

Optionally, the encryption and decryption device further includes:

A receiving port configured to receive a ciphertext sent from a paired encryption device;

A decryption module configured to parse the received ciphertext to extract the key sequence number in the ciphertext header;

Wherein, the key generation device generates a decryption key corresponding to the serial number by using the received key serial number according to the system information;

The decryption module uses the decryption key to decrypt the ciphertext to generate a decrypted plaintext;

The formatting unit converts the plaintext after decryption into recovered data;

An output port configured to output the restored data.

According to another embodiment of the present application, a key generation and distribution system is provided, including a paired first key generation device and a second key generation device, where

The first key generation device includes:

A first system information module configured to store first system information of the first key generation device;

A first key generation module configured to controllably and orderly generate unpredictable information as the first key, and use a generation number thereof as a corresponding first key number according to the first system information; and

A first sending module configured to send the first key serial number to a second key generating device,

The second key generation device includes:

A second receiving module configured to receive a first key sequence number sent from the first sending module,

A second system information module configured to store second system information of the second key generation device, the second system information being the same as or corresponding to the first system information;

The second key generation module is configured to generate a second decryption key corresponding to the first key number according to the received first key number according to the second system information.

Optionally,

The second key generation module generates the unpredictable information as the second key in a controlled and orderly manner according to the second system information, and uses the generated serial number as the corresponding second key serial number,

The second key generating device further includes a second sending module configured to send the second key serial number to the first key generating device,

The first key generating device further includes a first receiving module configured to receive a second key sequence number sent from the second sending module,

The first key generation module generates a first decryption key corresponding to the second key number according to the accepted second key number according to the system information.

According to another embodiment of the present application, an information security transfer system is provided, including a first communication device and a second communication device, wherein

The first communication device includes:

The first key generating device according to the foregoing embodiment is configured to generate a one-time first key;

A first input port configured to read or input data to be encrypted;

A first formatting unit configured to convert the data to be encrypted input from the input port into a first formatted plain text that matches a key format;

A first encryption module configured to use a generated one-time key to convert a first formatted plain text generated by a first formatting unit into a first main cipher text, and use a first key sequence number of the first key as a first A ciphertext title, combining the main ciphertext and the ciphertext title to generate the first ciphertext;

A first sending port configured to send the generated first ciphertext to a second communication device,

The second communication device includes:

A second receiving port configured to receive a first ciphertext sent by the first sending port;

A second decryption module configured to parse the received first ciphertext to extract a first key sequence number in the first ciphertext header;

The second key generation device according to the foregoing embodiment is configured to generate a second decryption key corresponding to the serial number according to the first system serial number according to the second system information;

The second decryption module uses the second decryption key to decrypt the received first ciphertext to generate a second decrypted plaintext;

A second formatting unit configured to convert the second decrypted plaintext into second restored data;

The second output port is configured to output second restoration data.

Optionally, the second communication device includes:

A second input port configured to read or input a second data to be encrypted;

The second key generating device may controllably and orderly generate unpredictable information as the second key, and use the generated serial number as the second key serial number according to the second system information;

The second formatting unit converts the data to be encrypted input from the second input port into a second formatted plain text that matches the key format;

A second encryption module configured to use the generated second key to convert the second formatted plain text generated by the second formatting unit into a second main cipher text, and use the second key sequence number of the second key as the first Second ciphertext title, combining the second main ciphertext and the second ciphertext title to generate a second ciphertext;

A second sending port configured to send the generated second ciphertext to the first communication device,

The first communication device includes:

A first receiving port configured to receive a second ciphertext sent by the second sending port;

A first decryption module configured to parse the received second ciphertext to extract a second key sequence number in a second ciphertext header;

The first key generation device generates a first decryption key corresponding to the second sequence number according to the second key sequence number according to the system information;

The first decryption module uses the first decryption key to decrypt the second ciphertext to generate a first decrypted plaintext;

The first formatting unit converts the first decrypted plain text into first restored data;

The first output port is configured to output the first restoration data.

The key generation device, encryption and decryption device, key generation and distribution system, and information security delivery system according to the embodiments of the present invention can generate a large number of security keys by relying on limited and unpredictable shared unpredictable information and can conveniently generate the generated keys And secure distribution, thereby solving the fundamental problem of information security.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram illustrating a key generation device and a key distribution system according to an embodiment of the present invention.

FIG. 2 is a schematic diagram illustrating a correspondence relationship between unpredictable information and a serial number stored in a database.

FIG. 3 is a schematic diagram illustrating an embodiment of an unpredictable information controllable and ordered generation module in a key generation device according to an embodiment of the present invention.

4 is a schematic diagram illustrating another embodiment of an unpredictable information controllable and ordered generation module in a key generation device according to an embodiment of the present invention.

5 is a schematic diagram illustrating another embodiment of an unpredictable information controllable and ordered generation module in a key generation device according to an embodiment of the present invention.

6 is a schematic diagram illustrating another embodiment of an unpredictable information controllable and ordered generation module in a key generation device according to an embodiment of the present invention.

FIG. 7 is a schematic diagram illustrating an encryption and decryption apparatus according to an embodiment of the present invention.

FIG. 8 is a schematic diagram illustrating an information security transfer system according to an embodiment of the present invention.

detailed description

Hereinafter, a key generation device, an encryption and decryption device, a key generation and distribution system, and an information security delivery system according to embodiments of the present invention will be described in detail with reference to the accompanying drawings.

First, FIG. 1 is a schematic diagram illustrating a key generation device and a key distribution system according to an embodiment of the present invention. As shown in FIG. 1, a key distribution system 1 according to an embodiment of the present invention includes a paired key generation device 100 and a key generation device 200.

The key generation apparatus 100 may include:

A system information module 101 configured to store system information of the key generation device;

The key generation module 102 is configured to controllably and orderly generate unpredictable information as a key based on the system information, and use a generation number of the unpredictable information as a corresponding key number; and

The transmission module 103 is configured to send the key serial number to a paired key generation device, wherein the paired key generation device stores second system information corresponding to the system information, where the corresponding system The information can be completely identical, one-to-one correspondence, or a limited number of one-to-one correspondences or one-to-one correspondences.

The key generation device 200 has the same structure as the key generation device 100. The key generation device may also include a system information module 201, a key generation module 202, and a transmission module 203.

Configurations and functions of the system information module 201, the key generation module 202, and the transmission module 203 are the same as those of the system information module 101, the key generation module 102, and the transmission module 103, and detailed descriptions thereof are omitted here.

Specifically, the system information module 101 stores system information of the key generation device, and the system information may include, for example, a database, information about a method of generating a database, system settings and control information, and the like.

The key generation module 102 can controllably and orderly generate unpredictable information as a key based on the system information, and use its generated serial number as the corresponding key serial number, and can generate the key sent by the paired key generation device according to the received The serial number generates a key corresponding to the serial number.

In one embodiment, the system information module 101 includes a database that stores unpredictable information.

The key generation module 102 sequentially extracts unpredictable information from the database as a key, and uses its generated serial number as the corresponding key serial number, and can rely on the key serial number of the key generated by the received paired key generation module, depending on the The database generates a key corresponding to the serial number.

Specifically, FIG. 2 is a schematic diagram illustrating a correspondence relationship between unpredictable information and a serial number stored in a database.

As shown in Figure 2, the unpredictable information corresponding to sequence number 1 in the database is "1234abcd", the unpredictable information corresponding to sequence number 2 is "bcde2345", the unpredictable information corresponding to sequence number 3 is "ef34gh56", and the unpredictable information corresponding to sequence number 4 The message is "78ab12cd" and so on. It should be noted that the database in Figure 2 only shows the serial number and unpredictable information, but additional information can be added as needed. In addition, the unpredictable information shown in the database in FIG. 2 is merely an example. Actually, the unpredictable information may be unpredictable information generated in any manner.

Then, the key generation module 102 may select any existing serial number and extract unpredictable information corresponding to the serial number from the database as a key. In this embodiment, it is assumed that the key generation module 102 randomly selects a serial number 1, extracts unpredictable information “1234abcd” corresponding to the serial number 1 as a key, and uses 1 as a corresponding key serial number.

That is to say, unlike the way of generating a key by a specific algorithm in the prior art, in this embodiment, the unpredictable information is not generated by a specific algorithm, but by the information stored in the system information database in advance. Generating in an orderly manner in a general manner, and then extracting some or all of the information from the generated information as a secret key. The simplest form of the generated information is to retrieve the unpredictable information directly from the database information and orderly extract the information from it as a key; This embodiment does not exclude that the corresponding unpredictable information retrieved through a non-degenerate transformation is used as a key through a specific algorithm.

In this way, the risk that the unpredictable information can be obtained in the prior art because the algorithm that generates the unpredictable information is cracked can be avoided.

Then, the transmission module 103 may send the key sequence number 1 to the paired key generation device 200, where the paired key generation device 200 stores second system information corresponding to the system information.

In one embodiment, the second system information of the paired key generation device 200 and the system information of the key generation device 100 are completely the same. For example, in the database of the key generation device 200, the unpredictable information corresponding to sequence number 1 in the database is "1234abcd", the unpredictable information corresponding to sequence number 2 is "bcde2345", and the unpredictable information corresponding to sequence number 3 is "ef34gh56". The unpredictable information corresponding to the serial number 4 is "78ab12cd" and so on.

In another embodiment, the second system information of the paired key generation device 200 and the system information of the key generation device 100 may correspond according to a predetermined correspondence relationship. For example, in the database of the key generation device 200, the unpredictable information corresponding to each serial number in the database may be offset by a predetermined number from the serial number in the key generation device 100. Specifically, in the database of the key generation device 200, the unpredictable information corresponding to sequence number 1 in the database is "bcde2345", the unpredictable information corresponding to sequence number 2 is "ef34gh56", and the unpredictable information corresponding to sequence number 3 is "78ab12cd" The unpredictable information corresponding to sequence number 4 is "1234abcd" and so on.

Of course, the second system information of the key generation apparatus 200 and the system information of the key generation apparatus 100 may correspond in a corresponding relationship in the reverse order, and so on.

Similarly, the transmission module 103 may be further configured to receive a key sequence number sent from the paired key generation device 200. The key generation module 102 is further configured to generate a decryption key corresponding to the serial number through the system information according to the received serial number of the key.

Referring again to FIG. 1, when the key is distributed, the unpredictable information (that is, the key “1234abcd”) is directly sent to the receiving device in the prior art. In the embodiment of the present application, For example, the transmission module 103 may send the serial number 1 used to generate the key to the paired key generation device 200. Then, when the paired key generation device 200 receives the serial number 1 sent by the key generation device 100 through the transmission module 203, the key generation module 202 searches the database corresponding to the serial number 1 from the database of the system information module 201 according to the serial number 1 Prediction information, thereby obtaining the same key information as the key generation device 100 intends to transmit, that is, "1234abcd".

In this way, because the information sent by the key generation device 100 to the key generation device 200 includes only the serial number 1, there is no specific key information other than this, so even if the information is intercepted during the transmission process, the information is intercepted. The information person cannot obtain the key information from the serial number 1.

In this way, the risk of key information leakage in the prior art because the key information is intercepted during distribution can be avoided.

Obviously, in the above example, the roles of the key sender and receiver are completely interchangeable. The key generating device 200 is used as the key information sender, and the key generating device 100 is used as the key information receiver.

Hereinafter, an unpredictable information controllable and ordered generation module in a key generation device according to an embodiment of the present invention will be described with reference to FIG. 3.

The system information module 101 in the key generation device 100 described in the first embodiment above includes the unpredictable information controllable and ordered generation module 300 shown in FIG. 3.

As shown in FIG. 3, the controllable and ordered generation module 300 includes:

A control module 301 configured to control generation of unpredictable information;

A database module 302 configured to store unpredictable information,

According to the control of the control module 301, the key generation module 102 in the first embodiment extracts the unpredictable information from the database module 302 in a controlled and orderly manner as a key, and uses its generated serial number as the corresponding key serial number. The key generation device extracts the corresponding unpredictable information from the database as the corresponding key by receiving the key serial number sent from the paired key generation device.

According to this embodiment, as shown in FIG. 3, the database may be designed as a large-capacity database, in which unpredictable information is stored in an orderly manner. Then the key generation module 102 extracts non-overlapping pieces of information from the database in a controlled and orderly manner through sequence control according to the received serial number as mutually independent and unpredictable one-time keys to form an unconditional security key in a controlled and orderly manner Generate device.

Hereinafter, an unpredictable information controllable and ordered generation module in a key generation device according to an embodiment of the present invention will be described with reference to FIG. 4.

The system information module 101 in the key generation device 100 described in the first embodiment above includes the unpredictable information controllable and ordered generation module 400 shown in FIG. 4.

As shown in FIG. 4, the controllable and ordered generation module 400 includes:

A control module 401 configured to control generation of unpredictable information;

A dynamic information module 402 configured to provide input information to be processed;

The information processing module 403 is configured to convert the input information provided by the dynamic information module into generated information through a predetermined algorithm according to the control of the control module, and extract part of the information from the generated information as output information for generating a key through information distribution. Another part of the information is provided as feedback information to the dynamic information module to keep it stable and updated.

Specifically, as shown in FIG. 4, the control module 401 sequentially retrieves input information from the dynamic information module 402 and passes it to the information processing module 403 according to requirements, and sequentially updates serial number control information.

The dynamic information module 402 may provide input information to be processed.

The information processing module 403 converts the input information provided by the dynamic information module 402 into generated information that can be expanded by the amount of information determined by the input information, and then allocates the generated information in a predetermined manner, such as orderly selecting feedback from the generated information that has the same capacity as the input information The information is passed to the dynamic information module 402 to compensate the used information in order to keep it stable and updated. At the same time, the output information that does not overlap with the feedback information is sequentially selected as a key and a serial number is generated for it as the key serial number.

In this way, through reasonable settings, there is no predictable logical or mathematical relationship between the output information, and between the output information and the device-related information, especially the dynamic information, so that the input information is irreversibly and unidirectionally converted into output information through the information processing module. The feedback information forms an irreversible one-way evolution system of unpredictable dynamic information. It can pass through the cycle of information input, information processing, information output, and information feedback, and rely on limited initial unpredictable dynamic information to form a sustainable key that can be controlled and ordered. Generate device.

Hereinafter, an unpredictable information controllable and ordered generation module in a key generation device according to an embodiment of the present invention will be described with reference to FIG. 5.

The system information module 101 in the key generation device 100 described in the first embodiment above includes the unpredictable information controllable and ordered generation module 500 shown in FIG. 5.

As shown in FIG. 5, the controllable and ordered generation module 500 includes:

A control module 501 configured to control generation of unpredictable information;

An input information sub-module 502 configured to provide input information to be processed;

The information processing module 503 is configured to convert the input information into generated information whose information amount can be determined by the input information through an iterative information processing method, and extract a first part and a non-overlapping part of the generated information from the generated information according to a predetermined information distribution method. The input information is fed back to the input information sub-module as iterative information as input information for the next step, and the second part that does not overlap with each other is extracted as unpredictable information for generating a key.

In this embodiment, the input information sub-module 502 may be a part of the dynamic information module 402 shown in FIG. 4 and configured to receive unpredictable information as initial input information.

Then, under the control of the control module 501, the information processing module 503 converts the input information input from the input information submodule 502 into generated information with an expanded amount of information that can be determined by the input information through an iterative information processing method. The allocation method extracts from the generated information the first part of the non-overlapping part and the same amount of input information as iterative information and feeds it back to the input information sub-module as the next input information, and extracts the second part of the non-overlapping part as Outputs information for generating keys.

In this way, through proper settings, there is no predictable logical and mathematical relationship between the output information, and between the output information and the relevant information in the device, so as to form a sustainable key through information input, information generation, key output, and iteration cycles. Controllable and orderly generating device.

For example, we can use different algorithms and distribution methods to convert the input information into key information and feedback information that can be determined by the input information. In this example, we use 8-digit decimal values as input. In actual applications, other base numbers can be used and selected. Suitable number of significant digits.

Through the process described in the table above, the iterative method of key generation with encoding information "... 1A2379D4 ..." is achieved. The key information is ... 15254815870289282110919868440514 ..., where the serial number parameter is "23758715", and the feedback information from the previous step is used as the next Enter the information. The serial number parameter value remains the same during the same key generation process. After an orderly generation of a key, the sequence is increased by 1 to avoid premature data cycles.

The information processing module 503 can convert the input information into the determined key information and feedback information, and there is no analyzable mathematical relationship and limited corresponding logic between the output information and between the output information and the input information and other information of the device. Relationship; so that the above information is transformed into an irreversible one-way process, and sustainable key generation can be controlled and ordered through information input, information generation, key output, and iterative cycles.

The above example provides a basic iterative process. The iterative algorithm in the following embodiments can be used as a reference. More complex iterative processes can be set up on this basis. For example, different algorithms, allocation parameters, and serial number parameters can be encoded and processed. Encoding information, and performing different conversions on the distributed information, etc., improve the diversity and security of the system.

The types of the above algorithms and information distribution methods can be unlimited, and can be completely independent of each other through different parameter settings.

The above iterative process is implemented in various ways. In addition to using mathematical iterative algorithms to output digitized information, physical methods such as pulse signals can be output through oscillator circuits controlled by pulse signals.

In the following, an unpredictable information controllable and ordered generation module in a key generation device according to an embodiment of the present invention will be described with reference to FIG. 6.

The system information module 101 in the key generation device 100 described in the first embodiment above includes the unpredictable information controllable and ordered generation module 600 shown in FIG. 6.

As shown in FIG. 6, the controllable and ordered generation module 600 includes:

A control module 601 configured to control generation of unpredictable information;

The database module 602 is configured to include a main database storing a predetermined number of unpredictable information units, and an encoding database formed by encoding a predetermined number of unpredictable information units, where the number of codes is greater than the number of unpredictable information units stored in the database submodule. ,

The control module 601 sequentially extracts codes from the coding database, extracts a plurality of unpredictable information units from the main database according to the coding information, and passes them as a set of input information to the information processing module 603. The codes are not reused and the sequence numbers are sequentially updated. Control information,

The information processing module 603 generates a secondary information by combining a set of input information,

The information processing module 603 generates secondary information in an orderly manner under the control of the control module 601, and selects a predetermined number of output information as a key according to a set information distribution scheme, and uses a generation number of the output information as a corresponding key number.

After generating a predetermined number of keys, the information processing module 603 generates secondary information with the same amount of unpredictable information stored in the database submodule 602 according to the instruction sequence of the control module 601 and feeds it back to the database submodule 602 as database regeneration information to update Information in the database submodule.

The information processing module continues to produce keys based on the information in the updated database submodule,

Cyclic database submodule update and key generation process.

In this embodiment, the database 602 may be, for example, a part of the dynamic information module 402 shown in FIG. 4 and configured to store a predetermined number of unpredictable information units and store a predetermined number of unpredictable information codes.

In the following, a specific exemplary example will be used to explain the controllable and ordered generation module according to this embodiment. It should be noted that the unpredictable information, encoding, and the like shown in this example are merely examples, and are not restrictive descriptions of this embodiment.

For example, as shown in FIG. 6, the database 602 according to this embodiment includes two sub-databases, that is, a main database storing a predetermined number of unpredictable information units and an encoding database formed by encoding a predetermined number of unpredictable information.

For the purpose of illustration, the length of the unpredictable information unit stored in the main database in this example is an arbitrary length and the number is 16.

For example, Table 1 below shows examples of unpredictable information units stored in the main database. It should be noted that only 8-bit unpredictable information is shown in Table 1 below. Actually, the length of the unpredictable information can be any length.

In addition, the length of the encoding stored in the encoding database in this example is 2 bytes, and the number is 32. The value of the encoding information is expressed in binary.

When the key is generated, the control module sequentially extracts the code from the coding database. For example, when the key is generated for the first time, the serial number is 1. Therefore, the control module extracts the code corresponding to the serial number 1 from the coding database, that is, (0000 0111 1010 1111), and the corresponding hexadecimal value is 07AF.

At this time, the control module extracts a plurality of unpredictable information units corresponding to the coding information from the main database according to the coding information 07AF, and passes the information to the information processing module as a set of input information. For example, the control module extracts from the main database corresponding to the encoded information 07AF, the 0th unpredictable information unit (13, 8, 2, 1 ...) and the 7th unpredictable information unit (15, 3, 14, 0 ...), the Ath (ie, 10th) unpredictable information unit (8, 15, 3, 7 ...), and the 15th unpredictable information unit (12, 10, 6, 15 ...).

It should be noted that, in this embodiment, the encoding is not repeatedly used.

The information processing module combines the set of input information to generate a secondary information. For example, the information processing module sums the four sets of input information and then uses the hexadecimal to take the remainder to generate secondary information.

For example, the secondary information generated is as follows:

Therefore, a piece of secondary information generated by the set of input information including four pieces of unpredictable information is (0, 4, 9, 7 ...). At this time, the generation number 1 of the piece of secondary information is its corresponding key number. At the same time, the serial number control information in the control module is sequentially updated.

In this way, after using the information in the current database submodule to generate the predetermined number of keys, the information processing module generates the same amount of secondary information as the database regeneration information feedback as the number of unpredictable information stored in the database submodule. Give the database submodule to update the information in the database submodule.

The information processing module then continues to produce keys based on the information in the updated database submodule, and iterates through the database submodule update and key generation process.

The above example provides a basic process for generating a secondary sequence with the encoding information of 07AF by a combination method. The combination algorithm in the following embodiments can be used as a reference, and a more complex secondary sequence generation process can be set on this basis, such as taking a different The combination algorithm, encoding format and sequence extraction mode, database update mode, etc. of the series can improve the diversity and security of the system.

The modulo operation adopted above is an irreversible one-way algorithm, that is, the secondary sequence generated by the original sequence can be determined, but the original sequence cannot be effectively inferred from the secondary sequence. Since the possible values of the corresponding elements of the original sequence inferred from the elements in each of the secondary sequence are distributed without preference in the range of the sequence elements, the algorithm is a mathematically strict irreversible one-way algorithm.

Select a combination algorithm with irreversible unidirectional characteristics, use undisclosed random encoding, and make the encoding length, sequence length, main database capacity, and the number of secondary sequences output during each update meet the requirements, which can guarantee the above output information, There is no detectable logical and mathematical relationship between output information and system information.

This embodiment uses the basic mathematical principle that the type of the arrangement and combination between elements can be much larger than the number of elements, uses the combination method to generate information with an expanded amount of information, and realizes the controllable and orderly generation of sustainable unpredictable information through information generation and feedback loops.

The database 602 is designed to store a limited number of unpredictable information units in an orderly manner. The method of generating a secondary information by combining the information units makes the amount of secondary information that can be generated greater than that of the database. Under this design framework, the dynamic information module is in the form of a database, and the control module sequentially extracts a number of information units from the database as a set of input information to pass to the information processing module, and at the same time sequentially updates the serial number control information; the information processing module sends a set of inputs The information unit combines to generate a secondary information that can be determined by the input information. The number of secondary information generated by the method is greater than the number of information units in the database. The system sequentially generates a set of agreed number of secondary sequence numbers as keys and uses them to generate serial numbers. Mark them in turn, and then spontaneously and controllably generate secondary information equal to the database capacity to update the database in an orderly manner as the database regeneration information. After the database is updated, the next round of key generation is performed; the output information is between the output information and the output information and the database through appropriate settings There is no predictable logical and mathematical relationship between the information, so a sustainable key controllable and ordered generation device can be formed through key generation and database update cycles.

Further, by using the above-mentioned information combination strategy, a universally applicable sustainable and unpredictable information controllable and orderly generation device design scheme can be constructed through the concept of multiplyable encoding information.

First introduce the concept of coding information, and generate coding information through the database. The database is determined by the identified structural units and the information stored in the units. The storage unit and the structural relationship between them form the fixed frame of the database and can be adjusted by parameters. The information stored in the unit The variable part of the database, the information in the database is related through the structural relationship between the structural units to which it belongs; the specific form and content of the encoded information is determined by the information stored in the database structural unit, and the encoding determines all data structures corresponding to the information generation process The relationship can be completely restored through the same database through coding; the specific form and content of the coding and information are independent of each other, and the information can be tracked and manipulated with limited information and the form and content are not restricted to achieve the controlled and orderly generation of information .

Further, the concept of multiplication information is introduced, and the number of progeny information is generated by random combination of database information, so that the information can be multiplied through the database to become multiplication information, and the value space of the progeny information is expanded by continuous random passage and multiplication. Finally, the value space is made to the information space of the corresponding format information, so that the child information selected by a random method is unpredictable, and the proliferated child information is randomly selected to replace the database information, thereby achieving effective regeneration of unpredictable information in the database.

Enrichable information is encoded according to the combination of database information and all related data structure relationships at the time of its generation, and becomes an expandable coded information. The database is designed according to the concept of the augmentable coded information, and organized to store unpredictable information of limited capacity, including the main database and A coding database composed of random codes; the information units in the main database are stored in an orderly manner for the information generating device to retrieve the corresponding information units according to the coded order in the coding database to generate secondary information, and to track and manipulate the information through the random coding in the coding database Generation and generation, to achieve spontaneous and controllable regeneration of unpredictable databases.

On the basis of the controllable and orderly generation of information and the spontaneous and controllable regeneration of the unpredictable database achieved through the proliferation of encoded information, the present invention can rely on an unpredictable database with limited capacity to form a secondary information generation and database regeneration cycle. Sustainable and unpredictable information controllable and orderly generating device.

The universality of the information definition makes the design of the above-mentioned sustainable and unpredictable information controllable and ordered generation device based on the concept of multiply-encoding information universally applicable. Various forms of unpredictable information and signal units can be put into the main database. With the help of a coding database composed of undisclosed random codes, the concept of multiplyable coding information and appropriate information processing technologies can be used to achieve sustainable and unpredictable information controllability. Ordered generation.

Hereinafter, an encryption and decryption apparatus according to an embodiment of the present invention will be described with reference to FIG. 7.

As shown in FIG. 7, the encryption and decryption apparatus 700 according to this embodiment includes:

The key generation device 100 described in the first embodiment is configured to controllably and orderly generate a one-time key. In addition, the control module 701 in the encryption and decryption device 700 adds parameters and functions as a control module of the encryption device.

Input port 702 is configured to read or input data to be encrypted;

A formatting unit 703 configured to convert the data to be encrypted input from the input port into a formatted plain text that matches the key format;

The encryption module 704 is configured to convert the formatted plain text generated by the formatting unit 703 into a main cipher text using the one-time key that is controlledly and orderly generated by the key generation device 100, and use the serial number of the one-time key as Ciphertext title, combining main ciphertext and ciphertext title to generate ciphertext;

The sending port 705 is configured to send the generated ciphertext to the paired decryption device.

In addition, the encryption and decryption apparatus 700 according to this embodiment further includes:

A receiving port 706 configured to receive a ciphertext sent from a paired encryption device;

The decryption module 707 is configured to parse the received ciphertext to extract the key sequence number in the ciphertext header, and use the key generation device 100 to generate a decryption key corresponding to the key sequence number according to the key sequence number, and use the The decryption key decrypts the ciphertext to generate the decrypted plaintext;

The formatting unit 703 is further configured to convert the decrypted plain text into recovered data;

An output port 708 is configured to output the restored data.

According to the encryption and decryption device of this embodiment, the sender inputs file information through the input port, and becomes formatted plain text that can be processed by the encryption module through the formatting unit, and the key generation device extracts the required information from the database in order to generate one-time The key is combined with the formatted plain text to form the main cipher text, and the key generation sequence number is used as the cipher text title to generate a cipher text to complete the encryption; the cipher text enters the regular channel through the sending port; Extract the key generation sequence number from the ciphertext title, generate the corresponding decryption key, decrypt the main ciphertext to generate the formatted plaintext, and complete the decryption; the formatted plaintext is restored to the original file by the formatting unit and output through the output port.

In this embodiment, the decryption clue accompanying the ciphertext is a universal serial number and does not contain any key information, which completely avoids the risk of key information leakage during the ciphertext transfer process. Therefore, the encryption and decryption device according to this embodiment can Achieve secure file transfer.

The dashed part of this embodiment shows that exogenous random information can be used as a sending file, and random information from different sources can be securely shared between the paired encryption and decryption devices separated in time and space by cipher text, and the exclusive shared database can be updated synchronously. Share system information with others to form an open and evolvable key generation and secure distribution system, which effectively eliminates and corrects the accumulation of system defects caused by imperfect initial system information under long-term operation of a closed system.

Hereinafter, an information security transfer system according to an embodiment of the present invention will be described with reference to FIG. 8.

As shown in FIG. 8, the information security transfer system according to the present embodiment includes a paired first communication device 800 and a second communication device 900, where the first communication device 800 and the second communication device 900 may have the same configuration. Both the first communication device 800 and the second communication device 900 may include encryption and decryption means as in the above embodiment.

The first communication device 800 is held by the correspondent A, for example, and the second communication device 900 is held by the correspondent B, for example.

Specifically, for example, the first communication device 800 includes:

The first key generation device 100 according to the first embodiment is configured to controllably and orderly generate a one-time key as the first key; the control module 801 in the key generation device 100 adds parameters and functions as the encryption Control module of the device.

A first input port 802 configured to read or input first data to be encrypted;

A first formatting unit 803 configured to convert the first to-be-encrypted data input from the input port into a first formatted plaintext having the same key format;

The first encryption module 804 is configured to convert the first formatted plain text into a first main cipher text by using a first key generated by a first key generation device, and use a generation number of the first key as a first Ciphertext title, combining the first main ciphertext and the first ciphertext title to generate the first ciphertext;

A first sending port 805 configured to send the generated first ciphertext to a second communication device,

The second communication device 900 includes:

The second key generation device 100 according to the first embodiment is configured to controllably and orderly generate a one-time key as the second key; the control module 901 in the key generation device 100 adds parameters and functions as the encryption Control module of the device.

A second receiving port 906 configured to receive a first ciphertext sent by a first sending port;

A second decryption module 907 is configured to parse the received first ciphertext to extract a first key sequence number in a first ciphertext header, and pass the second key generation device according to the first key sequence number. Generating a corresponding second decryption key text, and using the second key to decrypt the first cipher text to generate a second decrypted plain text;

A second formatting unit 903 configured to convert the second decrypted plain text into second restored data;

The second output port 908 is configured to output the second restoration data.

Similarly, the second communication device 900 includes:

The second input port 902 is configured to read or input the second data to be encrypted;

The second formatting unit is also configured to convert the second to-be-encrypted data input from the second input port into a second formatted plain text that matches the key format;

A second encryption module 904 configured to convert the second formatted plain text into a second main cipher text through a second key that is controllably and orderly generated by the second key generation device, and convert the second key The second key sequence number of the key is used as the second ciphertext title, and the second main ciphertext and the second ciphertext title are combined to generate a second ciphertext;

A second sending port 905, configured to send the generated second ciphertext to the first communication device,

A first receiving port 806 of the first communication device, configured to receive a second ciphertext sent by the second sending port;

A first decryption module 807, configured to parse the received second ciphertext to extract a second key sequence number in a header of the second ciphertext, generate a sequence number according to the second key, and generate the sequence by using the first key The device generates a first decryption key corresponding to the second key serial number, and uses the first key to decrypt the second ciphertext to generate a first decrypted plaintext;

The first formatting unit simultaneously converts the first decrypted plaintext into the first restored data;

The first output port 808 is configured to output the first restoration data.

Using the same type of encryption and decryption device, the target correspondent establishes a secure connection by exclusively sharing the encrypted database information; the sender uses the encryption device to sequentially generate a one-time key to encrypt the file to generate a ciphertext with the corresponding key serial number as the title, through the regular channel Pass; the ciphertext receiver obtains the corresponding key generation sequence number according to the ciphertext title, generates the corresponding key to decrypt the ciphertext, and realizes the secure transmission of the file; the correspondent can securely share random information from different sources through the ciphertext and update the exclusive shared database And related system information to form an evolvable open key generation and secure distribution system.

In this embodiment, the decryption clue accompanying the ciphertext is a universal serial number and does not contain any key information, which completely avoids the risk of key information leakage during the ciphertext transmission process. Therefore, the information security transmission system according to this embodiment Enables secure transmission of information.

In the following, some specific application examples will be described.

In order to establish a universal information security system in combination with current computers and information technology, the formatting unit of the encryptor according to the present invention is coupled to a modem; the key uses a sequence of the same format, and the value range of the sequence element is a value that is easily processed by a computer binary system. For example, 2, 16 (compatible with hexadecimal numbers commonly used by computers), 256 (one byte of information), etc., and when necessary, treat the sequence as a multi-digit number with its element value range as the base value, and define The multi-digit number is a sequence value. For example, we can treat the sequence 127, ^3, 192, 8 (value range 0-255, value range 256) as a multi-digit number, and the corresponding sequence value is 127 * 256 ³ + 3 * 256 ² + 192 * 256 + 8; the same reason, the sequence of the sequence of 2, 13, 11, 7, ^{9, 5} (range 0-15, range 16) is 2 * 16 ⁵ + 13 * 16 ⁴ + 11 * 16 ³ + 7 * 16 ² + 9 * 16 + 5. In actual operation, the carry processing is performed only in accordance with the multi-digit arithmetic rules, without having to be converted into a commonly used decimal value. Of course, it is not excluded that the base conversion is used as a non-degenerate data conversion method for information encryption and related applications. By using a formatting unit coupled with a modem and a sequence of the same format as the key, the digitization of the encryptor is realized. The formatting unit converts all forms of input information into analogue key sequences through analog-to-digital conversion, that is, formatting plaintext; digitizing information processed by the encryptor, including ciphertext and decrypted formatted plaintext, by Digital-to-analog conversion generates the appropriate form of output information. All information processed in the digital encryptor is a sequence of the same format; when encrypted, the formatted plaintext and key are generated by modulo operation; when decrypted, the ciphertext and corresponding key are recovered by the inverse process of modulo operation To format plain text; the encryption-decryption and the entire information processing process can be implemented intuitively by computer.

After the digitalization of the encryptor is adopted, the key problem to be solved by the present invention will be the controlled and orderly generation of an unpredictable sequence as a key.

The inventor adopts a combination strategy and develops a universal design strategy for a sustainable and unpredictable information controllable and ordered generation device through the concept of multiply-encoded information. Generate coded information through the database, and realize the controllable and orderly generation of information through the coding and tracking control information generation and conversion; further, the generation of secondary information through the combination of database information to achieve the generation and proliferation of database information and the regeneration of unpredictable databases; Combining the concept of coded information and the concept of multiplyable information, an updatable database is constructed through the concept of multiplyable coded information, and the secondary sequence output and database update are circulated to achieve the controllable, orderly and infinite generation of unpredictable information. The database structure and the form of information in it can be unlimited, and the combined strategy provides a universal sustainable unpredictable sequence controlled and orderly generation strategy. The key of the combination strategy is the secondary sequence generation algorithm.

The inventor first solved the problem of the sequence generation algorithm.

The common modulo operation of information encryption is to add the values of the corresponding sequence elements in the same format sequence, divide the sum by the value range of the element, and then take the remainder. As the corresponding sequence element of the new sequence, it can generate a certain format that is the same as the original sequence. Secondary sequence. The algorithm for generating the secondary sequence by modulo operation is an irreversible one-way algorithm, that is, the secondary sequence generated by the original sequence can be determined based on the combination of the original sequence, but the original sequence cannot be effectively inferred from the secondary sequence. Since the possible values of the corresponding elements of the original sequence inferred from the elements in each of the secondary sequence are distributed without preference in the range of the sequence elements, the algorithm is a mathematically strict irreversible one-way algorithm. The inventor introduced a carry on the basis of the modulo operation, taking the quotient appearing in the calculation of the sequence element value as a carry, adding it to the calculation of the next sequence element, deleting the carry of the last digit, and keeping the length of the secondary sequence unchanged. According to the definition of the sequence value, the carry modulo operation is equivalent to the modulo operation that takes the sequence sequence space value of the sequence between the sequence values and is defined as the sequence addition. The process of generating a secondary sequence by the algorithm determined by the defined sequence addition also has the mathematically irreversible algorithm characteristics. Based on the addition between the same sequence, the inventor defines the multiplication of the sequence and the natural number.

The sequence addition and sequence multiplication defined above are used for the generation operation of the secondary sequence in the present invention. If there is no common number greater than 1 between the seed sequence values in the database, that is, coprime, and there is no premature cycle in the process of continuous passage and proliferation, theoretically the possible sequence value of the secondary sequence can be extended to its entire sequence space. Mathematically, it can be considered to ensure that the secondary sequence selected from the random method is unpredictable.

In addition to numerical operations, logical or mathematical generalized algorithms can also be used. The inventor defines a control template operation here: one sequence is used as the template sequence, the other is used as the control sequence, the value m of the element with the sequence number n in the control sequence is used as the sequence number, and the element with the sequence number m is extracted from the template sequence. As an element of the new sequence number n, a secondary sequence is obtained.

There are no restrictions on the types of generalized algorithms. For example, you can add element values and then add a positive number, and then perform square root and logarithmic operations to obtain an irrational number. Select the value of a valid number within the agreed range after selecting the decimal point. Elementary sequence elements are obtained by modulo operation. The types and parameters of these algorithms will be infinite, and the algorithms are independent of each other. There is no analytic mathematical and logical relationship between the value of the secondary sequence and the original sequence.

Based on the above-mentioned combination strategy and the secondary sequence generation algorithm, the inventor constructed an unpredictable secondary sequence generation system through the following schemes, but not limited to the following schemes.

1) Construct a main database that contains a limited number of undisclosed random seed sequences of the same format, and number them from 0 to N-1, where N is the number of seed sequences in the main database;

2) Combine the m seed sequences to generate a secondary sequence, and use a suitable algorithm to make the secondary sequence correspond to the seed sequence number sequence used, and encode the number sequence as the corresponding secondary sequence;

3) The above encoding method can generate N ^m secondary sequence of numbers, which is encoded with M bytes of information, where M is determined by 256 ^M = N ^m .

Each secondary sequence generated by the method is unpredictable to outside observers when the primary database remains unpredictable, and database information cannot be effectively predicted based on any single secondary sequence. However, the encoding contains the combination information of the seed sequence used in the generation of the secondary sequence, so that the secondary sequence is related to each other through the encoding and the seed sequence; the unused secondary sequence of the specific encoding can be derived based on the encoding combination of the published secondary sequence, or The entire database is solved by solving the system of equations to determine all secondary sequences of a given encoding. Therefore, the secondary sequence encoding information needs to be hidden from the outside world during distribution.

In order to hide the encoding information of the secondary sequence, the inventor constructed a coding database that stores a certain number of random codes and distinguishes them by numbers. The secondary sequence generated by the corresponding code is identified by the number, and the correlation between the secondary sequence displayed in the coding information is masked. . Since the amount of encoded information can be much smaller than that of the secondary sequence, the required number of encodings can be stored in a small amount of storage space.

Under the cover of the coding information, the difficulty of predicting the unused secondary sequence based on the used secondary sequence will be greatly increased. In a sequence generation system that includes N seed sequences, at least N secondary sequences that determine both encoding and content are required to ensure that a complete set of secondary sequences is constructed through derivation, thereby turning the predicted unused secondary sequence into one and encoding, etc. Long traditional password brute force problem. Under the above M-byte encoding, the possible number of secondary sequences is 256 ^M. The theoretical combination type of randomly selected N secondary sequences is 256 ^{N * M} , and the required information amount is N * M bytes.

When the amount of information required to predict a sequence is equivalent to the amount of information in the sequence itself, the prediction will be meaningless, and the methodology can be considered to be unpredictable. Therefore, when designing a secondary sequence generation system, the inventor made the information of the seed sequence and the corresponding secondary sequence equal to the product of the number of seed sequences and the amount of encoded information N * M, and used it as a database design standard.

The above design standards unify the encoding database and the main database format. An element of an undisclosed random number sequence in the same format as the seed sequence can be sequentially divided into random codes with the same number of seed sequences in the main database, numbered sequentially; the encoding database of the format contains an integer multiple of the number of seed sequences in the main database. Random encoding, carried by an undisclosed random sequence of the same format, to increase the standardization of the database design.

The database is generated using the secondary sequence that contains the main database and the coding database. The system sequentially extracts codes composed of random information from the coding database. Based on the coding information, a set of seed sequences with corresponding numbers is selected from the main database and a secondary is generated by a suitable algorithm. The sequence number is used to realize the controlled and orderly generation of the secondary sequence number through its generation serial number identification.

The above secondary sequence cannot be effectively predicted by the outside world on the premise that the database remains unpredictable, but due to the limitation of the encoding length, the diversity cannot meet the randomness requirement. The inventor can use the proliferative characteristics of the database to randomly select the secondary sequence as the next-generation seed sequence, and gradually expand the value range of the secondary sequence through the generational update of the main database, and finally reach its sequence space, thereby enabling random coding The resulting secondary sequence is unpredictable.

With the standard database design, the inventor only needs to pass the database randomly once, and then can expand the value range of the secondary sequence to the entire sequence space of the corresponding format sequence, so that the secondary sequence generated by the random coding in order conforms to the methodology Absolute randomness.

In order to realize the spontaneous and controllable passage of the database, the inventor expanded the coding database to add the coding used for database update on the basis of retaining the original coding used to generate the key. The increased number of random codes is sufficient to generate the entire database. Updated secondary sequence.

According to the setting, after generating the agreed number of keys, the system sequentially extracts the encoding from the encoding database, relies on the current primary database to generate the secondary sequence, replaces the primary database information in an orderly manner, and encodes the database information to achieve an orderly and controllable entire database. regeneration.

Under the design of a standardized key generation device that uses the same format sequence, the inventor can use fragments of the agreed position and encoding in the seed sequence, such as the front-end fragment, as the working encoding for key generation; the end and encoding are of equal length. The fragment is used as the encoding for updating and is used for database update; the encoding number is the same as the seed sequence number in which it is located. The encoding database is cancelled and the database design is simplified and standardized.

Based on the above strategy, the inventors built a sustainable and unpredictable sequence controllable ordered generation system. This is achieved through, but not limited to:

1) Construct a master database composed of undisclosed random number sequences of the same format, containing a certain number of seed sequences, distinguished by number; determine the secondary sequence encoding format, take the front-end fragments of the seed sequence to form the working code, and the end fragments to constitute the update Code, the number corresponding to the code is consistent with the number of the seed sequence to which it belongs;

2) a working code is sequentially extracted, a set of seed sequences is selected according to the corresponding information, and a suitable secondary sequence corresponding to the code is generated through a suitable operation, and a serial number identifier is generated using it, and the working code is not reused;

3) Before the work code is exhausted, the system sequentially extracts the update code, generates a secondary sequence through the current main database, and sequentially replaces the current main database information to achieve the spontaneous regeneration of the database;

4) After the database regeneration, continue to generate the secondary sequence in an orderly manner. Through the secondary sequence generation and the database spontaneous regeneration cycle, a sustainable and unpredictable sequence generation can be achieved.

Because the encoding length is less than the length of the sequence, the probability of the same encoding appearing in the encoding database is greater than the probability of the same secondary sequence occurring randomly; to avoid this, the program can detect the generated encoding database each time to ensure that the same encoding does not appear. It only needs to be agreed upon by both programs to add a certain value, such as 1, to the code that appears later in the same code, to maintain the randomness of the code and effectively avoid the occurrence of the same secondary sequence above the random probability.

The above method provides a universal design framework of a sustainable and unpredictable sequence controllable and ordered generation device through a database design with a definite structure, compatible with different data formats and corresponding secondary sequence generation algorithms. In the above design, the amount of secondary sequence information output during each round of database update is not greater than the capacity of the main database. Under the premise that the database information is unpredictable, the secondary sequence output from each round is unpredictable to outside observers, and The spontaneously controllable and updated database is also unpredictable to outside observers, thereby achieving a controlled and orderly generation of sustainable unpredictable information.

If the unpredictability of the information generated by the above methods can be proved strictly in theory, or the system can be improved by improving or adopting a specific method, a standard design scheme of the key generation device will be provided. Under this scheme, the theoretical security strength of the key generation system will be determined by the randomness of the database information and the database capacity, and ultimately depends on the database capacity.

The above-mentioned secondary sequence generation algorithm for generating keys and feedback information selects a modulo operation with irreversible unidirectional characteristics, uses random encoding, and makes the encoding length, sequence length, main database capacity, and secondary output during each update The number of sequences meets the requirements. The above database evolves into an irreversible one-way evolution process, that is, the initial database can accurately evolve all descendant databases of a given algebra, but the previous generation database cannot be effectively detected based on the descendant database. The irreversible one-way evolution characteristics of the above database allow us to rely on unpredictable information of limited capacity and to controllably and orderly generate more keys than the database capacity.

The above-mentioned standard key generation device can determine the basic type of the encryptor by the three basic parameters of sequence format, database capacity, and encoding length to meet different application requirements; at the same time, the algorithm, encoding form, database update method, cipher text organization format, and key distribution Diversity parameters such as form determine the diversity of the design of the cipher.

The invention also provides a method for generating high-quality random data. A random number generator can be constructed by using the initialized undisclosed random database, running the database update randomly, and clearing the previous generation database in time. Run the database updates at random times during the program idle period or when the database is updated to improve the randomness of the system. Under long-term random operation of the system, even if the randomness of the initial sequence is not high, the generated sequence can gradually be completely random in the continuous operation.

When it is not theoretically strictly proven that the secondary sequence generation system and distribution mode using specific methods are absolutely safe, integrating different algorithms into one system can increase the complexity of the system and enhance the intruder's prediction of new births based on the known secondary sequence Secondary sequence and difficulty of detecting the database. The inventor can use the above-mentioned standard key generation device as a basic framework, while introducing other unpredictable information generation methods and related elements to construct a key generation device with required security requirements.

In the following, a controllable and orderly generation device of unpredictable information complementary to the standard model will be constructed.

Utilize the concept of coded information to design a database to store undisclosed random number sequences in the same format in an orderly manner, and sequentially extract the number sequences from the database according to requirements to generate unconditional and independent unconditional security keys containing information, and build an unconditional security key Controllable ordered generation device (basic mode).

The total amount of information of the unconditional security key generated by the basic mode is the same as the database capacity. It is used as a one-time key to encrypt the file information of the same amount of information to generate an unconditional secure ciphertext. An exclusive shared encrypted database is used to establish a secure connection to establish an unconditional Safe information exchange system. Under the current technical conditions, the exclusive shared encrypted database with Tb capacity can meet the long-term security information exchange between the two parties in communication; using the 64Gb exclusive shared encrypted database that can be built in ordinary communication terminals, using high-quality audio or video communication with 1Mb information per minute, It can meet the 64000 minutes of secure communication. Combined with mobile storage technology, it can build an unconditionally secure communication network between certain "acquaintances" who exclusively share one-time encrypted databases in person. The application scope of the above-mentioned unconditional secure information exchange mode will be expanded with the rapid development of storage technology.

Basic mode key can control the basic parameters of the orderly generating device: key format, database capacity.

As a one-time key encrypted ciphertext with the same amount of information, the amount of information that can be safely transmitted in the basic mode is not greater than the capacity of the encrypted database, and is a non-persistent mode. In order to overcome this limitation, the inventors used the unconditional security key generated by the basic mode as a one-time password, encrypting the required length of information larger than the amount of password information, increasing the amount of information that can be safely transmitted, and maintaining the one-time password generated by the system. A surplus appears on the basis of the exclusive shared database update, so that correspondents can pass information through the surplus password to achieve sustainable secure information exchange. The method is equivalent to reducing the information density of the unconditional key, increasing the amount of information that can be transmitted, and achieving sustainable information exchange.

In order to maintain the uniformity of the encryption scheme, that is, to use one-time key encryption to encrypt file information of the same length as the key, the inventor divided the undisclosed random number sequence in the basic pattern database into equal-length fragments as the dilution sequence, so that the dilution sequence The number of expansions corresponds to multiples. The system sequentially extracts the dilution sequence according to the requirements, and expands it in a certain way to determine the secondary sequence with the same format as the initial sequence from the extracted dilution sequence as a key, and generates a key with a larger amount of apparent information than the database capacity (dilution mode) ).

Compared with the combination mode, the information generated by the orderly generated keys in the dilution mode is independent of each other. You can achieve any level of security by setting a dilution sequence of any length. The security of the encryption system is easy to control; its disadvantage is that it must be sacrificed. Key information density in exchange for sustainable communication.

The dilution mode key can control the basic parameters of the orderly generation device: key format, database capacity, dilution multiple; diversity parameters: sequence division method, expansion method or algorithm, etc.

In addition to the coding information strategy, the iterative method also provides a class of independent sustainable key controllable ordered generation schemes. You can choose a mathematical iterative algorithm, input a multi-digit number, and generate a generation information with more significant digits than the entered multi-digit number through the operation. According to the agreed rules, the significant numbers are extracted from the generated information without overlap, and a part of the iteration is generated. Multi-digit numbers are used as the next input information, and part of them are used as the output sequence. Through the multi-digit input, operation, effective number extraction, sequence output, and iterative multi-digit input cycle, a sustainable sequence-controlled and orderly generation system is established. Through different system settings, such as initial multi-digit value, multiple independent algorithms such as multiplication, square operation, logarithmic operation, etc., and different effective digit extraction rules, and avoid the output by adding the serial number value of the generated information to the operation The periodic repetition of information and other methods increase the unpredictability of the output sequence and achieve a controlled and orderly generation of a sustainable unpredictable sequence.

When the above iterative device is determined by an algorithm, the unpredictability of the generated information is determined by the initial multi-bit value and various operation control parameters. These parameters are expressed in a formatted unpredictable sequence to form encrypted database information as the determining part of the key's unpredictability, and the rest as the public part of the encryptor. The following methods are used, but not limited to the following methods. System-compatible and orderly generating device for sustainable unpredictable information.

1) Determine the algorithm, select several independent algorithms, each algorithm is assigned a certain number;

2) The parameter database is composed of undisclosed random number sequences of the same format. The sequence of elements in the number sequence constitutes parameter information that determines the number of groups. Each group of parameter information includes input values, algorithm numbers, information allocation parameters, and dynamic iteration parameters. The amount of information is N times the amount of input numerical information; set the amount of output information to be the same as the amount of input numerical information, and generate a secondary sequence from the parameter information in the N undisclosed random sequence;

3) Information processing, sequentially extracting a set of parameter information from the parameter database, adding the dynamic iteration parameters and the input value, and generating a generated information through a corresponding numbered algorithm; assigning parameter information according to the corresponding information, and generating information from Extract the output sequence and iteration value in the parameter, replace the input value in the parameter information with the iteration value, and increase the dynamic iteration parameter value by 1 at the same time; complete the extraction, operation and update of the parameter database information in sequence, and combine the output sequence order into A key, which is used to generate a serial number identifier;

4) Repeat step 3) to achieve unlimited and controlled and orderly generation of keys;

Basic parameters of the iterative mode key controllable and ordered generation device: key format, database capacity; diversity parameters: number of input values, length of output sequence, number of parameter information groups, etc .; when the number of parameter groups is 1, it is simple Iterative system.

Before theoretically proving that the key generation and distribution methods are absolutely secure, different policies can be combined, and the possible shortcomings of a single policy can be complemented by complementarity to construct a high-security level key generation device.

By combining the elements in the different systems mentioned above, a comprehensive sustainable key controllable and ordered generation system is constructed by, but not limited to, the following methods.

1) Construct a database consisting of undisclosed random number sequences of the same format, including: a) the main database, which contains a certain number of sequences, distinguished by number; determine the combined encoding format, and agree non-intersecting fragments from the seed sequence Form a work code and update code, the corresponding code number is the same as the seed sequence number to which it belongs; in addition, the element fragments constitute a set of iteration parameters; b) dilute the database, containing a certain number of sequences, and divide each sequence into equal numbers of Dilution series, distinguished by number;

2) Determine different algorithms, including sequence addition and multiplication, and control template algorithms for combined algorithms, relying on the main database, orderly extracting work codes or updating codes, and orderly generating sequence numbers for output or spontaneously controlled update of the database; A series of iterable algorithms that can be distinguished by numbering. Iteratively extracts iteration parameters to generate output sequences and iteration sequences. Dilution algorithm, sequentially extracts dilution sequences from the dilution sequence library, and expands them to the key format by appropriate methods. The same sequence

3) Generate a quasi-key, use the database to extract information according to the set order, and generate a corresponding secondary sequence with the same key format as the quasi-key by using different secondary sequence generation modes.

4) Generate a key by the quasi-key through modulo operation, and use it to generate a serial number identifier;

5) Before the working code in the main database is exhausted, update the main database by combining the update code with the current main database information and update the main database by combining the methods; after the main database is updated, continue to generate the key;

6) Cyclic key generation and autonomous controllable update of the main database; before the number in the diluted database runs out, update the diluted database information through ciphertext sharing of unpredictable information from new sources, or update the entire database information at the same time;

7) After the database is updated, the keys can be generated in a controlled and orderly manner.

Due to the introduction of the dilution series, the keys generated by the above system have independent contents, and the quasi-keys generated by the combination method and the iterative method do not reduce the information density, so that the ones that are larger than the database information amount can be generated in an orderly manner and have independence from each other. A securely distributable key for the content. In addition to transmitting information, the system can safely share unpredictable information through cipher text, and regularly update the exclusive shared database, especially the dilution series database, to achieve sustainable security information exchange.

The above-mentioned key-controllable and orderly generating device securely shares new sources of unpredictable information through ciphertext into an open system, increasing the diversity of the database's controllable evolution, and can continuously introduce new information to correct possible systems caused by the initial database defect. Therefore, in the application, even if the method adopted can be proved to be absolutely reliable in methodology, the inventor still recommends constantly introducing new sources of unpredictable information to update the database, while effectively eliminating possible system defects, and avoiding long-term closed systems. Operation makes the initial shared database information of limited capacity a valuable target for brute force cracking.

Basic parameters of the integrated mode key controllable and orderly generating device: key format, main database capacity, key generation mode, diluted database capacity; diversity parameters: algorithm, dilution sequence division method, dilution sequence expansion algorithm, database update method Wait.

As a generally applicable standard framework, different types of key generation devices can be designed by selecting different functional units in the integrated key generation device described above.

1) Standard mode: only the main database is selected; combined algorithm modules, sequence addition and multiplication are used;

2) Iterative mode: only the main database is selected, and iterative algorithm modules are used;

3) Basic mode (unconditional security mode): only the main database is selected, and the algorithm is to directly extract the sequence;

4) Dilution mode: only the dilution database is selected, and the dilution algorithm module is used;

5) Security mode: a combination of standard mode and dilution mode, on which an algorithm and other modes are added.

The above-mentioned digitized and suitable type of key controllable and orderly generating device is written into a computer program, and information is sequentially retrieved from an encrypted database to generate a key. The formatted unit coupled to the modem is used to convert the received information into a secret key. The keyed format matches the formatted plaintext. The key is used to encrypt the plaintext to generate a ciphertext that can be sent. The ciphertext is decrypted and the decrypted plaintext is converted into outputtable decryption information through a formatting unit coupled to the modem to form an encryptor.

A dedicated encryptor is generated by initializing the encrypted database with unpredictable information to realize the information encryption-decryption; through the information security software constituted by public settings, the target correspondent can establish a secure connection only by exclusively sharing the encrypted database information, with the help of ordinary channels Passing cipher text that can only be identified between target correspondents, thereby establishing a universal information security system that meets different needs.

In the above information security system, the amount of information carried in cipher text is close to the amount of file information. Encryption-decryption is only performed at the communication terminal, and the formatting unit and the modem are coupled to realize the transmission and reception of information without delay, which is completely compatible with the current communication system. After the secure connection is established, the software can automatically complete the system maintenance and daily encryption, including the spontaneous update of the main database, the update of the diluted database by periodically exchanging unpredictable information (requires the system to connect a random information generator according to the present invention), and routine encryption. Decryption work, at the same time convenient for users to update exclusive shared information at any time as needed.

By encrypting the encrypted database in different ways to form a paired encryptor, different information security systems can be constructed to meet a variety of needs, including but not limited to file preservation, file transfer, instant messaging, digital identity verification, and network communication systems.

Specific application examples are provided below to describe a typical information security system and its applications, and should not be taken as a limitation on the content of the invention.

1. An iterative mode of sustainable key controllable ordered generation system.

1) Algorithm, choose 16 groups of independent algorithms: y = x ³ , log ₂ (x), x ^1/3 , x ^1/2 , x ^2/3 , x ^3/4 , log ₃ (x), x ^4/3 , x ^3/2 , x ^5/3 , x ^7/4 , log ₁₀ (x), x ^7/3 , x ^5/2 , Ln (x), x ^11/4 , where x is the number of inputs Digit value, y is the calculation result, and each algorithm is numbered from 0 to 15. Each of the above algorithms can convert ordinary input multiple digits into an operation result that can be determined by the input multiple digits and doubles the number of significant digits. Determine the dynamic iteration parameters, add them to the input multi-digit number and run the corresponding algorithm, so that the same group of algorithms becomes independent algorithms with the participation of different dynamic iteration parameters; increase the dynamic iteration parameter value by 1 after each operation to avoid calculation Results in a cycle;

2) Information extraction and distribution, the effective number is extracted from the operation result according to the agreed rules; first, it is agreed that the extraction interval is 2 times the number of input digits. If the number of effective digits in the operation result is limited, the middle part is extracted. Continuous significant digits in the interval; for example, you can use 8-digit hexadecimal input values, select 4-19 digits of the 3rd power operation result, and 1 to 16 significant digits after the decimal point of the irrational operation result are used to extract the interval. A sequence with a value range and a length of 16; two random number sequences with the same format are determined, one is an extraction sequence, and the other is a template sequence; the significant digits corresponding to the sequence values are sequentially extracted from the extraction interval through the extraction sequence to form a sequence, and then The template sequence is subjected to modulo operation to generate a sequence with the same format. The odd sequence position element sequence generates an iterative value, and the even sequence position element sequence generates an output sequence. The above-mentioned extracted sequence and template sequence together form an information distribution parameter, and the amount of information is the output sequence information. 4 times the amount;

3) The database uses a 4Kb information key and consists of 8192 elements with a value range of 16. The parameter database contains 1024 sets of parameter information arranged in sequence; each set of parameter information includes an initial 8-digit hexadecimal input Value (4 bytes of information), an algorithm number (0.5 bytes), a group of information allocation parameters (16 bytes) consisting of 2 sequences of length and element value range 16 Dynamic iteration parameters of hexadecimal value (3.5 bytes of information); each group of parameters has 24 bytes of information and the parameter database capacity is 24Kb, which is composed of 6 undisclosed random number sequences with the same key format;

4) Key generation, sequentially extract a set of parameter information from the parameter database, add the corresponding dynamic iteration parameters to the input value, generate an operation value through the corresponding numbered algorithm, and extract the parameter from the operation value according to the corresponding information distribution parameter Output sequence and iteration value, replace the input value in this group of parameter information with iteration value, and increase the dynamic iteration parameter value by 1 at the same time; complete the extraction, operation and update of 1024 groups of parameter information in sequence, and combine the output sequence order into one Key, used to generate serial number identification;

5) Repeat step 4) to achieve unlimited and controlled and orderly generation of keys;

Basic parameters: key format, database capacity; diversity parameters: number of input values, length of output sequence, algorithm library, number of parameter groups, etc .; when the number of parameter groups is 1, it is a simple iterative system.

2. A standard mode sustainable key controllable and ordered generation device.

1) The database consists of 256 undisclosed random number sequences with a length of 4096 (4K) and an element value range of 256. The number of elements in the sequence is represented by 1 byte of information. The amount of information in each sequence is 4Kb, which is called the seed sequence. Numbering up to 255, the numbering occupies 1 byte of information; using 16-byte encoding, the first 16 elements of the seed sequence constitute the working code, and the last 16 elements constitute the updating code. The element values in the encoding correspond to the seed sequence number, and the encoding uses the seed to which it belongs. Consistent serial numbers; database capacity is 1Mb;

2) Algorithm, according to the encoding information, extract a set of 16 seed sequences in sequence from the main database and number them from 0 to 15; multiply the selected seed sequence by the value 2n + 1, where n is the corresponding number of the seed sequence in this group , And then generate a secondary sequence by sequence addition;

3) Sequentially extract the working code, generate the secondary sequence as the key, mark it with the generated serial number, and the code is not reused;

4) After the No. 239 code is used, the system sequentially extracts the update code, relies on the current database to generate 256 secondary sequence numbers, replaces the database in an orderly manner, automatically completes the orderly regeneration of the database, and then returns to step 3), generating less than the seed during each update. The number of keys in the sequence makes it impossible for an illegal detector to construct a whole combination of possible equations through brute force cracking to crack the main database information (256 ^{4096 in} this example). The number of attempts is 256 ^(4096x256) ;

5) Loops 3) and 4) continue to generate keys.

The above system becomes a random number sequence generator under random operation. By setting the database update to random mode, the database update is run randomly during the system output interval, so that the system sharing the initial database becomes unsynchronized after running for a period of time. The system can adjust the parameters to generate a random sequence of the required length. The system does not have high requirements for the randomness of the initial data. Under the correct design and standardized use, the system will gradually output randomness to a sequence that is absolutely random.

Basic parameters: sequence format, database size, encoding length; diversity parameters: algorithm, database regeneration mode, etc.

3. A fully replaceable standard mode key controllable and ordered generation system.

1) Database, including: the main database, composed of 65,536 undisclosed random numbers with a length of 4096 (4K) and an element value range of 256. The number of elements in the sequence is represented by 1 byte of information, and the amount of information in each sequence is 4Kb. The seed sequence number is numbered from 0 to 65535, and the number occupies 2 bytes of information; using 4Kb encoding, a secondary sequence is generated from 2048 seed sequences; the encoding database has the same format as the main database, and contains 65536 codes, numbered from 0 to 65535; Another buffer database of the same format; the database capacity is 768Mb;

2) The algorithm extracts a set of 2048 seed sequences in sequence from the main database based on the encoded information and numbers them from 0 to 2047; multiplies the selected seed sequence by the value 2n + 1, where n is the corresponding number of the seed sequence in this group , And then generate a secondary sequence by sequence addition;

3) Extract the codes sequentially from the encoding database to generate the secondary sequence 1; use the sequence in the main data as the code, extract the codes sequentially, use the sequence in the encoding database as the seed sequence, and generate the secondary sequence 2. The code is not reused. The elements of the odd sequence numbers of the two secondary sequences are combined into a sequence number as a key, and the generated sequence number is used to mark, and the elements of the even sequence numbers are combined into a number sequence, which are sequentially stored in the buffer database;

4) After the 65535 code in the coding database is used, the information in the coding database is emptied as a buffer database, the main database is changed to the coding database, the buffer database is changed to the main database, and the orderly regeneration of the database is automatically completed, and then returns to step 3);

5) Loops 3) and 4) continue to generate keys.

4. A controlled and orderly generation system of keys in an unconditional security mode.

1) The database consists of 1048576 (1M) undisclosed random number sequences with a length of 65536 (64K) and an element value range of 256. The sequence elements are represented by 1 byte of information, and the amount of information in each sequence is 64Kb, which is defined as an information unit. Numbering from 0 to 1048575, each number occupies 2.5 bytes of information, and the database capacity is 64Gb;

2) sequentially extract an information unit from the database as a key, and use it to generate a serial number or number identification.

The generated key information is independent of each other. It is an unconditional security key. One-time use of encrypted equivalent file information can generate unconditional secure ciphertext. The total amount of unconditionally secure file information that the system can transmit is equal to the database capacity.

Basic parameters: sequence format, database size.

5. A controllable and ordered generation system of keys in dilution mode.

1) Database. The database consists of 1048576 (1M) undisclosed random number sequences with a length of 65536 (64K) and an element value range of 256. The number of elements in the sequence is represented by 1 byte of information, and the amount of information in each sequence is 64Kb. It is defined as a seed. Number sequence; each seed sequence is sequentially divided into 16 dilution series with a length of 4096, the total number of dilution series is 16M, and the numbers are sequentially numbered, each number occupies 3 bytes of information; the database capacity is 64Gb;

2) The algorithm repeatedly arranges the dilution sequence 16 times to generate a 64Kb secondary sequence. It uses modular operation with an undisclosed random number sequence of the same format fixed in a system to cover the repeatability and generate a key;

3) Extract the dilution series in sequence from the database, generate the key, use it to generate the serial number identification, and the dilution series is not reused;

The generated key information is independent of each other and the information density is reduced. The same amount of encrypted file information is used at one time. The ciphertext of the required key strength can be generated by adjusting the length of the diluted sequence. The system can safely transfer files larger than the database capacity. Information, so that the way of exclusive shared database information can be updated in cipher text to achieve sustainable and secure communication.

Basic parameters: sequence format, database size, dilution factor; diversity parameters: division method of dilution sequence, dispersion algorithm, etc.

6. An orderly generation system of unpredictable secondary sequence of security mode.

1) database, the format of the sequence is 65536 (64K), the element value range is 4096, and the amount of information is 96Kb; including: a) the main database, which contains 4096 seed sequences, numbered from 0 to 4095, and the number of information is 1.5 bytes; 24-byte combination coding, corresponding to 16 seed sequence numbers, the first 16 elements of each seed sequence form the working code, and the last 16 elements form the database update code, the number is consistent with the seed sequence; each group of 24 byte iteration parameters is used 6 elements are composed of 16 to 111 elements of each seed sequence, a total of 24,576 sets of iteration parameters; b) a dilution database containing 65536 sequences, each sequence is sequentially divided into 16 6Kb information-rich dilution sequences, the total number of which is 1048576 (1M), numbered from 0 to 1048575. Database capacity is about 6.4Gb;

2) Define a control template algorithm. The control sequence and the template sequence are involved in the operation. The value m of the n element in the control sequence is used as the sequence number. The m element in the template sequence is extracted and used as the element n in the new sequence to generate a template sequence. Freshman sequence of the same format;

3) Define the combined quasi-key generation algorithm. Generate a quasi-key from 16 seed sequences; extract a set of 4 seed sequences from the main database in sequence according to the encoded information, multiply the first sequence by a constant 15 and add it to the second sequence to generate a template sequence; Combine the elements of the same sequence number in the third and fourth sequence with 1 byte each in order to form an element to generate a control sequence with a sequence length and element value range of 65536; the above sequence generates a temporary through the control template operation Sequence; generate 4 temporary sequence from 1 encoding in the same way, cycle through the above process, and finally generate a combined quasi-key;

4) Iterative algorithm library, select 16 groups of independent algorithms: y = x ³ , log ₂ (x), x ^1/3 , x ^1/2 , x ^2/3 , x ^3/4 , log ₃ (x) , X ^4/3 , x ^3/2 , x ^5/3 , x ^7/4 , log ₁₀ (x), x ^7/3 , x ^5/2 , x ^8/3 , x ^11/4 , where x is Enter the value, y is the calculation result, each algorithm is assigned a certain number from 0 to 15;

5) Iteration parameters, each group of parameters includes an 8-digit hexadecimal initial input value (4 bytes of information), an algorithm number (0.5 bytes), and a group of 2 length and element values. A 16-number sequence of information distribution parameters (16 bytes), a 7-digit hexadecimal value (3.5 bytes of information) of a dynamic iteration parameter; the parameter information amount of 24 bytes, each iteration outputs 4 bytes of information;

6) Iterative quasi-key generation, extract a set of iteration parameters, add the corresponding dynamic iteration parameters to the input value, and generate an operation value through the corresponding numbering algorithm; select 4-19 digits of the third power operation, the 1 to 16 significant digits after the decimal point are the extraction interval to form a sequence; according to the extraction sequence in the information distribution parameter, the significant sequence corresponding to the element value is sequentially extracted from the extraction interval to form a sequence, and then a modular operation is performed with the template sequence to generate a sequence. For the sequence of the same format, the first half of the elements generates an iterative value to replace the input value in the parameter information of the group, and the dynamic iteration parameter value is increased by 1, and the second half is used as the output sequence; 24576 groups of iteration parameter extraction and calculation are completed in order. And update, the output sequence is combined into an iterative quasi-key;

7) Key generation, the system sequentially extracts the working code to generate a combined quasi-key, and the code is not reused; the diluted sequence is sequentially extracted, and it is repeatedly arranged 16 times to expand into a diluted quasi-key of 65536 in length and the diluted sequence Do not reuse; orderly generate iterative quasi-keys; use the modulo operation on the above 3 quasi-keys to generate a key, and use it to generate a serial number identifier;

8) After the working code No. 4095 is used, the system starts to sequentially extract the database update code, generate 4096 secondary sequence numbers from the current main database, replace the original main database in an orderly manner, and complete the main database update spontaneously;

9) After the update of the main database is completed, the system continues to generate the secondary sequence until the number in the diluted database is exhausted, and the main database is automatically updated 255 times throughout the process.

The dilution database in the above system is a one-time database, and the number of one-time keys that can be generated is 1M, which can securely exchange 96Gb ciphertext information, which is greater than the amount of about 6.4Gb information in the database. The communicating parties securely exchange the shared database updates through the undisclosed random sequence of 6.4Gb new sources in cipher text, and the remaining part is used to securely exchange file information to achieve sustainable and secure information exchange. During operation, the system can automatically exchange database update information according to settings to achieve system self-maintenance.

Basic parameters: sequence format, main database size, diluted database size; diversified parameters: key generation method, dilution factor, algorithm, database update method, etc.

7. An Information Security Software and Encryptor Design Example

According to the digital key controllable and orderly generating device design scheme in Application Examples 1-6, the generated key is used as a one-time key to encrypt the file to generate the ciphertext, and the reverse process is used to decrypt the ciphertext to organize various elements Together, a computer program is generated to complete key generation, information encryption-decryption, transfer, and system maintenance spontaneously under the control of the computer, to achieve continuous and automated information security transfer, and to become an information security software; Personalize the design and initialize the database based on the input of unpredictable information, similar to the structure shown in Figure 7 above, and design an exclusive encryptor; it includes the following key units:

1) Algorithm library, including various secondary sequence generation algorithms, key generation methods, encryption algorithms, etc., arrange the algorithms in order to form an algorithm library for the program to retrieve; as an option, a random number sequence generation program, using Generate random information from new sources for initialization or update of the encrypted database;

2) The control unit plans the structure of the encrypted database, connects the algorithm database and the database, and generates a one-time key in a controlled and orderly manner through the sequence control module. It automatically completes encryption-decryption and system maintenance updates to form a black box system. Users rely on only a few instructions and buttons to complete program initialization and automatic safety information transmission;

3) The user interface, which prompts the user to select the key generation device type through the selection module. The optional types include the above-mentioned standard mode, iterative mode, unconditional security mode, dilution mode, security mode, etc., and new device types can be developed; Type of key generation device, prompting the user to set basic parameters such as key format and main database size, as well as other diversity parameters; according to the selected parameters, the computer plans the database, prompts for input information, builds a database of corresponding structure and size, and completes data initialization Or update

The above software system combines the formatting unit and the input and output unit to form the public part of the encryptor. According to specific requirements, the software parameters are set through the user interface, and the computer prompts the user to enter exclusive unpredictable information to complete the database initialization or update according to the parameter settings. Describe the exclusive encryptor of the structure shown in Figure 7;

Basic parameters: key generation device type, sequence format, main database size, diluted database size; diversified parameters: key generation method, dilution multiple, algorithm, cipher text organization method, control process, database update method, key distribution method Wait.

With the above software and encryptor, and through appropriate parameter settings, the following typical information security systems are constructed.

8. A data security storage system.

The key to a secure data storage system is the long-term traceability of the key. The system retains the initial encrypted database or the foremost updated database involved as the starting point for system synchronization and deduction; divides the key generation number by the number of key generations during each database update, and determines the number of database updates by the quotient. The computer derives the corresponding database, determines the corresponding work code number from the remainder, and extracts the random code of the corresponding number to generate the corresponding serial key.

Software parameters: standard mode; 20Kb key, element value range 1024; 20Mb main database, 1024 seed sequences; 16 seed sequences generate a secondary sequence, 20-byte encoding.

For example, the maximum number of times that the computer can update the database can be set to 256 times. The current conventional personal computer's memory and computing power can complete the above calculations within a reasonable time. Then, 5Gb encrypted files can be saved during the database backup; the interval is 256. Update the database backup of the generation and label the algebra to improve the deduction efficiency. The encrypted file information that can be saved at the same time is 256 times the information of the encryptor database. When the calculation time allows, the capacity of the ciphertext information that can be saved at the same time will not be affected. limit.

The encryption method is simple and straightforward. Generate the key sequentially, encrypt the formatted information to generate the main ciphertext, use the key generation serial number as the title and the main ciphertext to form the ciphertext, and store it securely through the public storage device; use the same encryption database according to the ciphertext title Generate the same key and decrypt the file.

Through the information security storage system, you can make full use of a variety of storage systems, including Internet storage platforms, to securely back up files in cipher text and access them as needed.

9. An information security transmission system.

The key to the safe transmission of intelligence is that the key information is not leaked. The most secure way is that after the ciphertext is sent, the key is not traceable except for the target receiver, including the ciphertext sender himself.

Software parameters: standard mode; 80Kb key, element value range 1024; 80Mb main database, containing 1024 seed sequences; 64 seed sequences generate a secondary sequence, 80-byte encoding.

The file owner generates a key in order, encrypts the file, organizes the ciphertext, deletes the encoding used, and sends the ciphertext; the target ciphertext receiver securely obtains the file information, deletes the corresponding encoding, and notifies the sender; if the database is synchronized, the two parties in the communication Update database information and erase irrelevant information in time to ensure that the history of the encryption process cannot be traced.

The 80-byte long encoding can ensure that even after the entire encryption system is hijacked, unauthorized persons cannot recover the key by brute-force cracking (the number of attempts is 256 ⁸⁰ ) within a reasonable time based on the existing information.

10. A real-time secure communication system.

The key to real-time communication is the fast encryption-decryption process, which ensures that the exclusive shared database can be synchronized without requiring special traceability of the key. Shorter keys and codes are used, and smaller-scale databases are used.

Software parameters: standard mode; 2Kb key, element value range 256; 512Kb main database, 256 seed sequences; 8 seed sequences generate a secondary sequence, 8-byte encoding.

A database of the above-mentioned size can be easily inserted into commonly used communication equipment. Correspondents can share encrypted databases face-to-face exclusively, as additional information of contacts in the address book, to achieve secure communication through encrypted software.

Real-time communication requires application software to quickly and continuously encrypt and decrypt digital multimedia information such as text, audio and video. For example, processing 32 2Kb ciphertext per second can ensure high-quality multimedia real-time communication. In the real-time communication encryptor, a modem coupled with a formatting unit is integrated with a multimedia digital signal conversion module of a communication terminal device, as a standard configuration of the communication terminal device, and realizes technically instantaneous and secure communication without delay.

Address book members use secure communication as the default communication mode. When a call is made, the communication device automatically connects to the corresponding encrypted database to achieve real-time encrypted communication. Correspondents can regularly and securely update the exclusive shared database when they meet to enhance their sense of security. According to the current portable communication device storage configuration, there can be thousands of secure communication partners on each communication device, and the number of secure communication partners can be considered unlimited.

11. A digital signature and information integrity verification system.

The communication principals who establish a secure connection through an exclusive shared encrypted database also establish an undeniable direct authentication relationship. If the communication subject has different exclusive and secure communication partners, a network will be formed. The communication subject relies on network nodes, that is, "acquaintances" who know each other as a guarantee, to establish an indirect identity verification relationship.

According to the concept of "acquaintance", a public "acquaintance" recognized by the public and having legal or administrative authority, that is, a certification center, can act as a guarantee intermediary to establish a legally valid digital identity verification system.

1) Establish a digital identity authentication center that is publicly recognized and has legal or administrative authority;

2) Software parameters: standard mode; 1Kb key, element value range 256; 256Kb main database, 256 seed sequences; 4 seed sequences generate a secondary sequence, 4 byte encoding; digital signature key space 256 ¹⁰²⁴ ;

3) An individual becomes a registered user by exclusively sharing a digital signature database with a digital identity verification agency to obtain an identity identification number. A total of 8 billion registered users worldwide need 2048Tb of storage;

4) Use the entire digitized file information as a number, that is, the corresponding sequence value; the sender of the file uses his registration database information to generate a signature key, and multiply the corresponding sequence value by 2 and 1 to add the two ends of the binary number. A 1, as a divisor, divided by the file sequence value, and then taking the remainder to generate a sequence as a signature; the signature information can be displayed in the corresponding physical document in the form of a multimedia signature such as two-dimensional code, audio and video noise, and the signature Information such as the serial number of the signing key, the name of the sender, the name of the certification center, the personal identification number, and the date are also marked for query confirmation; the marked information can be displayed using standard entities such as printed text and machine sounds, and the sender's Writing, recording or video signature, etc., together with the multimedia signature, form a physical signature;

5) The verifier sends the marked information to the certification center. The certification center connects to the signer database to generate the corresponding signature key and sends it to the verifier. The verifier uses the same rules to generate digital signature information, compares it with the corresponding signature information, and determines The legitimacy and data integrity of the information source;

6) Agree on the maximum number of database deductions. For example, 256 deductions will allow registered users to maintain 65536 digital signatures to be verified, and ensure that the shared database is updated on a regular basis on a synchronized basis.

In the above digital identity verification system, the file owner provides both signature information and label information (signing key generation sequence number), and the recipient of the file decides whether to verify the legal source of the information, forming an asymmetric digital signature system dominated by the recipient of the file; The owner can choose to use the signing key as a password to encrypt the file information. The recipient of the file obtains the signing key from the certification center to decrypt the corresponding file according to the marked information, and then verifies the digital signature to form a symmetrical digital signature system that can be traced by both sending and receiving parties. .

12. A global security communications system.

Using the peer-to-peer information transfer function in the digital signature system, the registrant can share the encrypted database information exclusively and securely with the certification center as a medium, establish a secure communication connection, and realize secure communication between non- "acquaintance" registered members;

The communication subject completes registration through a unique identification number, similar to a mobile phone number, and exclusively shares an encrypted database with the communication control center, becoming a registered user. 4096Tb storage can meet the needs of 8 billion users worldwide.

Registered users apply to the communication control center. The communication control center generates the required shared encrypted database information, which is encrypted with the encrypted database shared by the applicant and the control center, and then transmitted to the applicant in cipher text to realize the encrypted database in the applicant. Exclusive sharing between them, establishing a secure communication connection. The communication control center is only responsible for the transfer task, and the information transfer load carried by each transfer is only 512Kb, which is equivalent to a few seconds of call volume, which greatly reduces the workload of the communication control center. During the whole process, all parties to the communication do not contact the encrypted database of the other party; the encrypted database of the parties to the communication remains secure in the absence of information leakage during the communication control center and transfer process.

After the secure communication, the two parties of one-to-one communication can agree to retain the shared information and become "acquaintances". After that, they can directly conduct secure communication without transferring.

13. A network authentication system.

Changing the central control structure of the digital identity verification system or global network communication system into a branched structure can effectively decentralize the information transfer workload of the control agency in order to establish a secure communication directly between the branch control agency and registered users A full-coverage network identity verification system that effectively traces all incoming information.

Software parameters: standard mode; 1Kb key, element value range 256; 256Kb main database, 256 seed sequences; 4 seed sequences generate a secondary sequence, 4 bytes encoding.

Using the existing network branch structure, the communication subject shares the encrypted database with the nearest network management organization (network management), obtains the identification number, and becomes a registered user; the current network management backs up the shared information to the branch network management to which the registered user belongs, until Global Network Management Center. The above-mentioned encryptor including the registered encrypted database will become an Internet pass for registered users, which can be built into the network card as a standard plug-in for the modem.

The sender uses the network card to sequentially generate the key to encrypt the information in a set of 1Kb. The key generation sequence number is used as the subtitle. The 3-byte subtitle can hold 16M keys at the same time and cache 16Gb information. Header to generate a packet slightly larger than 1Kb. The end network administrator connects the sender's encrypted database according to the packet header and subtitle, retrieves the corresponding key, and directly decrypts the ordinary information (the decrypted information can be cipher text). The subtitle is replaced with the end network management identification number and converted into legal information. Release. The header line of legal information contains the sender's and end network management identification numbers, so that the source of the information can be traced back; illegal information becomes garbled through the above conversion. If the information packet is marked as registered, the end network administrator re-encrypts the information with its own encryptor after verifying the information, adds the sender and each level of network management identification number, and verifies, re-encrypts, and releases the information step by step until the receiver's end network management uses the accept The network card key of the user is encrypted to complete the information transmission, ensuring that the information transmission chain is complete and traceable.

In order to support remote Internet access, except at the end of the registered communication address, all levels of network administrators from the end to the global network management center will permanently store the encrypted database of registered users. When the end network administrator receives a request from a remote user for the first time, he will use the global network management center to sequentially The network managers at all levels of the network management back up the user's encrypted database and establish temporary connections, making remote communication as convenient as local communication, and can reasonably charge a one-time transfer fee. As a convention, each branch network administrator allocates appropriate buffer storage space to store the encrypted database of users in different places; after the buffer storage is exhausted, free up space for new users in accordance with the first-in, first-out principle to avoid frequent data handling and reduce the cost of remote communication ; The end network management of hot tourist areas can appropriately increase storage space and reasonably increase communication prices.

The above-mentioned entire information transfer process is automatically completed by the network card, and the user cannot feel it. Because the information processing is mainly completed by the end network management, and the effective information content in the information packet is close to 100%, under normal circumstances, it has little effect on the transmission speed of ordinary information, and the registered information may be congested when the upper-level network management is overloaded.

The above network identity verification system has both network communication and digital identity verification functions.

14. A military security communication system.

Software parameters: security mode, keys are generated by combining quasi-keys, iterative quasi-keys and diluted quasi-keys; 96Kb keys with element values ranging from 4096; 384Mb main database with 4096 seed sequences; 6Gb dilution database with dilution multiples 16; Encrypted database capacity is 6.4Gb.

The above-mentioned software and the encrypted database determined by the encrypted database are made into a USB military identification card. A copy of the encrypted database is stored centrally in the headquarters, and one copy is stored in the headquarters of the military at all levels. The identification tag is carried by soldiers as the final proof of their active status. The headquarters regularly updates relevant information according to personnel changes to ensure information security and smooth communication. 2.56 million soldiers need 16Pb of headquarters storage capacity.

When communicating, the identification card of the person in charge of the army's telecommunications will become the default encryptor for orders given by the higher-level organization to the army. Set different levels of security according to the confidentiality of the command.

Secret files, marked AA, are encrypted and decrypted using the encrypted database of the person in charge of the telecommunications department. The title of the cipher text includes the troop number and key generation serial number.

Confidential documents, marked as AAA. The encrypted database of the person in charge of the army telecommunications and the head provides the combination and iteration of quasi-keys, dilution of quasi-keys, generation of keys, and encryption of files. The cipher text title is based on AA grade, and the head of the unit is diluted with the quasi-key number as the subtitle. When the transceiver receives the AAA-level ciphertext, it reports to the head, and under common witness, generates a key and decrypts the ciphertext; using the same procedure to report the AAA-level ciphertext. AAA-grade ciphertexts can also be used to direct orders directly to specific soldiers in the troop's telecommunications room in a similar manner in accordance with organizational procedures. Similarly, AA-level cipher text can be used to communicate or report direct orders of superiors and each soldier of the affiliated army.

Top-secret documents, defined as AAAA. The combined quasi-key is generated using the encrypted database of the person in charge of the army telecommunications, and the iterator quasi-key is generated by the encryptor of the army leader. The two soldiers of the affiliated army are randomly selected and ordered, and eight consecutive dilution series are selected from their dilution database. A high-information-density sequence that is combined with a combination and iterative quasi-key to generate an unconditional security key. The title of the cipher text is based on the AAA grade, adding the military identification number and the corresponding serial number of the first dilution. When the transceiver received the AAAA ciphertext, it reported to the head of the army, convened the corresponding soldiers, and collectively witnessed to generate a key and decrypt the ciphertext.

High-class documents can ensure that even in extreme cases where military personnel's USB identification plate information is leaked in key locations and a small number of personnel in the army are held hostage or counter-insured, the command is still transmitted to the greatest extent possible. The program also provides an irregular confirmation method under the witness of the core members of the army to ensure that in the army that is isolated from the headquarters to perform top-secret tasks, the military USB tag is held by a legal person.

The above scheme can also be used to build police and diplomatic security communication systems. After adjustment to ensure that the required security standards are met, banks, governments, and commercial security communication systems will be built by simplifying relevant procedures and improving efficiency.

15. An unconditional and secure information exchange system.

Software parameters: basic mode; 16Kb key, element value range 256; 256Gb main database, 16M information unit.

The unconditional security key that is generated in a controlled and orderly manner is used to encrypt the file information with the same amount of information to generate an unconditional security ciphertext. An exclusive shared encrypted database is used to establish a secure connection to achieve unconditional secure communication.

The shared encrypted database can meet the unconditional secure information exchange of a certain information exchange density for a long period of time between the communicating parties. For example, using high-quality audio or ordinary quality video communication with 1Mb of information per minute, 256Gb shared information can meet 250,000 minutes and about 4,000 hours of communication, which is equivalent to 2 years of uninterrupted working communication.

The above storage requirements can be realized in conventional mobile hard disks. The rapid development of high-density data storage technology will bring greater convenience and more application space to the above-mentioned unconditional security information exchange.

The above system is used for military security communication. It uses 10Pb central storage device to serve 40,000 end users, and promotes the unconditional and secure information security system to even the first-level grass-roots telecommunications institutions. At the same time, the one-time security keys with the same information volume are dispersed It is stored in the USB identification card of each soldier, for example, a 4Gb one-time security key is stored in each soldier's USB identification card, which can realize unconditional and secure command transmission and confidential information reporting in high-density communication.

The foregoing outlines different aspects of a method of providing information required by a key generation device, an encryption device, a key generation and distribution system, an information security delivery system, and / or a method of implementing other steps through a program. The program part in the technology may be considered as a "product" or "article" in the form of executable code and / or related data, which is participated or realized through a computer-readable medium. The tangible, permanent storage medium may include memory or storage used by any computer, processor, or similar device or related module. For example, various semiconductor memories, magnetic tape drives, magnetic disk drives or similar devices capable of providing storage functions for software.

All software or parts of it may sometimes communicate over a network, such as the Internet or other communication networks. This type of communication can load software from one computer device or processor to another. For example: a hardware platform loaded from a server or host computer of an IoT system to a computer environment, or other computer environment that implements the system, or a system with similar functions related to providing information required by the IoT. Therefore, another medium capable of transmitting software elements can also be used as a physical connection between local devices, such as light waves, radio waves, electromagnetic waves, etc., and is transmitted through cables, optical cables, or air. The physical medium used for carrier waves, such as electrical cables, wireless connections, or fiber optic cables, can also be considered as the medium that carries the software. As used herein, unless tangible "storage" media is restricted, other terms referring to computer or machine "readable media" refer to media that participates in the execution of any instruction by a processor.

A computer-readable medium may take many forms, including tangible storage media, carrier wave media, or physical transmission media. Stable storage media may include: optical disks or disks, and storage systems used in other computers or similar devices that can implement the system components described in the figures. The unstable storage medium may include dynamic memory, such as the main memory of a computer platform. Tangible transmission media may include coaxial cables, copper cables, and optical fibers, such as the lines that form a bus inside a computer system. The carrier wave transmission medium can transmit electrical signals, electromagnetic signals, acoustic signals or light signals. These signals can be generated by radio frequency or infrared, visible light, and acoustic data communication methods. Common computer-readable media include hard disks, floppy disks, magnetic tapes, any other magnetic media; CD-ROM, DVD, DVD-ROM, any other optical media; punch cards, any other physical storage media containing a small hole pattern; RAM, PROM , EPROM, FLASH-EPROM, any other memory chip or tape; carrier wave for transmitting data or instructions, cable or connection device for transmitting carrier wave, any other program code and / or data that can be read by computer. In the form of these computer-readable media, there are many ways in which a processor executes instructions and passes one or more results.

"Module" in this application refers to logic or a set of software instructions stored in hardware, firmware. The "module" referred to herein can be executed by software and / or hardware modules, or stored in any kind of computer-readable non-transitory medium or other storage device. Modules can be implemented by sub-circuits. In some embodiments, a software module can be compiled and linked into an executable program. Obviously, the software module here can respond to the information passed by itself or other modules, and / or can respond when certain events or interruptions are detected. A software module may be provided on a computer-readable medium, and the software module may be configured to perform operations on a computing device (e.g., the processor 220). The computer-readable medium herein may be an optical disk, a digital optical disk, a flash disk, a magnetic disk, or any other kind of tangible medium. Software modules can also be obtained through the digital download mode (the digital download here also includes the data stored in the compressed package or installation package, which needs to be decompressed or decoded before execution). The code of the software module herein may be partially or wholly stored in a storage device of a computing device that performs an operation, and applied to the operation of the computing device. Software instructions can be embedded in firmware, such as erasable programmable read-only memory (EPROM). Obviously, a hardware module may contain logic units connected together, such as gates, flip-flops, and / or programmable units, such as a programmable gate array or processor. The functions of the modules or computing devices described herein are preferably implemented as software modules, but may also be represented in hardware or firmware. In general, the modules mentioned here are logical modules and are not limited by their specific physical form or memory. A module can be combined with other modules or separated into a series of sub-modules.

Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs. It should also be understood that terms such as those defined in ordinary dictionaries should be interpreted as having meanings consistent with their meaning in the context of the relevant technology, and should not be interpreted in an idealized or extremely formal sense unless explicitly stated here Land is so defined.

The above is a description of the disclosure and should not be considered as limiting it. Although several exemplary embodiments of the present disclosure have been described, those skilled in the art will readily understand that many modifications can be made to the exemplary embodiments without departing from the novel teachings and advantages of the present disclosure. Accordingly, all such modifications are intended to be included within the scope of this disclosure as defined by the claims. It should be understood that the above is a description of the present disclosure and should not be considered to be limited to the specific embodiments disclosed, and modifications to the disclosed embodiments and other embodiments are intended to be included within the scope of the appended claims. This disclosure is defined by the claims and their equivalents.

Claims

A key generation device includes:

A system information module configured to store system information of the key generation device;

A key generation module configured to sequentially and controllably generate unpredictable information as a key based on the system information, and use its generated serial number as the corresponding key serial number; and

The transmission module is configured to send the key serial number to a paired key generation device, wherein the paired key generation device stores second system information corresponding to the system information.
The key generation device according to claim 1, wherein the system information module further comprises:

A control module configured to control the generation of unpredictable information;

Database module configured to store unpredictable information;

According to the control of the control module, the key generation module relies on the information in the database module to controllably and orderly generate unpredictable information as a key, and uses its generated serial number as the corresponding key serial number.
The key generation device according to claim 1, wherein the system information module further comprises:

A control module configured to control the generation of unpredictable information;

Dynamic information module configured to provide pending input information;

An information processing module configured to convert input information provided by the dynamic information module into generated information with an expanded amount of information through a predetermined algorithm according to the control of the control module, and extract part of the information from the generated information as unpredictable information for generating The key and other unpredictable information are provided as feedback information to the dynamic information module to keep it stable and updated.
The key generation device according to claim 3, wherein the dynamic information module includes an input information sub-module configured to receive unpredictable information as initial input information,

The information processing module converts the input information into generated information that can be expanded by an amount of information determined by the input information through an iterative information processing method, and extracts a first portion of the non-overlapping portion from the generated information in an equal amount as the input information in a predetermined manner. The information is fed back to the input information sub-module as iterative information as input information for the next step, and the second part that does not overlap with each other is extracted as unpredictable information for generating a key.
The key generation device according to claim 3, wherein the dynamic information module includes a database submodule configured to store a predetermined amount of unpredictable information,

According to the control of the control module, the information processing module relies on the information in the database submodule to controllably and orderly generate a predetermined amount of unpredictable information as a key, and uses its generated serial number as the corresponding key serial number, and then generates another The unpredictable information is fed back to the database submodule as database regeneration information to update the information in the database submodule,

The information processing module continues to generate keys based on the information in the updated database submodule.

The control module controls the information input, generation, distribution, output, and database regeneration of the database sub-module and the information processing module to cycle the database sub-module information update and key generation process.
The key generation device according to claim 5, wherein the database submodule comprises a main database storing a predetermined number of unpredictable information units, and a coding database formed by coding a predetermined number of unpredictable information, wherein the number of codes is Greater than the number of unpredictable information units stored in the database submodule,

The control module sequentially extracts the encoding from the encoding database, and extracts the multiple information units corresponding to the encoded information from the main database according to the information in the encoding, and passes the information to the information processing module as a set of input information. reuse,

The information processing module combines a group of input information to generate a secondary information.

The information processing module generates a predetermined number of secondary information as unpredictable information for generating keys according to the information in the current database submodule, and uses the generation number of each unpredictable information as the corresponding key number, and sequentially updates the control module Serial number control information,

After using the information in the current database sub-module to generate the predetermined number of keys, the information processing module generates the same amount of secondary information as the number of unpredictable information stored in the database sub-module as database regeneration information and feeds it back to the database sub-module to Update the information in the database submodule,

The information processing module continues to produce keys based on the information in the updated database submodule,

Cyclic database submodule update and key generation process.
The key generation device according to any one of claims 3 to 6, wherein an irreversible one-way algorithm is used in the information processing process, and the irreversible one-way algorithm generates the determined key information and feedback information according to the input information, but The number of possible values of the reasonable input information calculated according to the key information or the feedback information is equivalent to the information space of the key, so the input information and dynamic information cannot be determined or detected.
The key generation device according to claim 1, wherein the transmission module is further configured to receive a key sequence number from the paired key generation device,

The key generation module is further configured to generate a decryption key corresponding to the second key number based on the system information based on the second key number received from the paired key generation device.
An encryption and decryption device includes:

The key generation device according to any one of claims 1-8, configured to controllably and orderly generate a one-time key, wherein the control module adds parameters and functions as a control module of the encryption device;

Input port, configured to read or enter data to be encrypted;

A formatting unit configured to convert the data to be encrypted input from the input port into a formatted plain text that matches the key format;

An encryption module configured to convert the formatted plain text generated by the formatting unit into a main cipher text using the one-time key that is controllably and orderly generated by the key generation device, and use the serial number of the one-time key as the cipher text title To merge the main ciphertext and the ciphertext title to generate the ciphertext;

The sending port is configured to send the generated ciphertext to a paired decryption device.
The encryption and decryption device according to claim 9, further comprising:

A receiving port configured to receive a ciphertext sent from a paired encryption device;

A decryption module configured to parse the received ciphertext to extract the key sequence number in the ciphertext title, and use the key generation device to generate a decryption key corresponding to the key sequence number according to the key sequence number, and use the decryption The key is used to decrypt the ciphertext to generate the decrypted plaintext;

The formatting unit is further configured to convert the decrypted plain text into restored data;

An output port configured to output the restored data.
A key generation and distribution system, comprising a paired first key generation device and a second key generation device according to any one of claims 1-8, wherein

The first key generation device includes:

A first system information module configured to store first system information of the first key generation device;

A first key generation module configured to controllably and orderly generate unpredictable information as the first key, and use the generated serial number as the corresponding first key serial number according to the first system information;

A first sending module configured to send the first key serial number to a second key generating device,

The second key generation device includes:

A second system information module configured to store second system information of the second key generation device, the second system information being the same as or corresponding to the first system information;

A second receiving module configured to receive a first key sequence number sent from the first sending module;

A second key generation module configured to generate a second decryption key corresponding to the first key number according to the second system information according to the first key number received from the second receiving module .
The key generation and distribution system according to claim 11, wherein:

The second key generation module further controls the orderly generation of unpredictable information as the second key according to the second system information, and uses its generated serial number as the corresponding second key serial number;

A second sending module configured to send the second key sequence number to the first key generating device,

The first key generating device further includes a first receiving module configured to receive a second key sequence number sent from the second sending module,

The first key generation module further generates a first decryption corresponding to the second key sequence number through the first system information according to the second key sequence number received from the first receiving module. Key.
An information security transfer system includes a paired first communication device and a second communication device, wherein

The first communication device includes:

The first key generation device according to any one of claims 1 to 8, configured to controllably and orderly generate a one-time key as the first key;

A first input port configured to read or input first data to be encrypted;

A first formatting unit configured to convert the first to-be-encrypted data input from the input port into a first formatted plaintext having the same key format;

A first encryption module configured to convert the first formatted plain text into a first main cipher text by using a first key generated by a first key generation device, and using a generation number of the first key as a first secret Text title, combining the first main ciphertext and the first ciphertext title to generate the first ciphertext;

A first sending port configured to send the generated first ciphertext to a second communication device,

The second communication device includes:

The second key generation device according to any one of claims 1-8, configured to controllably and orderly generate a one-time key as the second key;

A second receiving port configured to receive a first ciphertext sent by a first sending port;

A second decryption module configured to parse the received first ciphertext to extract a first key sequence number in a first ciphertext header, and generate the first key sequence number according to the first key sequence number by the second key generation device Corresponding to the second decryption key, using the second key to decrypt the first ciphertext to generate a second decrypted plaintext;

A second formatting unit configured to convert the second decrypted plaintext into second restored data;

The second output port is configured to output the second restoration data.
The information security transfer system according to claim 13, wherein

The second communication device includes:

A second input port configured to read or input a second data to be encrypted;

The second formatting unit is also configured to convert the second to-be-encrypted data input from the second input port into a second formatted plain text that matches the key format;

A second encryption module configured to convert the second formatted plain text into a second main cipher text by a second key that is controllably and orderly generated by the second key generation device, and convert the second key The second key sequence number is used as the second ciphertext title, and the second main ciphertext and the second ciphertext title are combined to generate a second ciphertext;

A second sending port configured to send the generated second ciphertext to the first communication device,

A first receiving port configured to receive a second ciphertext sent by the second sending port;

A first decryption module configured to parse the received second ciphertext to extract a second key sequence number in the second ciphertext header, generate a sequence number based on the second key, and pass the first key generation device Generating a first decryption key corresponding to the second key sequence number, and using the first key to decrypt the second ciphertext to generate a first decrypted plaintext;

The first formatting unit is simultaneously configured to convert the first decrypted plain text into the first restored data;

The first output port is configured to output the first restoration data.