This isn't security through obscurity

This isn't security through obscurity at all. In "security through obscurity" you're trying to hide how the system is designed, under the theory that no one could ever find out (ha!). This doesn't try to hide the design at all; here, you're countering an attacker even if the attacker knows this is going on (hopefully). Using unknown, easily-changed data to make a system hard to attack is well-accepted; passwords and crypto keys are also based on this idea.