A method and system for implementing a secure and easy-to-use file vault based on eCryptfs

Abstract

This application discloses a secure and easy-to-use file vault implementation method and system based on eCryptfs. The user inputs a first string as the input password (bPassword); a random password (ePassword) is generated, which is used for encrypting or decrypting files using eCryptfs; ePassword and bPassword are concatenated to form "ePassword+bPassword"; bPassword is used as a key to encrypt "ePassword+bPassword" and stored in a database; and a random passphrase is generated and used as a key to encrypt bPassword and stored in the database. In this application, passwords and passphrases are controlled in the form of keys, and plaintext passwords and keys are not stored in the database, ensuring security.

Description

Technical Field

[0001] This application belongs to the field of data security, specifically involving a method and system for implementing a secure and easy-to-use file vault based on eCryptfs. Background Technology

[0002] In the Linux operating system, file encryption is an important data protection technology. To meet users' needs for file security, Linux provides a variety of encrypted file system solutions, such as EncFS. These encrypted file systems provide a robust protection mechanism for user data by encrypting data at the file system level.

[0003] EncFS is an encrypted file system based on FUSE (Filesystem in Userspace), developed and open-sourced by Variable Gough. EncFS runs in user space, interacting with the kernel through interfaces provided by FUSE to encrypt and decrypt files. EncFS uses its own encryption algorithms, supporting multiple algorithms such as AES and BlueFish. Encryption keys are primarily derived from the user's password. EncFS's encryption method is relatively simple, focusing on providing basic file encryption functionality. Primarily aimed at individual users, EncFS offers a simple and easy-to-use encrypted file system solution.

[0004] These encrypted file systems primarily provide underlying file system encryption capabilities, but their usability is poor: 1) Since the password is used as the key to encrypt files, changing the password requires decrypting the file system with the original password, then resetting the encryption password, and re-encrypting the file system with the new password—a time-consuming and cumbersome process. Because this process requires decrypting the encrypted file system, other privileged users can steal the decrypted files, posing a security risk. 2) In cloud computing or cloud storage scenarios, a large number of users share computing and storage resources, making it impossible to uniformly manage the numerous encrypted file systems created by users. 3) If a user forgets the password, the file will be inaccessible.

[0005] Application content

[0006] To overcome the shortcomings of existing technologies, this application provides a secure and easy-to-use file vault implementation method and system based on eCryptfs. It can support changing the password of the file vault without decrypting the encrypted files; prevent other users from stealing files when accessing the file vault; provide the ability to manage the file vault in a unified manner; and allow password retrieval through methods such as password verification when the password is forgotten.

[0007] To achieve the above objectives, this application adopts the following technical solution:

[0008] A method for implementing a secure and easy-to-use file vault based on eCryptfs includes creating the file vault, wherein creating the file vault includes:

[0009] The user enters the first string as the password bPassword;

[0010] Generate a random second string as the password ePassword for eCryptfs, which is used to encrypt or decrypt files in eCryptfs;

[0011] Concatenate the ePassword and the bPassword to form the plaintext string "ePassword+bPassword";

[0012] Using bPassword as the key, encrypt the "ePassword+bPassword" and store it in the database; and

[0013] Generate a random third string as the password, and use the password as the key to encrypt the bPassword and store it in the database.

[0014] Furthermore, it also includes opening the file safe, which includes:

[0015] The user establishes a dbus connection to the backend service;

[0016] The user enters a first password;

[0017] Read the “ePassword+bPassword” and decrypt it using the bPassword, then verify whether the first password is the bPassword; and

[0018] If so, the file safe is opened, and when the user opens the encrypted file, the encrypted file is decrypted using eCryptfs via the ePassword, and the decrypted file is placed in the backend service.

[0019] Furthermore, it also includes deleting the file vault, wherein deleting the file vault includes:

[0020] The user establishes a dbus connection to the backend service;

[0021] The user enters a first password;

[0022] Read the “ePassword+bPassword” and decrypt it using the bPassword, then verify whether the first password is the bPassword; and

[0023] If so, delete the file safe.

[0024] Furthermore, it also includes changing the password of the file safe, wherein changing the password of the file safe includes:

[0025] The user enters a second password;

[0026] Read the “ePassword+bPassword” and decrypt it using the bPassword, then verify whether the second password is the bPassword;

[0027] If not, then changing the password is not allowed;

[0028] If so, a third password is allowed, which is then used as the new input password bPassword. The third password is also used as the key to encrypt the "ePassword + new input password bPassword" and store it in the database.

[0029] Furthermore, it also includes retrieving the password for the document safe, which includes:

[0030] The user enters the password;

[0031] Read the encrypted bPassword and decrypt the encrypted bPassword using the password to obtain the decrypted bPassword.

[0032] In addition, this application also provides a secure and easy-to-use file vault implementation system based on eCryptfs, including:

[0033] database;

[0034] eCryptfs; and

[0035] The service module is used to receive a first string input by the user as the input password bPassword; the service module is also used to generate a random second string as the password ePassword for eCryptfs, and the ePassword is used to encrypt or decrypt files in eCryptfs.

[0036] The service module is also used to concatenate the ePassword and the bPassword to form the plaintext string "ePassword+bPassword"; and to use the bPassword as a key to encrypt the "ePassword+bPassword" and store it in the database.

[0037] The service module is also used to generate a random third string as a password, and the service module is also used to encrypt the bPassword with the password as a key and store it in the database.

[0038] Furthermore, it also includes:

[0039] Backend services are used to establish a D-Bus connection with the user;

[0040] When the user enters the first password, the service module reads the "ePassword+bPassword" and decrypts it using the bPassword, verifying whether the first password is the bPassword; if so, the user opens the file safe.

[0041] When the user opens the encrypted file, the eCryptfs is also used to decrypt the encrypted file using the ePassword, and the decrypted file is placed in the backend service.

[0042] Furthermore, it also includes:

[0043] Backend services are used to establish a D-Bus connection with the user;

[0044] When the user enters the first password, the service module is also used to read the "ePassword+bPassword" and use the bPassword to decrypt it, and verify whether the first password is the bPassword; if so, the user deletes the file safe.

[0045] Furthermore, including:

[0046] When the user enters the second password, the service module is also used to read the "ePassword+bPassword" and use the bPassword to decrypt it, and verify whether the second password is the bPassword;

[0047] If not, the user is not allowed to change their password;

[0048] If so, the user is allowed to enter a third password. The service module is also used to use the third password as a new input password bPassword and the third password as a key to encrypt the "ePassword + new input password bPassword" and store it in the database.

[0049] Furthermore, including:

[0050] When the user enters the password, the service module is also used to read the encrypted bPassword and decrypt the encrypted bPassword with the password to obtain the decrypted bPassword.

[0051] Compared with the prior art, this application has the following advantages:

[0052] This application utilizes a key-based system to control passwords and passphrases, ensuring security by eliminating the storage of plaintext passwords and keys in the database. Password changes only require replacing the encrypted "ePassword+bPassword" string, eliminating the need for data encryption / decryption and ensuring both efficiency and security. Password retrieval is supported via passphrase. It also prevents other users from stealing files when accessing the file vault and provides centralized management capabilities for the file vault. Attached Figure Description

[0053] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments of the application and, together with their description, serve to explain the application, but do not constitute an undue limitation of the application. In the drawings:

[0054] Figure 1 A flowchart for creating a file vault for this application;

[0055] Figure 2 Example diagram for creating a file safe for this application;

[0056] Figure 3 Example diagram of opening the file safe in this application;

[0057] Figure 4 This is an example diagram illustrating the modification of the file safe password in this application;

[0058] Figure 5 Example diagram for retrieving the password of the document safe in this application;

[0059] Figure 6 Example diagrams for each operation of this application;

[0060] Figure 7 The framework of the system in this application Figure 1;

[0061] Figure 8 The framework of the system in this application Figure 2 .

[0062] Figure 9-19 This is a presentation of the operation method of a specific embodiment of this application. Detailed Implementation

[0063] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0064] In the description of this application, it should be understood that the orientations or positional relationships indicated by terms, etc., are based on the orientations or positional relationships shown in the accompanying drawings and are only for the convenience of describing this application and simplifying the description, and are not intended to indicate or imply that the device, element, module, system, platform, or device referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this application. The following description of this application is only to be understood as a description of individual embodiments of the technical solutions of this application. Other embodiments are not reflected in the following description, but this does not mean that this application excludes these other embodiments, nor is the technical solution of this application limited to the specific implementations described below, and the protection scope of this application is not limited to the specific implementations described below. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of this application.

[0065] It should be noted that if the terms "first," "second," etc., appear in the specification, claims, and accompanying drawings of this application, such descriptions are only used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0066] In some embodiments, this application provides a secure and easy-to-use file safe implementation method based on eCryptfs, including creating the file safe, opening the file safe, deleting the file safe, modifying the password of the file safe, and retrieving the password of the file safe.

[0067] In some embodiments, specifically, the operation of creating the file vault, such as Figure 1 As shown, it includes:

[0068] S1: The user enters the first string as the password bPassword;

[0069] S2: Generate a random second string as the password ePassword for eCryptfs, which is used to encrypt or decrypt files in eCryptfs;

[0070] S3: Concatenate the ePassword and the bPassword to form the plaintext string "ePassword+bPassword";

[0071] S4: Using bPassword as the key, encrypt the "ePassword + bPassword" and store it in the database; and

[0072] S5: Generate a random third string as a password, and use the password as a key to encrypt the bPassword and store it in the database.

[0073] Specifically, such as Figure 2 As shown, the specific process for creating a safe can be as follows:

[0074] 1) Generate a random number as ePassword. The ePassword will not be exposed to the user during the entire encryption and decryption process, nor will it be stored in plaintext, so no modification is required.

[0075] 2) Use the user-entered password (bPassword) as a key to encrypt "ePassword + bPassword" and store it in the database. The reason for including bPassword here is to compare the entered password later when opening the safe.

[0076] 3) Generate a random string as a password and provide it to the user, who can use this password to retrieve their password. For security reasons, the password cannot be stored in plaintext in the system; therefore, the password needs to be used as a key to symmetrically encrypt bPassword before being stored in the database.

[0077] In some embodiments, specifically, the operation of opening the file safe includes:

[0078] The user establishes a dbus connection to the backend service;

[0079] The user enters a first password;

[0080] Read the “ePassword+bPassword” and decrypt it using the bPassword, then verify whether the first password is the bPassword; and

[0081] If so, the file safe is opened, and when the user opens the encrypted file, the encrypted file is decrypted using eCryptfs via the ePassword, and the decrypted file is placed in the backend service.

[0082] Specifically, opening the safe requires decrypting the encrypted file system. eCryptfs decrypts the file system by mounting it, with plaintext data stored in the mounted path. The downside of this is that other privileged users can access it, posing a certain security risk.

[0083] like Figure 3 As shown, the operation to open the file safe can be as follows:

[0084] This application provides a separate backend service that stores the decrypted data in memory. Users request the backend service via a dbus connection. Each connection has a unique identifier, and only those with that identifier who have successfully opened the vault can access the data within it.

[0085] In some embodiments, specifically, deleting the file vault may include:

[0086] The user establishes a dbus connection to the backend service;

[0087] The user enters a first password;

[0088] Read the “ePassword+bPassword” and decrypt it using the bPassword, then verify whether the first password is the bPassword; and

[0089] If so, delete the file safe.

[0090] As you can see, you need to verify the password before you can delete the safe. The safe can only be deleted after the password verification is successful.

[0091] In some embodiments, specifically, the operation of changing the password of the file safe may include:

[0092] The user enters a second password;

[0093] Read the “ePassword+bPassword” and decrypt it using the bPassword, then verify whether the second password is the bPassword;

[0094] If not, then changing the password is not allowed;

[0095] If so, a third password is allowed, which is then used as the new input password bPassword. The third password is also used as the key to encrypt the "ePassword + new input password bPassword" and store it in the database.

[0096] Specifically, such as Figure 4 As shown, the specific steps to change the password of the file safe are as follows:

[0097] 1) When changing a password, the user will first enter the old password. After entering the password, the previously encrypted "ePassword+bPassword" will be retrieved from the database, and then the old password will be used as the key to decrypt the password.

[0098] 2) After decryption, the plaintext string "ePassword+bPassword" is obtained. The old password entered by the user is compared with bPassword in the plaintext string to determine whether the entered password is correct. If it is incorrect, the password cannot be changed.

[0099] 3) If the old password is entered correctly, a new password can be entered. This new password will be used as the key to re-encrypt "ePassword+bPassword", at which point bPassword will be replaced by the new password. Throughout the process, ePassword remains unchanged, thus eliminating the need for decryption and re-encryption of the file system, ensuring efficiency and security.

[0100] In some embodiments, specifically, the operation of retrieving the password of the file vault may include:

[0101] The user enters the password;

[0102] Read the encrypted bPassword and decrypt the encrypted bPassword using the password to obtain the decrypted bPassword.

[0103] Specifically, such as Figure 5 As shown, to retrieve the password, the user needs to first enter the password set when creating the safe. Then, the password is used to encrypt the original password data. The password entered by the user is then used as the key to decrypt the data and obtain the password.

[0104] In some embodiments, specifically, such as Figure 6The process shown is as follows: creating the file safe, opening the file safe, deleting the file safe, changing the password of the file safe, and retrieving the password of the file safe.

[0105] In some embodiments, such as Figure 7 As shown, this application also provides a secure and easy-to-use file vault implementation system 1 based on eCryptfs, including:

[0106] Database 11;

[0107] eCryptfs12; and

[0108] Service module 13 is used to receive a first string input by the user as the input password bPassword; service module 13 is also used to generate a random second string as the password ePassword for eCryptfs, and the ePassword is used to encrypt or decrypt files in eCryptfs.

[0109] The service module 13 is also used to concatenate the ePassword and the bPassword to form a plaintext string "ePassword+bPassword"; and to use the bPassword as a key to encrypt the "ePassword+bPassword" and store it in the database.

[0110] The service module 13 is also used to generate a random third string as a password, and the service module 12 is also used to encrypt the bPassword as a key and store it in the database.

[0111] In some embodiments, such as Figure 8 As shown, it also includes:

[0112] Backend service 14 is used to establish a dbus connection with the user;

[0113] When the user enters the first password, the service module 12 reads the "ePassword+bPassword" and decrypts it using the bPassword, and verifies whether the first password is the bPassword; if so, the user opens the file safe.

[0114] When the user opens the encrypted file, the eCryptfs13 is also used to decrypt the encrypted file using the ePassword, and the decrypted file is placed in the backend service 14.

[0115] In some embodiments, when the user enters the first password, the service module 12 is further configured to read the "ePassword+bPassword" and use the bPassword to decrypt it, and verify whether the first password is the bPassword; if so, the user deletes the file safe.

[0116] In some embodiments, when the user enters a second password, the service module 12 is further configured to read the “ePassword+bPassword” and decrypt it using the bPassword, and verify whether the second password is the bPassword;

[0117] If not, the user is not allowed to change their password;

[0118] If so, the user is allowed to enter a third password. The service module 12 is also used to use the third password as a new input password bPassword and the third password as a key to encrypt the "ePassword + new input password bPassword" and store it in the database.

[0119] In some embodiments, when the user enters the password, the service module 12 is further configured to read the encrypted bPassword and decrypt the encrypted bPassword using the password to obtain the decrypted bPassword.

[0120] In some embodiments, the specific implementation of the solution in this application may be as follows:

[0121] 1) such as Figure 9-10 As shown, click "New" to bring up the "Create Safe" dialog box. Enter the name (test) and password (boxtest123), and click the "Confirm" button. If the creation is successful, a pop-up window will display the safe's password.

[0122] 2) such as Figure 11-13 As shown, double-click the safe, and an unlock dialog box will pop up. After entering the correct password, a pop-up message will indicate that the unlock was successful. Double-click the safe again to open it.

[0123] 3) such as Figure 14-15 As shown, right-click on the safe location to bring up the pop-up menu, select "Change Password," and a "Change Password" dialog box will appear. Enter the current password (boxtest123) and the new password (boxtest124), then click "Confirm." If the verification is successful, a "Change Successful" dialog box will appear.

[0124] 4) such as Figure 16-17As shown, right-click on the safe location to bring up the pop-up menu, select "Forgot Password," and a "Forgot Password" dialog box will appear. Enter the password returned in step 1) (23c1 f313), and click "Confirm." If the password is correct, the current password (boxtest124) will be returned.

[0125] 5) such as Figure 18-19 Right-click on the safe location as shown in the image to bring up the pop-up menu, select Delete, and a Delete Safe dialog box will appear. Enter your current password and click Confirm. If the password is correct, a Delete Successful dialog box will appear.

[0126] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0127] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. An implementation method of a file safe based on eCryptfs security easy-to-use, comprising creating the file safe, characterized in that, The creating the file safe includes: The user inputs a first string as an input password bPassword; A random second string is generated as an eCryptfs password ePassword, which is used for encrypting or decrypting files of eCryptfs; The ePassword and the bPassword are spliced to form a plaintext string "ePassword+bPassword"; The bPassword is used as a key to encrypt the "ePassword+bPassword" and store it into a database; and A random third string is generated as a password, and the bPassword is encrypted using the password as a key and stored into the database; The file safe implementation method further includes opening the file safe, and the opening the file safe includes: The user establishes a dbus connection to a backend service, each connection having a unique identifier; The user inputs a first password; The "ePassword+bPassword" is read and decrypted using the bPassword to verify whether the first password is the bPassword; and If yes, the file safe is opened, and when the user opens an encrypted file, the encrypted file is decrypted by eCryptfs using the ePassword, and the decrypted file is placed in the backend service.

2. The method of claim 1, wherein the eCryptfs-based secure easy-to-use file safe implementation method is characterized by, Further includes deleting the file safe, and the deleting the file safe includes: The user establishes a dbus connection to a backend service; The user inputs a first password; The "ePassword+bPassword" is read and decrypted using the bPassword to verify whether the first password is the bPassword; and If yes, the file safe is deleted.

3. The eCryptfs-based secure easy-to-use file safe implementation method according to claim 1 or 2, characterized in that, Further includes modifying the password of the file safe, and the modifying the password of the file safe includes: The user inputs a second password; The "ePassword+bPassword" is read and decrypted using the bPassword to verify whether the second password is the bPassword; If no, the password is not allowed to be modified; If yes, a third password is allowed to be input, the third password is used as a new input password bPassword, and the third password is used as a key to encrypt the "ePassword+new input password bPassword" and store it into the database.

4. The method of claim 1, wherein the eCryptfs-based secure easy-to-use file safe implementation method is characterized by, Further includes retrieving the password of the file safe, and the retrieving the password of the file safe includes: The user inputs the password; The encrypted bPassword is read and decrypted using the password to obtain the decrypted bPassword.

5. A system for implementing a secure easy-to-use file safe based on eCryptfs, characterized in that, It includes: A database; eCryptfs; and a service module, configured to receive a first string input by a user as an input password bPassword; the service module is further configured to generate a random second string as an eCryptfs password ePassword, the ePassword being used for encrypting or decrypting files by the eCryptfs; the service module is further configured to splice the ePassword and the bPassword to form a plaintext string "ePassword+bPassword"; the service module is further configured to encrypt the "ePassword+bPassword" by using the bPassword as a key and store the encrypted "ePassword+bPassword" in the database; the service module is further configured to generate a random third string as a password, and encrypt the bPassword by using the password as a key and store the encrypted bPassword in the database; the file safe box implementation system further comprises: a backend service, configured to establish a dbus connection with the user, each connection having a unique identifier; when the user inputs a first password, the service module is configured to read the "ePassword+bPassword" and decrypt the "ePassword+bPassword" by using the bPassword to check whether the first password is the bPassword; if yes, the user opens the file safe box; when the user opens an encrypted file, the eCryptfs is further configured to decrypt the encrypted file by using the ePassword, and the decrypted file is placed in the backend service.

6. The eCryptfs-based secure easy-to-use file safe implementation system according to claim 5, wherein, the file safe box implementation system further comprises: a backend service, configured to establish a dbus connection with the user; when the user inputs a first password, the service module is further configured to read the "ePassword+bPassword" and decrypt the "ePassword+bPassword" by using the bPassword to check whether the first password is the bPassword; if yes, the user deletes the file safe box. the file safe box implementation system further comprises:

7. The eCryptfs-based secure easy-to-use file safe implementation system according to claim 5 or 6, characterized in that, when the user inputs a second password, the service module is further configured to read the "ePassword+bPassword" and decrypt the "ePassword+bPassword" by using the bPassword to check whether the second password is the bPassword; if no, the user is not allowed to modify the password; if yes, the user is allowed to input a third password, the service module is further configured to use the third password as a new input password bPassword, and encrypt the "ePassword+new input password bPassword" by using the third password as a key and store the encrypted "ePassword+new input password bPassword" in the database. the file safe box implementation system further comprises: when the user inputs the password, the service module is further configured to read the encrypted bPassword and decrypt the encrypted bPassword by using the password to obtain the decrypted bPassword. ​ 8. The eCryptfs-based secure easy-to-use file safe implementation system according to claim 7, characterized in that, ​ ​

Images