File secure transmission system and method based on virtual printer

Abstract

The invention relates to the technical field of data transmission security, in particular to a file security transmission system and method based on a virtual printer. The method comprises the following steps: acquiring a key constraint parameter set, and generating a preselected key pool according to the key constraint parameter set; acquiring virtual printing task information, analyzing the virtual printing task information, and generating a document data block set; based on the preselected key pool, performing encryption-write separated transmission on each data block in the document data block set to generate local encryption cache information; and determining a decryption key set according to the local encryption cache information and the preselected key pool, performing decryption-reading separated transmission on each data block in the local encryption cache information according to the decryption key set, and generating and outputting virtual printing content. According to the method and the device, the whole-process encryption and separated processing of the data are realized in the printing data transmission process, and the security and confidentiality of the document content are effectively guaranteed.

Description

Technical Field

[0001] The present application relates to the technical field of data transmission security, and in particular to a file security transmission system and method based on a virtual printer. Background Art

[0002] Against the backdrop of rapid informatization development, virtual printers, as a document generation and transmission tool that does not require physical media, are widely used in document generation, format conversion, and file sharing, effectively improving the convenience and flexibility of document management.

[0003] However, existing virtual printer technology is limited by factors such as task scheduling, performance optimization and fault tolerance mechanisms. Before processing the target document, the target file needs to be transferred to the corresponding temporary cache directory. In this process, the existing technology lacks an effective file security protection mechanism, which makes the target file vulnerable to theft and tampering by attackers, making it difficult to ensure file security. Summary of the Invention

[0004] The present application provides a file security transmission system and method based on a virtual printer to solve the above technical problems.

[0005] In a first aspect, the present application provides a method for secure file transmission based on a virtual printer, the method comprising: Acquire a key constraint parameter set, and generate a preselected key pool based on the key constraint parameter set; acquire virtual printing task information, analyze the virtual printing task information, and generate a document data block set; based on the preselected key pool, encrypt and write each data block in the document data block set in a separate transmission to generate local encrypted cache information; determine a decryption key set based on the local encrypted cache information and the preselected key pool, and decrypt and read each data block in the local encrypted cache information in a separate transmission based on the decryption key set to generate and output virtual printing content.

[0006] Through this solution, a pre-selected key pool is generated based on key constraint parameters, and the document data block is encrypted-written separately and transmitted in combination with the virtual printing task information. Using local encrypted cache information as the medium, the corresponding virtual printing content is generated and provided to the user through decryption-reading separate transmission. During the printing data transmission process, full encryption and separate processing of data are achieved, effectively ensuring the security and confidentiality of the document content. At the same time, the dynamic generation and management of keys through the pre-selected key pool improves the security and flexibility of key use, avoids the security threats brought by static key management, and takes into account the security, efficiency and reliability of document transmission, providing technical support for data security protection and trusted execution of virtual printing tasks, and strengthening the trust and cooperation relationship between users.

[0007] Optionally, the key constraint parameter set includes an initial pool capacity, a key length, a key lifecycle, and a random number source; and the preselected key pool is installed in a non-relational cache database that supports a Key-Value data structure.

[0008] Through this solution, the initialization construction process of the pre-selected key pool is preset by utilizing the initial pool capacity, key length, key life cycle and random number source in the key constraint parameter set to clarify the initial scale, key complexity, key validity period and key randomness of the pre-selected key pool, so that the pre-selected key pool is highly matched with the requirements of the virtual printing task. The pre-selected key pool is further carried in a non-relational cache database that supports the Key-Value data structure, which improves the key retrieval efficiency while automatically managing the key life cycle, thereby improving key security and the overall efficiency of virtual printing.

[0009] Optionally, generating a preselected key pool according to the key constraint parameter set includes: Based on the key length and according to the random number source, a symmetric encryption algorithm is used to generate a number of preselected encryption keys corresponding to the initial pool capacity, determine the preselected encryption key set, and record the millisecond value of the generation time and the auto-increment index value of each preselected encryption key; the starting auto-increment value of the auto-increment index value is 1; based on the ratio between the millisecond value of the generation time of each preselected encryption key and the corresponding auto-increment index value, determine the unique index identifier of each preselected encryption key; based on the unique index identifier and the preselected encryption key, generate corresponding key-value pair data, and based on the key life cycle, set a validity period for the key-value pair data to determine the key-value pair set; based on the key-value pair set, the generation time millisecond value of each preselected encryption key and the auto-increment index value, construct the preselected key pool.

[0010] Through this scheme, a symmetric encryption algorithm is adopted to generate several corresponding pre-selected encryption keys according to the key length and random number source, and the ratio between the millisecond value of the generation time of each pre-selected encryption key and the corresponding auto-increment index value is used as the unique index identifier of the key to ensure the uniqueness and unpredictability of the key index, so as to ensure the accuracy of subsequent key retrieval, and at the same time prevent attackers from locating the corresponding key through reasoning about the index, thereby improving key security. In the process of generating the corresponding key-value pair data according to the unique index identifier and the pre-selected encryption key, the validity period is set for the key-value pair data according to the key life cycle to ensure the dynamic nature of the key. According to the key-value pair set, the millisecond value of the generation time of each pre-selected encryption key and the auto-increment index value, a pre-selected key pool is constructed to ensure key retrieval efficiency and index verifiability.

[0011] Optionally, the method further includes: The preselected key pool is divided into a plurality of logical partitions, including an active area, a buffer area, and a to-be-eliminated area. The active area is used to store key-value pairs whose active time is less than a preset active period. The active area is accessed frequently. Each time a key-value pair in the active area is used, the active time of the corresponding key-value pair is reset. The buffer area is used to store newly generated but unused key-value pairs. The buffer area is used to smoothly expand the capacity of the active area. When a key-value pair in the buffer area is used, the corresponding key value is stored in the active area. The eliminated area is used to store key-value pairs whose active time is greater than a preset active period. The key-value pairs in the eliminated area are only allowed to be used and their active time is not allowed to be reset. When the existence time of a key-value pair in the eliminated area exceeds the corresponding validity period, the corresponding key-value pair is deleted. According to a preset recycling period, the key-value pairs in the buffer area that have not been used within the preset recycling period are deleted, and a corresponding number of key-value pairs are generated.

[0012] Through this solution, the pre-selected key pool is divided into three logical partitions: active area, buffer area and to-be-eliminated area, which are used to store frequently used keys, unused keys and infrequently used keys respectively. According to the usage of the keys, the keys in the above three areas are dynamically migrated, which improves the efficiency of key retrieval hits and eliminates expired keys in time, thereby improving the security and dynamism of keys.

[0013] Optionally, analyzing the virtual printing task information to generate a document data block set includes: Analyze the virtual printing task information to extract the sequence of files to be processed and the total file size; based on the total file size and according to the virtual printer data throughput rate, determine the unit data block size; based on the data block local coverage strategy, divide the sequence of files to be processed into a number of document data blocks to be processed according to the unit data block size; and construct the document data block set based on the several document data blocks to be processed.

[0014] Through this solution, the unit data block size is determined according to the total file size and the virtual printer data throughput rate, so that the unit data block size adapts to the system real-time load and virtual printer performance, improving the efficiency of subsequent data block encryption. Combined with the data block local overwriting strategy used to constrain the data block overwriting rules, the to-be-processed file sequence is divided into several to-be-processed document data blocks, thereby constructing a document data block set, making it impossible for attackers to restore the complete file through the data blocks, causing the attack cost to increase exponentially.

[0015] Optionally, the data block local coverage strategy includes: It is prohibited for a unit data block to completely cover any single file in the sequence of files to be processed; the unit data block only contains partial file contents corresponding to several files in the sequence of files to be processed; when a single file in the sequence of files to be processed is split, a unique combined index is established for the partial file contents obtained by each split.

[0016] Through this solution, a data block partial coverage strategy is utilized to constrain the file content within a unit data block, preventing the unit data block from completely covering any single file in the sequence of files to be processed. Instead, the unit data block only contains partial file content corresponding to several files in the sequence of files to be processed, making it impossible for attackers to completely restore the files based on the hijacked partial database, thereby increasing the attacker's attack cost. At the same time, by establishing a unique combined index for each partial file content obtained by splitting, the efficiency and accuracy of data block restoration during subsequent virtual printing are guaranteed.

[0017] Optionally, performing encryption-write separation transmission on each data block in the document data block set based on the preselected key pool to generate local encryption cache information includes: Obtain idle thread information, and determine the target thread index set based on the idle thread information; create several encryption threads and corresponding several writing threads based on the target thread index set; extract the corresponding number of key-value pairs in the pre-selected key pool based on the number of data blocks in the document data block set, and determine the key set to be used; based on the unique index identifier, verify whether there is a tampered key in the key set to be used according to the generation time millisecond value and the self-increment index value recorded in the pre-selected key pool; if the tampered key exists, delete the corresponding key-value pair from the key set to be used, and re-extract the corresponding number of key-value pairs from the pre-selected key pool. The key-value pair is added to the key set to be used, and the newly added key-value pair is re-verified; when there is no tampered key in the key set to be used, according to each key in the key set to be used, a symmetric encryption algorithm is used through several encryption threads to perform parallel symmetric encryption on each data block in the document data block set, and each encrypted data block and the unique index identifier of the corresponding key are transmitted to the memory queue; according to the preset cache target path, each encrypted data block provided by the memory queue and the corresponding unique index identifier are written to the preset cache target path through several writing threads to construct the local encrypted cache information.

[0018] Through this solution, by creating and separating the encryption thread and the writing thread, CPU-intensive encryption tasks are handed over to a dedicated encryption thread, and I / O-intensive writing tasks are handed over to a dedicated writing thread, avoiding the occurrence of thread resource competition, improving the encryption and writing efficiency of files, and effectively resisting the middleman's attack on the pre-selected key pool through the key tampering detection mechanism. Through the cooperation of threads and memory queues, the data throughput efficiency of the file encryption and writing process is guaranteed to avoid task blocking.

[0019] Optionally, the memory queue is a lock-free queue; A circular queue is formed between the encryption threads and the memory queue; when the encryption thread transmits the corresponding encrypted data block and unique index identifier to the memory queue, the resources occupied by the corresponding data block and key in the encryption thread are immediately released; a one-way queue is formed between the write threads and the memory queue.

[0020] Through this solution, the memory queue is set as a lock-free queue to eliminate thread contention, improve the data throughput of encryption tasks, and reduce response delays in high-concurrency scenarios. The setting of a circular queue improves the efficiency of encryption threads in filling the memory queue and improves memory utilization. The setting of a one-way queue prevents reverse injection attacks from contaminating the memory queue while ensuring data sequence, further improving data security.

[0021] Optionally, determining a decryption key set based on the local encrypted cache information and the pre-selected key pool, and performing decryption-reading separate transmission on each data block in the local encrypted cache information based on the decryption key set to generate and output virtual print content includes: According to the unique index identifier corresponding to each encrypted data block, the pre-selected key pool is retrieved to determine a number of decryption keys and construct the decryption key set; a secure enclave is created and divided into a decryption buffer and a read buffer; in the decryption buffer, each encrypted data block in the local encryption cache information is symmetrically decrypted according to the decryption key set to determine a decrypted data block set; in the read buffer, all decrypted data blocks are combined according to the unique combination index corresponding to each decrypted data block in the decrypted data block set to determine a combined data block sequence; and the virtual print content is generated and output based on the combined data block sequence.

[0022] This solution utilizes a secure enclave and dual-buffer design to isolate the entire data block decryption and reassembly process in an isolated environment, thereby defending against advanced threats such as memory scanning and cold boot attacks, significantly reducing the risk of data leakage. The decryption and reassembly efficiency of data blocks is improved by dividing and separating the decryption buffer and the read buffer.

[0023] In a second aspect, the present application provides a file security transmission system based on a virtual printer, the system comprising: A key pool creation module is used to obtain a key constraint parameter set and generate a preselected key pool based on the key constraint parameter set; a document analysis module is used to obtain virtual printing task information, analyze the virtual printing task information, and generate a document data block set; an encryption cache module is used to encrypt and write each data block in the document data block set based on the preselected key pool to generate local encryption cache information; a decryption output module is used to determine a decryption key set based on the local encryption cache information and the preselected key pool, and decrypt and read each data block in the local encryption cache information based on the decryption key set to generate and output virtual printing content. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0025] Figure 1 A schematic diagram of an application scenario provided in one embodiment of the present application; Figure 2 A flowchart of a method for secure file transmission based on a virtual printer provided in one embodiment of the present application; Figure 3 A schematic structural diagram of a file security transmission system based on a virtual printer provided in one embodiment of the present application. DETAILED DESCRIPTION

[0026] To make the purpose, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0027] In this document, the term "and / or" simply describes a relationship between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document, unless otherwise specified, generally indicates an "or" relationship between the related objects.

[0028] The embodiments of the present application are described in further detail below with reference to the accompanying drawings.

[0029] Existing virtual printer technology is limited by factors such as task scheduling, performance optimization and fault tolerance mechanisms. Before processing the target document, the target file needs to be transferred to the corresponding temporary cache directory. During this process, the existing technology lacks an effective file security protection mechanism, which makes the target file vulnerable to theft and tampering by attackers, making it difficult to ensure file security.

[0030] Based on this, the present application provides a file security transmission system and method based on a virtual printer. Based on key constraint parameters, a preselected key pool is generated, and in combination with virtual printing task information, document data blocks are encrypted and written separately for transmission. Local encrypted cache information is used as a medium, and the corresponding virtual printing content is generated and provided to the user through decryption-reading separate transmission. During the data transmission process, full encryption and separate processing of data are achieved, effectively ensuring the security and confidentiality of the document content. At the same time, the dynamic generation and management of keys through the preselected key pool improves the security and flexibility of key use, avoids the security threats brought by static key management, takes into account the security, efficiency and reliability of document transmission, provides technical support for data security protection and trusted execution of virtual printing tasks, and strengthens the trust and cooperation relationship between users.

[0031] Figure 1 This is a schematic diagram of an application scenario provided by this application. During the process of file processing and transmission by a virtual printer, the method provided by this application is applied to achieve full encryption and separate processing of file data, effectively ensuring the security and confidentiality of document content.

[0032] Specifically, the method of the present application is applied to any server, which obtains the key constraint parameter set and virtual printing task information provided by the user through the server, generates a pre-selected key pool based on the key constraint parameters, and encrypts and writes the document data block in combination with the virtual printing task information for separate transmission. Using local encrypted cache information as a medium, the corresponding virtual printing content is generated and provided to the user through decryption-reading separate transmission, thereby realizing full encryption and separate processing of data during data transmission, effectively ensuring the security and confidentiality of document content. At the same time, the dynamic generation and management of keys through the pre-selected key pool improves the security and flexibility of key use, avoids the security threats brought by static key management, takes into account the security, efficiency and reliability of document transmission, provides technical support for data security protection and trusted execution of virtual printing tasks, and strengthens the trust and cooperation relationship between users.

[0033] For specific implementation methods, please refer to the following embodiments.

[0034] Figure 2 This is a flowchart of a method for secure file transmission based on a virtual printer provided in one embodiment of the present application. The method of this embodiment can be applied to the server in the above scenario. Figure 2 As shown, the method includes: S201: Obtain a key constraint parameter set, and generate a pre-selected key pool according to the key constraint parameter set.

[0035] The key constraint parameter set may be a set of parameters used as constraints for key pool construction. The key constraint parameter set may include parameters such as initial pool capacity, key length, key lifecycle, etc. The key constraint parameter set may be set by the user.

[0036] The preselected key pool may be a set of keys used to encrypt print data.

[0037] Specifically, existing virtual printer technologies usually use static generation or single random generation methods to encrypt printed content to improve file security. This method has problems such as high key reuse rate and extensive lifecycle management. It is unable to dynamically optimize according to the frequency and timeliness of key use, resulting in an increased risk of key leakage. Attackers can obtain keys through long-term monitoring or brute force cracking, and then steal the file contents in the cache. In addition, a corresponding key needs to be constructed before each file transmission, which has a negative impact on the printing efficiency of the file.

[0038] According to the key constraint parameter set, a pre-selected key pool is pre-built. The pre-selected key pool stores several keys that can be used to encrypt printed files. All keys are managed uniformly through the pre-selected key pool, and a dynamic rotation mechanism is set up to dynamically update the keys in the pre-selected key pool to improve key security and the encryption efficiency of printed files.

[0039] S202: Acquire virtual printing task information, analyze the virtual printing task information, and generate a document data block set.

[0040] The virtual printing task information may be information used to characterize the file characteristics corresponding to the current printing task, such as the file size, etc. The virtual printing task information is provided by the user.

[0041] The document data block set may be a data block set obtained by dividing the file corresponding to the current print task into several data blocks.

[0042] Specifically, existing virtual printer technology usually processes the entire print file as a single piece of data when processing print files, which means that attackers can restore the complete file by stealing the single piece of data. This poses an extremely high security risk and is prone to performance bottlenecks when processing large-scale print files, affecting file transfer efficiency.

[0043] According to the file features in the virtual printing task information, the corresponding to-be-processed files in the virtual printing task information are divided into several data blocks to construct a document data block set. The subsequent encryption, decryption and transmission processes of the printed files all use the data blocks as processing targets, ensuring that even if some data blocks are stolen, the attacker cannot restore the original file, further improving file security.

[0044] S203: Based on the pre-selected key pool, each data block in the document data block set is encrypted and written separately for transmission to generate local encryption cache information.

[0045] The encryption-write separation transmission may be a transmission process in which encryption and writing of document data are respectively performed through independent threads.

[0046] The local encrypted cache information may be information obtained by writing the encrypted data block into the local cache location.

[0047] Specifically, in the process of processing files, in order to ensure data integrity, processing flexibility, error rollback and independence of the original document during the processing, the virtual printer needs to first transfer the corresponding file data to the local temporary cache. During this process, if the attacker sniffs the corresponding cache write operation and the corresponding cache directory, it is very easy to cause file leakage. Therefore, when writing file data to the temporary cache, the file data needs to be encrypted. When existing virtual printers encrypt and write file data, the encryption and write operations are usually coupled in the same thread, causing the encryption process to occupy CPU resources and the write operation to be forced to wait, resulting in a decrease in the overall data throughput of the virtual printer, and causing the plaintext data before encryption to reside in the memory for too long, which can be easily stolen by attackers using memory scanning methods.

[0048] By assigning CPU-intensive encryption tasks and I / O-intensive writing tasks to independent threads for execution, parallel processing of encryption and writing is achieved, improving data encryption efficiency and reducing the residence time of plaintext data in memory. While ensuring data security, it does not negatively impact the data throughput performance of the virtual printer.

[0049] S204: Determine a decryption key set based on the local encrypted cache information and the pre-selected key pool, and perform decryption-reading separate transmission on each data block in the local encrypted cache information based on the decryption key set to generate and output virtual print content.

[0050] The decryption key set may be a key set used to decrypt the encrypted data block.

[0051] Decryption-read split transfer can be a transfer process in which encrypted data blocks are decrypted and read in independent trusted memory areas.

[0052] The virtual print content may be print content generated by a virtual printer according to the decrypted data block.

[0053] Specifically, the existing virtual printer technology performs decryption operations on document data directly in the application layer memory, which can easily cause the decrypted plaintext data to be stolen by malicious potential application processes in the system, and the key transmission and use process is prone to side channel attacks, resulting in key leakage.

[0054] By creating an independent trusted memory area outside the application layer memory, the encrypted data blocks in the local encrypted cache information are decrypted and read in the corresponding memory area. On this basis, the corresponding virtual print content is generated and output through the virtual printer driver, and the virtual print content is provided to the user. By isolating sensitive operations, it effectively resists memory injection attacks and ensures security during data processing and transmission.

[0055] Through this solution, a pre-selected key pool is generated based on key constraint parameters, and the document data block is encrypted-written separately and transmitted in combination with the virtual printing task information. Using local encrypted cache information as the medium, the corresponding virtual printing content is generated and provided to the user through decryption-reading separate transmission. During the printing data transmission process, full encryption and separate processing of data are achieved, effectively ensuring the security and confidentiality of the document content. At the same time, the dynamic generation and management of keys through the pre-selected key pool improves the security and flexibility of key use, avoids the security threats brought by static key management, and takes into account the security, efficiency and reliability of document transmission, providing technical support for data security protection and trusted execution of virtual printing tasks, and strengthening the trust and cooperation relationship between users.

[0056] In some embodiments, the key constraint parameter set includes an initial pool capacity, a key length, a key lifetime, and a random number source; the preselected key pool is mounted in a non-relational cache database that supports a Key-Value data structure.

[0057] The initial pool capacity may be an upper limit on the number of keys generated when the preselected key pool is initialized, and is used to balance key generation efficiency and storage overhead.

[0058] The key length can be the number of key bits used by the encryption algorithm, which directly affects the encryption strength.

[0059] The key lifecycle can be the time range from the generation to the expiration of a single key, preventing security risks caused by long-term exposure of the key.

[0060] The random number source can be a source of entropy required to generate a key to ensure the unpredictability of the key. The random number source can use a pseudo-random number algorithm or a hardware true random number generator.

[0061] A Key-Value data structure may be a data structure that identifies a data item through a unique key (Key) and associates it with a value (Value).

[0062] A non-relational cache database can be a data storage system with key-value pairs, documents, or column families as its data model, used for efficient and fast access, and can flexibly respond to unstructured or semi-structured data needs.

[0063] Specifically, the initialization capacity of the pre-selected key pool is constrained by the initial pool capacity. If the key pool capacity is too small, it will lead to frequent and repeated key generation, increasing the computing load. If the capacity is too large, it will occupy too many memory resources. The initial pool capacity can be set according to the complexity of the task; the complexity of the keys generated in the pre-selected key pool is constrained by the key length. Short keys are easily cracked by brute force, while long keys require more computing resources. The key length can be set according to the sensitivity of the task data; the validity period of the keys generated in the pre-selected key pool is constrained by the key life cycle. Once the long-term valid keys are leaked, attackers can decrypt historical files indefinitely. By constraining the validity period of the keys, the scope of the impact of key leakage in extreme cases is reduced; the entropy required for key generation provided by the random number source is used to ensure the unpredictability of the keys generated in the pre-selected key pool; existing virtual printer technologies usually store keys in traditional relational databases or even local files (the data storage targets of traditional relational databases and local files are both disks), which leads to subsequent key detection. There is a significant delay in the search process, which makes it difficult to meet the real-time encryption requirements of files and will have a significant negative impact on the efficiency of virtual printing. By placing the pre-selected key pool in a non-relational cache database that supports the Key-Value data structure, a millisecond-level response to key retrieval can be achieved. Since non-relational cache databases, such as Redis, store data in memory, they can provide faster key reading and writing speeds than disks. The storage space occupied by the key itself is not large and will not take up too much memory. The non-relational cache database has a TTL (Time-To-Live) mechanism, which can achieve real-time dynamic management of the key life cycle in the pre-selected key pool. In addition, the non-relational cache database supports horizontal expansion, providing a basis for the dynamic expansion of the pre-selected key pool. The time complexity corresponding to the search and update operations of the Key-Value data structure is low, and can usually be completed in constant time (the time complexity is O(1)), which can well adapt to the needs of frequent query and update of keys.

[0064] Through this solution, the initialization construction process of the pre-selected key pool is preset by utilizing the initial pool capacity, key length, key life cycle and random number source in the key constraint parameter set to clarify the initial scale, key complexity, key validity period and key randomness of the pre-selected key pool, so that the pre-selected key pool is highly matched with the requirements of the virtual printing task. The pre-selected key pool is further carried in a non-relational cache database that supports the Key-Value data structure, which improves the key retrieval efficiency while automatically managing the key life cycle, thereby improving key security and the overall efficiency of virtual printing.

[0065] In some embodiments, based on the key length and according to the random number source, a symmetric encryption algorithm is used to generate a number of preselected encryption keys corresponding to the initial pool capacity, determine the preselected encryption key set, and record the millisecond value of the generation time and the auto-increment index value of each preselected encryption key; the starting auto-increment value of the auto-increment index value is 1; based on the ratio between the millisecond value of the generation time of each preselected encryption key and the corresponding auto-increment index value, determine the unique index identifier of each preselected encryption key; based on the unique index identifier and the preselected encryption key, generate corresponding key-value pair data, and based on the key life cycle, set a validity period for the key-value pair data to determine the key-value pair set; based on the key-value pair set, the preselected key pool is constructed in accordance with the key-value pair set, the millisecond value of the generation time and the auto-increment index value of each preselected encryption key.

[0066] A symmetric encryption algorithm may be an algorithm that uses the same key for encryption and decryption, such as AES and ChaCha20.

[0067] The preselected encryption key set may be a set of keys generated by a symmetric encryption algorithm.

[0068] The generation time millisecond value may be a millisecond value corresponding to the precise timestamp of key generation.

[0069] The auto-increment index value may be an auto-increment value used as a default index for the key during the key generation process.

[0070] The start auto-increment value may be an initial value of the auto-increment index value.

[0071] The unique index identifier may be a unique index used to refer to the key.

[0072] The key-value pair data may be data of a Key-Value structure with a unique index identifier as the Key and a pre-selected encryption key as the Value.

[0073] Specifically, according to the key length and the random number provided by the random number source, a symmetric encryption algorithm, such as the AES algorithm, is used to generate pre-selected keys of corresponding lengths corresponding to the initial pool capacity. The use of a symmetric encryption algorithm can improve encryption efficiency. According to the generation timestamp of each pre-selected key (the time elapsed since the Unix epoch, in seconds), the corresponding generation time millisecond value is obtained. During the key generation process, an auto-incrementing index is automatically assigned to the key. The auto-incrementing index is unique, but considering that the auto-incrementing index is too simple and has a significant regularity (generally increasing from a single-digit integer), it is easy for an attacker to deduce it, and the generation time millisecond value may be repeated in a high-concurrency scenario (when multiple threads generate keys at the same time, it is possible that two keys have the same generation time). In order to ensure the uniqueness of the key index (to ensure retrieval accuracy) and unpredictability (to prevent attackers from locating the corresponding key by reasoning about the index), each pre-selected key is assigned a value in milliseconds. The ratio between the millisecond value of the encryption key generation time and the corresponding auto-increment index value is used as the unique index identifier of each pre-selected encryption key. In order to prevent the unique index identifier from being 0, the starting auto-increment value of the auto-increment index value is limited to 1. The unique index identifier is used as the Key and the corresponding pre-selected encryption key is used as the Value to construct key-value pair data with a Key-Value data structure. According to the key life cycle, the validity period is set for the key-value pair data through the TTL mechanism to construct a key-key-value pair set. At the same time, the auto-increment index value is used as the Key and the corresponding generation time millisecond value is used as the Value. The generation basis of the unique index identifier is constructed as the corresponding key-value pair data to facilitate subsequent verification of the key index. The key-value pairs in the key-value pair set and the key-value pair data serving as the generation basis of the unique index identifier are uniformly stored in a non-relational cache database that supports the Key-Value data structure to realize the construction of the pre-selected key pool.

[0074] Through this scheme, a symmetric encryption algorithm is adopted to generate several corresponding pre-selected encryption keys according to the key length and random number source, and the ratio between the millisecond value of the generation time of each pre-selected encryption key and the corresponding auto-increment index value is used as the unique index identifier of the key to ensure the uniqueness and unpredictability of the key index, so as to ensure the accuracy of subsequent key retrieval, and at the same time prevent attackers from locating the corresponding key through reasoning about the index, thereby improving key security. In the process of generating the corresponding key-value pair data according to the unique index identifier and the pre-selected encryption key, the validity period is set for the key-value pair data according to the key life cycle to ensure the dynamic nature of the key. According to the key-value pair set, the millisecond value of the generation time of each pre-selected encryption key and the auto-increment index value, a pre-selected key pool is constructed to ensure key retrieval efficiency and index verifiability.

[0075] In some embodiments, the preselected key pool is divided into several logical partitions, and the several logical partitions include an active area, a buffer area and a to-be-eliminated area; the active area is used to store key-value pairs whose active time is less than a preset active period, and the active area is accessed at a high frequency. Each time a key-value pair in the active area is used, the active time of the corresponding key-value pair is reset; the buffer area is used to store newly generated but unused key-value pairs, and the buffer area is used to smoothly expand the active area. When the key-value pair in the buffer area is used, the corresponding key value is stored in the active area; the eliminated area is used to store key-value pairs whose active time is greater than the preset active period. The key-value pairs in the eliminated area are only allowed to be used, and their active time is not allowed to be reset. When the active time of the key-value pair in the eliminated area is greater than the corresponding validity period, the corresponding key-value pair is deleted; according to the preset recycling period, the key-value pairs in the buffer area that are not used within the preset recycling period are deleted, and a corresponding number of key-value pairs are generated.

[0076] The active area may be an area for storing used keys.

[0077] The buffer may be an area for storing unused keys.

[0078] The to-be-eliminated area may be an area for storing keys that are about to expire.

[0079] The active time may be a time period that has passed from the time the key was used to the current time.

[0080] The preset active period may be a threshold of the maximum time that the key is allowed to reside in the active zone.

[0081] High-frequency access can be a high-frequency retrieval process of the key by the printing task.

[0082] The reset process may be an operation of resetting the key active time to 0.

[0083] Smooth expansion can be an operation to expand the number of key storages in the active area.

[0084] The preset recycling period may be a preset time interval for determining whether there is an expired key in the buffer.

[0085] Specifically, in the process of extracting keys from the preselected key pool and encrypting the corresponding file data, in order to prevent the key extraction process from being sniffed and intercepted by attackers, a random key selection method is adopted to improve the unpredictability of the key extraction process. During the working process of the preselected key pool, due to the differences in requirements and timing of different printing tasks, it is impossible to guarantee that all keys in the preselected key pool can be fully utilized, and the usage frequency of different keys over a period of time also varies. If high-frequency, low-frequency and idle keys are directly mixed and stored in one area, the key retrieval efficiency will be low (if a key is used by a task, it can no longer be used by other tasks. Since the selection of keys is random, if all types of keys are in one area, the computing resources required for the process of screening unused keys will increase rapidly with the increase in key usage rate. Similarly, the screening and elimination of expired keys also require a lot of computing resources). To address the above problems, by The system divides the key into an active zone, a buffer zone, and a to-be-eliminated zone. Based on the frequency of key usage, unused keys are placed in the buffer zone, frequently used keys are placed in the active zone, and keys that have been used but less frequently are placed in the to-be-eliminated zone. For frequently used keys, their corresponding active time is reset to 0 each time they are used, so that the corresponding key always remains in the active zone during the period of frequent use, thereby improving key retrieval efficiency. All key requests for new tasks are located in the buffer zone because the keys in the buffer zone have never been used. For keys that have expired without being used, their validity period only needs to be regularly retrieved from the buffer zone according to the preset recycling cycle, and the corresponding expired keys can be eliminated. For keys that have been used but are used less frequently, in order to prevent them from affecting the concurrent performance of high-frequency keys in the active zone, they are placed in the to-be-eliminated zone after their activity in the active zone decreases. If the corresponding key is not found in the active zone, the to-be-eliminated zone can be directly searched. When the existence time of a key in the eliminated zone is greater than the corresponding key's validity period, the corresponding key is eliminated.

[0086] Through this solution, the pre-selected key pool is divided into three logical partitions: active area, buffer area and to-be-eliminated area, which are used to store frequently used keys, unused keys and infrequently used keys respectively. According to the usage of the keys, the keys in the above three areas are dynamically migrated, which improves the efficiency of key retrieval hits and eliminates expired keys in time, thereby improving the security and dynamism of keys.

[0087] In some embodiments, virtual printing task information is analyzed to extract the sequence of files to be processed and the total file size; based on the total file size, the unit data block size is determined according to the virtual printer data throughput rate; based on the data block local coverage strategy, the sequence of files to be processed is divided into several document data blocks to be processed according to the unit data block size; and based on the several document data blocks to be processed, a document data block set is constructed.

[0088] The sequence of files to be processed may be a logically ordered set of files to be processed that are submitted by the user through the virtual printer (eg, a queue formed by multiple PDF and DOCX files sorted by submission time).

[0089] The total file size can be the total data volume of all files in the file sequence to be processed (such as 500MB), which is obtained through statistics of file metadata (size, format).

[0090] The virtual printer data throughput rate may be the amount of data that the virtual printer can process per unit time (eg, 50 MB / s).

[0091] The unit data block size can be the maximum capacity of a single data block (such as 10MB) dynamically calculated based on the data throughput rate, which is used to optimize file splitting and encryption efficiency.

[0092] The data block local overwriting strategy may be a data block division rule for the file to be processed.

[0093] The document data block to be processed may be a data unit generated by splitting the document to be processed according to the unit data block size and the local coverage strategy.

[0094] Specifically, in the process of splitting the files to be processed to improve the efficiency of subsequent encryption and reduce the risk of file leakage, due to fluctuations in system load and differences in the performance of corresponding virtual printers, it is necessary to determine the appropriate data block size based on the total file size and the virtual printer data throughput rate. The principle is that the size of a single data block cannot be greater than the printer data throughput rate and the total file size can be evenly divided (the size of each data block is the same, blurring the data size differences between data blocks to prevent attackers from deducing sensitive files from the size differences of data blocks). After determining the unit data block size, the file sequence to be processed is divided into several document data blocks to be processed according to the data block local coverage strategy used to constrain the data block to file coverage rules, thereby constructing a document data block set.

[0095] Through this solution, the unit data block size is determined according to the total file size and the virtual printer data throughput rate, so that the unit data block size adapts to the system real-time load and virtual printer performance, improving the efficiency of subsequent data block encryption. Combined with the data block local overwriting strategy used to constrain the data block overwriting rules, the to-be-processed file sequence is divided into several to-be-processed document data blocks, thereby constructing a document data block set, making it impossible for attackers to restore the complete file through the data blocks, causing the attack cost to increase exponentially.

[0096] In some embodiments, a unit data block is prohibited from completely covering any single file in the sequence of files to be processed; a unit data block only contains partial file contents corresponding to several files in the sequence of files to be processed; when a single file in the sequence of files to be processed is split, a unique combined index is established for each partial file content obtained by the split.

[0097] The unit data block may be a minimum encryption processing unit dynamically divided according to the data throughput rate of the virtual printer.

[0098] A single document can be a standalone document entity submitted by a user (such as a PDF or DOCX file).

[0099] The partial file content may be a data segment containing partial content after a single file is split.

[0100] The unique combined index can be metadata that identifies the source and location of the file fragment, and is used to accurately reconstruct the original file after decryption.

[0101] Specifically, during the data block splitting process of the to-be-processed file sequence, due to the uncertainty of the file size in the to-be-processed file sequence, it is possible that a data block may contain an entire or multiple small files. In this case, an attacker may restore multiple files containing complete content from a single stolen data block, posing a huge threat to file security. Therefore, in the data block partial overwriting strategy, a unit data block is prohibited from completely overwriting any single file in the to-be-processed file sequence. A unit data block only contains partial file contents corresponding to several files in the to-be-processed file sequence. The specific implementation process is as follows: each independent file is split into several data fragments of different sizes, and the data blocks are padded based on the capacity of the unit data block. Each unit data block only contains partial contents of several files, and there is no significant contextual relationship between these contents. Even if an attacker steals a portion of the data block, he cannot quickly obtain useful information from it. To facilitate the subsequent virtual printing process to combine and restore different data blocks, when a single file in the to-be-processed file sequence is split, a unique combination index is established for each partial file content obtained by the split. The unique combination index contains the combination mapping information between data blocks.

[0102] Through this solution, a data block partial coverage strategy is utilized to constrain the file content within a unit data block, preventing the unit data block from completely covering any single file in the sequence of files to be processed. Instead, the unit data block only contains partial file content corresponding to several files in the sequence of files to be processed, making it impossible for attackers to completely restore the files based on the hijacked partial database, thereby increasing the attacker's attack cost. At the same time, by establishing a unique combined index for each partial file content obtained by splitting, the efficiency and accuracy of data block restoration during subsequent virtual printing are guaranteed.

[0103] In some embodiments, idle thread information is obtained, and a target thread index set is determined based on the idle thread information; a number of encryption threads and corresponding writing threads are created based on the target thread index set; a corresponding number of key-value pairs in a preselected key pool are extracted based on the number of data blocks in the document data block set, and a key set to be used is determined; based on a unique index identifier, and based on the millisecond value of the generation time recorded in the preselected key pool and the auto-increment index value, it is verified whether there is a tampered key in the key set to be used; if there is a tampered key, the corresponding key-value pair is deleted from the key set to be used, and the corresponding key-value pair is extracted from the preselected key pool again. A number of key-value pairs are added to the key set to be used, and the newly added key-value pairs are re-verified; when there is no tampered key in the key set to be used, according to each key in the key set to be used, a symmetric encryption algorithm is adopted through several encryption threads to perform parallel symmetric encryption on each data block in the document data block set, and each encrypted data block and the unique index identifier of the corresponding key are transmitted to the memory queue; according to the preset cache target path, each encrypted data block and the corresponding unique index identifier provided by the memory queue are written to the preset cache target path through several writing threads to build local encrypted cache information.

[0104] The idle thread information may be state data of thread resources that are not occupied when the current system is running.

[0105] The target thread index set may be a thread index set corresponding to an idle thread.

[0106] The encryption thread may be a system thread dedicated to performing data block encryption tasks.

[0107] The write thread may be a system thread that is specifically used to perform the task of persistently storing encrypted data blocks.

[0108] The key set to be used may be a set of keys used to encrypt the data block.

[0109] A tampered key may be a key whose data consistency is compromised by an attack.

[0110] The memory queue may be an efficient data buffer memory queue for temporarily storing encrypted data blocks and their corresponding metadata.

[0111] The preset cache target path may be a preset file directory for storing virtual printing temporary files.

[0112] Specifically, the system idle thread information is collected in real time through the system API, and the corresponding encryption thread and writing thread are dynamically created according to the idle thread index. The dynamic thread allocation method is used to avoid resource idleness or overload problems caused by the fixed thread allocation strategy. According to the number of data blocks in the document data block set, the corresponding number of key-value pairs in the pre-selected key pool are randomly selected to determine the key set to be used. In order to prevent the use of injected or tampered keys that may exist in the pre-selected key pool (if the injected or tampered keys are used, the encryption process will lose its meaning), according to the obtained unique index identifier, verify whether the corresponding unique index identifier is the ratio of the generation time millisecond value to the corresponding auto-increment index value. If the key is injected or tampered in the middle, there must be at least one abnormal data in its corresponding generation time millisecond value and auto-increment index value. If there is a tampered key, the key to be used is selected from the ratio of the injected or tampered keys to the auto-increment index value. Delete the corresponding key-value pairs in the set, extract the corresponding number of key-value pairs from the pre-selected key pool and add them to the key set to be used, and re-verify the newly added key-value pairs to prevent the pre-selected key pool from being continuously polluted. Through the verification of the unique index identifier, prevent the use of injected and tampered keys. When there is no tampered key in the key set to be used, use a symmetric encryption algorithm such as the AES encryption algorithm through several encryption threads to perform parallel symmetric encryption on each data block to improve encryption efficiency and avoid thread resource competition. The encrypted data block and the corresponding unique index identifier are transmitted to the corresponding memory queue. The write thread takes the encrypted data block and the corresponding unique index identifier from the corresponding memory queue, and performs I / O write on the encrypted data block and the corresponding unique index identifier according to the preset cache target path to obtain local encryption cache information and complete the temporary encryption cache operation on the file.

[0113] Through this solution, by creating and separating the encryption thread and the writing thread, CPU-intensive encryption tasks are handed over to a dedicated encryption thread, and I / O-intensive writing tasks are handed over to a dedicated writing thread, avoiding the occurrence of thread resource competition, improving the encryption and writing efficiency of files, and effectively resisting the middleman's attack on the pre-selected key pool through the key tampering detection mechanism. Through the cooperation of threads and memory queues, the data throughput efficiency of the file encryption and writing process is guaranteed to avoid task blocking.

[0114] In some embodiments, the memory queue is a lock-free queue; a circular queue is formed between several encryption threads and the memory queue; when the encryption thread transfers the corresponding encrypted data block and unique index identifier to the memory queue, the resources occupied by the corresponding data block and key in the encryption thread are immediately released; a one-way queue is formed between several writing threads and the memory queue.

[0115] A lock-free queue can be a multi-threaded concurrent access queue implemented based on atomic operations (Compare-And-Swap, CAS), without the need to control thread synchronization through mutexes.

[0116] The circular queue acts as a data channel between the encryption thread and the memory queue, using a ring buffer design. The buffer is divided into fixed-size slots, which the encryption thread fills sequentially in a circular manner, automatically overwriting the oldest data when the slots are full.

[0117] A one-way queue can be a data transmission channel between a memory queue and a write thread, allowing data to flow only from the queue to the write thread and prohibiting the reverse operation.

[0118] Specifically, traditional memory queues use mutual exclusion locks to ensure thread safety. In short-term high-concurrency scenarios (such as one-time virtual printing of massive files), the thread enters a blocked state due to waiting for the lock to be released, which will cause the virtual printer data throughput to drop sharply. A lock-free queue is used as the type of memory queue, and multi-threaded concurrent access is achieved through CAS atomic operations. The encryption thread directly writes data by calculating the next available slot pointer without waiting for the lock to be released, so as to support the encryption thread to efficiently and continuously fill the memory queue. Furthermore, the data transmission channel between the memory queue and the encryption thread is set to a circular queue. The circular queue divides the memory into slots of equal length. The encryption thread fills data into the memory queue in a circular order. When the memory queue is full, it automatically overwrites the earliest filled slot that has been read by the writing thread, and releases the corresponding data block and key resources in the encryption thread, thereby improving memory utilization. The data transmission channel between the writing thread and the memory queue is set to a one-way queue, which only allows data to flow from the queue to the writing thread, so as to prevent reverse injection attacks from contaminating the memory queue, further improving data security.

[0119] Through this solution, the memory queue is set as a lock-free queue to eliminate thread contention, improve the data throughput of encryption tasks, and reduce response delays in high-concurrency scenarios. The setting of a circular queue improves the efficiency of encryption threads in filling the memory queue and improves memory utilization. The setting of a one-way queue prevents reverse injection attacks from contaminating the memory queue while ensuring data sequence, further improving data security.

[0120] In some embodiments, a preselected key pool is retrieved based on the unique index identifier corresponding to each encrypted data block, a number of decryption keys are determined, and a decryption key set is constructed; a secure enclave is created and divided into a decryption buffer and a read buffer; in the decryption buffer, each encrypted data block in the local encryption cache information is symmetrically decrypted based on the decryption key set to determine a decrypted data block set; in the read buffer, all decrypted data blocks are combined based on the unique combination index corresponding to each decrypted data block in the decrypted data block set to determine a combined data block sequence; and virtual print content is generated and output based on the combined data block sequence.

[0121] The decryption key set may be a valid key set retrieved from a pre-selected key pool and used for batch decryption of encrypted data blocks.

[0122] A secure enclave can be an isolated memory area built based on an HSM (Hardware Security Module) or a Trusted Execution Environment (TEE), which only allows authorized processes to access it and prevents sensitive data (such as decryption keys) from being maliciously stolen.

[0123] The decryption buffer can be a memory partition in the secure enclave specifically used to perform decryption operations. During the decryption process, the key and plaintext data only reside in this area and are erased immediately after completion.

[0124] The read buffer can be a memory partition in the secure enclave used to temporarily store decrypted data blocks. It supports content reorganization based on a unique combination index, and the data is automatically released after the reorganization is completed.

[0125] The decrypted data block set may be a set including all data blocks that have been decrypted.

[0126] The combined data block sequence may be a complete file sequence obtained by sorting and concatenating the decrypted data blocks according to the unique combined index.

[0127] Specifically, the existing virtual printer decryption process is performed in the system's public memory. Attackers can steal the decryption key through memory dumps (such as Cold Boot attacks), resulting in the cracking of encrypted data. By creating a secure enclave, the decryption process is confined to a hardware-level isolated environment. For example, Intel SGX technology is used to create a secure container. The key is only used for decryption within the enclave, and external processes cannot access the enclave memory, completely eliminating the risk of key leakage. The secure enclave is divided into a decryption buffer and a read buffer. The decryption buffer is dedicated to key verification and data block decryption. After completion, the plaintext data is immediately moved to the read buffer and the decryption buffer content is erased. The read buffer only allows data to be read in sequence according to a unique combination index to prevent malicious processes from inserting illegal data blocks. The read buffer reorganizes the decrypted database based on the unique combination index corresponding to each data block, and converts the combined data block sequence into the user's target file format, such as PDF format, through the virtual printer driver to construct and output the virtual print content.

[0128] This solution utilizes a secure enclave and dual-buffer design to isolate the entire data block decryption and reassembly process in an isolated environment, thereby defending against advanced threats such as memory scanning and cold boot attacks, significantly reducing the risk of data leakage. The decryption and reassembly efficiency of data blocks is improved by dividing and separating the decryption buffer and the read buffer.

[0129] Figure 3 A structural diagram of a file security transmission system based on a virtual printer is provided in one embodiment of the present application. Figure 3 As shown, a virtual printer-based secure file transmission system 300 of this embodiment includes: a key pool creation module 301 , a document analysis module 302 , an encryption cache module 303 and a decryption output module 304 .

[0130] A key pool creation module 301 is configured to obtain a key constraint parameter set and generate a preselected key pool based on the key constraint parameter set; The document analysis module 302 is used to obtain virtual printing task information, analyze the virtual printing task information, and generate a document data block set; The encryption cache module 303 is configured to perform encryption-write separation transmission on each data block in the document data block set based on the preselected key pool to generate local encryption cache information; The decryption output module 304 is used to determine a decryption key set based on the local encryption cache information and the pre-selected key pool, and decrypt and read each data block in the local encryption cache information according to the decryption key set to generate and output virtual print content.

[0131] Optionally, in the key pool creation module 301, the key constraint parameter set includes initial pool capacity, key length, key life cycle and random number source; the pre-selected key pool is installed in a non-relational cache database that supports Key-Value data structure.

[0132] Optionally, the key pool creation module 301 is specifically configured to: Based on the key length and according to the random number source, a symmetric encryption algorithm is used to generate a number of preselected encryption keys corresponding to the initial pool capacity, determine the preselected encryption key set, and record the millisecond value of the generation time and the auto-increment index value of each preselected encryption key; the starting auto-increment value of the auto-increment index value is 1; based on the ratio between the millisecond value of the generation time of each preselected encryption key and the corresponding auto-increment index value, determine the unique index identifier of each preselected encryption key; based on the unique index identifier and the preselected encryption key, generate corresponding key-value pair data, and based on the key life cycle, set a validity period for the key-value pair data to determine the key-value pair set; based on the key-value pair set, the generation time millisecond value of each preselected encryption key and the auto-increment index value, construct the preselected key pool.

[0133] Optionally, the system 300 further includes a key rotation module 305, specifically configured to: The preselected key pool is divided into a plurality of logical partitions, including an active area, a buffer area, and a to-be-eliminated area. The active area is used to store key-value pairs whose active time is less than a preset active period. The active area is accessed frequently. Each time a key-value pair in the active area is used, the active time of the corresponding key-value pair is reset. The buffer area is used to store newly generated but unused key-value pairs. The buffer area is used to smoothly expand the capacity of the active area. When a key-value pair in the buffer area is used, the corresponding key value is stored in the active area. The eliminated area is used to store key-value pairs whose active time is greater than a preset active period. The key-value pairs in the eliminated area are only allowed to be used and their active time is not allowed to be reset. When the existence time of a key-value pair in the eliminated area exceeds the corresponding validity period, the corresponding key-value pair is deleted. According to a preset recycling period, the key-value pairs in the buffer area that have not been used within the preset recycling period are deleted, and a corresponding number of key-value pairs are generated.

[0134] Optionally, the document analysis module 302 is specifically configured to: Analyze the virtual printing task information to extract the sequence of files to be processed and the total file size; based on the total file size and according to the virtual printer data throughput rate, determine the unit data block size; based on the data block local coverage strategy, divide the sequence of files to be processed into a number of document data blocks to be processed according to the unit data block size; and construct the document data block set based on the several document data blocks to be processed.

[0135] Optionally, the data block local coverage strategy in the document analysis module 302 is specifically used to: It is prohibited for a unit data block to completely cover any single file in the sequence of files to be processed; the unit data block only contains partial file contents corresponding to several files in the sequence of files to be processed; when a single file in the sequence of files to be processed is split, a unique combined index is established for the partial file contents obtained by each split.

[0136] Optionally, the encryption cache module 303 is specifically configured to: Obtain idle thread information, and determine the target thread index set based on the idle thread information; create several encryption threads and corresponding several writing threads based on the target thread index set; extract the corresponding number of key-value pairs in the pre-selected key pool based on the number of data blocks in the document data block set, and determine the key set to be used; based on the unique index identifier, verify whether there is a tampered key in the key set to be used according to the generation time millisecond value and the self-increment index value recorded in the pre-selected key pool; if the tampered key exists, delete the corresponding key-value pair from the key set to be used, and re-extract the corresponding number of key-value pairs from the pre-selected key pool. The key-value pair is added to the key set to be used, and the newly added key-value pair is re-verified; when there is no tampered key in the key set to be used, according to each key in the key set to be used, a symmetric encryption algorithm is used through several encryption threads to perform parallel symmetric encryption on each data block in the document data block set, and each encrypted data block and the unique index identifier of the corresponding key are transmitted to the memory queue; according to the preset cache target path, each encrypted data block provided by the memory queue and the corresponding unique index identifier are written to the preset cache target path through several writing threads to construct the local encrypted cache information.

[0137] Optionally, the memory queue in the encryption cache module 303 is a lock-free queue; a circular queue is formed between several encryption threads and the memory queue; when the encryption thread transfers the corresponding encrypted data block and unique index identifier to the memory queue, the resources occupied by the corresponding data block and key in the encryption thread are immediately released; a one-way queue is formed between several write threads and the memory queue.

[0138] Optionally, the decryption output module 304 is specifically configured to: According to the unique index identifier corresponding to each encrypted data block, the pre-selected key pool is retrieved to determine a number of decryption keys and construct the decryption key set; a secure enclave is created and divided into a decryption buffer and a read buffer; in the decryption buffer, each encrypted data block in the local encryption cache information is symmetrically decrypted according to the decryption key set to determine a decrypted data block set; in the read buffer, all decrypted data blocks are combined according to the unique combination index corresponding to each decrypted data block in the decrypted data block set to determine a combined data block sequence; and the virtual print content is generated and output based on the combined data block sequence.

[0139] The system of this embodiment can be used to execute the method of any of the above embodiments. Its implementation principles and technical effects are similar and will not be described in detail here.

Claims

1. A file security transmission method based on a virtual printer, characterized in that: include: Obtaining a key constraint parameter set, and generating a preselected key pool based on the key constraint parameter set; Acquire virtual printing task information, analyze the virtual printing task information, and generate a document data block set; Based on the preselected key pool, each data block in the document data block set is encrypted and written separately for transmission to generate local encryption cache information; A decryption key set is determined according to the local encrypted cache information and the preselected key pool, and decryption-reading separate transmission is performed on each data block in the local encrypted cache information according to the decryption key set to generate and output virtual print content.

2. The method according to claim 1, characterized in that The key constraint parameter set includes initial pool capacity, key length, key life cycle and random number source; The pre-selected key pool is installed in a non-relational cache database that supports a Key-Value data structure.

3. The method according to claim 2, characterized in that Generating a preselected key pool according to the key constraint parameter set includes: Based on the key length and the random number source, a symmetric encryption algorithm is used to generate a number of preselected encryption keys corresponding to the initial pool capacity, determine a set of preselected encryption keys, and record the millisecond value of the generation time and the auto-increment index value of each preselected encryption key; The starting value of the auto-increment index is 1. Determine a unique index identifier for each preselected encryption key based on a ratio between the millisecond value of the generation time of each preselected encryption key and the corresponding auto-increment index value; Generate corresponding key-value pair data according to the unique index identifier and the preselected encryption key, set a validity period for the key-value pair data according to the key life cycle, and determine a key-value pair set; The preselected key pool is constructed according to the key-value pair set, the generation time in milliseconds value of each preselected encryption key, and the auto-increment index value.

4. The method according to claim 3, characterized in that The method further comprises: Dividing the pre-selected key pool into a plurality of logical partitions, wherein the plurality of logical partitions include an active area, a buffer area, and a to-be-eliminated area; The active area is used to store the key-value pairs whose active time is less than a preset active period. The active area is accessed frequently. Each time the key-value pairs in the active area are used, the active time of the corresponding key-value pairs is reset. The buffer is used to store the newly generated but unused key-value pairs. The buffer is used to smoothly expand the active area. When the key-value pairs in the buffer are used, the corresponding key-value pairs are stored in the active area. The elimination zone is used to store the key-value pairs whose active time is greater than a preset active period. The key-value pairs in the elimination zone are only allowed to be used, and their active time is not allowed to be reset. When the existence time of the key-value pairs in the elimination zone is greater than the corresponding validity period, the corresponding key-value pairs are deleted; According to a preset recycling cycle, the key-value pairs in the buffer area that are not used within the preset recycling cycle are deleted, and a corresponding number of the key-value pairs are generated.

5. The method according to claim 3, characterized in that The step of analyzing the virtual printing task information to generate a document data block set includes: Analyzing the virtual printing task information to extract the sequence of files to be processed and the total file size; Based on the total file size and the data throughput rate of the virtual printer, determining a unit data block size; Based on the data block partial coverage strategy, the to-be-processed file sequence is divided into a plurality of to-be-processed document data blocks according to the size of the unit data block; The document data block set is constructed according to the plurality of document data blocks to be processed.

6. The method according to claim 5, characterized in that The data block local coverage strategy includes: It is prohibited for a unit data block to completely cover any single file in the sequence of files to be processed; The unit data block only contains partial file contents corresponding to several files in the sequence of files to be processed; When a single file in the sequence of files to be processed is split, a unique combined index is created for each of the partial file contents obtained by the split.

7. The method according to claim 5, characterized in that The step of performing encryption-write separation transmission on each data block in the document data block set based on the preselected key pool to generate local encryption cache information includes: Obtaining idle thread information, and determining a target thread index set based on the idle thread information; Creating a number of encryption threads and corresponding writing threads according to the target thread index set; Extracting a corresponding number of key-value pairs from the preselected key pool according to the number of data blocks in the document data block set, and determining a key set to be used; Based on the unique index identifier, and according to the millisecond value of the generation time and the auto-increment index value recorded in the pre-selected key pool, verify whether there is a tampered key in the key set to be used; If the tampered key exists, deleting the corresponding key-value pair from the key set to be used, re-extracting a corresponding number of key-value pairs from the pre-selected key pool and adding them to the key set to be used, and re-verifying the newly added key-value pairs; When no tampered key exists in the key set to be used, performing parallel symmetric encryption on each data block in the document data block set using a symmetric encryption algorithm based on each key in the key set to be used, and transmitting each encrypted data block and the unique index identifier of the corresponding key to a memory queue; According to a preset cache target path, each encrypted data block provided by the memory queue and the corresponding unique index identifier are written into the preset cache target path by a plurality of the writing threads to construct the local encrypted cache information.

8. The method according to claim 7, characterized in that The memory queue is a lock-free queue; A circular queue is formed between the plurality of encryption threads and the memory queue; When the encryption thread transmits the corresponding encrypted data block and unique index identifier to the memory queue, immediately releasing the resources occupied by the corresponding data block and key in the encryption thread; A unidirectional queue is formed between the plurality of writing threads and the memory queue.

9. The method according to claim 7, characterized in that The method of determining a decryption key set based on the local encrypted cache information and the pre-selected key pool, and performing decryption-reading separate transmission on each data block in the local encrypted cache information based on the decryption key set to generate and output virtual print content includes: According to the unique index identifier corresponding to each encrypted data block, the pre-selected key pool is searched to determine a plurality of decryption keys, and the decryption key set is constructed; creating a secure enclave, dividing the secure enclave into a decryption buffer and a read buffer; In the decryption buffer, symmetrically decrypting each encrypted data block in the local encryption cache information according to the decryption key set to determine a set of decrypted data blocks; In the read buffer, according to the unique combination index corresponding to each decrypted data block in the decrypted data block set, all the decrypted data blocks are combined to determine a combined data block sequence; The virtual printing content is generated and output according to the combined data block sequence.

10. A file security transmission system based on a virtual printer, characterized in that: include: A key pool creation module is used to obtain a key constraint parameter set and generate a pre-selected key pool according to the key constraint parameter set; A document analysis module, configured to obtain virtual printing task information, analyze the virtual printing task information, and generate a document data block set; An encryption cache module, configured to perform encryption-write separation transmission on each data block in the document data block set based on the preselected key pool, and generate local encryption cache information; The decryption output module is used to determine a decryption key set based on the local encrypted cache information and the pre-selected key pool, and perform decryption-reading separate transmission on each data block in the local encrypted cache information based on the decryption key set to generate and output virtual print content.

Images