Multi-level security management and control system for electronic archives

Abstract

The invention relates to the technical field of information security, and discloses an electronic archive multi-level security management and control system, which comprises an integrated security management and control platform deployed at a server side and a trusted security terminal module at a client side, the trusted security terminal module is used for periodically generating and sending heartbeat messages containing client environment characteristics; receiving the encrypted data fragments and the recombined blueprint issued by the server, and rendering the data in the memory in real time; the integrated security management and control platform is used for receiving and continuously verifying the heartbeat message; and dynamically decomposing the electronic file into encrypted data fragments according to the client state passing the verification, generating a recombined blueprint, and issuing the recombined blueprint to the client. According to the method, a dynamic closed-loop management and control system is constructed through client continuous state certification and server state binding fragmentation technology, and the data security of the electronic archives in the interaction process is remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to a multi-level security management and control system for electronic archives. BACKGROUND

[0002] With the development of information technology, electronic archives are gradually replacing traditional paper archives in many fields such as government, finance, scientific research and military, and becoming the main form of information resource management, due to their advantages such as efficient storage and convenient retrieval. However, the digitization and networking characteristics of electronic archives also pose unprecedented security challenges, such as illegal copying, unauthorized access, data leakage, and malicious attacks on reading terminals. Therefore, it is of great practical significance to develop a technical solution that can ensure the security and controllability of electronic archives throughout their storage, transmission and reading life cycle.

[0003] Currently, to solve the problem of secure reading of electronic archives, a common technical solution is to establish an encrypted channel based on the Transport Layer Security (TLS) protocol between the client and the server. After the user is authenticated, the server sends the complete and encrypted electronic archive file to the authorized client application. The client application decrypts the entire file locally and renders the decrypted content in its software interface. To prevent data leakage, such client applications usually integrate some local security protection functions, such as prohibiting file printing, copying and saving as, or limiting the screenshot function at the operating system level through technical means.

[0004] Although the existing technology ensures the security of archives to some extent through encrypted transmission and permission control, there are still some inherent limitations in the design of its security mechanism. The core problem lies in its architecture model of "one-time authentication, whole delivery, and complete trust of the client". First of all, the security verification of this model is static, only verifying the identity and environment of the user at the initial stage of the access session. Once the authentication is passed, the server lacks effective means to perceive and constrain the subsequent changes in the client's environment. If the client's environment is infected with malicious processes or attacked by network attacks during the reading process, the static security model cannot make any dynamic response, and the secure session and decrypted data will continue to be exposed to risks.

[0005] Secondly, delivering the complete encrypted archive as a whole greatly increases the loss caused by a single data leakage. Once the attacker breaks through this layer of encryption through certain means (such as a man-in-the-middle attack or obtaining the session key from the client's memory), he obtains the entire ciphertext of the archive, which facilitates subsequent offline cracking and constitutes a high-value single attack target.

[0006] Furthermore, this model places all authority and logic for data decryption, content reassembly, and final rendering entirely on the client. This complete trust in the client is fragile, as the client environment is the most complex and uncontrollable link in the entire security chain. Once an attacker gains control of the client application's process space through vulnerability exploits or memory scraping, they can directly obtain the final decrypted plaintext data. Existing technologies lack effective countermeasures against such deep attacks on the client.

[0007] Finally, existing defenses are reactive. They protect against attacks by setting up access barriers, but they are unable to proactively identify and trap attackers attempting to circumvent defenses. When a potential attack occurs, the model cannot distinguish it from normal user errors, lacking the ability to proactively alert and block attacks in real time. Summary of the Invention

[0008] The purpose of the present invention is to provide a multi-level security management and control system for electronic archives, which solves the problem in the prior art that after a one-time static authentication of the client environment, subsequent changes in its security status cannot be effectively perceived, thereby causing the data to be continuously exposed to unknown risks throughout the reading process.

[0009] To achieve the above objectives, the present invention is implemented through the following technical solutions: The present invention provides a multi-level security management and control system for electronic archives, which includes an integrated security management and control platform deployed on a server side and a trusted security terminal module deployed on a client side.

[0010] The integrated security management and control platform is used to receive and process requests from the trusted security terminal module. Its core function is to dynamically and illogically decompose the original electronic file into a series of encrypted data fragments bound to the state based on the environmental status reported in real time by the trusted security terminal module, and generate corresponding reorganization instructions that require authorization from multiple parties before use.

[0011] The trusted secure terminal module is used to provide users with a unique interface for accessing electronic archives. Its core function is to continuously prove the security of its own operating environment to the integrated security management and control platform, and to perform instant, non-persistent reorganization and rendering of encrypted data fragments in the protected client memory based on instructions obtained from the integrated security management and control platform and other authorized nodes.

[0012] Specifically, the technical solution of the system includes the following modules and functional processes: The integrated security management and control platform is the control center of this system and consists of the following modules: The terminal authentication and session management module is used to authenticate the trusted secure terminal module that requests access, establish an encrypted communication session after the authentication is passed, and distribute the session master key K session This module continuously receives and verifies the heartbeat message Msg sent periodically by the trusted security terminal module. heartbeat If the heartbeat message fails to be verified, times out, or contains an abnormal environment status, the current session will be terminated immediately.

[0013] The adaptive content security engine module is the core of dynamic security control. When responding to the archive access request from the trusted security terminal module, it performs the following operations: From the latest verified heartbeat message Msg heartbeat In (t-1), extract the environmental status proof A C The hash value of (t-1) is used as the dynamic security seed for this data processing. dyn .

[0014] Seed dyn =H(A C (t-1)); In the formula, Seed dyn is the dynamic security seed; H is a preset cryptographic hash function; A C (t-1) is the environmental status certificate generated by the trusted secure terminal module at the previous time point t-1; The dynamic security seed dyn As input parameters of the pseudo-random function, a series of non-fixed and irregular segmentation boundary offsets are generated for the original electronic file F to be accessed, and the electronic file F is decomposed into a series of data fragments based on this offset set. This process is determined by the following formula: {o1,o2,...,o n}=PRF(Seed dyn ,length(F)); In the formula, {o1,o2,...,o n} is a set of segmentation boundary offsets of the electronic file F, where each element represents the byte offset position of a segmentation point in the file; PRF is a pseudo-random function used to generate a deterministic but unpredictable output sequence; Seed dyn is the dynamic security seed, whose value uniquely depends on the environmental state of the client at the previous moment; length(F) is the total byte length of the electronic file F.

[0015] For each data fragment i Generate a unique, one-time encryption key The key generation process is determined by the following formula: session , the dynamic security seed Seed dyn And the serial number i of the data fragment is bound: Where, K is the one-time encryption key for the i-th data fragment; session The session master key for the current session between the integrated security management and control platform and the trusted security terminal module; dyn is the dynamic security seed; i is the serial number of the data fragment; HMAC is a hash-based message authentication code function; || is a data splicing operator.

[0016] Then, use the generated key For the corresponding data fragment frag i Encrypt to obtain encrypted data fragments

[0017] In the process of generating data fragments, according to the preset security policy, one or more honeypot fragments are generated that are indistinguishable from normal data fragments in terms of data structure. h , and encrypt it and randomly insert it into the encrypted data fragment stream.

[0018] The distributed authorization and auditing module is used to improve the robustness of the system and achieve active attack awareness: Split the reorganization blueprint B used to guide the reorganization of data fragments into two parts: the infrastructure blueprint B that defines most of the reorganization logic base , and defines the key node authorization B of the key connection point reorganization information key . B base Directly managed by this platform, and B key The authorization information is distributed to one or more independent verification microservices for safekeeping.

[0019] The verification microservice it manages is responsible for monitoring and identifying authorized access requests for the honeypot fragments. Once such a request is received, it is identified as an attack behavior and immediately reports a security alert containing the attack fingerprint to the system security center, triggering the blocking of the relevant session.

[0020] The trusted secure terminal module is the execution entity of this system deployed on the user side and consists of the following units: The environment status perception and certification unit is used to periodically collect the client's operating environment characteristics to form a structured environment status certification package. The generation process is determined by the following formula: A C (t)={ts,H proc,H net ,F dbg ,FA C (t)={ts,H proc ,H net ,F dbg ,F virt ,H sys ,...}; Where A C (t) is the environmental status certification package generated by the trusted secure terminal module at time point t; ts is the precise timestamp when the trusted secure terminal module generates the certification package; H proc H is the hash value obtained by computing the key process list currently running on the trusted secure terminal module through a preset hash function; net The hash value obtained by performing a preset hash function operation on the current network configuration information of the trusted secure terminal module; dbg A flag bit representing the debugger status of the system where the trusted secure terminal module is located; F virt A flag indicating whether the trusted secure terminal module is running in a virtualized environment; sys is the integrity check hash value of the key system files of the trusted security terminal module; ... is a set of other preset characteristic parameters used to characterize the security status of the client environment where the trusted security terminal module is located.

[0021] Then, using the client private key P C To A C The hash value of (t) is digitally signed to generate the final heartbeat message Msg heartbeat (t) and sent to the integrated security management and control platform. This process is determined by the following formula: Msg heartbeat (t) = A C (t)|||Sig(H(A C (t)),P C ); In the formula, Msg heartbeat (t) is the heartbeat message generated at time t and finally sent to the server; A C (t) is the environmental status certification package at the current time point; H is the preset cryptographic hash function; Sig is the digital signature function; P C is the private key held by the trusted secure terminal module and used for signing; || is the data splicing operator.

[0022] The multi-source authorization and data reassembly unit is used to perform the following operations after initiating an archive access request: Receive the encrypted data fragment stream and encrypted infrastructure blueprint B sent by the integrated security management and control platform base According to Bbase Instructions in the request to one or more specified verification microservices and obtain key node authorization B key After assembling the complete reconstruction blueprint, the data fragments are rendered in real time within the protected memory provided by the security sandbox and protection unit, presenting the visual content on the screen. Throughout this process, the complete, decrypted electronic archive file is not created in any persistent storage or memory area on the client.

[0023] The security sandbox and protection unit is used to provide an isolated memory space for the operation of the multi-source authorization and data reassembly unit, and has the function of preventing external programs from capturing screen content and reading memory data to ensure the security of data in the final presentation link.

[0024] In summary, the present invention includes at least one of the following beneficial technical effects: 1. This invention utilizes the adaptive content security engine module within the integrated security management and control platform to break down static electronic archives into encrypted data fragments that are strongly tied to the client's real-time environmental state. Specifically, the system uses the environmental state proof carried in heartbeat messages to generate a dynamic security seed, which determines the fragmentation structure and the one-time encryption key. Therefore, any data fragment that is separated from a specific point in time and client environment is inherently worthless and cannot be reassembled offline, ensuring that even if the archive data is intercepted, it cannot be decrypted and exploited.

[0025] 2. By splitting the reorganization blueprint into a basic structure blueprint issued by the main platform and key node authorizations maintained by an independent verification microservice, this invention disperses the risks of authorization management and avoids single points of failure. Furthermore, by injecting honeypot fragments into the data stream, the system can proactively trap and identify illegal reorganization attempts. Once an attacker triggers access to the honeypot fragment, the distributed authorization and auditing module immediately issues an alert and blocks the session, achieving a technological leap from passive defense to active trapping.

[0026] 3. The trusted security terminal module of the present invention periodically sends a heartbeat message containing proof of its environmental status, and the integrated security management and control platform continuously verifies the message. Any abnormality in the client environment (such as the debugger is turned on) or network interruption will cause verification failure, and the platform will immediately terminate the issuance of data and authorization. This mechanism of real-time, two-way binding of the client environment status to the server authorization policy ensures that data can only be used under the premise of continuous trustworthiness of the environment, effectively preventing data leakage caused by deterioration of the client environment during the session. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 Schematic diagram of the system structure of the present invention; Figure 2 Schematic diagram of the internal structure of the trusted and secure terminal module of the present invention; Figure 3 This is a schematic diagram of the internal structure of the integrated security management and control platform of the present invention; Figure 4 Schematic diagram of the workflow of the present invention. DETAILED DESCRIPTION

[0028] The following is combined with Figure 1 , the present invention is described in further detail.

[0029] Attachment Figure 1 Figure 2 is a schematic diagram of the system architecture of a multi-level security management and control system for electronic archives according to one embodiment of the present invention. This embodiment of the present invention provides a multi-level security management and control system for electronic archives. The system may include a trusted security terminal module 10 deployed on a client device and an integrated security management and control platform 20 deployed on one or more servers. The trusted security terminal module 10 and the integrated security management and control platform 20 are connected to each other via a network.

[0030] The trusted security terminal module 10, as the execution entity for the user to interact with this system, has the following functions: after receiving the user's file access instruction, it initiates a file access request to the integrated security management and control platform 20; after the session is established, it periodically collects the environmental characteristics of the client device where it is located to generate a structured environmental status certificate, and digitally signs the certificate and encapsulates it as a heartbeat message, which is continuously sent to the integrated security management and control platform 20; and, it receives the encrypted data fragments and reassembly blueprints issued by the integrated security management and control platform 20, and performs real-time rendering in a protected memory space to present the electronic file content to the user in a visual manner.

[0031] The integrated security management and control platform 20, as the control entity of this system, has the following functions: receiving and verifying the access request and user identity information of the trusted security terminal module 10 to establish a secure session; continuously receiving and verifying the heartbeat messages sent by the trusted security terminal module 10 to confirm the security of the client environment in real time; responding to file access requests, and based on the verified heartbeat message content, dynamically and non-logically decomposing and encrypting the original electronic files, thereby generating a series of encrypted data fragments and a corresponding reorganization blueprint, and sending both to the trusted security terminal module 10.

[0032] In a specific embodiment, the collaborative relationship between the trusted secure terminal module 10 and the integrated security management and control platform 20 is constrained by a closed-loop security mechanism based on continuous state proof. The trusted secure terminal module 10 continuously provides proof of its own environmental state to the integrated security management and control platform 20 by sending heartbeat messages. The generation of heartbeat messages can be determined by the following formula: Msg heartbeat (t) = A C (t)|||Sig(H(A C (t)),P C ); In the formula, Msg heartbeat (t) is the heartbeat message generated at time t and finally sent to the server; A C (t) is the environmental status certification package at the current time point; H is the preset cryptographic hash function; Sig is the digital signature function; P C It is the private key held by the trusted secure terminal module and used for signing; || is the data splicing operator.

[0033] After receiving and verifying the integrity and signature validity of the above-mentioned heartbeat message, the integrated security management and control platform 20 processes the electronic archive in a manner that is strongly related to the content of the heartbeat message. The platform first extracts the environmental status certificate A from the verified heartbeat message at the previous moment. C The hash value of (t-1) is used as the dynamic security seed. dyn .

[0034] Seed dyn =H(A C (t-1)); In the formula, Seed dyn is a dynamic security seed; H is a preset cryptographic hash function; A C (t-1) is the environment status proof generated by the trusted secure terminal module at the previous time point t-1.

[0035] Subsequently, the platform uses this dynamic security seed and the session master key K of the current session to session , for each data fragment to be decomposed, the platform then uses this dynamic security seed and the session master key K of the current session session , for each data fragment to be decomposed i Generate a one-time encryption key

[0036] The key generation process can be determined by the following formula: Where, K is the one-time encryption key for the i-th data fragment; K session Seed is the session master key for the current session between the integrated security management platform and the trusted security terminal module; dyn Seed is the dynamic security seed; i is the serial number of the data fragment; HMAC is the hash-based message authentication code function; || is the data concatenation operator.

[0037] In the above manner, the system binds the decomposition and encryption process of the electronic archives to the security state of the client device at a specific time point. The trusted security terminal module 10 can only finally complete the reading of the archive content when it can continuously prove the security of its environment and correctly obtain the matching encrypted data and reorganization instructions from the integrated security management platform 20, thereby constructing a complete, dynamic, and closed-loop security management process.

[0038] Referring to the accompanying drawings Figure 2 , the accompanying drawings Figure 2 is a schematic diagram of the internal structure of the trusted security terminal module 10 according to an embodiment of the present application. In a specific implementation, the trusted security terminal module 10 can include: an environment state perception and proof unit 11, a multi-source authorization and data reorganization unit 12, and a security sandbox and protection unit 13.

[0039] This part will describe the environment state perception and proof unit 11 in detail. The function of this unit is to periodically collect the running environment characteristics of the client device it is located in, and combine and sign these characteristics to generate a heartbeat message that can be verified. This unit is the basis for realizing the client state reporting function in the closed-loop management system of the present application.

[0040] In a specific embodiment, the environment state perception and proof unit 11 is configured to periodically perform a state collection process. The process includes: acquiring the current precise timestamp of the client device; scanning and acquiring a preset list of key processes; reading the current system network configuration information; detecting whether there is a system-level or application-level debugger in an active state; determining whether the current operating system is running on a virtualization environment; and calculating the hash value of a preset key system file for integrity verification.

[0041] After collecting the above environment characteristics, the environment state perception and proof unit 11 organizes these characteristic values in a structured manner to generate an environment state proof package. The proof package is represented by the following formula: A C (t)={ts,H proc ,H net ,F dbg ,FA C (t)={ts,H procH net ,F dbg ,F virt ,H sys ,...}; wherein A C (t) is the environment state attestation package generated by the trusted secure terminal module at time point t; ts is the precise time stamp when the trusted secure terminal module generates the attestation package; H proc is the hash value of the list of critical processes currently running in the trusted secure terminal module after being operated by a preset hash function; H net is the hash value of the current network configuration information of the trusted secure terminal module after being operated by a preset hash function; F dbg is a flag representing the state of the system debugger in which the trusted secure terminal module is located; F virt is a flag representing whether the trusted secure terminal module is running in a virtualized environment; H sys is the integrity verification hash value of the critical system files of the trusted secure terminal module; and... is a set of other preset characteristic parameters representing the security state of the client environment in which the trusted secure terminal module is located.

[0042] Subsequently, the environment state awareness and attestation unit 11 uses its own securely held asymmetric encryption private key to digitally sign the hash value of the aforementioned generated environment state attestation package, and splices the original environment state attestation package with the digital signature to generate the final heartbeat message.

[0043] Finally, the environment state awareness and attestation unit 11 sends the generated heartbeat message Msg heartbeat (t) through the encrypted channel established with the integrated security management platform 20 for verification and decision-making by the latter. This process is executed in a loop at a preset frequency (e.g., once every few seconds), thereby constituting continuous monitoring and attestation of the client environment.

[0044] The function of the multi-source authorization and data reorganization unit 12 is to initiate a file access request after receiving the user's operation instruction, and to be responsible for receiving and processing data and authorization from multiple sources, and finally to complete the instant presentation of the electronic file content in the protected memory environment.

[0045] In a specific embodiment, when the user requests to access a certain electronic file through the interface of the trusted secure terminal module 10, the multi-source authorization and data reorganization unit 12 first initiates a file access request carrying the target file identifier to the integrated security management platform 20.

[0046] After the integrated security management platform 20 responds to the request, the multi-source authorization and data reorganization unit 12 separates two core contents from the data stream it receives: one part is the infrastructure blueprint B base that contains most of the reorganization logic after being encrypted ; the other part is a data stream containing a series of encrypted data fragments .

[0047] After receiving the infrastructure blueprint B base , the multi-source authorization and data reorganization unit 12 decrypts and parses it. The blueprint contains instructions for the initial arrangement of data fragments, and crucially, it contains one or more network address pointers that point to independent verification microservices responsible for maintaining and distributing key node authorizations B key .

[0048] Subsequently, the multi-source authorization and data reorganization unit 12 initiates authorization requests to one or more corresponding verification microservices based on the network address pointers parsed from the infrastructure blueprint B base to obtain the necessary key node authorizations B key for decrypting and reorganizing the key data fragments. This request process also takes place in an encrypted channel established with the verification microservices.

[0049] After obtaining the infrastructure blueprint B base issued by the integrated security management platform 20 and the key node authorizations B key issued by all designated verification microservices, the multi-source authorization and data reorganization unit 12 combines them in memory to form a complete reorganization blueprint B.

[0050] The multi-source authorization and data reorganization unit 12 processes the received encrypted data fragment stream according to the instructions in the complete reorganization blueprint B in the isolated memory space provided by the secure sandbox and protection unit 13. This processing includes: using session keys and dynamic security seeds to derive one-time keys for each data fragment to decrypt the data fragments; splicing the decrypted data fragments in memory according to the precise order and position defined in the reorganization blueprint B; and directly rendering the spliced visual content to the display device.

[0051] The function of the secure sandbox and protection unit 13 is to provide a secure and protected execution environment for the multi-source authorization and data reorganization unit 12 to ensure the security of electronic file content during the final rendering and presentation stage, preventing data from being illegally obtained through external channels of the client.

[0052] In one specific embodiment, the security sandbox and protection unit 13 creates an independent, restricted process or memory space when the trusted secure terminal module 10 is started. All operations of the multi-source authorization and data reassembly unit 12, including parsing the reassembly blueprint, decrypting and splicing data fragments, and rendering the final content, are completed within this isolated memory space.

[0053] To protect screen content from being captured, the security sandbox and protection unit 13 is configured to perform one or more of the following operations: Through API hooking technology, it intercepts and filters function calls related to screenshots in the operating system, such as specific calls to the Graphics Device Interface (GDI) or DirectX, so that other applications cannot capture the window content rendered by this module; and when creating a rendering window, it sets specific window display properties for it. This property can inform the operating system and other compliant applications that the window content is protected and should not be recorded or copied.

[0054] To protect memory data from being captured, the security sandbox and protection unit 13 utilizes the operating system's memory protection mechanism to set the memory area allocated to the multi-source authorization and data reassembly unit 12 as private, and strictly restricts read and write access rights from any other external process.

[0055] In addition, for decrypted data fragments that temporarily exist in the memory, the unit will immediately perform data overwriting or memory clearing operations when they are no longer needed to ensure that no valuable data residues are left in the memory.

[0056] Through the above structure and functions, the security sandbox and protection unit 13 ensures that even if the electronic archive content is correctly reorganized and rendered on the client, its visual content and binary data in memory are always in a controlled and protected environment, thereby effectively resisting attacks such as screenshots, screen recordings, and malicious memory scanning from the client.

[0057] Please see the attached Figure 3 , attached Figure 3 FIG2 is a schematic diagram of the internal structure of an integrated security management and control platform 20 according to an embodiment of the present invention. In a specific implementation, the integrated security management and control platform 20 may include: a terminal authentication and session management module 21, an adaptive content security engine module 22, and a distributed authorization and audit module 23.

[0058] This section will describe in detail the terminal authentication and session management module 21. The function of this unit is to authenticate the trusted secure terminal module 10 requesting access, establish and manage secure sessions, and continuously receive and verify heartbeat messages sent by the trusted secure terminal module 10.

[0059] In a specific embodiment, when a trusted secure terminal module 10 initiates an initial connection request to the system, the terminal authentication and session management module 21 first performs an identity authentication process. This process may include: the trusted secure terminal module 10 presenting its digital certificate; the terminal authentication and session management module 21 verifying the validity of the certificate and confirming, through an asymmetric encryption mechanism, that the trusted secure terminal module 10 actually holds the private key corresponding to the public key in the certificate.

[0060] After the identity authentication is successfully completed, the terminal authentication and session management module 21 generates a unique session identifier for this connection, and generates a session master key K for all subsequent communication encryption through a key negotiation protocol with the trusted security terminal module 10. session At this point, a secure session is successfully established.

[0061] During the session, the core task of the terminal authentication and session management module 21 is to periodically receive and process the heartbeat message Msg from the trusted security terminal module 10. heartbeat (t). For each received heartbeat message, the module performs a strict verification procedure, which includes the following steps: First, the public key of the trusted secure terminal module 10 obtained in the authentication phase is used to verify the digital signature portion of the heartbeat message. If the verification is successful, it proves that the source of the message is reliable and has not been tampered with during transmission.

[0062] Secondly, check the environmental status certificate package A contained in the heartbeat message C The timestamp ts in (t) is compared with the current server time to confirm the timeliness of the message and prevent replay attacks.

[0063] Again, parse the environment status certificate package A C (t) Various environmental characteristic parameters, such as H proc 、H net 、F dbg And compare these parameter values ​​with the security policy baseline preset on the platform side to determine whether the current environment status of the client is compliant.

[0064] The terminal authentication and session management module 21 performs session control based on the above verification results. If the signature verification of the heartbeat message fails, the message reception times out, the timestamp verification fails, or any environmental characteristic parameters contained in it do not conform to the security policy baseline, the module will immediately determine that the current session has a security risk.

[0065] At this point, the module will immediately terminate the current session, mark the session identifier as invalid, and notify other modules within the platform to stop distributing any subsequent data fragments and reassembly blueprints to the trusted secure terminal module 10 corresponding to the session.

[0066] The adaptive content security engine module 22 is a functional entity that executes the core security policy of the present invention. Its function is to respond to the file access request of the trusted security terminal module 10 and perform dynamic, non-logical decomposition and encryption processing on the original electronic file based on the real-time environmental status of the client.

[0067] In a specific embodiment, when a file access request is confirmed to be valid, the adaptive content security engine module 22 first performs a dynamic security seed generation operation. The module receives the latest heartbeat message Msg that has been verified by the terminal authentication and session management module 21. heartbeat In (t-1), extract the environmental status certificate A contained therein C (t-1), and perform a hash operation on the certificate package to generate the dynamic security seed used in this file processing process. dyn .

[0068] After generating the dynamic security seed, the adaptive content security engine module 22 performs the adaptive fragmentation operation. dyn As the input parameter of the pseudo-random function, a series of non-fixed and irregular segmentation boundary offsets are generated for the original electronic file F to be accessed, and the electronic file F is decomposed into a series of data fragments {Frag1, Frag2, ..., Frag n}.

[0069] The process is determined by the following formula: {o1,o2,...,o n}=PRF(Seed dyn ,length(F)); In the formula, {o1,o2,...,o n} is a set of segmentation boundary offsets of the electronic file F, where each element represents the byte offset position of a segmentation point in the file; PRF is a pseudo-random function used to generate a deterministic but unpredictable output sequence; Seed dyn It is a dynamic security seed whose value depends uniquely on the client's environmental status at the previous moment; length(F) is the total byte length of the electronic file F.

[0070] Next, the adaptive content security engine module 22 generates a nPerform state-bound encryption operations. This module generates a unique, one-time symmetric encryption key for each data fragment. The key generation process is bound to the current session and client state.

[0071] When generating a key After that, the module immediately uses the key to encrypt the corresponding data fragments through a standard symmetric encryption algorithm (such as AES-256). i Encrypt to obtain encrypted data fragments

[0072] In addition, the adaptive content security engine module 22 is also configured to perform active defense injection operations. In the process of generating data fragments, the module generates one or more honeypot fragments that are indistinguishable from normal data fragments in terms of data structure and length according to a preset strategy. h These honeypot fragments are also encrypted and randomly inserted into the normal encrypted data fragment stream. Their corresponding reassembly information will not be included in the reassembly blueprint sent to the client.

[0073] The function of the distributed authorization and audit module 23 is to split and distribute the complete reorganization blueprint generated by the adaptive content security engine module 22, and monitor potential attack behaviors to achieve active security response.

[0074] In a specific embodiment, the distributed authorization and audit module 23 receives a complete reorganization blueprint B generated for an archive access from the adaptive content security engine module 22. The module then splits the complete reorganization blueprint B into two independent components: an infrastructure blueprint B base and one or more key nodes authorized by B key .

[0075] Infrastructure Blueprint B base It contains instructions for sorting and locating most of the non-critical data fragments, but it intentionally removes the logic information for connecting one or more critical data fragments, resulting in an incomplete instruction set. key It specifically contains the removed key connection point information necessary to complete the entire reorganization logic.

[0076] After the split is completed, the distributed authorization and audit module 23 performs the differentiated distribution operation. base Send it to the adaptive content security engine module 22 for it to be sent to the trusted security terminal module 10 that initiated the request. At the same time, it authorizes the key node B keySent to one or more independently deployed validation microservices on the network for safekeeping. In this way, no single entity holds the complete reassembly instructions.

[0077] Another core function of this module is attack perception and auditing. This function is consistent with the honeypot fragments injected by the adaptive content security engine module 22. h When the complete reassembly blueprint B is generated, it is set to not contain any fragments related to the honeypot. h Therefore, any decryption or reassembly of the honeypot fragment h Any access or authorization request that is made by the user is considered an abnormal operation.

[0078] The independent verification microservice is configured to continuously monitor all the authorization requests it receives. Once a verification microservice receives an authorization B for the key node it is keeping, key Fragments that do not exist in the honeypot h When an authorization request is received, the microservice will determine that the request is an attack.

[0079] At this time, the microservice will immediately generate a security alert containing the attack source network address, session identifier and timestamp, report it to the system security center, and trigger a notification to the terminal authentication and session management module 21 to immediately terminate the network session associated with the attack behavior.

[0080] Please see the attached Figure 4 , attached Figure 4 The figure is a schematic diagram of the workflow of a multi-level security management system for electronic archives according to one embodiment of the present invention. This embodiment of the present invention provides a multi-level security management method for electronic archives, which may include the following steps: S401: The trusted security terminal module 10 initiates a connection request to the integrated security management platform 20. The terminal authentication and session management module 21 in the integrated security management platform 20 verifies the identity of the trusted security terminal module 10. Once the verification is successful, both parties generate a session master key dedicated to this communication through a key negotiation protocol and establish a unique secure session.

[0081] S402: After the session is established, the environmental status perception and verification unit 11 in the trusted secure terminal module 10 begins periodically executing a status collection and verification process. This process combines an environmental status verification package containing various environmental characteristic parameters of the client with its own digital signature to generate a heartbeat message, which is continuously sent to the integrated security management and control platform 20. Simultaneously, when a user requests access to a specific electronic file, the trusted secure terminal module 10 sends a file access request to the integrated security management and control platform 20.

[0082] S403: After the integrated security management and control platform 20 receives the archive access request, its terminal authentication and session management module 21 first verifies the most recently received heartbeat message. Once verification is successful, the adaptive content security engine module 22 initiates the archive processing process. This module first generates a dynamic security seed based on the verified environmental status proof content and then adaptively fragments the target electronic archive based on this seed. Next, the module uses the session master key of the current session, the aforementioned dynamic security seed, and the serial number of each data fragment to derive a bound, one-time encryption key for each data fragment. This key is then used to encrypt the data fragment to generate an encrypted data fragment stream. Simultaneously, the distributed authorization and audit module 23 splits the complete reorganization blueprint into an infrastructure blueprint and key node authorizations, distributing the latter to independent verification microservices. Finally, the integrated security management and control platform 20 sends the encrypted data fragment stream and the encrypted infrastructure blueprint to the trusted security terminal module 10.

[0083] At step S404, after receiving the encrypted data fragment stream and the infrastructure blueprint, the multi-source authorization and data reassembly unit 12 in the trusted secure terminal module 10 first decrypts and parses the infrastructure blueprint to obtain the network addresses of one or more verification microservices. The unit then initiates requests to these verification microservices to obtain authorization for key nodes.

[0084] At step S405, after the multi-source authorization and data reassembly unit 12 has assembled the infrastructure blueprint and all key node authorization components, it merges them into a complete reassembly blueprint within the isolated memory space provided by the security sandbox and protection unit 13. Finally, according to the instructions of the complete blueprint, the unit decrypts, splices, and instantly renders the encrypted data fragments, presenting the visual content to the user.

[0085] S406, when the user closes the reading or the session is terminated by the terminal authentication and session management module 21 for any reason (for example, heartbeat message verification fails), the multi-source authorization and data reassembly unit 12 immediately stops rendering, and the security sandbox and protection unit 13 is responsible for clearing all relevant data in the isolated memory space. The integrated security management and control platform 20 then discards this session and related keys, completing the entire closed-loop process.

[0086] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. The multi-level security management and control system for electronic archives is characterized by: It includes an integrated security management and control platform deployed on the server side, and a trusted security terminal module deployed on the client side; The trusted security terminal module is used to send a file access request to the integrated security management and control platform, and simultaneously generate and send a heartbeat message containing the current environment characteristics of the client to the integrated security management and control platform; Receiving encrypted data fragments and reassembly blueprints from the integrated security management and control platform, and rendering the data fragments in real time in memory; The integrated security management and control platform is used to receive and verify the heartbeat message to confirm the continued credibility of the client status; In response to the archive access request of the trusted secure terminal module, the electronic archive is dynamically decomposed into a series of encrypted data fragments according to the verified heartbeat message, and the reorganization blueprint for guiding reorganization is generated, and the encrypted data fragments and the reorganization blueprint are sent to the trusted secure terminal module.

2. The electronic archive multi-level security management and control system according to claim 1 is characterized in that: The integrated security management and control platform includes: A terminal authentication and session management module, configured to receive and verify the heartbeat message; an adaptive content security engine module, configured to dynamically decompose the electronic archive into the encrypted data fragments and generate the reassembly blueprint; The adaptive content security engine module is specifically used to: Extracting a hash value of the environment status proof contained in the verified heartbeat message and using it as a dynamic security seed; Based on the dynamic security seed, determining a segmentation boundary for decomposing the electronic archive to generate the data fragments; Based on the dynamic security seed and the session key, a one-time encryption key corresponding to each data fragment is generated, and the data fragment is encrypted using the key.

3. The electronic archive multi-level security management and control system according to claim 2 is characterized in that: The method of generating an encryption key for each data fragment is: K fragi =HMAC(K session ,Seed dyn ∣∣i); Where K fragi K is the one-time encryption key for the i-th data fragment; session The session master key for the current session between the integrated security management and control platform and the trusted security terminal module; dyn is the dynamic security seed; i is the serial number of the data fragment; HMAC is a hash-based message authentication code function; || is a data splicing operator.

4. The electronic archive multi-level security management and control system according to claim 2 is characterized in that: The adaptive content security engine module is further configured to: In the process of generating the data fragments, one or more honeypot fragments are generated according to a preset strategy, and the honeypot fragments are encrypted and then injected into the normal encrypted data fragment stream.

5. The electronic archive multi-level security management and control system according to claim 1 is characterized in that: The integrated security management and control platform also includes: A distributed authorization and audit module, used to split the reorganization blueprint into an infrastructure blueprint and key node authorization; The infrastructure blueprint is sent from the integrated security management and control platform to the trusted security terminal module; The key node authorization is maintained and distributed by one or more independent verification microservices managed by the distributed authorization and audit module.

6. The electronic archive multi-level security management and control system according to claim 5 is characterized in that: The trusted secure terminal module is specifically used for: receiving the infrastructure blueprint; According to the instructions in the infrastructure blueprint, request and obtain the key node authorization from the verification microservice; After simultaneously obtaining the infrastructure blueprint and the key node authorization, the data fragments are reassembled and rendered.

7. The electronic archive multi-level security management and control system according to claim 6 is characterized in that: The distributed authorization and audit module is also used to: monitoring access requests to the honeypot fragments; When the verification microservice managed by it receives an authorization request for the honeypot fragment from the trusted security terminal module, it identifies the request as an attack behavior and triggers a security alarm and session termination.

8. The electronic archive multi-level security management and control system according to claim 1 is characterized in that: The trusted and secure terminal module includes: An environmental status perception and certification unit, configured to collect the current environmental characteristics of the client, generate the environmental status certification, and encapsulate it into the heartbeat message after signing; A multi-source authorization and data reassembly unit, configured to initiate archive access requests, receive data, obtain a complete reassembly blueprint from the integrated security management and control platform and the distributed authorization and audit module's verification microservice, and perform rendering of the data fragments; The security sandbox and protection unit is used to provide an isolated operating environment with anti-screenshot and anti-memory crawling capabilities for the multi-source authorization and data reorganization unit.

9. The electronic archive multi-level security management and control system according to claim 1, characterized in that: When the heartbeat message is interrupted, times out, or the client environment characteristics contained therein are abnormal, the integrated security management and control platform will immediately stop all subsequent data and authorization distribution to the trusted security terminal module.

10. The electronic archive multi-level security management and control system according to claim 1, characterized in that: The dynamic decomposition of the electronic file into a series of encrypted data fragments specifically includes uniform decomposition and encryption of the file name, file extension and file content of the electronic file.

Images