Method for automatically verifying timeliness of secret key

Abstract

The invention discloses an automatic key timeliness verification method. The method comprises the following steps: (1) inputting a unique feature code and a target file by a user; (2) acquiring a key and a ciphertext sample from a database and a target file; (3) verifying the validity of the current key; (4) judging whether the current key is invalid or not according to the correct rate; (5) starting a key cracking task; (6) obtaining keys to be selected and verifying the keys one by one; and (7) storing the correct secret key and returning the correct secret key to the user. According to the method and the device, fine management of using one key for each MAC address and each file is realized, and the problems that in the prior art, the key granularity is relatively coarse, binding with the terminal is difficult, self-adaptive aging control cannot be carried out according to cross-region access risks, abnormal cross-border access is difficult to identify in time and the like are solved; therefore, the security, the flexibility and the auditing performance of the network file system are improved.

Description

Technical Field

[0001] This invention belongs to the field of information security technology and relates to an automatic key validity verification method, especially a validity verification method based on terminal MAC address and file-level key management. Background Technology

[0002] With the widespread adoption of cloud storage services, distributed network file systems, and cross-regional collaborative work, users often remotely access data in network file systems through terminal devices in different countries and regions. To ensure the confidentiality and integrity of files during network transmission and storage, symmetric keys are typically used for file encryption and decryption.

[0003] In existing technologies, the management of symmetric keys in network file systems mainly relies on "volume-level keys," "directory-level keys," or "user-level keys," and generally employs fixed periods or strategies for validity control: for example, setting a uniform validity period for a specific volume key and rotating it upon expiration; or assigning a long-term valid encryption key to a user upon initial access. However, such schemes have shortcomings in the following aspects:

[0004] 1. Coarse-grained key: When using volume-level or user-level keys, a single key often corresponds to a large number of files and / or multiple terminals. Once the key is leaked, a large amount of file data will be exposed at the same time.

[0005] 2. Lack of ability to bind to terminal devices: In cross-country access scenarios, the terminal device environment and security status vary greatly. It is difficult to bind volume-level or user-level keys to specific terminal identifiers (such as MAC addresses) one by one, making it impossible to carry out differentiated timeliness control and risk isolation at the terminal level.

[0006] 3. Insufficient coupling between time-sensitive policies and cross-regional access risks: Existing fixed-period policies often do not make full use of information on the country / region of origin and terminal identification information. When the same key is frequently used by multiple countries or regions and multiple terminals in a short period of time, it may still remain available throughout the fixed validity period, making it difficult to identify and respond to abnormal cross-border access behavior in a timely manner.

[0007] Therefore, it is necessary to provide a symmetric key non-fixed-period validity verification scheme for network file systems that combines terminal MAC address and file-level key management. Under the premise of using an independent key for each MAC address and each file, a dynamic validity strategy based on cross-country and terminal risks is introduced to achieve more refined and secure key lifecycle management. Summary of the Invention

[0008] The purpose of this invention is to provide an automatic key validity verification method, application, electronic device, and storage medium to achieve fine-grained management of "one key for each MAC address and each file". This solves the problems in the prior art, such as coarse key granularity, difficulty in binding with terminals, inability to adaptively control validity based on cross-regional access risks, and difficulty in timely identification of abnormal cross-border access. This improves the security, flexibility, and auditability of network file systems in cross-national and regional access scenarios.

[0009] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0010] In a first aspect, the present invention provides an automatic key validity verification method, comprising the following steps:

[0011] (1) The user inputs a unique identifier and the target file, wherein the unique identifier is the MAC address of the terminal;

[0012] (2) Obtain the key and ciphertext sample from the database and target file:

[0013] The management system extracts the known current key corresponding to the MAC address from the database based on the MAC address; and reads n ciphertexts from the target file.

[0014] (3) Verify the validity of the current key:

[0015] The management system sends the current key and the n ciphertexts to the verification module;

[0016] The verification module uses the current key to decrypt the n ciphertexts respectively, and judges whether each ciphertext is decrypted correctly based on the decryption result, obtains the result of whether the decryption of the n ciphertexts is correct or not, and returns the decryption accuracy rate to the management system.

[0017] (4) Determine whether the current key is invalid based on the decryption accuracy rate:

[0018] The management system compares the decryption accuracy rate with a preset threshold x;

[0019] When the decryption accuracy is less than the threshold x, the current key recorded in the database is determined to be invalid, and the key cracking process begins; when the decryption accuracy is greater than or equal to the threshold x, the current key is determined to be valid, the current key is output as the correct key, and the process ends.

[0020] (5) Initiate the key cracking task:

[0021] If the current key is determined to be invalid, the management system selects at least one ciphertext from the target file, sends the at least one ciphertext to the cracking module, and sets the cracking parameters to start the key cracking task.

[0022] (6) Obtain the candidate keys and verify them one by one:

[0023] During the execution of the cracking task, whenever a candidate key is generated, the cracking module sends the candidate key to the management system.

[0024] After receiving the candidate key, the management system sends the candidate key together with the n ciphertexts obtained in step (2) to the verification module for decryption;

[0025] (7) Store the correct key and return it to the user:

[0026] When the management system determines that the decryption accuracy of a candidate key is greater than or equal to the threshold x, it stores the candidate key as the correct key in the database and establishes an association with the corresponding MAC address; and returns the correct key to the user or for use in subsequent decryption operations.

[0027] Furthermore, in step (2), the value of n is a preset parameter that can be configured in the management system, and n is a multiple of 10.

[0028] Furthermore, in step (4), the threshold x is a preset percentage and can be configured in the management system.

[0029] Furthermore, the verification workflow is as follows:

[0030] (1) Obtain the ciphertext and the key to be verified:

[0031] The verification module receives n ciphertexts and the key to be verified from the management system.

[0032] (2) Decrypt and extract plaintext using the key to be verified:

[0033] The verification module uses the key to be verified to decrypt n ciphertexts respectively, and obtains the corresponding n plaintext data;

[0034] For IP protocol packets in the plaintext data, a judgment is made based on minimizing the verification conditions;

[0035] (3) Determine the correctness of the decryption of each ciphertext:

[0036] For plaintext data that simultaneously meets the verification conditions, the decryption result of the corresponding ciphertext is determined to be correct.

[0037] For plaintext data that does not meet any of the above verification conditions, the decryption result of the corresponding ciphertext is determined to be an incorrect decryption.

[0038] (4) Calculate and output the decryption accuracy:

[0039] The decryption accuracy rate is calculated by counting the number of ciphertexts whose decryption results are correctly determined out of the n ciphertexts.

[0040] The decryption accuracy of the n ciphertexts is returned to the management system for subsequent key validity judgment and cracking process control.

[0041] Furthermore, the working process of the encryption module is as follows:

[0042] (1) Obtain the ciphertext to be cracked:

[0043] The cracking module receives at least one ciphertext to be cracked sent by the management system, wherein the ciphertext to be cracked is ciphertext data obtained by encryption based on an unknown key;

[0044] (2) Search for the key sequentially within the predetermined search range:

[0045] The cracking module generates candidate keys sequentially according to a predetermined search strategy based on the preset cracking search range and cracking parameters.

[0046] (3) Determine the validity of the candidate key based on the cracking verification conditions:

[0047] Whenever a candidate key is generated, the candidate key is used to decrypt the ciphertext to be cracked, and the decrypted plaintext data is obtained.

[0048] For IP protocol packets in the plaintext data, verification is performed based on minimizing the judgment conditions;

[0049] (4) Determine the candidate keys and output them:

[0050] When the plaintext data obtained by decrypting using a candidate key meets the above-mentioned cracking verification conditions, the candidate key is determined to be a candidate key;

[0051] The cracking module outputs the candidate key and sends it to the management system, whereby the verification module will perform further multi-ciphertext verification on the candidate key.

[0052] Furthermore, the minimum validation condition is as follows:

[0053] Determine if the first byte of the IP packet header is 0x45;

[0054] Determine if the checksum of the IP packet header is correct.

[0055] Furthermore, in step (6), the verification module uses the candidate key to decrypt the n ciphertexts respectively, judges whether the decryption result of each ciphertext is correct, calculates the decryption accuracy rate corresponding to the current candidate key, and returns the accuracy rate to the management system.

[0056] When the decryption accuracy rate is greater than or equal to the threshold x, the management system determines that the current candidate key is the correct key; when the decryption accuracy rate is less than the threshold x, the management system determines that the current candidate key is incorrect, and continues to receive the next candidate key sent by the cracking module, repeating the verification process of this step until a candidate key that meets the conditions is obtained.

[0057] Secondly, the present invention provides an application of an automatic key validity verification method in network file system encryption, including:

[0058] (1) In the network file system, a key identifier is determined for each terminal MAC address and each target file. A corresponding symmetric key is generated or distributed based on the terminal MAC address, file identifier and preset master key. An initial validity policy parameter is configured for the symmetric key. The initial validity policy parameter includes at least the initial validity period of the key, the sensitivity level of the target file and the default regional risk level associated with the terminal MAC address.

[0059] (2) During operation, for each dimension of the symmetric key, the initial validity period strategy parameters are adjusted based on one or more dynamic indicators, including at least the historical behavior characteristics of the MAC address of the access request terminal, file access frequency, access time distribution, access failure situation and historical security events, to obtain the non-fixed validity period window of the symmetric key;

[0060] (3) When a target file encryption or decryption request is received from a terminal MAC address based on the corresponding symmetric key, the terminal MAC address and geographical location information corresponding to the request are parsed, and the current request time is compared with the non-fixed validity period window corresponding to the symmetric key and the access source is verified to meet the preset regional policy.

[0061] (4) When the current request time is within the non-fixed validity period window and matches the regional risk policy of the terminal MAC address, the symmetric key is determined to be valid, and the encryption or decryption operation of the target file is allowed to be completed; when the current request time exceeds the non-fixed validity period window, the symmetric key is determined to be invalid or restricted, and at least one of the following operations is performed: reject the current decryption request, trigger the key rotation or regeneration process for this dimension, record fine-grained cross-regional audit logs and trigger security alarms.

[0062] Thirdly, the present invention provides an electronic device including a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, wherein the processor, when executing the computer-readable instructions, implements the key validity automatic verification method as described above.

[0063] Fourthly, the present invention provides a readable storage medium storing computer-readable instructions, which, when executed by one or more processors, cause the one or more processors to perform the key validity automatic verification method as described above.

[0064] The beneficial effects of this invention are as follows:

[0065] This invention enables fine-grained management of "one key for each MAC address and one key for each file," solving problems such as coarse key granularity, difficulty in binding to terminals, inability to adaptively control timeliness based on cross-regional access risks, and difficulty in timely identification of abnormal cross-border access, thereby improving the security, flexibility, and auditability of the network file system.

[0066] This invention enables the validity period and scope of use of symmetric keys to be dynamically adjusted according to the source of access, access mode and system security status: when high-risk access or abnormal switching behavior is detected, the validity period of the key is proactively shortened or the scope of key availability is restricted; in low-risk, stable access scenarios, the performance overhead caused by frequent key rotation is reduced, thereby significantly improving the security, compliance and operational controllability of network file system encryption. Attached Figure Description

[0067] Figure 1 This is a schematic diagram of the overall process of the present invention;

[0068] Figure 2 This is the verification workflow of the present invention;

[0069] Figure 3 This is a flowchart of the decryption module of the present invention. Detailed Implementation

[0070] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0071] like Figures 1 to 3 As shown, an automatic key validity verification method includes the following steps:

[0072] (1) The user inputs a unique identifier and the target file;

[0073] The unique identifier is the terminal's MAC address; the management system receives the MAC address and target file input by the user.

[0074] (2) Obtain the key and ciphertext sample from the database and target file;

[0075] The management system extracts the currently known key corresponding to the MAC address from the database based on the MAC address; and reads multiple ciphertexts (number n, where n is a multiple of 10) from the target file.

[0076] (3) Verify the validity of the current key;

[0077] The management system sends the current key and the n ciphertexts to the verification module;

[0078] The verification module uses the current key to decrypt each of the n ciphertexts, and determines whether each ciphertext is decrypted correctly based on the decryption result, thereby obtaining the result of whether the decryption of the n ciphertexts is correct or not, and returns the result of correct decryption to the management system.

[0079] (4) Determine whether the current key is invalid based on the decryption accuracy rate;

[0080] The management system compares the decryption accuracy with a preset threshold x, where x is a preset percentage and can be configured in the management system.

[0081] When the decryption accuracy is less than the threshold x, the current key recorded in the database is determined to be invalid, and the key cracking process is initiated; when the decryption accuracy is greater than or equal to the threshold x, the current key is determined to be valid, the current key is output as the correct key, and the process ends.

[0082] (5) Initiate the key cracking task;

[0083] If the current key is determined to be invalid, the management system selects at least one ciphertext from the target file, sends the at least one ciphertext to the cracking module, and sets the cracking parameters to start the key cracking task.

[0084] (6) Obtain the candidate keys and verify them one by one;

[0085] During the execution of the cracking task, whenever a candidate key is generated, the cracking module sends the candidate key to the management system.

[0086] After receiving the candidate key, the management system sends the candidate key together with the n ciphertexts obtained in step (2) to the verification module;

[0087] The verification module uses the candidate key to decrypt the n ciphertexts respectively, determines whether the decryption result of each ciphertext is correct, calculates the decryption accuracy corresponding to the current candidate key, and returns the accuracy to the management system.

[0088] When the decryption accuracy rate is greater than or equal to the threshold x, the management system determines that the current candidate key is the correct key; when the decryption accuracy rate is less than the threshold x, the management system determines that the current candidate key is incorrect, and continues to receive the next candidate key sent by the cracking module, repeating the verification process of this step until a candidate key that meets the conditions is obtained.

[0089] (7) Store the correct key and return it to the user;

[0090] When the management system determines that the decryption accuracy of a candidate key is greater than or equal to the threshold x, it stores the candidate key as the correct key in the database and establishes an association with the corresponding MAC address; and returns the correct key to the user or for use in subsequent decryption operations.

[0091] In this embodiment, the verification workflow is as follows:

[0092] (1) Obtain the ciphertext and the key to be verified:

[0093] The verification module receives n encrypted messages and the key to be verified from the management system, where n is a preset configurable parameter.

[0094] (2) Decrypt and extract plaintext using the key to be verified:

[0095] The verification module uses the key to be verified to decrypt the n ciphertexts respectively, and obtains the corresponding n plaintext data;

[0096] For IP protocol packets in the plaintext data, the judgment is based on the following minimum check condition:

[0097] Determine whether the first byte of the IP packet header is 0x45;

[0098] Determine whether the checksum of the IP packet header is correct.

[0099] (3) Determine the correctness of the decryption of each ciphertext:

[0100] For plaintext data that simultaneously meets the above verification conditions, the decryption result of the corresponding ciphertext is determined to be correct.

[0101] For plaintext data that does not meet any of the above verification conditions, the decryption result of the corresponding ciphertext is determined to be an incorrect decryption.

[0102] (4) Calculate and output the decryption accuracy:

[0103] The decryption accuracy rate is calculated by counting the number of ciphertexts whose decryption results are correctly determined out of the n ciphertexts.

[0104] The decryption accuracy of the n ciphertexts is returned to the management system for subsequent key validity judgment and cracking process control.

[0105] In this embodiment, the decryption module works as follows:

[0106] (1) Obtain the ciphertext to be cracked:

[0107] The cracking module receives at least one ciphertext to be cracked from the management system, wherein the ciphertext to be cracked is ciphertext data obtained by encryption based on an unknown key.

[0108] (2) Search for the key sequentially within the predetermined search range:

[0109] The cracking module generates candidate keys sequentially according to the preset cracking search range and cracking parameters, following a predetermined search strategy (including sequential traversal, dictionary matching, or other key space search algorithms).

[0110] (3) Determine the validity of the candidate key based on the cracking verification conditions:

[0111] Whenever a candidate key is generated, the candidate key is used to decrypt the ciphertext to be cracked, and the decrypted plaintext data is obtained.

[0112] For IP protocol packets in the plaintext data, verification is performed based on the following minimum judgment condition:

[0113] Determine whether the first byte of the IP packet header is 0x45;

[0114] Determine whether the checksum of the IP packet header is correct.

[0115] (4) Determine the candidate keys and output them:

[0116] When the plaintext data obtained by decrypting using a candidate key meets the above-mentioned cracking verification conditions, the candidate key is determined to be a candidate key;

[0117] The cracking module outputs the candidate key and sends it to the management system, whereby the verification module will perform further multi-ciphertext verification on the candidate key.

[0118] In this embodiment, the above method can be used to verify the non-fixed-period validity of symmetric keys encrypted by network file systems. The verification application also includes:

[0119] (1) In the network file system, a key identifier is determined for each terminal MAC address and each target file. A corresponding symmetric key is generated or distributed based on the terminal MAC address, file identifier and preset master key. An initial validity policy parameter is configured for the symmetric key. The initial validity policy parameter includes at least the initial validity period of the key, the sensitivity level of the target file and the default regional risk level associated with the terminal MAC address.

[0120] (2) During operation, for each symmetric key in the dimension of (MAC address, file), the initial validity period strategy parameters are adjusted based on one or more dynamic indicators, including at least the historical behavior characteristics of the MAC address of the access request terminal, file access frequency, access time distribution, access failure situation and historical security events, to obtain a non-fixed validity period window for the symmetric key.

[0121] (3) When a target file encryption or decryption request is received from a terminal MAC address based on the corresponding symmetric key, the terminal MAC address and geographical location information corresponding to the request are parsed, and the current request time is compared with the non-fixed validity period window corresponding to the symmetric key and the access source is verified to meet the preset regional policy.

[0122] (4) When the current request time is within the non-fixed validity period window and matches the regional risk policy of the terminal MAC address, the symmetric key is determined to be valid, and the encryption or decryption operation of the target file is allowed to be completed; when the current request time exceeds the non-fixed validity period window, the symmetric key is determined to be invalid or restricted, and at least one of the following operations is performed: reject the current decryption request, trigger the key rotation or regeneration process for the (MAC address, file) dimension, record fine-grained cross-regional audit logs and trigger security alarms.

[0123] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0124] It should be understood that the processor in the embodiments of this application can be a central processing unit, or it can be other general-purpose processors, digital signal processors, application-specific integrated circuits, off-the-shelf programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The memory in the embodiments of this application can be volatile memory or non-volatile memory, or it can include both volatile and non-volatile memory.

[0125] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the above embodiments do not limit the scope of protection of the present invention in any way, and all technical solutions obtained by equivalent substitution or other means fall within the scope of protection of the present invention.

[0126] All parts not covered in this invention are the same as or can be implemented using existing technologies.

Claims

1. An automatic key validity verification method, characterized in that, Includes the following steps: (1) The user inputs a unique identifier and the target file, wherein the unique identifier is the MAC address of the terminal; (2) Obtain the key and ciphertext sample from the database and target file: The management system retrieves the known current key corresponding to the MAC address from the database based on the MAC address. And read n ciphertexts from the target file; (3) Verify the validity of the current key: The management system sends the current key and the n ciphertexts to the verification module; The verification module uses the current key to decrypt the n ciphertexts respectively, and judges whether each ciphertext is decrypted correctly based on the decryption result, obtains the result of whether the decryption of the n ciphertexts is correct or not, and returns the decryption accuracy rate to the management system. (4) Determine whether the current key is invalid based on the decryption accuracy rate: The management system compares the decryption accuracy rate with a preset threshold x; When the decryption accuracy is less than the threshold x, it is determined that the current key recorded in the database has expired, and the key cracking process begins. When the decryption accuracy is greater than or equal to the threshold x, the current key is determined to be valid, the current key is output as the correct key, and the process ends. (5) Initiate the key cracking task: If the current key is determined to be invalid, the management system selects at least one ciphertext from the target file, sends the at least one ciphertext to the cracking module, and sets the cracking parameters to start the key cracking task. (6) Obtain the candidate keys and verify them one by one: During the execution of the cracking task, whenever a candidate key is generated, the cracking module sends the candidate key to the management system. After receiving the candidate key, the management system sends the candidate key together with the n ciphertexts obtained in step (2) to the verification module for decryption; (7) Store the correct key and return it to the user: When the management system determines that the decryption accuracy of a candidate key is greater than or equal to the threshold x, it stores the candidate key as the correct key in the database and establishes an association with the corresponding MAC address; and returns the correct key to the user or for use in subsequent decryption operations.

2. The method for automatic verification of key validity according to claim 1, characterized in that, In step (2), the value of n is a preset parameter that can be configured in the management system, and n is a multiple of 10.

3. The automatic key validity verification method according to claim 1, characterized in that, In step (4), the threshold x is a preset percentage and can be configured in the management system.

4. The method for automatic verification of key validity according to claim 1, characterized in that, The verification process is as follows: (1) Obtain the ciphertext and the key to be verified: The verification module receives n ciphertexts and the key to be verified from the management system. (2) Decrypt and extract plaintext using the key to be verified: The verification module uses the key to be verified to decrypt n ciphertexts respectively, and obtains the corresponding n plaintext data; For IP protocol packets in the plaintext data, a judgment is made based on minimizing the verification conditions; (3) Determine the correctness of the decryption of each ciphertext: For plaintext data that simultaneously meets the verification conditions, the decryption result of the corresponding ciphertext is determined to be correct. For plaintext data that does not meet any of the above verification conditions, the decryption result of the corresponding ciphertext is determined to be an incorrect decryption. (4) Calculate and output the decryption accuracy: The decryption accuracy rate is calculated by counting the number of ciphertexts whose decryption results are correctly determined out of the n ciphertexts. The decryption accuracy of the n ciphertexts is returned to the management system for subsequent key validity judgment and cracking process control.

5. The automatic key validity verification method according to claim 1, characterized in that, The working process of the decryption module is as follows: (1) Obtain the ciphertext to be cracked: The cracking module receives at least one ciphertext to be cracked sent by the management system, wherein the ciphertext to be cracked is ciphertext data obtained by encryption based on an unknown key; (2) Search for the key sequentially within the predetermined search range: The cracking module generates candidate keys sequentially according to a predetermined search strategy based on the preset cracking search range and cracking parameters. (3) Determine the validity of the candidate key based on the cracking verification conditions: Whenever a candidate key is generated, the candidate key is used to decrypt the ciphertext to be cracked, and the decrypted plaintext data is obtained. For IP protocol packets in the plaintext data, verification is performed based on minimizing the judgment conditions; (4) Determine the candidate keys and output them: When the plaintext data obtained by decrypting using a candidate key meets the above-mentioned cracking verification conditions, the candidate key is determined to be a candidate key; The cracking module outputs the candidate key and sends it to the management system, whereby the verification module will perform further multi-ciphertext verification on the candidate key.

6. The automatic key validity verification method according to claim 4 or 5, characterized in that, The minimum validation conditions are as follows: Determine if the first byte of the IP packet header is 0x45; Determine if the checksum of the IP packet header is correct.

7. The automatic key validity verification method according to claim 1, characterized in that, In step (6), the verification module uses the candidate key to decrypt the n ciphertexts respectively, judges whether the decryption result of each ciphertext is correct, calculates the decryption accuracy rate corresponding to the current candidate key, and returns the accuracy rate to the management system. When the decryption accuracy rate is greater than or equal to the threshold x, the management system determines that the current candidate key is the correct key; when the decryption accuracy rate is less than the threshold x, the management system determines that the current candidate key is incorrect, and continues to receive the next candidate key sent by the cracking module, repeating the verification process of this step until a candidate key that meets the conditions is obtained.

8. The application of the key validity automatic verification method as described in claim 1 in network file system encryption, characterized in that, include: (1) In the network file system, a key identifier is determined for each terminal MAC address and each target file. A corresponding symmetric key is generated or distributed based on the terminal MAC address, file identifier and preset master key. An initial validity policy parameter is configured for the symmetric key. The initial validity policy parameter includes at least the initial validity period of the key, the sensitivity level of the target file and the default regional risk level associated with the terminal MAC address. (2) During operation, for each dimension of the symmetric key, the initial validity period strategy parameters are adjusted based on one or more dynamic indicators, including at least the historical behavior characteristics of the MAC address of the access request terminal, file access frequency, access time distribution, access failure situation and historical security events, to obtain the non-fixed validity period window of the symmetric key; (3) When a target file encryption or decryption request is received from a terminal MAC address based on the corresponding symmetric key, the terminal MAC address and geographical location information corresponding to the request are parsed, and the current request time is compared with the non-fixed validity period window corresponding to the symmetric key and the access source is verified to meet the preset regional policy. (4) When the current request time is within the non-fixed validity period window and matches the regional risk policy of the terminal MAC address, the symmetric key is determined to be valid, and the encryption or decryption operation of the target file is allowed to be completed; when the current request time exceeds the non-fixed validity period window, the symmetric key is determined to be invalid or restricted, and at least one of the following operations is performed: reject the current decryption request, trigger the key rotation or regeneration process for this dimension, record fine-grained cross-regional audit logs and trigger security alarms.

9. An electronic device comprising a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, characterized in that, When the processor executes the computer-readable instructions, it implements the automatic key validity verification method as described in any one of claims 1 to 5.

10. A readable storage medium storing computer-readable instructions, characterized in that, When the computer-readable instructions are executed by one or more processors, the one or more processors cause the one or more processors to perform the key expiration automatic verification method as described in any one of claims 1 to 5.

Images