Cloud sharing multi-terminal real-time online document encryption device based on national secret

Abstract

The application discloses a cloud sharing multi-terminal real-time online document encryption device based on a national secret, belongs to the technical field of cloud sharing and encryption, and aims to solve the technical problem of how to realize real-time collaborative editing of user sensitive data and avoid content leakage in a document editing process. The technical scheme is that the device comprises a server and a client, the client comprises an application terminal and a password module, the server comprises a key distribution service unit and a collaborative service unit, the key distribution service unit comprises a key management service module and a key distribution service module, the collaborative service unit comprises a service module and a collaborative processing service module, the key distribution service unit is used for key distribution and key management, the collaborative service unit completes key distribution by calling the key distribution service module, and the client-encrypted document is converted and stored in ciphertext through collaborative operation, and the ciphertext is retransmitted to other clients.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cloud sharing and encryption technology, in particular to a cloud sharing multi-terminal real-time online document encryption device based on national encryption. BACKGROUND

[0002] With the performance improvement of intelligent terminal devices and the 5G enabled Internet of Things, more efficient and convenient digital collaboration has gradually become a new way of work. Multi-terminal real-time online document collaboration based on cloud sharing is the most common team collaboration method, which can effectively improve work efficiency, especially for real-time collaborative office application systems with high interaction requirements.

[0003] With the application of big data in various fields, real-time document collaboration has great significance for remote data statistics, document writing and other aspects. Existing real-time document editing and collaboration systems usually operate conversion and conflict resolution based on document plaintext, or use https to encrypt the transmission channel for protection, and must assume that the document server is secure and reliable, and users need to fully trust the document server. This mode makes the document leakage risk concentrated on the cloud server, and the server has complete access to all documents being collaborated. Once the cloud server for operation conversion or storage is maliciously used, a large amount of document plaintext information will be stolen at a moment. However, as a typical representative of remote office, real-time document collaboration inevitably involves some business secrets and enterprise, personal privacy and other sensitive information. Once the document data is leaked, it will cause significant loss to enterprises or individuals.

[0004] Therefore, how to realize real-time collaborative editing of user sensitive data and avoid content leakage during document editing and processing is a technical problem to be solved at present. SUMMARY

[0005] The technical task of the present application is to provide a cloud sharing multi-terminal real-time online document encryption device based on national encryption, to solve the problem of how to realize real-time collaborative editing of user sensitive data and avoid content leakage during document editing and processing.

[0006] The technical task of the present application is achieved in the following way: a cloud sharing multi-terminal real-time online document encryption device based on national encryption, the device includes a server and a client, the client includes an application terminal and a password module; the server includes a key distribution service unit and a collaboration service unit; the key distribution service unit includes a key management service module and a key distribution service module; the collaboration service unit includes a service module and a collaboration processing service module; the key distribution service unit is used for key distribution and key management, and the collaboration service unit completes key distribution by calling the key distribution service module; at the same time, the client encrypted document is operated and converted, and the ciphertext is stored and then forwarded to other clients.

[0007] Preferably, the server-side OT processing mechanism is consistent with the general document collaboration server-side processing mechanism; the specific information transmission path for any document operation is as follows:

[0008] The client edits the document and calls the password module to encrypt the document;

[0009] When encrypted information reaches the collaborative business service unit, it undergoes OT conversion and is persisted through the DB service. Finally, the converted information is pushed to the relevant clients.

[0010] The relevant client can retrieve the encrypted text and call the cryptographic module to decrypt it, thus revealing the collaborative editing actions of the other party.

[0011] Ideally, the client is used to complete local document updates and maintenance, with the following specific functions:

[0012] ① Collect user editing operations and edited content;

[0013] ② Encrypt local operation load;

[0014] ③ Receive operations from the server;

[0015] ④ Decrypt the received operation payload and apply it locally.

[0016] More preferably, the key distribution service unit is used for key distribution and document data distribution.

[0017] More preferably, the key distribution is as follows:

[0018] After the client selects the corresponding collaboration member and initiates a collaboration document request to the document collaboration server, the collaboration business service unit requests and generates the corresponding key through the key distribution service.

[0019] The document collaboration server encrypts the collaboration group key CGK of each client with the encryption public key CPUK of each client and then distributes it to each client.

[0020] The secure channel between the encryption module and the key distribution service unit is established using a TLS-based dual certificate verification mechanism.

[0021] The key distribution service unit uses the Access Control List (ACL) mechanism to control the permissions for encryption modules to request keys.

[0022] More preferably, the document data distribution is as follows:

[0023] After the collaborative client initiates the operation, it encrypts the document and sends it to the document collaboration server;

[0024] After the document collaboration server performs the OT operation, it pushes document update messages to other clients based on the collaboration members.

[0025] After receiving the push notification, the client retrieves the encrypted document, decrypts it using the local password module, performs OT conversion, and synchronizes it locally for further presentation.

[0026] More preferably, the key acquisition method is as follows:

[0027] ① Symmetric encryption algorithm: It adopts the SM4 algorithm and CBC working mode to realize the encryption and decryption functions of document data, and provides data confidentiality protection. Its block length is 128 bits and key length is 128 bits.

[0028] ② Asymmetric Algorithm: The SM2 algorithm is used for digital signatures, signature verification, encryption, decryption, and key protection; the private key is 256 bits and the public key is 512 bits.

[0029] ③ Hash Algorithm: The SM3 algorithm is used for digest calculation, and the output is a fixed length of 256 bits;

[0030] ④ SM4 Block Cipher Algorithm: Used to encrypt and protect real-time document data sources. It adopts the CBC working mode. Each message or file body corresponds to a body encryption key and encryption padding IV. The block padding method adopts the PKCS#7 standard padding method and refers to the SM4 algorithm standard specification "SM4 Block Cipher Algorithm".

[0031] As a preferred embodiment, the working process of the device is as follows:

[0032] S1. After the client inputs the content of the local document, it calls the password module to encrypt the document, thus obtaining the ciphertext document: E(FBK,FB)||E(CGK,FBK)||H(FB)||CGID||CGKV;

[0033] S2. The client transmits the encrypted document to the collaborative processing service unit;

[0034] S3. The server performs OT processing on the encrypted document through operation conversion;

[0035] S4 and OT encrypted documents are sent to other clients via push notifications.

[0036] S5. Other clients call the password module's decryption interface to decrypt the document, as detailed below:

[0037] S501. Use CGK to decrypt the ciphertext FBK to obtain FBK, i.e.: D(CGK,EFBK);

[0038] S502. Use FBK to decrypt the ciphertext file to obtain the plaintext FB, i.e.: D(FBK,EFile);

[0039] S6. Other clients perform OT operations on the decrypted document and display it locally.

[0040] The cloud-based, multi-terminal, real-time online document encryption device based on national cryptographic standards of the present invention has the following advantages:

[0041] (I) This invention analyzes the basic technology, current status and encryption requirements of real-time document collaboration, extracts encryption requirements from typical real-time document collaboration applications, studies commercial cryptographic algorithms released by the State Cryptography Administration, and designs a cloud-based multi-terminal real-time online document encryption device based on national cryptographic standards to ensure the security of document collaboration data and has high practicality.

[0042] (II) This invention addresses the problem of content leakage during document editing and processing by real-time collaborative editing of sensitive user data. It extracts password requirements from typical real-time collaborative document applications, conducts research in conjunction with commercial cryptographic algorithms, and designs a real-time collaborative document encryption device to ensure the security of collaborative document data.

[0043] (iii) The present invention can provide real-time collaborative editing services that protect sensitive user data in an environment that is not fully trusted. Even if an untrusted storage service is used, there is no risk of document leakage. Attached Figure Description

[0044] The invention will be further described below with reference to the accompanying drawings.

[0045] Appendix Figure 1 To collaboratively edit the basic principles and flowcharts;

[0046] Appendix Figure 2 A diagram illustrating the out-of-order workflow for collaborative editing;

[0047] Appendix Figure 3 Introducing operation transformation diagrams for collaborative editing;

[0048] Appendix Figure 4 This is a schematic diagram of a cloud-based, multi-terminal, real-time online document encryption device based on national cryptographic standards.

[0049] Appendix Figure 5 This is a schematic diagram of the structure of a document collaboration server;

[0050] Appendix Figure 6 This is a schematic diagram of the client's structure;

[0051] Appendix Figure 7 This is a flowchart illustrating the control and data flow of a cloud-based, multi-terminal, real-time online document encryption device based on national cryptographic standards. Detailed Implementation

[0052] The cloud-based multi-terminal real-time online document encryption device based on national cryptographic standards of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0053] Example:

[0054] Real-time document collaboration refers to the collaborative creation of documents by multiple people. This mechanism can also be extended to scenarios such as code development and creative drawing. Traditional document collaboration processes suffer from inefficiency and inconvenient conflict resolution. Participating parties cannot promptly access each other's edits, leading to chaotic document version updates and an inability to adapt to scenarios requiring multi-person collaborative editing. The core issue in achieving real-time collaborative interaction is how to support conflict resolution and eventual consistency for different interactive operations in heterogeneous environments. Since Google launched commercial online collaborative documents over a decade ago, various collaborative document applications, including Tencent Docs, have developed rapidly, and related consistency algorithms and their derivative technologies have remained a research hotspot. Operation transformation and conflict resolution mechanisms have been researched and applied in mobile cloud environments. Furthermore, digital collaborative systems have been designed and implemented based on operation transformation mechanisms.

[0055] Generally, there are two main implementation mechanisms: Operation Transformation (OT) and Conflict-free Replicated Data Type (CRDT). Google Docs, Microsoft 365, and the open-source Etherpad all use OT as a basic technology to solve the problem of multi-user editing conflicts. CRDT, which emerged from academic research in 2011, provides users with complete ownership of their data. As a distributed consensus algorithm that has emerged in recent years, it can be applied to distributed applications, such as distributed document collaboration and distributed storage, in conjunction with mechanisms like WebSocket. By introducing version management and operation transformation technology, version management and conflict resolution in collaborative editing are solved, making online real-time collaborative editing possible.

[0056] Because CRDT may have performance issues when processing complex data structures, it is mainly used in some prototype systems. Most product-level real-time collaborative editing is based on OT technology and its improvement mechanisms. This invention mainly focuses on the research and cryptographic security design of document collaboration based on the OT mechanism.

[0057] The principle of real-time document collaboration technology: During online real-time collaborative editing, the server's processing mechanism must be able to tolerate out-of-order or even lost operations from different users, and must ensure that all users are ultimately in a consistent state. The main processing tasks of the server are as follows:

[0058] 1) The server is responsible for listening to and collecting data changes from the client, and using Operational Transformation (OT) technology to resolve issues such as operation merging and conflicts;

[0059] 2) Based on each client's modification operation, the server promptly modifies the stored documents to obtain the latest version.

[0060] 3) Broadcast the converted changes to other clients participating in online collaboration so that they can update their local copies.

[0061] The simplest way to understand real-time collaborative editing is similar to group chat in an instant messaging system. Each user modifies a document locally and then sends the changes to other users in the group who have opened the same document. The document editor can be viewed as an operating space where text characters or rich text are inserted or deleted, and the results are saved to a file. Each operation consists of an "index" and a "value," which together determine the position and content of the operation within the document. For example, for the text "TEST," the first character has a value of "T" and a position of 0, and so on. Characters can be inserted or deleted simply by referencing the position index, as shown in the attached diagram. Figure 1 As shown.

[0062] However, in real-world applications, users' terminal environments and network performance vary significantly. Disconnections and network latency are unavoidable, and operations from different users may be executed in different orders on different devices. The same operation, executed in different orders, will produce different results, as shown in the attached diagram. Figure 2 As shown.

[0063] Data consistency is the most fundamental requirement for real-time document collaboration. Forcing operations to be sorted according to their arrival time on the server would disrupt the context of the user's editing, resulting in editing outcomes that do not meet the user's expectations. Therefore, operation transformation algorithms were introduced. Through operation transformation, the problem of final data consistency can be solved, as shown in the attached diagram. Figure 3 As shown.

[0064] The need for real-time document collaboration encryption: Existing real-time document collaboration typically only allows operations and conflict resolution based on plaintext documents. Operational conversion based on OT mechanisms relies on the server. Therefore, the server has full access to all documents being collaborated on, including document content and editing steps. In this model, the document service provider offers storage services and can process and distribute user data operations promptly and correctly, but it may actively or passively read user document data, and may even forward this data to third parties. Some applications use HTTPS to ensure data security during transmission, but once the client-edited data reaches the server, its processing and storage are based on plaintext operations, posing a risk of leakage. Some studies have analyzed document data security under different scenario architectures, but their security measures are not suitable for real-time collaborative editing applications. Some studies have explored data security protection measures and governance in the era of big data. Therefore, a mechanism is needed to achieve end-to-end encryption of documents, enabling real-time collaborative editing services that protect sensitive user data in a not-fully-trusted cloud environment. Even when using untrusted storage services, there should be no risk of document leakage. This invention should meet the following requirements:

[0065] (1) Confidentiality: User-sensitive document data needs to be encrypted and protected to ensure that the data content is not obtained by the server or unauthorized users.

[0066] (2) Real-time: The security scheme does not affect the ability of the client to synchronize the edited content to other clients in real time.

[0067] (3) Consistency: When there is inconsistency in the content of client documents due to network delay, the editing data between each client can be synchronized and correctly decrypted in a timely manner when the network is restored to normal in the next moment, so as to ensure the consistency of the content between each client.

[0068] (4) Flexibility: It needs to meet the encryption requirements of different documents at different collaborative stages. For specific users, only specific period and specific version of document data are allowed to be viewed. For new users joining the collaboration, their decryption permissions for the document history process can be controlled.

[0069] (5) Efficiency: Enhanced security should not bring additional heavy computing requirements, especially for mobile terminals, whose processing performance and efficiency must be considered.

[0070] The abbreviations and their Chinese and English descriptions are shown in the table.

[0071]

[0072] As attached Figure 4As shown, the present invention discloses a cloud-based, multi-terminal, real-time online document encryption device based on national cryptographic standards. The device includes a server and a client. The client includes an application terminal and a cryptographic module. The server includes a key distribution service unit and a collaborative business service unit. The key distribution service unit includes a key management service module and a key distribution service module. The collaborative business service unit includes a business service module and a collaborative processing service module. The key distribution service unit is used for key distribution and key management. The collaborative business service unit completes key distribution by calling the key distribution service module. Simultaneously, it performs collaborative operations to convert the encrypted documents on the client and stores the ciphertext, then forwards the ciphertext to other clients.

[0073] As attached Figure 5 As shown, the server-side OT processing mechanism in this embodiment is consistent with the general document collaboration server-side processing mechanism; the specific information transmission path for any document operation is as follows:

[0074] (1) The client edits the document and calls the password module to encrypt the document;

[0075] (2) When the encrypted information reaches the collaborative business service unit, it is converted by OT and persisted by DB service, and finally the information of the operation conversion is pushed to the relevant client.

[0076] (3) The relevant client can pull the ciphertext and call the password module to perform decryption operations, and then see the other party's collaborative editing actions.

[0077] As attached Figure 6 As shown, the client in this embodiment is used to complete the local updating and maintenance of documents, and its specific functions are as follows:

[0078] ① Collect user editing operations and edited content;

[0079] ② Encrypt local operation load;

[0080] ③ Receive operations from the server;

[0081] ④ Decrypt the received operation payload and apply it locally.

[0082] The key distribution service unit in this embodiment is used for key distribution and document data distribution.

[0083] The key distribution in this embodiment is as follows:

[0084] (1) After the client selects the corresponding collaborative member and initiates a collaborative document request to the document collaborative server, the collaborative business service unit requests the corresponding key through the key distribution service;

[0085] (2) The document collaboration server encrypts the collaboration group key CGK of each client with the encryption public key CPUK of each client and distributes it to each client;

[0086] (3) The secure channel between the encryption module and the key distribution service unit is established using a dual certificate verification mechanism based on TLS;

[0087] (4) The key distribution service unit implements access control mechanism ACL to control the permission of the encryption module to request keys.

[0088] The document data distribution in this embodiment is as follows:

[0089] (1) After the collaborative client initiates the operation, it encrypts the document and sends it to the document collaborative server;

[0090] (2) After the document collaboration server performs the OT operation, it pushes document update messages to other clients based on the collaboration members;

[0091] (3) After receiving the push, the client pulls the encrypted document, decrypts the document through the local password module, performs OT conversion, and synchronizes it to the local machine for further presentation.

[0092] The algorithm name, purpose, and specific parameter specifications used in this embodiment are shown in the table below:

[0093]

[0094] The key acquisition method is as follows:

[0095] ① Symmetric encryption algorithm: It adopts the SM4 algorithm and CBC working mode to realize the encryption and decryption functions of document data, and provides data confidentiality protection. Its block length is 128 bits and key length is 128 bits.

[0096] ② Asymmetric Algorithm: The SM2 algorithm is used for digital signatures, signature verification, encryption, decryption, and key protection; the private key is 256 bits and the public key is 512 bits.

[0097] ③ Hash Algorithm: The SM3 algorithm is used for digest calculation, and the output is a fixed length of 256 bits;

[0098] ④ SM4 Block Cipher Algorithm: Used to encrypt and protect real-time document data sources. It adopts the CBC working mode. Each message or file body corresponds to a body encryption key and encryption padding IV. The block padding method adopts the PKCS#7 standard padding method and refers to the SM4 algorithm standard specification "SM4 Block Cipher Algorithm".

[0099] As attached Figure 7As shown, the working process of this device is as follows:

[0100] S1. After the client inputs the content of the local document, it calls the password module to encrypt the document, thus obtaining the ciphertext document: E(FBK,FB)||E(CGK,FBK)||H(FB)||CGID||CGKV;

[0101] S2. The client transmits the encrypted document to the collaborative processing service unit;

[0102] S3. The server performs OT processing on the encrypted document through operation conversion;

[0103] S4 and OT encrypted documents are sent to other clients via push notifications.

[0104] S5. Other clients call the password module's decryption interface to decrypt the document, as detailed below:

[0105] S501. Use CGK to decrypt the ciphertext FBK to obtain FBK, i.e.: D(CGK,EFBK);

[0106] S502. Use FBK to decrypt the ciphertext file to obtain the plaintext FB, i.e.: D(FBK,EFile);

[0107] S6. Other clients perform OT operations on the decrypted document and display it locally.

[0108] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A cloud-based multi-terminal real-time online document encryption device based on national secret, characterized by, The device comprises a server and a client, the client comprises an application terminal and a password module; the server comprises a key distribution service unit and a collaborative service unit; the key distribution service unit comprises a key management service module and a key distribution service module; the collaborative service unit comprises a service module and a collaborative processing service module; the key distribution service unit is used for key distribution and key management, and the collaborative service unit completes key distribution by calling the key distribution service module; meanwhile, the client-encrypted document is converted for collaborative operation and stored in ciphertext, and the ciphertext is forwarded to other clients; The OT processing mechanism of the server is consistent with the general document collaborative server processing mechanism; the information transmission path of any document operation is as follows: The client performs document editing and calls the password module to encrypt the document; When the ciphertext information reaches the collaborative service unit, OT operation conversion is performed, and the operation conversion information is finally pushed to the related client through DB service persistence; The related client pulls the ciphertext and calls the password module to perform decryption operation, and the collaborative editing action of the other party can be seen; The client is used for completing local updating and maintenance of the document, and the specific functions are as follows: ①, collect the editing operation and editing content of the user; ②, encrypt the local operation load; ③, receive the operation from the server; ④, decrypt the received operation load and apply it to the local; The key distribution service unit is used for key distribution and document data distribution; The key distribution is as follows: After the client selects the corresponding collaborative member and initiates a collaborative document request to the document collaborative server, the collaborative service unit generates the corresponding key through the key distribution service request; The document collaborative server encrypts the collaborative group key CGK of each client with the encryption public key CPUK of each client and distributes it to each client; The security channel between the encryption module and the key distribution service unit is established based on the TLS double-certificate verification mechanism; The key distribution service unit realizes the permission control of the encryption module requesting the key through the access control mechanism ACL; The document data distribution is as follows: After the collaborative client initiates the operation, the document is encrypted and sent to the document collaborative server; After the document collaborative server performs OT operation, the document update message is pushed to other clients according to the collaborative members; After receiving the push, the client pulls the document ciphertext, performs decryption operation on the document through the local password module, performs OT conversion, and synchronizes to the local for further presentation; The key acquisition method is as follows: ①, symmetric encryption algorithm: SM4 algorithm and CBC mode are adopted to realize the encryption and decryption functions of the document data, and the confidentiality protection of the data is provided, the block length is 128 bits, and the key length is 128 bits; ②, asymmetric algorithm: SM2 algorithm is used for digital signature, signature verification, encryption, decryption and key protection; wherein, the private key is 256 bits, and the public key is 512 bits; ③, hash algorithm: SM3 algorithm is used for digest calculation, and the output is fixed length 256 bits; ④, SM4 block algorithm: used for encrypting real-time document data source, using CBC mode, each message or file text corresponds to a text encryption key and encryption padding IV; the block padding mode uses the PKCS#7 standard padding mode, and refers to the SM4 algorithm standard specification "SM4 block cipher algorithm"; The working process of the device is as follows: S1, after the client inputs the local document content, the password module is called to encrypt the document, that is, the ciphertext document E(FBK, FB) || E(CGK, FBK) || H(FB) || CGID || CGKV is obtained; wherein, FB represents the file for collaborative operation; FBK represents the file block encryption key; CGK represents the collaborative group key; CGID represents the collaborative group ID; CGKV represents the collaborative group key version; S2, the client transmits the ciphertext document to the collaborative processing service unit; S3, the server performs OT processing on the encrypted document through operation conversion; S4, the ciphertext document after OT is sent to other clients through pushing; S5, other clients call the decryption interface of the password module to decrypt the document, as follows: S501, use CGK to decrypt FBK ciphertext to obtain FBK, that is: D(CGK, EFBK); S502, use FBK to decrypt the ciphertext file to obtain plaintext FB, that is: D(FBK, EFile); S6, other clients perform OT operation on the decrypted document and perform local presentation.

Images