Dual-key encryption file access control method, system, device and medium

Abstract

The application provides a double-key encryption file access control method, system, device and medium, and relates to the technical field of computer information security, and comprises the following steps: a file key generation and encryption step: setting the authority of a file to be controlled, and double-encrypting the file content; a file access control step: double-decrypting the file, controlling the file operation by an encryption and decryption driver, and uploading the corresponding operation to a server; and a file authority and key management step: generating a file random key, and storing file authority data.The application can improve the security of the file itself, and realizes the ability of centralized management of the administrator on the key.

Description

Technical Field

[0001] This invention relates to the field of computer information security technology, specifically to a file access control method, system, device, and medium with dual-key encryption. Background Technology

[0002] The advent of the digital age has made data a crucial national strategic resource, containing immense value. Therefore, data security protection has been elevated to a national strategic level. In the current environment, encrypting files is an effective means of preventing leaks. Files can be accessed normally on secure terminals, but cannot be opened outside of them. This places higher demands on access control, security, and user convenience for encrypted files.

[0003] A common file encryption scheme typically involves setting an encryption policy for each user, and then encrypting files using the same policy on the encrypted terminal. The encryption policy usually includes a file key and permissions; it's worth noting that the file key is often specified by the user. This method is characterized by its simplicity in encryption operation and streamlined workflow.

[0004] This method is simple to use, but it also carries a certain risk of data leakage; there are already examples of this in the market. Encrypting file content using a single, specified key makes the file easily crackable. File encryption algorithms are limited to a few, such as SM4 and AES, and are relatively predictable. The file key is often imported into the encryption server via a license file, and the process from key generation to import carries a high risk of leakage. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a file access control method, system, device, and medium with dual-key encryption.

[0006] According to the present invention, a file access control method, system, device, and medium with dual-key encryption are provided, the scheme of which is as follows:

[0007] Firstly, a file access control method with dual-key encryption is provided, the method comprising:

[0008] File key generation and encryption steps: Set permissions for the files that need to be controlled, and double-encrypt the file content;

[0009] File access control steps: The file is double-decrypted, the encryption / decryption driver controls file operations, and the corresponding operations are uploaded to the server;

[0010] File permission and key management steps: Generate a random key for the file and store the file permission data.

[0011] Preferably, the file key generation and encryption steps include:

[0012] Step S1.1: Encrypt file permission settings. Users set permissions for files that need to be controlled, and set different access permissions for different people and groups;

[0013] Step S1.2: File key generation. After the permissions are set, an encrypted file is generated. The corresponding file ID, public key, and a unique random key for this file are obtained from the server.

[0014] Step S1.3: File encryption. The file content is double-encrypted using a random key and a public key. The encryption algorithm used is SM4.

[0015] Step S1.4: File permission upload. The set file access permissions, file IDs, and random keys are all stored on the server.

[0016] Preferably, the file access control steps include:

[0017] Step S2.1: Obtain the public key and file ID, and use the public key to perform the first level of decryption on the file to obtain the file ID;

[0018] Step S2.2: Obtain file access permissions. Obtain the current encrypted terminal user's access permissions from the server using the file ID.

[0019] Step S2.3: Obtain the random key for the file. For files with access permissions, obtain the random key from the server.

[0020] Step S2.4: File decryption. The encryption / decryption driver obtains the public key and random key, decrypts the file, and returns the plaintext content to the operating system for display.

[0021] Step S2.5: File permission control. The encryption / decryption driver controls related operations such as file editing, printing, and watermark display.

[0022] Step S2.6: Report relevant logs, upload user operations on files to the server for later auditing.

[0023] Preferably, the file permission and key management steps include:

[0024] Step S3.1: Generate a random key for the file. The server responds to step S1.2 by generating a 128-bit random key.

[0025] Step S3.2: File permission storage. The server responds to step S1.4 by storing the file permission information, file ID, and random key on the server.

[0026] Step S3.3: File permission modification. The user initiates the approval process, and the administrator modifies the file permissions on the server. The permission data is stored in step S3.2.

[0027] Step S3.4: File security audit. The operations in steps S3.2 and S3.3 are displayed on the page for administrators to perform auditing operations.

[0028] Secondly, a dual-key encrypted file access control system is provided, the system comprising:

[0029] User and Policy Module: Encrypted terminals need to log in with an account, and the account is verified on the server. The account is entered by the administrator or imported from other systems. The account is bound to the encryption policy on the server, and the relevant encryption policy information is issued after logging in.

[0030] File key generation and encryption module: Sets permissions for files that need to be controlled and performs double encryption on the file content;

[0031] File access control module: performs double decryption on files, controls file operations through encryption / decryption drivers, and uploads the corresponding operations to the server;

[0032] File permission and key management module: Generates random keys for files and stores file permission data.

[0033] Preferably, the user and policy module includes:

[0034] 1) Personnel organization and management settings: Administrators enter user accounts and verify accounts when logging in via encrypted terminals;

[0035] 2) Personnel policy settings: After entering the account, bind the account to the encryption policy so that the relevant policy is issued after the encrypted terminal logs in, and the terminal can use it normally.

[0036] 3) Watermark strategy settings: When an encrypted terminal opens or prints an encrypted document, the watermark content can be displayed. The watermark includes text watermark, image watermark, and QR code watermark.

[0037] 4) Controlled policy settings: Controlled policies refer to which software files the encrypted terminal can encrypt and use;

[0038] 5) Encryption policy settings: The encryption policy is a collection of various policies and function settings. In the encryption policy, you can set whether to enable watermarking, which type of watermark to enable; set which controlled policy; and set other related function switches, including printer and offline time.

[0039] 6) Database storage module: The personnel and policies operating on the page are stored in the database; the API interface communication between the encrypted terminal and the server is also used, and the server's data is also obtained from the database.

[0040] Preferably, the file key generation and encryption module includes:

[0041] Module M1.1: Encrypted file permission settings. Users can set permissions for files that need to be controlled, and set different access permissions for different personnel and groups;

[0042] Module M1.2: File key generation. After permissions are set, an encrypted file is generated. The corresponding file ID, public key, and a unique random key for this file are obtained from the server.

[0043] Module M1.3: File encryption, using a random key and a public key to double-encrypt the file content, with the encryption algorithm being SM4;

[0044] Module M1.4: File permission upload. All set file access permissions, file IDs, and random keys are stored on the server.

[0045] Preferably, the file access control module includes:

[0046] Module M2.1: Obtain the public key and file ID, and use the public key to perform the first-level decryption of the file to obtain the file ID;

[0047] Module M2.2: Obtains file access permissions by retrieving the current terminal user's access permissions from the server using the file ID;

[0048] Module M2.3: Obtains a random key for a file. For files with access permissions, it obtains the random key from the server.

[0049] Module M2.4: File decryption. The encryption / decryption driver obtains the public key and random key, decrypts the file, and returns the plaintext content to the operating system for display.

[0050] Module M2.5: File permission control, the encryption and decryption driver controls related operations such as file editing, printing, and watermark display;

[0051] Module M2.6: Related log reporting, uploading user file-related operations to the server for later auditing;

[0052] The file permission and key management module includes:

[0053] Module M3.1: Generates a random key for a file. The server responds to module M1.2 by generating a 128-bit random key.

[0054] Module M3.2: File permission storage. The server responds to module M1.4 by storing file permission information, file ID, and random key on the server.

[0055] Module M3.3: File permission modification. Users initiate approval processes, and administrators modify file permissions on the server. Permission data is stored in module M3.2.

[0056] Module M3.4: File security auditing. This module displays the operations of modules M3.2 and M3.3 on a webpage for administrators to perform auditing operations.

[0057] Thirdly, a computer-readable storage medium storing a computer program is provided, wherein the computer program, when executed by a processor, implements the steps of the dual-key encrypted file access control method.

[0058] Fourthly, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the dual-key encrypted file access control method.

[0059] Compared with the prior art, the present invention has the following beneficial effects:

[0060] 1. This invention enhances the security of files by adding a random key to each file and performing double encryption with a public key and a random key.

[0061] 2. File access keys are obtained from the server, thus enabling administrators to centrally manage the keys.

[0062] Other beneficial effects of the present invention will be explained in detail through the introduction of specific technical features and technical solutions in specific embodiments. Those skilled in the art should be able to understand the beneficial technical effects brought about by these technical features and technical solutions through the introduction of these technical features and technical solutions. Attached Figure Description

[0063] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0064] Figure 1 This is a schematic diagram of the overall process of the present invention;

[0065] Figure 2 Flowchart for file key generation and file encryption;

[0066] Figure 3 This is a flowchart of file access control.

[0067] Figure 4 Flowchart for file permissions and key management;

[0068] Figure 5 A diagram illustrating the user and policy settings module;

[0069] Figure 6 This is a schematic diagram of the business processing module;

[0070] Figure 7 This is a schematic diagram of an encrypted terminal application module;

[0071] Figure 8 This is a schematic diagram of an encrypted file access control module. Detailed Implementation

[0072] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0073] This invention provides a file access control method using dual-key encryption, referring to... Figure 1 As shown, the method is as follows:

[0074] File key generation and encryption steps: Set permissions for the files that need to be controlled, and double-encrypt the file content.

[0075] Reference Figure 2 As shown, this step specifically includes:

[0076] Encrypted file permission settings: Users can use the tool to set permissions for files that need to be controlled, and set different access permissions for different people and groups.

[0077] File key generation: After the permissions are set, an encrypted file is generated. This requires obtaining the corresponding file ID, public key, and a unique random key for this file from the server.

[0078] File encryption: The file content is encrypted using a random key and the algorithm is SM4 block encryption. A fixed-length content, called the encrypted file header, is generated by integrating the file ID, file type, enterprise information, terminal information, and basic file information. The SM4-encrypted file content is then appended to the file header, and the entire file content is encrypted again using the file public key.

[0079] File permission upload: All set file access permissions, file IDs, and random keys are stored on the server.

[0080] File access control steps: Double-click to open the file. The encryption / decryption driver first performs double decryption on the file. The corresponding software displays the plaintext content normally. The encryption / decryption driver controls the file editing and printing operations and uploads the corresponding operations to the server.

[0081] Reference Figure 3 As shown, this step specifically includes:

[0082] Obtain the public key: Obtain the public key from the server through the public key retrieval interface (HTTPS API).

[0083] Obtain the file ID: Decrypt the file using the public key to obtain the file header content, and then read the file ID from the file header.

[0084] Get file access permissions: The parameters are the file ID and the current terminal user account. The corresponding access permissions are returned from the server through the permission retrieval interface (HTTPS API).

[0085] Get the random key for the file: This is the content returned by the permission retrieval interface. If the file does not have access permissions, the content is the corresponding error value; if the file has access permissions, the content is the file access permissions and the random key. The file access permissions are the read-only, edit, print, etc. settings set during encryption.

[0086] File decryption demonstration: The encryption / decryption driver obtains the public key and random key, decrypts the file, and returns the plaintext content to the corresponding software for display.

[0087] File permission control: The encryption / decryption driver controls operations related to file editing, printing, watermark display, etc.

[0088] Related log reporting: User operations on files, such as opening and printing, are uploaded to the server via HTTPS API for later auditing.

[0089] File permission and key management steps: Generate a random key for the file and store the file permission data.

[0090] Reference Figure 4 As shown, this step specifically includes:

[0091] File random key generation: The server responds to the file key generation step and generates a 128-bit random key;

[0092] File permission storage: In response to the file key generation step, the server stores the file permission information, file ID, and random key on the server.

[0093] File permission modification: When a user initiates an approval process, the administrator modifies the file permissions on the server, and the permission data is stored in the file permission storage step.

[0094] File security audit: The page displays the steps for storing and modifying file permissions, allowing administrators to perform auditing operations.

[0095] This invention also provides a dual-key encrypted file access control system. This dual-key encrypted file access control system can be implemented by executing the steps of the dual-key encrypted file access control method. That is, those skilled in the art can understand the dual-key encrypted file access control method as a preferred embodiment of the dual-key encrypted file access control system. The specific details of this system are as follows:

[0096] User and Policy Module: Encrypted terminals require account login, which is verified on the server. Accounts are entered by the administrator or imported from other systems. Accounts are linked to encryption policies on the server; upon login, relevant encryption policy information is sent, including which software documents can be encrypted and what watermarks can be displayed.

[0097] The user and policy module includes:

[0098] 1) Personnel organization and management settings: Administrators enter user accounts and verify accounts when logging in via encrypted terminals.

[0099] 2) Personnel policy settings: After entering the account, the account must be bound to the encryption policy so that the relevant policy can be issued after the encrypted terminal logs in, and the terminal can be used normally.

[0100] 3) Watermark strategy settings: When an encrypted terminal opens or prints an encrypted document, watermark content can be displayed. Watermarks include text watermarks, image watermarks, and QR code watermarks.

[0101] 4) Controlled policy settings: Controlled policies refer to which software files the encrypted terminal can encrypt and use, such as WPS, Notepad, etc.

[0102] 5) Encryption policy settings: The encryption policy is a collection of various policies and function settings. In the encryption policy, you can set whether to enable watermarking, which type of watermark to enable; which controlled policy to set; and other function switches such as printer and offline time.

[0103] 6) Database storage module: The personnel and policies operating on the page are stored in the database; the API interface communication between the encrypted terminal and the server also uses data retrieved from the database.

[0104] File key generation and encryption module: Sets permissions for files that need to be controlled and performs double encryption on the file content.

[0105] The file key generation and encryption module includes:

[0106] Module M1.1: Encrypted file permission settings. Users can set permissions for files that need to be controlled, and set different access permissions for different people and groups.

[0107] Module M1.2: File key generation. After permissions are set, an encrypted file is generated. The corresponding file ID, public key, and a unique random key for this file are obtained from the server.

[0108] Module M1.3: File encryption, using a random key and a public key to double-encrypt the file content, with the encryption algorithm being SM4.

[0109] Module M1.4: File permission upload. All set file access permissions, file IDs, and random keys are stored on the server.

[0110] File access control module: Performs double decryption on files, controls file operations through encryption / decryption drivers, and uploads the corresponding operations to the server.

[0111] The file access control module includes:

[0112] Module M2.1: Obtain the public key and file ID, and use the public key to perform the first-level decryption of the file to obtain the file ID.

[0113] Module M2.2: Obtain file access permissions. It retrieves the current terminal user's access permissions from the server using the file ID.

[0114] Module M2.3: Obtains random keys for files. For files with access permissions, it obtains random keys from the server.

[0115] Module M2.4: File decryption. The encryption / decryption driver obtains the public key and random key, decrypts the file, and returns the plaintext content to the operating system for display.

[0116] Module M2.5: File permission control, encryption and decryption driver controls related operations such as file editing, printing, and watermark display.

[0117] Module M2.6: Related log reporting. For various user operations on files, such as opening and printing, the logs are uploaded to the server for later auditing.

[0118] File permission and key management module: Generates random keys for files and stores file permission data.

[0119] The file permissions and key management module includes:

[0120] Module M3.1: Generates a random key for a file. The server responds to module M1.2 by generating a 128-bit random key.

[0121] Module M3.2: File permission storage. The server responds to module M1.4 by storing file permission information, file ID, and random key on the server.

[0122] Module M3.3: File permission modification. Users initiate approval processes, and administrators modify file permissions on the server. Permission data is stored in module M3.2.

[0123] Module M3.4: File security auditing. This module displays the operations of modules M3.2 and M3.3 on a webpage for administrators to perform auditing operations.

[0124] The technical solution of this invention includes four system modules: a user and policy module, a business processing module, an encrypted terminal module, and a decrypted file access management module. The specific details of each module are as follows:

[0125] Reference Figure 5 As shown, the user and policy module also includes:

[0126] Personnel organization and management module:

[0127] Encrypted terminals require account login before use. Administrators need to manage the company's organizational structure on the control panel, set up accounts, passwords, etc., and store them in the database for API query verification.

[0128] Personnel strategy settings module:

[0129] An account needs to be bound to a specific encryption policy before encrypted files can be used normally after logging in on an encrypted terminal.

[0130] Watermarking strategy management module:

[0131] When opening or printing encrypted files on a terminal, a watermark can be displayed. The watermark content can be text, image, or QR code. Displaying a watermark can facilitate tracing in the event of a data breach.

[0132] Controlled policy management module:

[0133] A controlled policy refers to the ability to encrypt software and file formats, allowing them to be opened normally. Given the complexity and variety of software, monitoring is necessary when a terminal tries to open an encrypted file.

[0134] Encryption Policy Management Module:

[0135] The personnel policy settings module is where accounts are linked to encryption policies. An encryption policy is a set of settings that includes watermarks, controlled access policies, and other information such as offline time and security level.

[0136] Database storage module:

[0137] User accounts, watermarking policies, and controlled policies are all stored in the database.

[0138] Reference Figure 6 As shown, the business processing module also includes:

[0139] Key Management Module:

[0140] Encrypted terminals need to request a random key from the server via API. Within the API, for each terminal request, a file ID and a random key are returned.

[0141] Permission processing module:

[0142] After creating an encrypted file, the encrypted terminal sends information such as the file's author, authorized personnel, their respective permissions, and file ID to the server via API and stores it in the database. Administrators can directly modify permissions on the terminal, or authorized personnel can initiate an approval request to modify permissions; ultimately, all data is modified within the database. When the encrypted terminal opens or queries user permissions, it also queries the database via API.

[0143] Log processing module:

[0144] When encrypted terminals perform file operations, such as encrypting, modifying encrypted permissions, opening, and printing encrypted files, they upload log data to the database via API. Log data typically includes user account information, terminal information, file information, operation type, and operation result. Additionally, operations at the management console also generate logs, such as administrators adding accounts and setting policies, which are directly stored in the database. The server backend also needs to maintain and manage the log data, periodically cleaning up data that has been stored for too long.

[0145] Database storage module:

[0146] Logs and permission information are stored in the database via API. The encrypted file information, logs, and other displayed information are all retrieved directly from the database.

[0147] Permission display module:

[0148] The management console page displays information about all encrypted files, including the file author, authorized personnel's permissions, and file details. Administrators can also search for relevant files based on different criteria.

[0149] Log display module:

[0150] The aforementioned log module primarily records file operation logs from the terminal and management logs from the control panel. These logs are displayed in separate columns on the control panel page based on their type. The page also provides search and sorting options based on various criteria.

[0151] Reference Figure 7 As shown, the encrypted terminal module also includes:

[0152] User login module:

[0153] After the encrypted terminal is installed, you need to enter your username and password. Only after successfully calling the login API will the encryption policy be downloaded from the server, and the terminal's functions will then work properly. Login operations will be logged on the server.

[0154] Status maintenance module:

[0155] After successfully logging into the encrypted terminal and obtaining the configuration, all terminal functions become active. These functions are unavailable when the client is offline; they also fail to work if the account is logged out or disabled. This is to prevent data leaks due to accidental computer loss.

[0156] Policy refresh module:

[0157] After successfully logging into the encrypted terminal and obtaining the configuration, if the administrator modifies the encryption policy for that logged-in account on the management console, the changes must be promptly updated to take effect for the client. The terminal has two mechanisms for updating the encryption policy: active and passive. Active updating requires the user to click the relevant refresh button, and the configuration is immediately distributed after the update. Passive updating is performed in the background, and there is a slight time interval required for the passive operation to be triggered.

[0158] Terminal encrypted access control:

[0159] After successfully logging into the encrypted terminal and obtaining the configuration, double-clicking the encrypted file triggers the driver to retrieve the system's underlying operation functions. It then begins analyzing whether the file falls within a controlled policy. If not, the file is not decrypted, resulting in garbled text. If it is within a controlled policy, the public key is first obtained via API. The file header is then decrypted to obtain the file ID. Permissions are then retrieved from the server via API. If access is denied, the file opens as garbled text; otherwise, it is decrypted using a random key, and the plaintext content is returned to the software, allowing the file to open normally. File opening operations are logged.

[0160] System plugin modules:

[0161] After successfully logging into the encrypted terminal and obtaining the configuration, the system plugin can be used. It allows right-clicking on a file to bring up buttons for file encryption, permission modification, permission viewing, file restoration, permission modification approval, and file restoration approval, each performing its corresponding function.

[0162] Encrypted file creation module:

[0163] After successfully logging into the encrypted terminal and obtaining the configuration, you can right-click to perform encryption operations. The encryption operation has a terminal interface where you need to select the file validity period, authorized personnel, corresponding permissions, etc. After filling in the relevant information, the file ID and random key will be obtained from the server via API, the file will be encrypted, and the file permissions will be uploaded to the server. The encryption operation will be logged.

[0164] Log reporting module:

[0165] After successfully logging into the encrypted terminal and obtaining the configuration, all the above operations will generate logs, which will be sent to the logging module (the terminal's internal communication interface, implemented using sockets). The logging module will upload all logs to the server. In the event of a sudden network outage, the logs will be cached locally until they are successfully uploaded again.

[0166] Reference Figure 8 As shown, the decryption file access management module also includes:

[0167] Drive control module:

[0168] The driver control module monitors the system's low-level APIs, such as file opening, editing, saving, and printing. Before calling any system API, the driver module determines whether control is needed for the file. If control is required, the driver first calls its own interface before proceeding with the system API call.

[0169] Encryption policy parsing module:

[0170] Before calling the system's open API, the driver checks the file type and the corresponding software. The encryption policy includes settings for software and file types; the driver must ensure the file conforms to the policy before it will perform any control.

[0171] Access control module:

[0172] The driver, after confirming the need for control via the encryption policy parsing module, first checks its own function before accessing the corresponding system-level file operation APIs. Before the system call to open the file, it checks for access permissions; if so, it decrypts the file and sends the plaintext content to the system. Before the system call to save the file, it checks for edit permissions; otherwise, it intercepts the request. Before the system call to print the file, it checks for printing permissions; otherwise, it intercepts the request. It also checks for watermark permissions; if granted, the driver will display a watermark.

[0173] Overall implementation principle of the invention:

[0174] This invention employs a client / server (C / S) architecture. User basic information is set through user and policy modules. The encryption policy for the user is issued from the server via an encryption terminal module. Encrypted files are created on the terminal, and the server's business processing module handles operations such as creating encrypted files, querying permissions, and logging on the terminal. For core encrypted access control, the circulation channels of the encryption key are strictly controlled, and files are double-encrypted to enhance security. When an encrypted file is opened, the driver performs encryption policy parsing, permission parsing, and subsequent permission control in the background, ensuring a smooth user experience without requiring users to change their existing operating habits simply because the file is encrypted.

[0175] This invention provides a file access control method, system, device, and medium using dual-key encryption. In addition to public-key encryption, a random key encryption method is added to each file, and a file encryption and access control system is designed based on this method. For this dual-key encrypted file, in addition to a public key, there is also a separate 128-bit random key, which significantly improves the security of the encrypted file compared to traditional public-key encryption.

[0176] Those skilled in the art will understand that, besides implementing the system and its various devices, modules, and units provided by this invention in the form of purely computer-readable program code, the same functions can be achieved entirely through logical programming of the method steps, making the system and its various devices, modules, and units of this invention function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, the system and its various devices, modules, and units provided by this invention can be considered as a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component; alternatively, the devices, modules, and units for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0177] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A method of file access control by double-key encryption, characterized by, The application comprises the following steps: File key generation and encryption step: setting permissions for files that need to be controlled, and double-encrypting the file content; File access control step: double-decrypting the file, controlling the file operation by the encryption and decryption driver, and uploading the corresponding operation to the server; File permission and key management step: generating a file random key and storing file permission data; The file key generation and encryption step comprises: Step S1.1: encrypting file permission settings, the user sets permissions for the files that need to be controlled, and sets different access permissions for different personnel and groups; Step S1.2: file key generation, after setting the permissions, an encrypted file is generated, the corresponding file Id, public key, and an independent random key for the file are obtained from the server; Step S1.3: file encryption, the file content is double-encrypted using the random key and the public key, and the encryption algorithm uses SM4; Step S1.4: file permission upload, the set file access permissions, file Id, and random key are uniformly stored in the server; The file access control step comprises: Step S2.1: obtaining the public key and file Id, the file is decrypted by the public key to obtain the file Id; Step S2.2: obtaining the file access permission, the access permission of the current terminal user is obtained from the server by the file Id; Step S2.3: obtaining the file random key, the random key is obtained from the server for the file with access permission; Step S2.4: file decryption, the encryption and decryption driver obtains the public key and the random key to decrypt the file, and returns the plaintext content to the operating system and displays it; Step S2.5: file permission control, the encryption and decryption driver controls the related operations of the file, such as editing, printing, and watermark display; Step S2.6: related log reporting, the related operation of the user on the file is uploaded to the server for later auditing; The file permission and key management step comprises: Step S3.1: file random key generation, the server responds to step S1.2 to generate a 128-bit random key; Step S3.2: file permission storage, the server responds to step S1.4 to store the file permission information, file Id, and random key in the server; Step S3.3: file permission modification, the user initiates an approval, the administrator modifies the file permission on the server, and the permission data is stored in step S3.2; Step S3.4: file security audit, the operations in steps S3.2 and S3.3 are displayed on the page for the administrator to perform audit operations.

2. A dual-key encrypted file access control system, characterized by, The application comprises the following steps: User and policy module: the encryption terminal needs to log in through an account, the account is verified on the server, the account is input by the administrator or imported from other systems, the account is bound with the encryption policy on the server, and the relevant encryption policy information is issued after login; File key generation and encryption module: setting permissions for files that need to be controlled, and double-encrypting the file content; File access control module: double-decrypting the file, controlling the file operation by the encryption and decryption driver, and uploading the corresponding operation to the server; File permission and key management module: generate file random key, store file permission data; The user and policy module includes: 1) Personnel organization management setting, the administrator inputs the user account, and checks the account when the encryption terminal logs in; 2) Personnel policy setting, after inputting the account, the account is bound with the encryption policy, so that the relevant policy is issued after the encryption terminal logs in, and the terminal is normally used; 3) Watermark policy setting, when the encryption terminal opens and prints the encrypted document, the watermark content can be displayed, and the watermark includes text watermark, picture watermark, and two-dimensional code watermark; 4) Controlled policy setting, the controlled policy refers to which software files the encryption terminal can encrypt and use; 5) Encryption policy setting, the encryption policy is a collection of various policies and function settings, whether to enable watermark, which watermark to enable, which controlled policy to set, and related other function switches such as printer and offline time are set in the encryption policy; 6) Database storage module, the personnel and policy operated on the page are stored in the database; the API interface communication between the encryption terminal and the server is also taken from the database; The file key generation and encryption module includes: Module M1.1: encryption file permission setting, the user sets the permission for the file to be controlled, and sets different access permissions for different personnel and groups; Module M1.2: file key generation, after setting the permission, the encrypted file is generated, the corresponding file Id, public key, and independent random key for the file are obtained from the server; Module M1.3: file encryption, the file content is double-encrypted using the random key and the public key, and the encryption algorithm adopts SM4; Module M1.4: file permission upload, the set file access permission, file Id, and random key are uniformly stored in the server.

3. The dual-key encrypted file access control system of claim 2, wherein, The file access control module includes: Module M2.1: obtain the public key and file Id, and perform first-layer decryption on the file through the public key to obtain the file Id; Module M2.2: obtain the file access permission, and obtain the access permission of the current terminal user from the server through the file Id; Module M2.3: obtain the file random key, and obtain the random key from the server for the file with access permission; Module M2.4: file decryption, the public key and the random key are obtained by the encryption and decryption driver, the file is decrypted, and the plaintext content is returned to the operating system and displayed; Module M2.5: file permission control, the encryption and decryption driver controls the related operations of the file, such as editing, printing, and watermark display; Module M2.6: related log reporting, the related operations of the user on the file are uploaded to the server for later auditing; The file permission and key management module includes: Module M3.1: file random key generation, the server responds to module M1.2 to generate a 128-bit random key; Module M3.2: file permission storage, the server stores the file permission information, file Id, and random key in the server in response to module M1.4; Module M3.3: file permission modification, user initiates approval, administrator modifies file permission on server, permission data is stored in module M3.2; Module M3.4: file security audit, the operation of module M3.2 and module M3.3 is displayed on a page, for the administrator to perform audit operation.

4. A computer-readable storage medium storing a computer program, characterized in that, The computer program is executed by the processor to realize the steps of the double-key encrypted file access control method of claim 1.

5. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The computer program is executed by the processor to realize the steps of the double-key encrypted file access control method of claim 1.

Images