A network range resource encryption method and system

Abstract

The present invention discloses a network range resource encryption method and system, comprising: extracting characters from a user activation code to generate a first key to encrypt the original resource file; when importing a resource file after system activation, extracting characters from the user activation code to generate the first key to decrypt the resource file; extracting characters from the user activation code to generate a second key, using the second key to re-encrypt the decrypted resource file and store it, and adding an encryption mark; during use of the network range system, in response to a user interface requesting a resource file with an encryption mark from a range server, the range server redirects the request to a decryption server, which decrypts the resource file using the second key and returns it to the user interface; during backup / restore, extracting characters from the user activation code to generate a third key to encrypt / decrypt the resource file. This method can effectively prevent resource leakage and achieve user-level resource isolation.

Description

Technical Field

[0001] The present invention relates to a network range resource encryption method and system, and belongs to the fields of network security and computer software. Background Art

[0002] A cyber range uses virtualization technology to simulate a realistic cyberspace attack and defense environment, supporting combat capability research and weaponry verification. To achieve this, when using a cyber range for teaching experiments, some teaching data must be pre-installed, such as virtualized cyber experiment courses.

[0003] After purchasing the network range, the typical usage process is as follows: Figure 1 As shown below. 1. After purchasing the network range system, the user enters the user activation code to activate the range system. 2. Use the import command to import specific range resource data from the range system's built-in resource disk. 3. After successfully importing the resource data, the user can use the range for various teaching experiments. 4. To avoid misoperation during use, the user can regularly back up key resources. When necessary, import the specified backup data to implement resource backup and recovery functions to ensure smooth system operation.

[0004] The existing shooting range system usage process has the following issues: 1. Resource data on the original resource disk is unencrypted. If resources are lost during transportation, it may cause asset leakage. 2. Resource backup files exported by user A from the system can be directly imported into user B's system for use, making it impossible to isolate resources by user. Once user A purchases a resource, it can be shared with other users who have not purchased the resource directly. 3. Resource files are stored in plain text. As long as users know the resource storage path on the server, they can easily obtain the original resource file, which may lead to resource leakage. Summary of the Invention

[0005] Purpose of the invention: In response to the problems existing in the above-mentioned prior art, the purpose of the present invention is to provide a network target range resource encryption method and system, which encrypts the target range resource files based on the user dimension, avoids resource leakage, and realizes user-level resource isolation.

[0006] Technical solution: To achieve the above-mentioned purpose, the present invention adopts the following technical solution:

[0007] In a first aspect, the present invention provides a method for encrypting network range resources, comprising:

[0008] Extracting characters from the user activation code to generate a first key, and using the first key to encrypt the original resource file provided to the user to obtain an encrypted resource file;

[0009] When the encrypted resource file is imported after the network range system is activated, characters are extracted from the user activation code to generate a first key, and the encrypted resource file is decrypted to obtain a decrypted resource file; characters are extracted from the user activation code to generate a second key, and the decrypted resource file is re-encrypted using the second key, wherein the second key is different from the first key, and the re-encrypted resource file is written to the network range system disk and an encryption mark is added to form a resource file with an encryption mark;

[0010] During use of the network range system, in response to a user interface requesting a resource file with an encrypted mark from the range server, the range server redirects the request to the decryption server, which decrypts the resource file with the encrypted mark using the second key and returns it to the user interface;

[0011] When the network range system performs resource file backup, characters are extracted from the user activation code to generate a third key, the decrypted resource file is encrypted using the third key, and the backup resource file is exported; when performing resource file recovery, the backup resource file is decrypted using the third key, and the decrypted resource file is written to the network range system disk; the third key is different from the first key and the second key.

[0012] In some embodiments, the user activation code includes an authorization field and a key field, and the character string of the key field is hashed in the middle of the character string of the authorization field.

[0013] Furthermore, the authorization field is calculated based on the user hardware and usage period information. When the user extends the usage period, only the authorization field in the user activation code is updated, and the key field is not updated.

[0014] In some embodiments, the network range resource encryption method provides an original resource file provided to the user, and the encrypted resource file obtained by encrypting the original resource file is stored in a resource disk.

[0015] In some embodiments, the network range resource encryption method uses an encryption identifier prefix agreed upon on the file path or file name when the resource file re-encrypted with the second key is written to the network range system disk.

[0016] In some embodiments, the network range resource encryption method described above randomizes the file name while encrypting the resource file content when the re-encrypted resource file is written to the network range system disk.

[0017] In a second aspect, the present invention provides a network range resource encryption system, comprising:

[0018] An initial encryption module, configured to extract characters from a user activation code to generate a first key, and use the first key to encrypt an original resource file provided to the user to obtain an encrypted resource file;

[0019] An encryption conversion module is used to extract characters from the user activation code to generate a first key when importing the encrypted resource file after the network range system is activated, decrypt the encrypted resource file to obtain a decrypted resource file; extract characters from the user activation code to generate a second key, re-encrypt the decrypted resource file using the second key, wherein the second key is different from the first key, write the re-encrypted resource file to the network range system disk, and add an encryption mark to form a resource file with an encryption mark;

[0020] A real-time decryption module is used to, in response to a user interface requesting a resource file with an encryption mark from a range server during use of the network range system, redirect the request to a decryption server, and the decryption server decrypts the resource file with the encryption mark using a second key and returns the decrypted file to the user interface;

[0021] And, a backup and recovery module is used to extract characters from the user activation code to generate a third key when performing a resource file backup in the network target range system, use the third key to encrypt the decrypted resource file, and then export the backed up resource file; when performing resource file recovery, use the third key to decrypt the backed up resource file, and write the decrypted resource file to the network target range system disk; the third key is different from the first key and the second key.

[0022] In some embodiments, the user activation code includes an authorization field and a key field, and the character string of the key field is hashed in the middle of the character string of the authorization field.

[0023] Furthermore, the authorization field is calculated based on the user hardware and usage period information. When the user extends the usage period, only the authorization field in the user activation code is updated, and the key field is not updated.

[0024] In a third aspect, the present invention provides a resource encrypted network range system, comprising:

[0025] The encryption conversion module is used to extract characters from the user activation code to generate a first key when importing a resource file from the resource disk after the network range system is activated, and decrypt the resource file to obtain a decrypted resource file; extract characters from the user activation code to generate a second key, and re-encrypt the decrypted resource file using the second key, wherein the second key is different from the first key, and write the re-encrypted resource file to the network range system disk and add an encryption mark to form a resource file with an encryption mark; wherein the resource file in the resource disk is a file encrypted using the first key;

[0026] A real-time decryption module is used to, in response to a user interface requesting a resource file with an encryption mark from a range server during use of the network range system, redirect the request to a decryption server, and the decryption server decrypts the resource file with the encryption mark using a second key and returns the decrypted file to the user interface;

[0027] And, a backup and recovery module is used to extract characters from the user activation code to generate a third key when the network target range system performs a resource file backup, use the third key to encrypt the decrypted resource file, and then export the backed up resource file; and when the network target range system performs a resource file recovery, use the third key to decrypt the backed up resource file, and write the decrypted resource file to the network target range system disk; the third key is different from the first key and the second key.

[0028] Beneficial effects: Compared with the prior art, the present invention has the following advantages: 1. The present invention uses the first key to encrypt the original resource file and then store it. The resource is encrypted throughout the transportation process. Even if the original resource file is leaked, it will not cause asset loss. 2. The present invention uses the second key to transform and encrypt the imported resource file. After the resource is imported into the system, it exists in an encrypted form. Even if the user knows the original storage path of the resource, he cannot directly use the resource. 3. The present invention uses the third key to re-encrypt the resources exported by the user. The formats of the same resource after export are different for different network target range system platforms, which increases the difficulty of cracking the exported resources, ensures that the resources will not be shared between different users, and realizes user-level resource isolation. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 Use a flow chart for existing cyber range resources.

[0030] Figure 2 and Figure 3 This is a flow chart of a resource encryption method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] The technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings and specific embodiments.

[0032] Example 1

[0033] An embodiment of the present invention discloses a network range resource encryption method. When making an original resource disk, characters are extracted from a user activation code to generate a first key, and the first key is used to encrypt an original resource file provided to the user. When the network range system is activated and a resource file is imported, characters are extracted from the user activation code to generate a first key, and the resource file is decrypted. At the same time, characters are extracted from the user activation code to generate a second key, and the decrypted resource file is re-encrypted using the second key. The re-encrypted resource file is written to the network range system disk and an encryption mark is added. During the use of the network range system, if a user interface requests a resource file with an encryption mark from a range server, the range server redirects the request to a decryption server, and the decryption server decrypts the resource file using the second key and then returns it to the user interface. When the network range system performs a resource file backup, characters are extracted from the user activation code to generate a third key, and the resource file is encrypted using the third key and then exported. When performing a resource file recovery, the backed-up resource file is decrypted using the third key, and the decrypted resource file is written to the network range system disk.

[0034] This embodiment of the present invention encrypts original resource files, protecting data security during transport. Data imported into the system undergoes a transformation encryption operation, preventing users from directly using the imported resource data. Furthermore, encryption is performed on user-exported data. While ensuring effective backup of user data, the encrypted exported resources prevent users from sharing them with other users, thus achieving user-level resource isolation.

[0035] The following combination Figure 2 and Figure 3 , the specific process of the embodiment of the present invention is described in detail.

[0036] Step 1: After purchasing the range system, a user activation code is generated for them. The user activation code consists of two main parts: the first is an authorization field calculated based on factors related to the user's hardware and usage date; the second is a user key, which is hashed at different locations in the user activation code. For example, a user activation code with a length of 100 characters has 80 bits for the authorization field and 20 bits for the key field. The key field appears at positions 5, 10, 15, ..., 100 in the user activation code.

[0037] Step 2: Sequentially obtain encryption characters from the authorization code, generate a first key A, and encrypt the original resource data provided to the user.

[0038] Step 3: After the range system is activated, import the resource data required by the user from the resource disk (which can be a physical disk or a network disk).

[0039] Step 4: During the resource import process, the importer obtains the current system's user activation code, sequentially reads the key characters from the code, generates a first key, and decrypts the resource file in memory. Simultaneously, the key character fields are reordered according to a specified rule to generate a second key, B. The decrypted data in memory is re-encrypted using the reordered second key, B. The encrypted file, as the final imported data, is written to the target range system disk. The path metadata corresponding to the encrypted data written to the system disk is encrypted, for example, by adding a special encryption identifier prefix (for example, if the original storage path for an image is / media / a.png, adding the prefix / enc will create / enc / media / cf934171-7040-436d-887e-4bc4d21ffe04). While the file content is encrypted using the key (the encrypted file content cannot be used directly), the file name is also randomized, such as using a UUID, to desensitize it from the original resource file.

[0040] Step 5. When the user uses the range to perform actual business operations, when the user accesses the actual resource through the user interface, the user will first request the resource path with the encryption prefix from the range server. At this time, the range server recognizes that the resource is encrypted and redirects the access to the resource to the decryption server. The decryption server uses the second key B to perform the actual decryption operation and returns the decrypted data to the range server. The range server finally returns this data to the user interface and displays it to the user.

[0041] Step 6: When the user performs a backup operation, the backup program obtains the user activation code of the current system, rearranges the key character fields according to the specified rules, generates a third key C, and uses the third key C to re-encrypt the stored encrypted resource file before exporting it. Re-encrypting the exported resource file further hides the associations between resource files, making it impossible for the user to decrypt a specific resource file. There is no need to decrypt existing encrypted files in the system during export. This allows the export / import backup process to be completed with a single encryption and decryption, reducing unnecessary computational effort.

[0042] Step 7: When the user performs a recovery operation, the encrypted backup file in step 6 is imported, the backup file is decrypted using the third key C, and the decrypted file is written to the system disk.

[0043] Step 8: When the user needs to extend the authorized use period of the shooting range, the newly generated authorization code will only affect the authorization field, and the key string field remains unchanged, ensuring the compatibility of the encrypted data.

[0044] In the above steps, existing symmetric encryption schemes can be used for file encryption and decryption, including but not limited to the RC4 algorithm; the positional relationship between the three keys A, B, and C and the hash string in the user activation code is also customized by the program, as long as the encryption key and decryption key are obtained in the same way.

[0045] Example 2

[0046] Based on the same inventive concept, the present invention discloses a network range resource encryption system, which primarily includes an initial encryption module, an encryption conversion module, a real-time decryption module, and a backup and recovery module. The initial encryption module is integrated into the resource export tool and is not released with the range system. The encryption conversion module, real-time decryption module, and backup and recovery module are all integrated into the network range system. The initial encryption module is used to extract characters from the user activation code to generate a first key, and use the first key to encrypt the original resource file provided to the user; the encryption conversion module is used to extract characters from the user activation code to generate a first key when importing the resource file after the network range system is activated, and decrypt the resource file; at the same time, it extracts characters from the user activation code to generate a second key, uses the second key to re-encrypt the decrypted resource file, writes the re-encrypted resource file to the network range system disk, and adds an encryption mark; the real-time decryption module is used during the use of the network range system, if the user interface requests the range server for a resource file with an encryption mark, the range server redirects the request to the decryption server, and the decryption server uses the second key to decrypt the resource file and then returns it to the user interface; the backup and recovery module is used to extract characters from the user activation code to generate a third key when the network range system performs a resource file backup, uses the third key to encrypt the resource file and then exports it; and when the network range system performs a resource file recovery, uses the third key to decrypt the backed up resource file, and writes the decrypted resource file to the network range system disk.

[0047] Example 3

[0048] In addition, an embodiment of the present invention discloses a resource encryption network range system, comprising: an encryption conversion module, configured to extract characters from a user activation code to generate a first key to decrypt the resource file when importing a resource file from a resource disk after the network range system is activated; simultaneously extract characters from the user activation code to generate a second key, re-encrypt the decrypted resource file using the second key, write the re-encrypted resource file to the network range system disk and add an encryption mark; the resource file in the resource disk is a file encrypted using the first key; a real-time decryption module, configured to, during use of the network range system, if a user interface requests a resource file with an encryption mark from a range server, redirect the request to a decryption server, and have the decryption server decrypt the resource file using the second key and then return it to the user interface; and a backup and recovery module, configured to extract characters from the user activation code to generate a third key when the network range system performs a resource file backup, encrypt the resource file using the third key, and then export it; and, when the network range system performs a resource file recovery, decrypt the backed-up resource file using the third key and write the decrypted resource file to the network range system disk.

[0049] The specific working process of each module described above can refer to the corresponding process in the aforementioned method embodiment and will not be repeated here. The division of the modules is only a logical function division. In actual implementation, there may be other division methods, such as combining multiple modules or integrating them into another system.

[0050] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0051] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0052] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0053] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0054] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A network range resource encryption method, characterized in that: include: Extracting characters from the user activation code to generate a first key, and using the first key to encrypt the original resource file provided to the user to obtain an encrypted resource file; When the encrypted resource file is imported after the network range system is activated, characters are extracted from the user activation code to generate a first key, and the encrypted resource file is decrypted to obtain a decrypted resource file; Extracting characters from the user activation code to generate a second key, re-encrypting the decrypted resource file using the second key, wherein the second key is different from the first key, writing the re-encrypted resource file to the network range system disk and adding an encryption mark to form a resource file with an encryption mark; During use of the network range system, in response to a user interface requesting a resource file with an encrypted mark from the range server, the range server redirects the request to the decryption server, which decrypts the resource file with the encrypted mark using the second key and returns it to the user interface; When the network range system performs resource file backup, characters are extracted from the user activation code to generate a third key, and the decrypted resource file is encrypted using the third key and then the backup resource file is exported; When performing resource file recovery, the backed-up resource file is decrypted using a third key and written to the network range system disk after decryption; the third key is different from the first key and the second key.

2. The network range resource encryption method according to claim 1, characterized in that: The user activation code includes an authorization field and a key field, and the character string of the key field is hashed in the middle of the character string of the authorization field.

3. The network range resource encryption method according to claim 2, characterized in that: The authorization field is calculated based on the user hardware and usage period information. When the user extends the usage period, only the authorization field in the user activation code is updated, and the key field is not updated.

4. The network range resource encryption method according to claim 1, characterized in that: The encrypted resource file obtained after the original resource file provided to the user is encrypted is stored in the resource disk.

5. The network range resource encryption method according to claim 1, characterized in that: When the resource file re-encrypted with the second key is written to the network range system disk, the encryption identifier prefix agreed on in the file path or file name.

6. The network range resource encryption method according to claim 1, characterized in that: When the re-encrypted resource file is written to the network range system disk, the resource file content is encrypted and the file name is randomized.

7. A network range resource encryption system, characterized in that: include: An initial encryption module, configured to extract characters from a user activation code to generate a first key, and use the first key to encrypt an original resource file provided to the user to obtain an encrypted resource file; An encryption conversion module is used to extract characters from the user activation code to generate a first key when importing the encrypted resource file after the network range system is activated, and decrypt the encrypted resource file to obtain a decrypted resource file; Extracting characters from the user activation code to generate a second key, re-encrypting the decrypted resource file using the second key, wherein the second key is different from the first key, writing the re-encrypted resource file to the network range system disk and adding an encryption mark to form a resource file with an encryption mark; A real-time decryption module is used to, in response to a user interface requesting a resource file with an encryption mark from a range server during use of the network range system, redirect the request to a decryption server, and the decryption server decrypts the resource file with the encryption mark using a second key and returns the decrypted file to the user interface; and a backup and recovery module, configured to extract characters from the user activation code to generate a third key when performing a resource file backup in the network range system, and to encrypt the decrypted resource file using the third key and then export the backup resource file; When performing resource file recovery, the backed-up resource file is decrypted using a third key and written to the network range system disk after decryption; the third key is different from the first key and the second key.

8. The network range resource encryption system according to claim 7, characterized in that: The user activation code includes an authorization field and a key field, and the character string of the key field is hashed in the middle of the character string of the authorization field.

9. The network range resource encryption system according to claim 8, characterized in that: The authorization field is calculated based on the user hardware and usage period information. When the user extends the usage period, only the authorization field in the user activation code is updated, and the key field is not updated.

10. A resource encrypted network range system, characterized in that: include: The encryption conversion module is used to extract characters from the user activation code to generate a first key when importing a resource file from the resource disk after the network range system is activated, and decrypt the resource file to obtain a decrypted resource file; extract characters from the user activation code to generate a second key, and re-encrypt the decrypted resource file using the second key, wherein the second key is different from the first key, and write the re-encrypted resource file to the network range system disk and add an encryption mark to form a resource file with an encryption mark; wherein the resource file in the resource disk is a file encrypted using the first key; A real-time decryption module is used to, in response to a user interface requesting a resource file with an encryption mark from a range server during use of the network range system, redirect the request to a decryption server, and the decryption server decrypts the resource file with the encryption mark using a second key and returns the decrypted file to the user interface; and a backup and recovery module for extracting characters from the user activation code to generate a third key when performing a resource file backup in the network range system, encrypting the decrypted resource file using the third key, and then exporting the backup resource file; When the network range system performs resource file recovery, the backed-up resource file is decrypted using a third key and written to the network range system disk after decryption; the third key is different from the first key and the second key.

Images