File encryption, decryption method and device, and digital copyright protection system

Abstract

The present application discloses a file encryption and decryption method and device, and a digital copyright protection system. The digital copyright protection system includes a production service end, a key management service, a client end, and a content license service. The production service end and the key management service use a first certificate chain, a second certificate chain, and a key license to implement a file encryption method, which can be applicable to all types of container files. The client end and the content license service use a third certificate chain, a fourth certificate chain, and a content license to implement a file decryption method, which can also be applicable to all types of container files. In addition, based on the high security of certificate chains (i.e., the first certificate chain, the second certificate chain, the third certificate chain, and the fourth certificate chain), key licenses, and content licenses, the security protection capability of digital copyrights can be significantly improved.

Description

Technical Field

[0001] The present application relates to the field of digital copyright protection, and in particular to a file encryption and decryption method and device, and a digital copyright protection system. Background Art

[0002] The general encryption specifications used in existing digital copyright protection technologies are limited in that they can only be applied to container files of specified industrial standards. For example, the CENC general encryption specifications defined in ISO / IEC 23001-7 can only be applied to ISOBMFF file encapsulation formats (MP4, M4S, etc.). For some non-industrial standard container files (such as audio FLAG, OGG), the existing digital copyright protection technology cannot be used. Therefore, it is necessary to encrypt the non-industrial standard container files to protect the digital copyright of the digital products of the non-industrial standard container files.

[0003] The existing encryption method for non-industry standard container files usually uses a fixed single encryption key to encrypt all files of a digital product, which is relatively easy to be cracked by a third party and has low security protection capabilities.

[0004] Therefore, how to improve the security protection capabilities of digital copyright has become an issue that needs to be urgently addressed. Summary of the invention

[0005] The present application provides a file encryption and decryption method and device, and a digital copyright protection system, the purpose of which is to improve the security protection capability of digital copyright.

[0006] In order to achieve the above objectives, this application provides the following technical solutions:

[0007] A file encryption method, applied to a production server, comprising:

[0008] Whenever a file to be encrypted is obtained, a key generation request carrying a first certificate chain is sent to a preset key management service, so that the key management service responds to the key generation request and sends a key license carrying a second certificate chain to the production service end; wherein the first certificate chain includes the public key of the production service end; the second certificate chain includes the public key of the key management service; the key license includes a key information ciphertext; the key information ciphertext is obtained by the key management service using the public key in the first certificate chain to encrypt the content key generated by the key management service and the key identifier corresponding to the content key;

[0009] When the second certificate chain passes the authentication, the key information ciphertext obtained by parsing the key license is decrypted using the private key of the production server to obtain the content key and the key identifier;

[0010] Based on the key identifier, generate a digital copyright protection information header;

[0011] Using the content key, encrypting the file to be encrypted to obtain an encrypted file;

[0012] The digital copyright protection information header is used as a file header and encapsulated into the encrypted file to obtain a digital product ciphertext.

[0013] Optionally, also include:

[0014] If the second certificate chain fails authentication, the key generation request is resent to the key management service.

[0015] Optionally, the generating a digital copyright protection information header based on the key identifier includes:

[0016] A digital copyright protection information header is generated based on the key identifier, a preset number of information header bytes, an encryption type identifier, and an information header version.

[0017] A file decryption method, applied to a client, comprising:

[0018] Whenever the digital product ciphertext is obtained from the production server, the file header of the digital product ciphertext is extracted to obtain the digital copyright protection information header;

[0019] Parsing the digital copyright protection information header to obtain a key identifier;

[0020] Sending a license acquisition request carrying the key identifier and the third certificate chain to a preset content license service, so that the content license service responds to the license acquisition request and sends a content license carrying a fourth certificate chain to the client; wherein the third certificate chain includes the public key of the client; the fourth certificate chain includes the public key of the content license service; the content license includes an encryption key; the encryption key is obtained by the content license service using the public key in the third certificate chain to encrypt the content key corresponding to the key identifier obtained from the key management service;

[0021] When the fourth certificate passes the authentication, the encryption key obtained by parsing the content license is decrypted using the private key of the client to obtain the content key;

[0022] The digital product ciphertext is decrypted using the content key to obtain the digital product plaintext.

[0023] Optionally, parsing the digital copyright protection information header to obtain a key identifier includes:

[0024] Extracting an encryption type identifier from the digital copyright protection information header;

[0025] When the encryption type identifier is a universal digital copyright, the digital copyright protection information header is parsed to obtain a key identifier.

[0026] Optionally, also include:

[0027] If the fourth certificate chain fails authentication, the license acquisition request is resent to the content license service.

[0028] A file encryption device, comprising:

[0029] A request unit, configured to send a key generation request carrying a first certificate chain to a preset key management service every time after obtaining a file to be encrypted, so that the key management service responds to the key generation request and sends a key license carrying a second certificate chain to the file encryption device; wherein the first certificate chain includes a public key of the file encryption device; the second certificate chain includes a public key of the key management service; the key license includes a key information ciphertext; the key information ciphertext is obtained by the key management service using the public key in the first certificate chain to encrypt a content key generated by the key management service and a key identifier corresponding to the content key;

[0030] a decryption unit, configured to, when the second certificate chain passes authentication, use the private key of the file encryption device to decrypt the key information ciphertext obtained by parsing the key license, so as to obtain the content key and the key identifier;

[0031] A generating unit, configured to generate a digital copyright protection information header based on the key identifier;

[0032] An encryption unit, used to encrypt the file to be encrypted using the content key to obtain an encrypted file;

[0033] The encapsulation unit is used to encapsulate the digital copyright protection information header as a file header into the encrypted file to obtain the digital product ciphertext.

[0034] Optionally, the generating unit is specifically used for:

[0035] A digital copyright protection information header is generated based on the key identifier, a preset number of information header bytes, an encryption type identifier, and an information header version.

[0036] A file decryption device, comprising:

[0037] The extraction unit is used to extract the file header of the digital product ciphertext from the production server to obtain the digital copyright protection information header.

[0038] A parsing unit, used to parse the digital copyright protection information header to obtain a key identifier;

[0039] A request unit, configured to send a license acquisition request carrying the key identifier and a third certificate chain to a preset content license service, so that the content license service responds to the license acquisition request and sends a content license carrying a fourth certificate chain to the file decryption device; wherein the third certificate chain includes a public key of the file decryption device; the fourth certificate chain includes a public key of the content license service; the content license includes an encryption key; the encryption key is obtained by the content license service using the public key in the third certificate chain to encrypt a content key corresponding to the key identifier obtained from a key management service;

[0040] a first decryption unit, configured to, if the fourth certificate passes authentication, use the private key of the file decryption device to decrypt the encryption key obtained by parsing the content license to obtain the content key;

[0041] The second decryption unit is used to use the content key to decrypt the digital product ciphertext to obtain the digital product plaintext.

[0042] A digital copyright protection system, comprising:

[0043] Production server, key management service, client, and content license service;

[0044] The production server is used to: whenever a file to be encrypted is obtained, send a key generation request carrying a first certificate chain to the key management service, and receive a key license carrying a second certificate chain sent by the key management service; when the second certificate chain passes the authentication, use the private key of the production server to decrypt the key information ciphertext obtained by parsing the key license to obtain a content key and a key identifier; generate a digital copyright protection information header based on the key identifier; use the content key to encrypt the file to be encrypted to obtain an encrypted file; use the digital copyright protection information header as a file header, encapsulate it into the encrypted file, and obtain a digital product ciphertext;

[0045] The key management service is used to: respond to the key generation request, generate the content key and the key identifier corresponding to the content key; use the public key in the first certificate chain to encrypt the content key and the key identifier to obtain the key information ciphertext; generate the key license based on the second certificate chain and the key information ciphertext;

[0046] The client is used to: extract the file header of the digital product ciphertext from the production service end to obtain the digital copyright protection information header; parse the digital copyright protection information header to obtain the key identifier; send a license acquisition request carrying the key identifier and the third certificate chain to the content license service, and receive the content license carrying the fourth certificate chain sent by the content license service; when the fourth certificate passes the authentication, use the private key of the client to decrypt the encryption key obtained by parsing the content license to obtain the content key; use the content key to decrypt the digital product ciphertext to obtain the digital product plaintext;

[0047] The content license service is configured to: in response to the license acquisition request, obtain the content key corresponding to the key identifier from the key management service; encrypt the content key using the public key in the third certificate chain to obtain the encryption key; and generate the content license based on the encryption key and the fourth certificate chain;

[0048] The first certificate chain includes the public key of the production server; the second certificate chain includes the public key of the key management service; the third certificate chain includes the public key of the client; and the fourth certificate chain includes the public key of the content license service.

[0049] The technical solution provided in the present application utilizes a first certificate chain, a second certificate chain, a third certificate chain, a fourth certificate chain, a key license, and a content license to implement file encryption and file decryption, and can be applicable to all types of container files. Based on the high security of certificate chains (i.e., the first certificate chain, the second certificate chain, the third certificate chain, and the fourth certificate chain), key licenses, and content licenses, the security protection capabilities of digital copyrights can be significantly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0051] Figure 1 A flowchart of a file encryption method provided in an embodiment of the present application;

[0052] Figure 2 A flowchart of another file encryption method provided in an embodiment of the present application;

[0053] Figure 3 A flowchart of a file decryption method provided in an embodiment of the present application;

[0054] Figure 4 A flowchart of another file decryption method provided in an embodiment of the present application;

[0055] Figure 5 A schematic diagram of the architecture of a file encryption device provided in an embodiment of the present application;

[0056] Figure 6 A schematic diagram of the architecture of a file decryption device provided in an embodiment of the present application;

[0057] Figure 7 A schematic diagram of the architecture of a digital copyright protection system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0058] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0059] like Figure 1 As shown, it is a flow chart of a file encryption method provided in an embodiment of the present application, which is applied to a production server and includes the following steps.

[0060] S101: Whenever a file to be encrypted is obtained, a key generation request carrying a first certificate chain is sent to a preset key management service, so that the key management service responds to the key generation request and sends a key license carrying a second certificate chain to the production server.

[0061] The files to be encrypted include digital products that need to be encrypted and protected, and the file types of the digital products include but are not limited to: industrial standard container files and non-industrial standard container files.

[0062] It should be emphasized that the first certificate chain includes the public key of the production server. The process of obtaining the first certificate chain can be: the production server sends its own public key and identity information to the preset certificate issuing agency in advance. After the certificate issuing agency confirms that the identity information of the production server is correct, the public key of the production server is digitally signed to generate the first certificate chain.

[0063] In addition, the second certificate chain includes the public key of the key management service. The process of obtaining the second certificate chain can be as follows: the key management service sends its own public key and identity information to the certificate issuing authority in advance. After the certificate issuing authority confirms that the identity information of the key management service is correct, the public key of the key management service is digitally signed to generate the second certificate chain.

[0064] It should be noted that the key license includes key information ciphertext, which is obtained by encrypting the content key generated by the key management service and the key identifier corresponding to the content key using the public key in the first certificate chain.

[0065] In the embodiment of the present application, the specific implementation method of the key management service responding to the key generation request and sending the key license carrying the second certificate chain to the production server is:

[0066] 1. After receiving the key generation request, the key management service authenticates the first certificate chain and obtains the authentication result of the first certificate chain.

[0067] 2. When the authentication result of the first certificate chain is qualified, the key management service generates a content key and a key identifier corresponding to the content key, and saves the content key and the key identifier locally.

[0068] 3. The key management service uses the public key in the first certificate chain to encrypt the content key and key identifier to obtain the key information ciphertext.

[0069] 4. The key management service generates a key license based on the key information ciphertext and the second certificate chain.

[0070] 5. The key management service sends the key license to the production server.

[0071] Optionally, when the authentication result of the first certificate chain is unqualified, the key management service sends a key request failure prompt to the production server.

[0072] S102: Authenticate the second certificate chain to obtain an authentication result of the second certificate chain.

[0073] The specific implementation method of authenticating the second certificate chain is common knowledge familiar to those skilled in the art and will not be described in detail here.

[0074] S103: When the authentication result of the second certificate chain is qualified, the key license is parsed to obtain the key information ciphertext.

[0075] Optionally, when the authentication result of the second certificate chain is unqualified, it is determined that the key request has failed, and a key generation request carrying the first certificate chain is resent to the key management service.

[0076] S104: Use the private key of the production server to decrypt the key information ciphertext to obtain the content key and key identifier.

[0077] S105: Generate a digital copyright protection information header based on the key identifier, the preset number of information header bytes, the encryption type identifier, and the information header version.

[0078] Among them, the encryption type identifier is usually a universal digital copyright.

[0079] S106: Encrypt the file to be encrypted using the content key to obtain an encrypted file.

[0080] Optionally, the file to be encrypted may be encrypted using a content key based on a preset encryption rule to obtain an encrypted file.

[0081] Among them, the preset encryption rule can be: extracting a first array sequence and a second array sequence from the content key, and the total number of arrays included in the first array sequence is the same as the total number of arrays included in the second array sequence, and each array in the first array sequence is extracted sequentially, and each array in the second array sequence is extracted in reverse order; the file to be encrypted is regarded as a third array sequence, and the encrypted file is regarded as a fourth array sequence, and the total number of arrays included in the third array sequence is the same as the total number of arrays included in the fourth array sequence; the first array sequence is A[0]-A[7], the second array sequence is B[0]-B[7], the third array sequence is C[0]-C[N], and the fourth array sequence is E[0]-E[N], N is a positive integer, then E[N]=C[N]xor A[N%8]xorB[7-N%8], xor represents exclusive or, and % represents remainder.

[0082] S107: Encapsulate the digital copyright protection information header as a file header into the encrypted file to obtain the digital product ciphertext.

[0083] S108: Save the digital product ciphertext into a preset database.

[0084] In summary, the file encryption method for obtaining the ciphertext of a digital product using the first certificate chain, the second certificate chain, and the key license shown in this embodiment can be applied to all types of container files, and based on the high security of the certificate chain (i.e., the first certificate chain and the second certificate chain) and the key license, the security protection capability of digital copyright can be significantly improved.

[0085] It should be noted that the above Figure 1 S102 shown is an optional implementation of the file encryption method shown in the embodiment of the present application. Figure 1 S108 shown in the figure is also an optional implementation method of the file encryption method shown in the embodiment of the present application. Figure 1 The process shown can be summarized as Figure 2 The method shown.

[0086] like Figure 2 As shown, it is a flow chart of another file encryption method provided in an embodiment of the present application, including the following steps.

[0087] S201: Whenever a file to be encrypted is obtained, a key generation request carrying a first certificate chain is sent to a preset key management service, so that the key management service responds to the key generation request and sends a key license carrying a second certificate chain to the production server.

[0088] Among them, the first certificate chain includes the public key of the production server; the second certificate chain includes the public key of the key management service; the key license includes the key information ciphertext; the key information ciphertext is obtained by encrypting the content key generated by the key management service and the key identifier corresponding to the content key using the public key in the first certificate chain.

[0089] S202: When the second certificate chain passes the authentication, the private key of the production server is used to decrypt the key information ciphertext obtained by parsing the key license to obtain the content key and the key identifier.

[0090] S203: Generate a digital copyright protection information header based on the key identifier.

[0091] S204: Encrypt the file to be encrypted using the content key to obtain an encrypted file.

[0092] S205: Encapsulate the digital copyright protection information header as a file header into an encrypted file to obtain a digital product ciphertext.

[0093] In summary, the file encryption method for obtaining the ciphertext of a digital product using the first certificate chain, the second certificate chain, and the key license shown in this embodiment can be applied to all types of container files, and based on the high security of the certificate chain (i.e., the first certificate chain and the second certificate chain) and the key license, the security protection capability of digital copyright can be significantly improved.

[0094] It should be noted that, corresponding to the file encryption method, the embodiment of the present application also provides a file decryption method.

[0095] like Figure 3 As shown, it is a flowchart of a file decryption method provided in an embodiment of the present application, which is applied to a client and includes the following steps.

[0096] S301: Whenever a digital product ciphertext is obtained from a production server, a file header is extracted from the digital product ciphertext to obtain a digital copyright protection information header.

[0097] S302: Extracting an encryption type identifier from the digital copyright protection information header.

[0098] S303: When the encryption type identifier is a general digital copyright, the digital copyright protection information header is parsed to obtain a key identifier.

[0099] S304: Send a license acquisition request carrying the key identifier and the third certificate chain to a preset content license service, so that the content license service responds to the license acquisition request and sends the content license carrying the fourth certificate chain to the client.

[0100] Among them, the third certificate chain includes the public key of the client. The process of obtaining the third certificate chain can be: the client sends its own public key and identity information to the certificate issuing agency in advance. After the certificate issuing agency confirms that the client's identity information is correct, the client's public key is digitally signed to generate the third certificate chain.

[0101] In addition, the fourth certificate chain includes the public key of the content license service. The process of obtaining the fourth certificate chain may be as follows: the content license service sends its own public key and identity information to the certificate issuing authority in advance, and after the certificate issuing authority confirms that the identity information of the content license service is correct, the public key of the content license service is digitally signed to generate the fourth certificate chain.

[0102] Generally speaking, when the encryption type is marked as non-universal digital copyright, it is determined that the digital product ciphertext does not use the above Figure 1 Encrypted using the encryption method shown.

[0103] It should be noted that the content license includes an encryption key, which is obtained by the content license service using the public key in the third certificate chain to encrypt the content key corresponding to the key identifier obtained from the key management service.

[0104] In the embodiment of the present application, the specific implementation method of the content license service responding to the license acquisition request and sending the content license carrying the second certificate chain to the client includes:

[0105] 1. The content license service authenticates the third certificate chain and obtains an authentication result of the third certificate chain.

[0106] 2. When the authentication result of the third certificate chain is qualified, the content license service accesses the key management service and obtains the content key corresponding to the key identifier from the key management service.

[0107] 3. The content license service uses the public key in the third certificate chain to encrypt the content key to obtain an encryption key.

[0108] 4. The content license service generates a content license based on the encryption key and the fourth certificate chain.

[0109] 5. The content license service sends the content license to the client.

[0110] Optionally, when the authentication result of the third certificate chain is unqualified, the content license service sends a license request failure prompt to the client.

[0111] S305: Authenticate the fourth certificate chain to obtain an authentication result of the fourth certificate chain.

[0112] S306: When the authentication result of the fourth certificate chain is qualified, the content license is parsed to obtain the encryption key.

[0113] Optionally, when the authentication result of the fourth certificate chain is unqualified, it is determined that the license request has failed, and a license acquisition request carrying the third certificate chain is resent to the content license service.

[0114] S307: Use the client's private key to decrypt the encryption key to obtain the content key.

[0115] S308: Use the content key to decrypt the digital product ciphertext to obtain the digital product plaintext.

[0116] Optionally, when the digital product ciphertext is encrypted according to a preset encryption rule, it is also necessary to decrypt the digital product ciphertext based on a decryption rule corresponding to the preset encryption rule and use a content key to obtain the digital product plaintext.

[0117] In summary, the method for obtaining the plaintext file decryption of a digital product by utilizing the third certificate chain, the fourth certificate chain, and the content license as shown in this embodiment can be applicable to all types of container files, and based on the high security of the certificate chain (i.e., the third certificate chain and the fourth certificate chain) and the content license, the security protection capability of digital copyright can be significantly improved.

[0118] It should be noted that the above Figure 3 S302 shown is an optional implementation of the file decryption method shown in the embodiment of the present application. Figure 3 S305 shown is also an optional implementation of the file decryption method shown in the embodiment of the present application. Figure 3 The process shown can be summarized as Figure 4 The method shown.

[0119] like Figure 4 As shown, it is a flowchart of another file decryption method provided in an embodiment of the present application, including the following steps.

[0120] S401: Whenever a digital product ciphertext is obtained from a production server, a file header is extracted from the digital product ciphertext to obtain a digital copyright protection information header.

[0121] S402: Parse the digital copyright protection information header to obtain a key identifier.

[0122] S403: Send a license acquisition request carrying the key identifier and the third certificate chain to a preset content license service, so that the content license service responds to the license acquisition request and sends the content license carrying the fourth certificate chain to the client.

[0123] Among them, the third certificate chain includes the public key of the client; the fourth certificate chain includes the public key of the content license service; the content license includes an encryption key; the encryption key is obtained by the content license service using the public key in the third certificate chain to encrypt the content key corresponding to the key identifier obtained from the key management service.

[0124] S404: When the fourth certificate passes the authentication, the encryption key obtained by parsing the content license is decrypted using the private key of the client to obtain the content key.

[0125] S405: Use the content key to decrypt the digital product ciphertext to obtain the digital product plaintext.

[0126] In summary, the method for obtaining the plaintext file decryption of a digital product by utilizing the third certificate chain, the fourth certificate chain, and the content license as shown in this embodiment can be applicable to all types of container files, and based on the high security of the certificate chain (i.e., the third certificate chain and the fourth certificate chain) and the content license, the security protection capability of digital copyright can be significantly improved.

[0127] Based on the file encryption method and the file decryption method mentioned in the above embodiments, the embodiments of the present application also provide a file encryption device and a file decryption device.

[0128] like Figure 5 , which is a schematic diagram of the architecture of a file encryption device provided in an embodiment of the present application, including the units shown below.

[0129] The request unit 501 is used to send a key generation request carrying a first certificate chain to a preset key management service whenever a file to be encrypted is obtained, so that the key management service responds to the key generation request and sends a key license carrying a second certificate chain to the file encryption device; wherein the first certificate chain includes the public key of the file encryption device; the second certificate chain includes the public key of the key management service; the key license includes a key information ciphertext; the key information ciphertext is obtained by encrypting the content key generated by the key management service and the key identifier corresponding to the content key using the public key in the first certificate chain.

[0130] Optionally, the requesting unit 501 is further configured to: resend the key generation request to the key management service when the second certificate chain fails authentication.

[0131] The decryption unit 502 is used to decrypt the key information ciphertext obtained by parsing the key license using the private key of the file encryption device when the second certificate chain passes the authentication, so as to obtain the content key and the key identifier.

[0132] The generating unit 503 is used to generate a digital copyright protection information header based on the key identifier.

[0133] Optionally, the generating unit 503 is specifically used to generate a digital copyright protection information header based on the key identifier, and a preset number of information header bytes, an encryption type identifier, and an information header version.

[0134] The encryption unit 504 is used to encrypt the file to be encrypted using the content key to obtain the encrypted file.

[0135] The encapsulation unit 505 is used to encapsulate the digital copyright protection information header as a file header into the encrypted file to obtain the digital product ciphertext.

[0136] In summary, the file encryption method for obtaining the ciphertext of a digital product using the first certificate chain, the second certificate chain, and the key license shown in this embodiment can be applied to all types of container files, and based on the high security of the certificate chain (i.e., the first certificate chain and the second certificate chain) and the key license, the security protection capability of digital copyright can be significantly improved.

[0137] like Figure 6 , which is a schematic diagram of the architecture of a file decryption device provided in an embodiment of the present application, including the units shown below.

[0138] The extraction unit 601 is used to extract the file header of the digital product ciphertext from the production server to obtain the digital copyright protection information header.

[0139] The parsing unit 602 is used to parse the digital copyright protection information header to obtain a key identifier.

[0140] Optionally, the parsing unit 602 is specifically used to: extract an encryption type identifier from the digital copyright protection information header; when the encryption type identifier is a universal digital copyright, parse the digital copyright protection information header to obtain a key identifier.

[0141] The request unit 603 is used to send a license acquisition request carrying a key identifier and a third certificate chain to a preset content license service, so that the content license service responds to the license acquisition request and sends a content license carrying a fourth certificate chain to the file decryption device; wherein the third certificate chain includes a public key of the file decryption device; the fourth certificate chain includes a public key of the content license service; the content license includes an encryption key; the encryption key is obtained by encrypting the content key corresponding to the key identifier obtained from the key management service using the public key in the third certificate chain by the content license service.

[0142] Optionally, the requesting unit 603 is further configured to: if the fourth certificate chain fails authentication, resend the license acquisition request to the content license service.

[0143] The first decryption unit 604 is used to decrypt the encryption key obtained by parsing the content license using the private key of the file decryption device to obtain the content key when the fourth certificate passes the authentication.

[0144] The second decryption unit 605 is used to decrypt the digital product ciphertext using the content key to obtain the digital product plaintext.

[0145] In summary, the method for obtaining the plaintext file decryption of a digital product by utilizing the third certificate chain, the fourth certificate chain, and the content license as shown in this embodiment can be applicable to all types of container files, and based on the high security of the certificate chain (i.e., the third certificate chain and the fourth certificate chain) and the content license, the security protection capability of digital copyright can be significantly improved.

[0146] Based on the file encryption method and file decryption method mentioned in the above embodiments, the embodiments of the present application also provide a digital copyright protection system.

[0147] like Figure 7 , which is a schematic diagram of the architecture of a digital copyright protection system provided in an embodiment of the present application, including the following components.

[0148] Production server 701 , key management service 702 , client 703 and content license service 704 .

[0149] The production server 701 is used to: whenever a file to be encrypted is obtained, send a key generation request carrying a first certificate chain to the key management service, and receive a key license carrying a second certificate chain sent by the key management service; when the second certificate chain passes the authentication, use the private key of the production server to decrypt the key information ciphertext obtained by parsing the key license to obtain a content key and a key identifier; based on the key identifier, generate a digital copyright protection information header; use the content key to encrypt the file to be encrypted to obtain an encrypted file; use the digital copyright protection information header as a file header, encapsulate it into the encrypted file, and obtain a digital product ciphertext.

[0150] The key management service 702 is used to: respond to a key generation request, generate a content key and a key identifier corresponding to the content key; use the public key in the first certificate chain to encrypt the content key and the key identifier to obtain a key information ciphertext; and generate a key license based on the second certificate chain and the key information ciphertext.

[0151] The client 703 is used to: extract the file header of the digital product ciphertext from the production server to obtain the digital copyright protection information header whenever the digital product ciphertext is obtained from the production server; parse the digital copyright protection information header to obtain the key identifier; send a license acquisition request carrying the key identifier and the third certificate chain to the content license service, and receive the content license carrying the fourth certificate chain sent by the content license service; when the fourth certificate passes the authentication, use the client's private key to decrypt the encryption key obtained by parsing the content license to obtain the content key; use the content key to decrypt the digital product ciphertext to obtain the digital product plaintext.

[0152] The content license service 704 is used to: respond to the license acquisition request and obtain the content key corresponding to the key identifier from the key management service; use the public key in the third certificate chain to encrypt the content key to obtain the encryption key; and generate the content license based on the encryption key and the fourth certificate chain.

[0153] Among them, the first certificate chain includes the public key of the production server; the second certificate chain includes the public key of the key management service; the third certificate chain includes the public key of the client; and the fourth certificate chain includes the public key of the content license service.

[0154] In summary, the method of implementing file encryption and file decryption by using the first certificate chain, the second certificate chain, the third certificate chain, the fourth certificate chain, the key license and the content license as shown in this embodiment can be applied to all types of container files, and based on the high security of the certificate chain (i.e., the first certificate chain, the second certificate chain, the third certificate chain and the fourth certificate chain), the key license and the content license, the security protection capability of digital copyright can be significantly improved.

[0155] If the functions described in the method of the embodiment of the present application are implemented in the form of software functional units and sold or used as independent products, they can be stored in a storage medium readable by a computing device. Based on this understanding, the part of the embodiment of the present application that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computing device (which can be a personal computer, server, mobile computing device or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories, random access memories, magnetic disks or optical disks.

[0156] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0157] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A file encryption method, characterized in that: Applied to production servers, including: Whenever a file to be encrypted is obtained, a key generation request carrying a first certificate chain is sent to a preset key management service, so that the key management service responds to the key generation request and sends a key license carrying a second certificate chain to the production service end; wherein the first certificate chain includes the public key of the production service end; the second certificate chain includes the public key of the key management service; the key license includes a key information ciphertext; the key information ciphertext is obtained by the key management service using the public key in the first certificate chain to encrypt the content key generated by the key management service and the key identifier corresponding to the content key; When the second certificate chain passes the authentication, the key information ciphertext obtained by parsing the key license is decrypted using the private key of the production server to obtain the content key and the key identifier; Based on the key identifier, generate a digital copyright protection information header; Using the content key, encrypting the file to be encrypted to obtain an encrypted file; The digital copyright protection information header is used as a file header and encapsulated into the encrypted file to obtain a digital product ciphertext.

2. The method according to claim 1, characterized in that Also includes: If the second certificate chain fails authentication, the key generation request is resent to the key management service.

3. The method according to claim 1, characterized in that The step of generating a digital copyright protection information header based on the key identifier includes: A digital copyright protection information header is generated based on the key identifier, a preset number of information header bytes, an encryption type identifier, and an information header version.

4. A file decryption method, characterized in that: Applied to the client, including: Whenever the digital product ciphertext is obtained from the production server, the file header of the digital product ciphertext is extracted to obtain the digital copyright protection information header; Parsing the digital copyright protection information header to obtain a key identifier; Sending a license acquisition request carrying the key identifier and the third certificate chain to a preset content license service, so that the content license service responds to the license acquisition request and sends a content license carrying a fourth certificate chain to the client; wherein the third certificate chain includes the public key of the client; the fourth certificate chain includes the public key of the content license service; the content license includes an encryption key; the encryption key is obtained by the content license service using the public key in the third certificate chain to encrypt the content key corresponding to the key identifier obtained from the key management service; When the fourth certificate passes the authentication, the encryption key obtained by parsing the content license is decrypted using the private key of the client to obtain the content key; The digital product ciphertext is decrypted using the content key to obtain the digital product plaintext.

5. The method according to claim 4, characterized in that The step of parsing the digital copyright protection information header to obtain a key identifier includes: Extracting an encryption type identifier from the digital copyright protection information header; When the encryption type identifier is a universal digital copyright, the digital copyright protection information header is parsed to obtain a key identifier.

6. The method according to claim 4, characterized in that Also includes: If the fourth certificate chain fails authentication, the license acquisition request is resent to the content license service.

7. A file encryption device, characterized in that: include: A request unit, configured to send a key generation request carrying a first certificate chain to a preset key management service every time after obtaining a file to be encrypted, so that the key management service responds to the key generation request and sends a key license carrying a second certificate chain to the file encryption device; wherein the first certificate chain includes a public key of the file encryption device; the second certificate chain includes a public key of the key management service; the key license includes a key information ciphertext; the key information ciphertext is obtained by the key management service using the public key in the first certificate chain to encrypt a content key generated by the key management service and a key identifier corresponding to the content key; a decryption unit, configured to, when the second certificate chain passes authentication, use the private key of the file encryption device to decrypt the key information ciphertext obtained by parsing the key license, so as to obtain the content key and the key identifier; A generating unit, configured to generate a digital copyright protection information header based on the key identifier; An encryption unit, used to encrypt the file to be encrypted using the content key to obtain an encrypted file; The encapsulation unit is used to encapsulate the digital copyright protection information header as a file header into the encrypted file to obtain the digital product ciphertext.

8. The file encryption device according to claim 7, characterized in that: The generating unit is specifically used for: A digital copyright protection information header is generated based on the key identifier, a preset number of information header bytes, an encryption type identifier, and an information header version.

9. A file decryption device, characterized in that: include: The extraction unit is used to extract the file header of the digital product ciphertext from the production server to obtain the digital copyright protection information header. A parsing unit, used to parse the digital copyright protection information header to obtain a key identifier; A request unit, configured to send a license acquisition request carrying the key identifier and a third certificate chain to a preset content license service, so that the content license service responds to the license acquisition request and sends a content license carrying a fourth certificate chain to the file decryption device; wherein the third certificate chain includes a public key of the file decryption device; the fourth certificate chain includes a public key of the content license service; the content license includes an encryption key; the encryption key is obtained by the content license service using the public key in the third certificate chain to encrypt a content key corresponding to the key identifier obtained from a key management service; a first decryption unit, configured to, if the fourth certificate passes authentication, use the private key of the file decryption device to decrypt the encryption key obtained by parsing the content license to obtain the content key; The second decryption unit is used to use the content key to decrypt the digital product ciphertext to obtain the digital product plaintext.

10. A data copyright protection system, characterized in that: include: Production server, key management service, client, and content license service; The production server is used to: send a key generation request carrying a first certificate chain to the key management service every time a file to be encrypted is obtained, and receive a key license carrying a second certificate chain sent by the key management service; when the second certificate chain passes the authentication, use the private key of the production server to decrypt the key information ciphertext obtained by parsing the key license to obtain a content key and a key identifier; Based on the key identifier, generate a digital copyright protection information header; Using the content key, encrypting the file to be encrypted to obtain an encrypted file; The digital copyright protection information header is encapsulated into the encrypted file as a file header to obtain a digital product ciphertext; The key management service is used to: respond to the key generation request and generate the content key and the key identifier corresponding to the content key; Using the public key in the first certificate chain, encrypting the content key and the key identifier to obtain the key information ciphertext; generating the key license based on the second certificate chain and the key information ciphertext; The client is used to: extract the file header of the digital product ciphertext from the production server to obtain the digital copyright protection information header whenever the digital product ciphertext is obtained from the production server; Parsing the digital copyright protection information header to obtain the key identifier; sending a license acquisition request carrying the key identifier and the third certificate chain to the content license service, and receiving a content license carrying the fourth certificate chain sent by the content license service; When the fourth certificate passes the authentication, the encryption key obtained by parsing the content license is decrypted using the private key of the client to obtain the content key; Decrypt the digital product ciphertext using the content key to obtain the digital product plaintext; The content license service is used to: in response to the license acquisition request, acquire the content key corresponding to the key identifier from the key management service; Encrypt the content key using the public key in the third certificate chain to obtain the encryption key; generate the content license based on the encryption key and the fourth certificate chain; Wherein, the first certificate chain includes the public key of the production server; The second certificate chain includes the public key of the key management service; the third certificate chain includes the public key of the client; and the fourth certificate chain includes the public key of the content license service.

Images