U disk-based document encryption and decryption method and device, computer device and storage medium

Abstract

Embodiments of the present application disclose a document encryption and decryption method and device based on a U disk, computer equipment and a storage medium. The method comprises: obtaining an IRP file formed after an IO manager converts an operation request on a file; obtaining a control command from an application program; feeding back state information to the application program according to the control command, so that the application program formulates an encryption and decryption strategy and sends the encryption and decryption strategy; receiving the encryption and decryption strategy; determining whether the operation on the file is a type of operation requiring encryption and decryption in the encryption and decryption strategy according to the IRP file; and if the operation on the file is the type of operation requiring encryption and decryption in the encryption and decryption strategy, encrypting and decrypting the file by using a U disk encryption and decryption technology to obtain a processing result. The method of the embodiments of the present application can improve the security, reliability, applicability and compliance of the document encryption and decryption based on the U disk.

Description

Technical Field

[0001] The present invention relates to computers, and more specifically to a USB-shield-based document encryption and decryption method, device, computer equipment, and storage medium. Background Art

[0002] Currently, document encryption software is primarily categorized by type: pure software and a combination of hardware and software. Software-only encryption software uses keys and algorithms to encrypt documents, but the keys and algorithms are stored and performed in the operating system's memory. Combination encryption software uses a combination of hardware and software to perform encryption and decryption operations. These products typically utilize a network-based version, where encryption keys, sensitive data, algorithms, and custom algorithms are stored on an encryption card within the encryption server, and encryption and decryption operations are also performed within the encryption card within the server.

[0003] Pure software-based document encryption software, available in both standalone and network versions, is easy to use and adapt to any environment, but offers limited security and reliability, making it susceptible to decryption. Combining hardware and software with a network-based version offers high security and reliability, but suffers from poor applicability, inconvenience, and potential lags during centralized access. Furthermore, key storage, computation, and key generation are performed on encryption cards within encryption servers, which are operated and maintained in computer rooms, creating numerous potential security risks.

[0004] Therefore, it is necessary to design a new method to improve the security, reliability, applicability and compliance of document encryption and decryption based on U-Shield. Summary of the Invention

[0005] The purpose of the present invention is to overcome the defects of the prior art and provide a document encryption and decryption method, device, computer equipment and storage medium based on USB shield.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: a document encryption and decryption method based on USB shield, comprising:

[0007] Get the IRP file formed by the IO manager after converting the file operation request;

[0008] Get control commands from applications;

[0009] Feedback status information to the application according to the control command, so that the application can formulate an encryption and decryption strategy, and the application can send the encryption and decryption strategy;

[0010] receiving the encryption and decryption strategy;

[0011] Determine, based on the IRP file, whether the operation on the file is a type of operation requiring encryption and decryption in the encryption and decryption policy;

[0012] If the operation on the file is an operation type that requires encryption and decryption in the encryption and decryption strategy, the file is encrypted and decrypted using the U-shield encryption and decryption technology to obtain a processing result.

[0013] Its further technical solution is: the encryption and decryption strategy includes the following: for operations involving opening a non-empty, non-encrypted file in an authorized process, no encryption and decryption operation is performed; for operations involving opening a non-empty, encrypted file in an authorized process, a first encryption and decryption method is performed; for operations involving opening an empty file in an authorized process, a second encryption and decryption method is performed; for operations involving opening a non-empty, non-encrypted file in an unauthorized process, no encryption and decryption operation is performed; for operations involving opening a non-empty, encrypted file in an unauthorized process, a third encryption and decryption method is performed; and for operations involving opening an empty file in an unauthorized process, no encryption and decryption operation is performed.

[0014] Its further technical solution is: the first encryption and decryption method includes marking the file as a read-write encryption and decryption type, performing encryption and decryption operations, and refreshing the cache; the second encryption and decryption method includes marking the file as a read-write encryption and decryption type, and performing encryption and decryption operations; the third encryption and decryption method includes marking the file as a read-write encryption and decryption type, performing encryption and decryption operations, and clearing the cache.

[0015] A further technical solution is: judging whether the operation on the file complies with the encryption and decryption strategy according to the IRP file includes:

[0016] Parsing the IRP file to determine the type of operation on the file and the type of the file;

[0017] Determining whether the operation request belongs to the type of operation requiring encryption and decryption in the encryption and decryption policy according to the type of operation on the file and the type of the file;

[0018] If the operation request belongs to the type of operation requiring encryption and decryption in the encryption and decryption policy, determining that the operation on the file is the type of operation requiring encryption and decryption in the encryption and decryption policy;

[0019] If the operation request does not belong to the type of operation requiring encryption and decryption in the encryption and decryption policy, it is determined that the operation on the file is not the type of operation requiring encryption and decryption in the encryption and decryption policy.

[0020] Its further technical solution is: decryption technology performs encryption and decryption operations on the file to obtain a processing result;

[0021] The encryption and decryption operations on the file are performed according to the policy within the encryption and decryption operation type corresponding to the operation request and using the U-Shield encryption and decryption technology to obtain a processing result, including:

[0022] According to the policy of the encryption and decryption operation type corresponding to the operation request, the encryption and decryption link uses the U-shield encryption and decryption technology to encrypt and decrypt the file to obtain the processing result;

[0023] Among them, the U-shield encryption and decryption technology is used to encrypt and decrypt the file. When writing encrypted files, the IRP_MJ_WRITE write file information is intercepted, and the file content before encryption is recorded using the PREAD_WRITE_COMPLETION_CONTEXT structure. When the IRP file is received, the file content before encryption is reassigned to the IRP file and returned to the IO manager; when reading encrypted files, the IRP_MJ_READ read file information is intercepted. When the read file is an encrypted file, it is decrypted in the completion function SfReadCompletion.

[0024] A further technical solution is: sending the processing result includes:

[0025] Obtain public key certificates for all terminals;

[0026] Import the public key certificates of all terminals into the business card management list;

[0027] Select the terminal that needs to perform encrypted communication from the business card management list and import the corresponding public key certificate;

[0028] The processing result is sent to the terminal that needs to perform ciphertext communication, so that the terminal that needs to perform ciphertext communication can decrypt it according to the relevant key in the U shield.

[0029] A further technical solution is: sending the processing result includes:

[0030] Initialize the USB shield;

[0031] generating a shared ciphertext according to the processing result;

[0032] The shared ciphertext is shared within the file sharing group so that the U-shields within the file sharing group can decrypt the shared ciphertext.

[0033] The present invention also provides a document encryption and decryption device based on a USB shield, comprising:

[0034] The file acquisition unit is used to acquire an IRP file formed after the IO manager converts the operation request for the file;

[0035] A command acquisition unit, used to acquire control commands from an application program;

[0036] A feedback unit, configured to feed back status information to the application according to the control command, so that the application can formulate an encryption and decryption strategy, and the application can send the encryption and decryption strategy;

[0037] A receiving unit, configured to receive the encryption and decryption strategy;

[0038] a judging unit, configured to judge, based on the IRP file, whether the operation on the file is a type of operation requiring encryption and decryption in the encryption and decryption policy;

[0039] an encryption and decryption unit, configured to encrypt and decrypt the file using the U-Shield encryption and decryption technology to obtain a processing result if the operation on the file is a type of operation requiring encryption and decryption in the encryption and decryption policy;

[0040] A sending unit is used to send the processing result.

[0041] The present invention further provides a computer device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the above method when executing the computer program.

[0042] The present invention also provides a storage medium, wherein the storage medium stores a computer program, and the computer program implements the above method when executed by a processor.

[0043] The beneficial effects of the present invention compared with the existing technology are: after obtaining the IRP file and control command, the present invention feeds back status information to the application, and after receiving the encryption and decryption strategy, uses the encryption and decryption strategy to determine whether the file needs to be encrypted and decrypted, and uses the U-shield encryption and decryption technology to encrypt and decrypt the files that need encryption and decryption operations, and can use the U-shield to transmit and share, thereby improving the security, reliability, applicability and compliance of document encryption and decryption based on the U-shield.

[0044] The present invention will be further described below with reference to the accompanying drawings and specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0046] Figure 1 A schematic diagram of an application scenario of the USB-shield-based document encryption and decryption method provided in an embodiment of the present invention;

[0047] Figure 2 A flowchart of a USB-based document encryption and decryption method provided in an embodiment of the present invention;

[0048] Figure 3 A schematic diagram of a sub-process of a USB-shield-based document encryption and decryption method provided in an embodiment of the present invention;

[0049] Figure 4 A schematic diagram of device management provided by an embodiment of the present invention;

[0050] Figure 5 A schematic diagram of the logical structure of an application provided by an embodiment of the present invention;

[0051] Figure 6 A schematic block diagram of a document encryption and decryption device based on a USB shield provided in an embodiment of the present invention;

[0052] Figure 7 A schematic block diagram of a judgment unit of a document encryption and decryption device based on a USB shield according to an embodiment of the present invention;

[0053] Figure 8 A schematic block diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0054] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0055] It will be understood that when used in this specification and the appended claims, the terms “comprises” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0056] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the present invention. As used in the specification and appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0057] It should be further understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0058] See also Figure 1 and Figure 2 , Figure 1A schematic diagram of an application scenario of the USB-shield-based document encryption and decryption method provided in an embodiment of the present invention. Figure 2 A schematic flow chart of a document encryption and decryption method based on U-shield provided in an embodiment of the present invention. The document encryption and decryption method based on U-shield is applied in a terminal. The terminal interacts with the terminal for data exchange, and an application is deployed on the terminal. Specifically, in the terminal, after the software is installed, the original files and programs in the computer can be used normally without any impact; after the software is uninstalled, the ciphertext remains ciphertext and can only be turned into plaintext through manual decryption; when the software is running, the user's computer operation habits are not changed, and file encryption and decryption are all completed in the security chip, and the session key does not leave the hardware; the ciphertext on the physical storage medium is the ciphertext generated by the encryption algorithm, which is garbled code for the user; when the U-shield is not connected, the ciphertext can neither be opened nor deleted; illegal access by malicious programs is denied Ask for ciphertext; Copy ciphertext and no matter where you paste it, the newly generated file will still be ciphertext; Ciphertext will still be ciphertext when it is transmitted over the network or stored as an attachment on a third-party file server; Under normal operation, ciphertext and non-ciphertext are distinguished by whether there is a lock on the icon; On the same computer, ciphertext generated by USB-Shield A cannot be normally operated on other USB-Shields; Ciphertext generated by USB-Shield on computer A can only be normally operated on computer A, and cannot be normally opened on other computers even if the same USB-Shield is used; The plaintext session key does not leave the security chip in the USB-Shield, and the session key cannot be obtained from outside to crack the encrypted file;

[0059] Figure 2 This is a flowchart of a document encryption and decryption method based on a U-shield provided by an embodiment of the present invention. Figure 2 As shown, the method includes the following steps S110 to S150.

[0060] S110: Acquire an IRP file formed after the IO manager converts the operation request for the file.

[0061] In this embodiment, the IRP file refers to a file that is converted according to an operation request for the file and is recognizable by the kernel driver.

[0062] Specifically, when operating a file, the terminal calls and notifies the IO manager, which converts the operation request into an IRP that can be recognized by the kernel driver and sends it to the file filter driver. Of course, there may be multiple file filter drivers on the terminal.

[0063] S120: Obtain a control command from the application program.

[0064] In this embodiment, the control command refers to a control instruction formed by the operation of the application program.

[0065] S130 . Feedback status information to the application according to the control command, so that the application formulates an encryption and decryption strategy, and the application sends the encryption and decryption strategy.

[0066] In this embodiment, the application sends a control command to the terminal's driver. The filter driver returns status information to the application; the application formulates encryption and decryption strategies, such as authorizing programs that require encryption or canceling authorized programs.

[0067] Specifically, the encryption and decryption strategy includes: for operations involving opening non-empty non-encrypted files in an authorized process, no encryption and decryption operations are performed; for operations involving opening non-empty encrypted files in an authorized process, the first encryption and decryption method is performed; for operations involving opening empty files in an authorized process, the second encryption and decryption method is performed; for operations involving opening non-empty non-encrypted files in an unauthorized process, no encryption and decryption operations are performed; for operations involving opening non-empty encrypted files in an unauthorized process, the third encryption and decryption method is performed; and for operations involving opening empty files in an unauthorized process, no encryption and decryption operations are performed.

[0068] Among them, the first encryption and decryption method includes marking the file as a read-write encryption and decryption type, performing encryption and decryption operations, and refreshing the cache; the second encryption and decryption method includes marking the file as a read-write encryption and decryption type, and performing encryption and decryption operations; the third encryption and decryption method includes marking the file as a read-write encryption and decryption type, performing encryption and decryption operations, and clearing the cache.

[0069] S140, receiving the encryption and decryption strategy;

[0070] S150: Determine, based on the IRP file, whether the operation on the file is a type of operation requiring encryption and decryption in the encryption and decryption policy.

[0071] In one embodiment, see Figure 3 , the above-mentioned step S150 may include steps S151 to S154.

[0072] S151, parsing the IRP file to determine the operation type and file type of the file;

[0073] S152: Determine whether the operation request belongs to the type of operation requiring encryption and decryption in the encryption and decryption policy based on the type of operation on the file and the type of the file;

[0074] S153: If the operation request belongs to the type of operation requiring encryption and decryption in the encryption and decryption policy, determining that the operation on the file is the type of operation requiring encryption and decryption in the encryption and decryption policy;

[0075] S154: If the operation request does not belong to the type of operation requiring encryption and decryption in the encryption and decryption policy, determine that the operation on the file is not the type of operation requiring encryption and decryption in the encryption and decryption policy.

[0076] S160: If the operation on the file is a type of operation requiring encryption and decryption in the encryption and decryption policy, the file is encrypted and decrypted using the U-Shield encryption and decryption technology to obtain a processing result.

[0077] In this embodiment, the processing result refers to the result formed after encrypting and decrypting the file using the U-Shield encryption and decryption technology.

[0078] In this embodiment, the encryption and decryption operations are performed on the file according to the policy of the encryption and decryption operation type corresponding to the operation request and using the U-Shield encryption and decryption technology to obtain a processing result.

[0079] Specifically, according to the policy within the encryption and decryption operation type corresponding to the operation request, the encryption and decryption link uses the U-shield encryption and decryption technology to perform encryption and decryption operations on the file to obtain a processing result;

[0080] Among them, the U-shield encryption and decryption technology is used to encrypt and decrypt the file. When writing encrypted files, the IRP_MJ_WRITE write file information is intercepted, and the file content before encryption is recorded using the PREAD_WRITE_COMPLETION_CONTEXT structure. When the IRP file is received, the file content before encryption is reassigned to the IRP file and returned to the IO manager; when reading encrypted files, the IRP_MJ_READ read file information is intercepted. When the read file is an encrypted file, it is decrypted in the completion function SfReadCompletion.

[0081] Specifically, early binding is performed to create a device, and then the created device is bound to the file system control device, and the dispatch function of IRP_MJ_FILE_SYSTEM_CONTROL is registered, so that the device can be generated and bound when the volume is dynamically generated, and it can be unbound when the volume is dynamically unplugged.

[0082] Open the file and intercept the IRP_MJ_CREATE file opening message. We determine whether the file currently being opened meets our encryption and decryption strategy. If so, we record it and save it in a custom structure. For the file object of the same fcb, we keep it in the _FILE_CONTEXT structure. Its structure design is as follows:

[0083]

[0084]

[0085] To write a file, intercept the IRP_MJ_WRITE write message, first record the unencrypted file content in the PREAD_WRITE_COMPLETION_CONTEXT structure, wait for the IRP to be completed, and then reassign the unencrypted content to the IRP when the IRP is returned, and then return it to the upper-level driver. In this way, the data written to the disk (physical medium) is encrypted.

[0086] Read the file and intercept the IRP_MJ_READ information of the file. If it is an encrypted file, decrypt it in the completion function SfReadCompletion (decryption will not be performed until the data is confirmed to be read).

[0087] Close the file and intercept the IRP_MJ_CLOSE message to close the file. When the file is completely closed (all handles are closed), add the encryption header ZZXX of K to the file to be encrypted.

[0088] The timing of adding the mark header is when all handles to the file are closed, that is, it is added in the file closing function.

[0089] For U-Shield encryption and decryption technology, its management function consists of six parts: device management, access control, file management, application management, container management, and password services. Device management means that there are device authentication keys and multiple applications in a device, and the applications are independent of each other, such as Figure 4 As shown, access control: Access control mainly completes operations such as device authentication, PIN code management, and security status management. File management functions are used to meet the needs of user extension development, including creating files, deleting files, enumerating files, obtaining file information, and reading and writing files. Application management mainly completes operations such as creating, enumerating, deleting, opening, and closing applications. The corresponding applications contain their own containers, files, and PIN codes, such as Figure 5 As shown, container management is used to manage various containers, including creating, deleting, enumerating, opening, and closing containers. Containers store protection keys, encryption keys, and signature key pairs. Protection keys are used to encrypt keys, encryption keys are used to protect encryption keys, and signature key pairs are used for digital signatures and verification. Signature key pairs are generated internally, and encryption keys are also generated internally. Cryptographic services: Cryptographic service functions provide symmetric and asymmetric algorithm operations, cryptographic hash operations, key management, and message authentication code calculation.

[0090] S170: Send the processing result.

[0091] In one embodiment, this step may include:

[0092] Obtain the public key certificates of all terminals; import the public key certificates of all terminals into the business card management list; select the terminal that needs to perform encrypted communication from the business card management list and import the corresponding public key certificate; send the processing result to the terminal that needs to perform encrypted communication, so that the terminal that needs to perform encrypted communication can decrypt it according to the relevant key in the U shield.

[0093] In this embodiment, the public key certificate is a communication key certificate generated when the terminal is connected to the USB shield and the encryption software is initially bound.

[0094] When the terminal is first securely installed, the U shield will be bound to the encryption software and then to the host hardware. At this time, a public key certificate for ciphertext communication will be generated.

[0095] The content of the public key certificate includes the required information of the individual and basic information of the individual such as name and unit.

[0096] The private key of each U disk is a set of passwords that meet the set requirements generated by the random function generator of the security chip, ensuring that the private key of each U shield will not be repeated. The private key will not be released in the hardware encryption chip throughout its life cycle, and the released public key can only be used for encryption.

[0097] The ciphertext communication process will be executed only when the public key certificate is sent successfully, otherwise the end step will be executed.

[0098] In this embodiment, the business card management list collects the public key certificates of all terminals that can perform ciphertext communication.

[0099] In one embodiment, selecting a terminal requiring encrypted communication from the business card management list and importing the corresponding public key certificate may include:

[0100] Select a terminal that needs to perform encrypted communication from the business card management list and determine the corresponding public key certificate;

[0101] Determining whether the public key certificate is legal;

[0102] If the public key certificate is legal, select the public key certificate and import the public key in the public key certificate into the USB shield;

[0103] If the public key certificate is illegal, the terminal that needs to perform ciphertext communication is selected from the business card management list, and the corresponding public key certificate is determined.

[0104] The encrypted communication process will only begin after the public key certificate is legal and imported successfully. The matching and transmission are carried out by using the public key certificate sent by the other party. The public key certificate is imported once and used multiple times.

[0105] Set public key pointing information for easy operation and management, such as a person, an organization or a department, nickname, etc., and import the public key certificate. The certificate is used to encrypt communication files with people who communicate with you in ciphertext. The public key and private key used by the product to generate and compare certificates are random numbers generated by the random function generator of the security chip and generated by the chip's built-in SM2 national secret algorithm to ensure the uniqueness of the public key and private key of each U-shield.

[0106] The processing result may be a file formed by encrypting the file to be sent according to a randomly generated seed key with one text and one secret.

[0107] Specifically, a seed key with one text and one secret is randomly generated.

[0108] In this embodiment, the seed key refers to basic content that can be used to form a key for encrypting a file in a subsequent operation according to a predetermined rule.

[0109] The file to be sent is encrypted using the seed key through the USB shield to obtain a ciphertext.

[0110] When a user chooses to initiate encrypted communication, the software first generates a seed key, then generates a session key based on the seed key. A random generator in the USB-Shield's security chip generates a unique seed key, which is then calculated using pre-defined rules to generate the session key. The USB-Shield security chip encrypts the file based on the session key. The session key never leaves the USB-Shield security chip during the encryption process and becomes invalid upon use. The seed key for the session key is asymmetrically encrypted using the SM2's public key, and the encrypted seed key is then exported from the USB-Shield.

[0111] In this embodiment, an encrypted seed key is generated by importing the public key encryption seed key, the encrypted seed key is exported to the USB shield, and the encrypted seed key is used to encrypt the file to be sent using the USB shield to obtain a ciphertext.

[0112] Specifically, a session key is generated by combining the seed key with the scheme set in the U shield; the file to be sent is encrypted using the U shield with the session key to obtain a ciphertext.

[0113] After encryption, the ciphertext needs to be judged whether the encryption is successful. Only the successfully encrypted ciphertext will be sent to the terminal.

[0114] The USB-Shield's private key remains in the USB-Shield's security chip from the moment it is generated until the end of its lifecycle. The entire decryption process of the encrypted seed key is performed entirely within the USB-Shield's security chip, and the entire process never leaves the chip.

[0115] In this embodiment, the decryption session key is derived from a generated seed key through the USB-Shield's internal computational mechanism. During this process, the key remains untouched by the USB-Shield security chip. The entire file decryption process is completed entirely within the USB-Shield security chip. All key encryption and decryption operations and management are performed within the security chip, ensuring the security, reliability, and legal compliance of the product.

[0116] Specifically, the ciphertext is sent to a terminal that needs to perform ciphertext communication, so that the terminal that needs to perform ciphertext communication determines whether the ciphertext is a file generated by ciphertext communication. When the ciphertext is a file generated by ciphertext communication, the public key information, seed key, and ciphertext communication flag are read from the U shield of the terminal that needs to perform ciphertext communication, and when the public key certificate used by the ciphertext is the public key certificate of this terminal, the encrypted seed key is decrypted by the private key inside the U shield, the decrypted seed key is used to generate a session key, and the ciphertext is decrypted using the session key.

[0117] The terminal that needs to communicate in ciphertext reads the public key information of the encrypted file and the file communication identifier through the U shield and compares them with the local machine. The U shield contains the local machine's communication information and the private key corresponding to the public key.

[0118] The plaintext session key does not leave the security chip inside the USB-Shield, so it is impossible for anyone outside to obtain the session key and decrypt the encrypted file. It supports ciphertext communication, which can only be carried out between specific people. That is, the ciphertext sent to a specific person can only be decrypted when the person is connected to the designated computer and the designated USB-Shield. Even if anyone obtains the ciphertext, they cannot open it.

[0119] By using the public key certificate generated by the terminal to match and transmit ciphertext, and using a one-text-one-cipher method to encrypt the files to be sent, the encrypted content is executed in the U-Shield. The entire encryption certificate information belongs to the terminal that needs to communicate in ciphertext, which can decrypt the ciphertext. The decrypted content is also executed in the U-Shield, and it can only be decrypted under specified circumstances. It has high security. As long as the certificate is local, the ciphertext can be read, and the ciphertext can be read without obstacles.

[0120] In another embodiment, the step of sending the processing result may include:

[0121] Initializing the U shield; generating a shared ciphertext according to the processing result; and sharing the shared ciphertext within the file sharing group so that the U shields within the file sharing group can decrypt the shared ciphertext.

[0122] Specifically, to initialize the USB Shield, create an app_share application for file sharing within the USB Shield. To join the USB Shield to a shared file group, create a container named container_group1 within the app_share application. Import a seed key pair into container_group1. This key pair is used to generate the key for all shared encrypted files within group1.

[0123] Shared ciphertext generation: A random signature code 1 is generated. This signature code is encrypted using the public key of the seed key in the container. The resulting ciphertext (signature code 2) is recorded in the ciphertext header structure. Signature code 2 is decrypted using the private key of the seed key, and a session key is generated (this session key is the key used to encrypt and decrypt the file and is completely unknown to the public). The session key is used to encrypt and decrypt the file content.

[0124] Decrypting the shared ciphertext: Read signature 2 and the container name from the ciphertext header. Use the private key of the container's seed key to decrypt signature 2 and generate a session key. Use the session key to decrypt the ciphertext.

[0125] In the U-Shield, there are keys for encrypting and decrypting personal files, as well as keys for sharing ciphertexts with multiple people. These keys are stored in different areas and have different functions.

[0126] All seed keys are distributed and managed through dedicated initialization management tools, and the storage and use of seed keys and management tools must be subject to security measures.

[0127] S180: If the operation on the file is not a type of operation requiring encryption or decryption in the encryption or decryption policy, the file is sent to a disk or other filter driver.

[0128] Using a USB-Shield for encryption and decryption involves generating a session key. This involves traversing USB-Shield devices, connecting to the first USB-Shield device, verifying the USB-Shield device user PIN, opening the USB-Shield device application XinXinSingleAppSM1, and opening the USB-Shield XinXinSingleContainer. The public key of the encryption key pair in the container is exported. This step uses the public key of the USB-Shield container's encryption key pair to encrypt the session key and output the result. The encryption process is completed within the USB-Shield. Combined with the computer device's hardware information signature, a hashing algorithm is used to calculate the result, which serves as the computer's session key ciphertext file name. The file information is read. If the read fails, a session file is created, a session key is generated, and the session key ciphertext is exported. The session key ciphertext is written to the session file. The session key ciphertext file is read and imported into the device container. The USB-Shield container's encryption key pair is used to decrypt the session key ciphertext and generate the session key. This process is completed within the USB-Shield, generating a session key handle. If the read succeeds, the session key ciphertext file is read.

[0129] The initialization process is as follows: SerialNumbercheck retrieves the serial number stored on the EFlash and checks whether it matches the initial serial number. If a match is successful, the serial number is retrieved and written to the EFlash. The SM4 encryption key is checked to see if it is empty. If so, get_hrng() is called to generate a 16-bit random number, which is stored in the EFlash encryption and decryption key location and assigned to private_pbkey(). Protected_SM2_Keygen() is called to generate the SM2 public and private keys and store them in the EFlash. The data is written to the EFlash and the self-test data is updated. If a match fails, the encryption and decryption keys from the EFlash are retrieved and assigned to private_pbkey(). If the key is not empty, the data is written to the EFlash and the self-test data is updated. The generated private_pbKey is a true random number and is primarily used to encrypt data on the EFlash during storage and decrypt it during use, ensuring a unique key per disk. All keys are encrypted with this key before being stored in the EFlash. The SM2 public and private key pair is primarily used for SM2 encryption and decryption.

[0130] In this embodiment, the application software execution process of the U shield is as follows: the application is started, and it is determined whether SFK_Enum exists in the Ukey. If so, the device is connected SKF_ConnectDev; the application is opened XXSKF_OpenApplication; the container is opened XXSKF_OpenContainer; the Pin is verified XXSKF_VerifyPin; the secret key is exported XXSKF_ExportPublicKey; the hash is initialized XXSKF_DigestInit; the single set of data hash is XXSKF_Digest; the decryption password is obtained XXSKF_GetUesrDecrypCipher; the encryption handle is imported XXSKF_ImportSessionKey; the secret key interface is initialized XXSKF_EncryptInit; the secret key interface is initialized XXSKF_DecryptInit; the outgoing container is opened XXSKF_OpenContainer; the outgoing secret key is obtained XXSKF_GetEncrypCipher; the outgoing secret key interface XXSKF_EncryptInit is initialized; the device serial number XXSKF_GetSerialNumber is obtained, and the online mark is set; if not, the offline mark is set.

[0131] Start a timed thread for 5 seconds to determine if the Ukey contains SFK_Enum. If so, retrieve the Ukey's status using SKF_GetDevState. Analyze the Ukey's online status on the host computer. If it changes from offline to online, execute the check to determine if the Ukey contains SFK_Enum. If it does not change or changes from online to offline, execute the timed thread again for 5 seconds. Atomic Lock's operating process: Start the encryption process, read the file in binary, slice the file content into a maximum of 4096 and a minimum of 16, and encrypt the content using SKF_Encript.

[0132] The method of this embodiment solves the security and compliance issues of terminal document encryption software. There is an unwritten rule in the Commercial Cryptography Testing Center that the key cannot be removed from the hardware. It also increases the usability of the product and its adaptability to the working environment, and ensures the security, reliability and uniqueness of each link in the storage and transmission of encrypted files. After the software is installed, the original files in the computer and the normal use of the program will not be affected; after the software is uninstalled, the ciphertext is still ciphertext, and can only be turned into plaintext through manual decryption; when the software is running, it does not change the user's computer operation habits, and file encryption and decryption are all completed in the security chip, and the session key does not leave the hardware; the ciphertext on the physical storage medium is the ciphertext generated by the encryption algorithm, which is garbled to the user; when the U shield is not connected, the ciphertext can neither be opened nor deleted; malicious programs are denied illegal access to ciphertext; when the ciphertext is copied, no matter where it is pasted, the newly generated file is still ciphertext; the ciphertext is transmitted on the network, or stored as an attachment in a third-party file server, it is still ciphertext; ciphertext and non-ciphertext are ciphertext under normal operation. In the same computer, the ciphertext generated by U-Shield A cannot be operated normally on other U-Shields; the ciphertext generated by U-Shield on computer A can only be operated normally on computer A, and the ciphertext cannot be opened normally on other computers even if the same U-Shield is used; the plaintext session key does not leave the security chip in the U-Shield, and the session key cannot be obtained from the outside to crack the encrypted file; it supports ciphertext communication, which can only be carried out between specific people, that is, the ciphertext sent to someone can only be decrypted when the designated computer and the designated U-Shield are online, and anyone else cannot open it even if they obtain the ciphertext; it supports ciphertext sharing function, which supports barrier-free communication of ciphertext between specific people, and others cannot read it normally even if they obtain the ciphertext.

[0133] The method of this embodiment uses a chip provided by a manufacturer that meets the set password standards and has commercial password product production qualifications as a password component. The encryption USB shield has a built-in password component with an approved password algorithm. The storage, calculation and communication of the key meet security requirements, thereby ensuring the security of the product itself. A file filtering driver has been developed, which provides an authentication method for verification with the application program to prevent hacker programs from illegally operating the driver, further ensuring the security of the system. At the same time, during the product development and production process, full consideration is also given to environmental and management security.

[0134] The system uses stable, reliable, and mature technologies to ensure long-term safe operation. The system's software, hardware, and information resources meet reliability design requirements. It adheres to relevant information security standards, has necessary security protection and confidentiality measures, and has the ability to prevent computer crimes, ensuring information security and improving the system's anti-interference capabilities.

[0135] The U-Shield uses a new type of USB interface, which allows the product to be directly connected to the computer without the need for interface devices such as card readers, and the Xinxin Guardian encryption software can automatically identify the encrypted U-Shield on the machine. As long as the correct encrypted U-Shield is connected, the encryption software can be started, and the operation is quite simple.

[0136] It can run on the Kylin operating system and has the applicability principle of multiple operating systems; the encrypted file has nothing to do with the file format, and any file can be encrypted; it provides a variety of external interface functions, which are suitable for various application systems that require encryption and decryption processing; it can realize transparent encryption and decryption of files without changing the user's original operating habits. For users, the encryption and decryption operations are completely transparent; it can effectively prevent hackers and spyware from illegally intercepting data.

[0137] The interaction between the driver module and the application adopts a standardized calling interface to prevent illegal calls by other spyware; a standard external calling interface is provided to provide a secondary development interface.

[0138] The above-mentioned U-Shield-based document encryption and decryption method obtains the IRP file and control command, and then feeds back the status information to the application. After receiving the encryption and decryption strategy, it uses the encryption and decryption strategy to determine whether the file needs to be encrypted and decrypted. The U-Shield encryption and decryption technology is used to encrypt and decrypt the files that need encryption and decryption operations, and the U-Shield can be used for transmission and sharing, thereby improving the security, reliability, applicability and compliance of the document encryption and decryption based on the U-Shield.

[0139] Figure 6 This is a schematic block diagram of a document encryption and decryption device 300 based on a USB shield provided by an embodiment of the present invention. Figure 6 As shown, corresponding to the above-mentioned document encryption and decryption method based on U shield, the present invention also provides a document encryption and decryption device 300 based on U shield. The document encryption and decryption device 300 based on U shield includes a unit for executing the above-mentioned document encryption and decryption method based on U shield, and the device can be configured in a terminal. Specifically, please refer to Figure 6 The document encryption and decryption device 300 based on the USB shield includes a file acquisition unit 301, a command acquisition unit 302, a feedback unit 303, a receiving unit 304, a judgment unit 305, an encryption and decryption unit 306 and a sending unit 307.

[0140] The file acquisition unit 301 is used to obtain an IRP file generated by the IO manager after converting a file operation request. The command acquisition unit 302 is used to obtain a control command from the application. The feedback unit 303 is used to feedback status information to the application based on the control command, so that the application can formulate an encryption and decryption policy and send the encryption and decryption policy. The receiving unit 304 is used to receive the encryption and decryption policy. The judgment unit 305 is used to determine, based on the IRP file, whether the file operation is a type of operation requiring encryption and decryption as specified in the encryption and decryption policy. The encryption and decryption unit 306 is used to encrypt and decrypt the file using USB-Shield encryption and decryption technology if the file operation is a type of operation requiring encryption and decryption as specified in the encryption and decryption policy to obtain a processing result. The sending unit 307 is used to send the processing result.

[0141] In one embodiment, if Figure 7 As shown, the judgment unit 305 includes an analysis subunit 3051 , a judgment subunit 3052 , a first determination subunit 3053 and a second determination subunit 3054 .

[0142] The parsing subunit 3051 is used to parse the IRP file and determine the operation type of the file and the type of the file; the judging subunit 3052 is used to judge whether the operation request belongs to the type of operation requiring encryption and decryption in the encryption and decryption policy based on the operation type of the file and the type of the file; the first determining subunit 3053 is used to determine that the operation on the file is the type of operation requiring encryption and decryption in the encryption and decryption policy if the operation request belongs to the type of operation requiring encryption and decryption in the encryption and decryption policy; the second determining subunit 3054 is used to determine that the operation on the file is not the type of operation requiring encryption and decryption in the encryption and decryption policy if the operation request does not belong to the type of operation requiring encryption and decryption in the encryption and decryption policy.

[0143] In one embodiment, the encryption and decryption unit 306 is used to perform encryption and decryption operations on the file according to the policy within the encryption and decryption operation type corresponding to the operation request and using USB shield encryption and decryption technology to obtain a processing result.

[0144] In one embodiment, the encryption and decryption unit 306 is configured to perform encryption and decryption operations on the file using U-Shield encryption and decryption technology according to a policy within the encryption and decryption operation type corresponding to the operation request to obtain a processing result;

[0145] Among them, the U-shield encryption and decryption technology is used to encrypt and decrypt the file. When writing encrypted files, the IRP_MJ_WRITE write file information is intercepted, and the file content before encryption is recorded using the PREAD_WRITE_COMPLETION_CONTEXT structure. When the IRP file is received, the file content before encryption is reassigned to the IRP file and returned to the IO manager; when reading encrypted files, the IRP_MJ_READ read file information is intercepted. When the read file is an encrypted file, it is decrypted in the completion function SfReadCompletion.

[0146] In one embodiment, the sending unit includes:

[0147] The certificate acquisition subunit is used to obtain the public key certificates of all terminals; the import subunit is used to import the public key certificates of all terminals into the business card management list; the selection subunit is used to select the terminal that needs to perform ciphertext communication from the business card management list and import the corresponding public key certificate; the result sending subunit is used to send the processing result to the terminal that needs to perform ciphertext communication, so that the terminal that needs to perform ciphertext communication can decrypt it according to the relevant key in the U shield.

[0148] In one embodiment, the sending unit includes:

[0149] The initialization subunit is used to initialize the U shield; the shared ciphertext subunit is used to generate a shared ciphertext according to the processing result; the sharing subunit is used to share the shared ciphertext within the file sharing group so that the U shield in the file sharing group can decrypt the shared ciphertext.

[0150] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above-mentioned U-shield-based document encryption and decryption device 300 and each unit can refer to the corresponding description in the aforementioned method embodiment. For the convenience and conciseness of the description, it will not be repeated here.

[0151] The above-mentioned document encryption and decryption device 300 based on USB shield can be implemented in the form of a computer program. The computer program can be used in Figure 8 Runs on the computer equipment shown.

[0152] See also Figure 8 , Figure 8 1 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device 500 can be a terminal or a server.

[0153] See Figure 8The computer device 500 includes a processor 502 , a memory, and a network interface 505 connected via a system bus 501 , wherein the memory may include a non-volatile storage medium 503 and an internal memory 504 .

[0154] The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions, which, when executed, can enable the processor 502 to perform a document encryption and decryption method based on a USB shield.

[0155] The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500.

[0156] The internal memory 504 provides an environment for the operation of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute a document encryption and decryption method based on the U shield.

[0157] The network interface 505 is used to communicate with other devices through the network. Figure 8 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the computer device 500 to which the solution of the present application is applied. The specific computer device 500 may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0158] The processor 502 is configured to execute a computer program 5032 stored in the memory to implement the following steps:

[0159] Obtain an IRP file formed after the IO manager converts the operation request for the file; obtain a control command from the application; feedback status information to the application according to the control command, so that the application can formulate an encryption and decryption strategy, and the application sends the encryption and decryption strategy; receive the encryption and decryption strategy; determine whether the operation on the file is a type of operation that requires encryption and decryption in the encryption and decryption strategy according to the IRP file; if the operation on the file is a type of operation that requires encryption and decryption in the encryption and decryption strategy, encrypt and decrypt the file using U-shield encryption and decryption technology to obtain a processing result; and send the processing result.

[0160] Among them, the encryption and decryption strategy includes: for operations involving opening non-empty non-encrypted files in an authorized process, no encryption and decryption operations are performed; for operations involving opening non-empty encrypted files in an authorized process, the first encryption and decryption method is performed; for operations involving opening empty files in an authorized process, the second encryption and decryption method is performed; for operations involving opening non-empty non-encrypted files in an unauthorized process, no encryption and decryption operations are performed; for operations involving opening non-empty encrypted files in an unauthorized process, the third encryption and decryption method is performed; and for operations involving opening empty files in an unauthorized process, no encryption and decryption operations are performed.

[0161] The first encryption and decryption method includes marking the file as a read-write encryption and decryption type, performing encryption and decryption operations, and refreshing the cache; the second encryption and decryption method includes marking the file as a read-write encryption and decryption type, and performing encryption and decryption operations; the third encryption and decryption method includes marking the file as a read-write encryption and decryption type, performing encryption and decryption operations, and clearing the cache.

[0162] In one embodiment, when the processor 502 implements the step of determining whether the operation on the file complies with the encryption and decryption policy according to the IRP file, the processor 502 specifically implements the following steps:

[0163] Parse the IRP file to determine the operation type on the file and the type of the file; determine whether the operation request belongs to the operation type requiring encryption and decryption in the encryption and decryption policy based on the operation type on the file and the type of the file; if the operation request belongs to the operation type requiring encryption and decryption in the encryption and decryption policy, determine that the operation on the file is the operation type requiring encryption and decryption in the encryption and decryption policy; if the operation request does not belong to the operation type requiring encryption and decryption in the encryption and decryption policy, determine that the operation on the file is not the operation type requiring encryption and decryption in the encryption and decryption policy.

[0164] In one embodiment, when the processor 502 implements the step of encrypting and decrypting the file using the USB-shield encryption and decryption technology to obtain a processing result, the processor 502 specifically implements the following steps:

[0165] The file is encrypted and decrypted according to the policy of the encryption and decryption operation type corresponding to the operation request and using U-shield encryption and decryption technology to obtain a processing result.

[0166] In one embodiment, when the processor 502 implements the policy within the encryption and decryption operation type corresponding to the operation request and uses the USB-Shield encryption and decryption technology to perform encryption and decryption operations on the file to obtain a processing result, the processor 502 specifically implements the following steps:

[0167] According to the policy of the encryption and decryption operation type corresponding to the operation request, the encryption and decryption link uses the U-shield encryption and decryption technology to encrypt and decrypt the file to obtain the processing result;

[0168] Among them, the U-shield encryption and decryption technology is used to encrypt and decrypt the file. When writing encrypted files, the IRP_MJ_WRITE write file information is intercepted, and the file content before encryption is recorded using the PREAD_WRITE_COMPLETION_CONTEXT structure. When the IRP file is received, the file content before encryption is reassigned to the IRP file and returned to the IO manager; when reading encrypted files, the IRP_MJ_READ read file information is intercepted. When the read file is an encrypted file, it is decrypted in the completion function SfReadCompletion.

[0169] In one embodiment, when implementing the step of sending the processing result, the processor 502 specifically implements the following steps:

[0170] Obtain the public key certificates of all terminals; import the public key certificates of all terminals into the business card management list; select the terminal that needs to perform encrypted communication from the business card management list and import the corresponding public key certificate; send the processing result to the terminal that needs to perform encrypted communication, so that the terminal that needs to perform encrypted communication can decrypt it according to the relevant key in the U shield.

[0171] In one embodiment, when implementing the step of sending the processing result, the processor 502 specifically implements the following steps:

[0172] Initializing the U shield; generating a shared ciphertext according to the processing result; and sharing the shared ciphertext within the file sharing group so that the U shields within the file sharing group can decrypt the shared ciphertext.

[0173] It should be understood that in the embodiment of the present application, the processor 502 may be a central processing unit (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0174] Those skilled in the art will appreciate that all or part of the steps in the method of the above-described embodiment can be implemented by instructing the relevant hardware through a computer program. The computer program includes program instructions, which can be stored in a storage medium that is computer-readable. The program instructions are executed by at least one processor in the computer system to implement the steps in the method of the above-described embodiment.

[0175] Therefore, the present invention also provides a storage medium. The storage medium may be a computer-readable storage medium. The storage medium stores a computer program, wherein when the computer program is executed by a processor, the processor performs the following steps:

[0176] Obtain an IRP file formed after the IO manager converts the operation request for the file; obtain a control command from the application; feedback status information to the application according to the control command, so that the application can formulate an encryption and decryption strategy, and the application sends the encryption and decryption strategy; receive the encryption and decryption strategy; determine whether the operation on the file is a type of operation that requires encryption and decryption in the encryption and decryption strategy according to the IRP file; if the operation on the file is a type of operation that requires encryption and decryption in the encryption and decryption strategy, encrypt and decrypt the file using U-shield encryption and decryption technology to obtain a processing result; and send the processing result.

[0177] Among them, the encryption and decryption strategy includes: for operations involving opening non-empty non-encrypted files in an authorized process, no encryption and decryption operations are performed; for operations involving opening non-empty encrypted files in an authorized process, the first encryption and decryption method is performed; for operations involving opening empty files in an authorized process, the second encryption and decryption method is performed; for operations involving opening non-empty non-encrypted files in an unauthorized process, no encryption and decryption operations are performed; for operations involving opening non-empty encrypted files in an unauthorized process, the third encryption and decryption method is performed; and for operations involving opening empty files in an unauthorized process, no encryption and decryption operations are performed.

[0178] The first encryption and decryption method includes marking the file as a read-write encryption and decryption type, performing encryption and decryption operations, and refreshing the cache; the second encryption and decryption method includes marking the file as a read-write encryption and decryption type, and performing encryption and decryption operations; the third encryption and decryption method includes marking the file as a read-write encryption and decryption type, performing encryption and decryption operations, and clearing the cache.

[0179] In one embodiment, when the processor executes the computer program to implement the step of determining whether the operation on the file complies with the encryption and decryption policy according to the IRP file, the processor specifically implements the following steps:

[0180] Parse the IRP file to determine the operation type on the file and the type of the file; determine whether the operation request belongs to the operation type requiring encryption and decryption in the encryption and decryption policy based on the operation type on the file and the type of the file; if the operation request belongs to the operation type requiring encryption and decryption in the encryption and decryption policy, determine that the operation on the file is the operation type requiring encryption and decryption in the encryption and decryption policy; if the operation request does not belong to the operation type requiring encryption and decryption in the encryption and decryption policy, determine that the operation on the file is not the operation type requiring encryption and decryption in the encryption and decryption policy.

[0181] In one embodiment, when the processor executes the computer program to implement the step of encrypting and decrypting the file using the USB-Shield encryption and decryption technology to obtain a processing result, the processor specifically implements the following steps:

[0182] The file is encrypted and decrypted according to the policy of the encryption and decryption operation type corresponding to the operation request and using U-shield encryption and decryption technology to obtain a processing result.

[0183] In one embodiment, when the processor executes the computer program to implement the policy within the encryption and decryption operation type corresponding to the operation request and uses the USB-Shield encryption and decryption technology to perform the encryption and decryption operation on the file to obtain a processing result, the processor specifically implements the following steps:

[0184] According to the policy of the encryption and decryption operation type corresponding to the operation request, the encryption and decryption link uses the U-shield encryption and decryption technology to encrypt and decrypt the file to obtain the processing result;

[0185] Among them, the U-shield encryption and decryption technology is used to encrypt and decrypt the file. When writing encrypted files, the IRP_MJ_WRITE write file information is intercepted, and the file content before encryption is recorded using the PREAD_WRITE_COMPLETION_CONTEXT structure. When the IRP file is received, the file content before encryption is reassigned to the IRP file and returned to the IO manager; when reading encrypted files, the IRP_MJ_READ read file information is intercepted. When the read file is an encrypted file, it is decrypted in the completion function SfReadCompletion.

[0186] In one embodiment, when the processor executes the step of sending the processing result, the processor specifically implements the following steps:

[0187] Obtain the public key certificates of all terminals; import the public key certificates of all terminals into the business card management list; select the terminal that needs to perform encrypted communication from the business card management list and import the corresponding public key certificate; send the processing result to the terminal that needs to perform encrypted communication, so that the terminal that needs to perform encrypted communication can decrypt it according to the relevant key in the U shield.

[0188] In one embodiment, when the processor executes the computer program to implement the step of sending the processing result, the processor specifically implements the following steps:

[0189] Initializing the U shield; generating a shared ciphertext according to the processing result; and sharing the shared ciphertext within the file sharing group so that the U shields within the file sharing group can decrypt the shared ciphertext.

[0190] The storage medium may be any computer-readable storage medium that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disk.

[0191] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the composition and steps of each example according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0192] In the several embodiments provided herein, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the various units is merely a logical functional division, and actual implementation may employ other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be omitted or not implemented.

[0193] The steps in the methods of the embodiments of the present invention may be adjusted in order, combined, or deleted as needed. The units in the devices of the embodiments of the present invention may be combined, divided, or deleted as needed. Furthermore, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit.

[0194] If this integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the existing technology, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, terminal, or network device, etc.) to execute all or part of the steps of the method described in various embodiments of the present invention.

[0195] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and such modifications or substitutions are intended to be within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. The document encryption and decryption method based on U shield is characterized by: include: Get the IRP file formed by the IO manager after converting the file operation request; Get control commands from applications; Feedback status information to the application according to the control command, so that the application can formulate an encryption and decryption strategy, and the application can send the encryption and decryption strategy; receiving the encryption and decryption strategy; Determine, based on the IRP file, whether the operation on the file is a type of operation requiring encryption and decryption in the encryption and decryption policy; If the operation on the file is an operation type that requires encryption and decryption in the encryption and decryption strategy, the file is encrypted and decrypted using the U-Shield encryption and decryption technology to obtain a processing result; Sending the processing result; Among them, the U-shield encryption and decryption technology is used to encrypt and decrypt the file. When writing encrypted files, the IRP_MJ_WRITE write file information is intercepted, and the file content before encryption is recorded using the PREAD_WRITE_COMPLETION_CONTEXT structure. When the IRP file is received, the file content before encryption is reassigned to the IRP file and returned to the IO manager; when reading encrypted files, the IRP_MJ_READ read file information is intercepted. When the read file is an encrypted file, it is decrypted in the completion function SfReadCompletion.

2. The document encryption and decryption method based on USB shield according to claim 1 is characterized in that: The encryption and decryption strategy includes: when opening a non-empty non-encrypted file in an authorized process, no encryption and decryption operation is performed; when opening a non-empty encrypted file in an authorized process, the first encryption and decryption method is performed; This is an operation in which an authorized process opens an empty file and performs the second encryption and decryption method. This is an operation of opening a non-empty, non-encrypted file in an unauthorized process, and no encryption or decryption operations are performed; This is an operation of opening a non-empty encrypted file in an unauthorized process, and the third encryption and decryption method is used; This is an operation of opening an empty file in an unauthorized process, and no encryption or decryption operations are performed.

3. The document encryption and decryption method based on USB shield according to claim 2 is characterized in that: The first encryption and decryption method includes marking the file as a read-write encryption and decryption type, performing encryption and decryption operations, and refreshing the cache; the second encryption and decryption method includes marking the file as a read-write encryption and decryption type, and performing encryption and decryption operations; the third encryption and decryption method includes marking the file as a read-write encryption and decryption type, performing encryption and decryption operations, and clearing the cache.

4. The document encryption and decryption method based on USB shield according to claim 3 is characterized in that: The determining, based on the IRP file, whether the operation on the file complies with the encryption and decryption policy includes: Parsing the IRP file to determine the type of operation on the file and the type of the file; Determining whether the operation request belongs to the type of operation requiring encryption and decryption in the encryption and decryption policy according to the type of operation on the file and the type of the file; If the operation request belongs to the type of operation requiring encryption and decryption in the encryption and decryption policy, determining that the operation on the file is the type of operation requiring encryption and decryption in the encryption and decryption policy; If the operation request does not belong to the type of operation requiring encryption and decryption in the encryption and decryption policy, it is determined that the operation on the file is not the type of operation requiring encryption and decryption in the encryption and decryption policy.

5. The document encryption and decryption method based on USB shield according to claim 4 is characterized in that: The file is encrypted and decrypted using the U-Shield encryption and decryption technology to obtain a processing result, including: Perform encryption and decryption operations on the file using U-Shield encryption and decryption technology according to the policy of the encryption and decryption operation type corresponding to the operation request to obtain a processing result; The encryption and decryption operations on the file are performed according to the policy within the encryption and decryption operation type corresponding to the operation request and using the U-Shield encryption and decryption technology to obtain a processing result, including: According to the policy within the encryption and decryption operation type corresponding to the operation request, the encryption and decryption link uses U-shield encryption and decryption technology to encrypt and decrypt the file to obtain the processing result.

6. The document encryption and decryption method based on USB shield according to claim 1, characterized in that: The sending of the processing result includes: Obtain public key certificates for all terminals; Import the public key certificates of all terminals into the business card management list; Select the terminal that needs to perform encrypted communication from the business card management list and import the corresponding public key certificate; The processing result is sent to the terminal that needs to perform ciphertext communication, so that the terminal that needs to perform ciphertext communication can decrypt it according to the relevant key in the U shield.

7. The document encryption and decryption method based on USB shield according to claim 1, characterized in that: The sending of the processing result includes: Initialize the USB shield; generating a shared ciphertext according to the processing result; The shared ciphertext is shared within the file sharing group so that the U-shields within the file sharing group can decrypt the shared ciphertext.

8. The document encryption and decryption device based on U shield is characterized by: The document encryption and decryption method according to any one of claims 1 to 7 comprises: The file acquisition unit is used to acquire an IRP file formed after the IO manager converts the operation request for the file; A command acquisition unit, used to acquire control commands from an application program; A feedback unit, configured to feed back status information to the application according to the control command, so that the application can formulate an encryption and decryption strategy, and the application can send the encryption and decryption strategy; A receiving unit, configured to receive the encryption and decryption strategy; a judging unit, configured to judge, based on the IRP file, whether the operation on the file is a type of operation requiring encryption and decryption in the encryption and decryption policy; an encryption and decryption unit, configured to encrypt and decrypt the file using the U-Shield encryption and decryption technology to obtain a processing result if the operation on the file is a type of operation requiring encryption and decryption in the encryption and decryption policy; A sending unit is used to send the processing result.

9. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images