A file encryption transmission method, device and equipment supporting cross-domain and a medium

Abstract

The application discloses a file encryption transmission method and device supporting cross-domain, equipment and medium, relates to the field of instant communication technology, and comprises the following steps: after the domain server and the user are registered successfully, it is judged whether the user group created exists in the center server, if not, the user group is created and the group key is generated, and the group key is sent to the user terminal based on the user group; through the user sending end, it is judged whether the to-be-transmitted file is the first transmission based on the file Hash corresponding to the to-be-transmitted file, and the to-be-transmitted file and the file key corresponding to the to-be-transmitted file are encrypted and processed according to the judgment result, the file Hash, the random number and the group key, so as to obtain the target information package; the target information package is distributed to each user receiving end through the domain server and the center server, so that the user receiving end decrypts the target information package according to the group key to obtain the decrypted file ID, and the to-be-transmitted file is obtained based on the decrypted file ID.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of instant messaging technology, and in particular to a file encryption transmission method and device supporting cross-domain, equipment and medium. BACKGROUND

[0002] With the development of mobile communication technology, the demand for interconnection between enterprises is increasing. How to efficiently and securely transmit and share files between users of different domains, especially for large files, is a pressing problem. The existing file transmission method of instant messaging system generally uses digital envelope to encrypt and transmit files. This scheme is complex for large group processing. The sender needs to maintain a large amount of user public key information, generate multiple file ciphertexts, and distribute them to the corresponding users. Another existing key and file ciphertext separation scheme still needs to generate multiple key ciphertexts. The server distributes the corresponding key ciphertexts to the designated user receiving end according to the receiver information. In this way, the server processing logic is complex, and the cross-domain transmission scenario is not involved. With the increasing number of communication and collaboration scenarios in mobile office scenarios, the communication and interaction between organizations are closer, and more and more systems need to consider cross-domain and cross-organizational data flow problems to promote efficient and secure data exchange and analysis. SUMMARY

[0003] Therefore, the purpose of the present application is to provide a file encryption transmission method and device supporting cross-domain, equipment and medium, which can realize file encryption once, upload to the whole network once, reduce cost, and reduce the complexity of group file cross-domain transmission processing. The specific scheme is as follows:

[0004] In a first aspect, the present application discloses a file encryption transmission method supporting cross-domain, comprising:

[0005] After the domain server and the user are successfully registered respectively, it is judged whether there is an already created user group in the center server. If not, the user group is created and the group key is generated, and the group key is distributed to the user terminal based on the user group. The user terminal includes a user sending end and a user receiving end;

[0006] Through the user sending end, it is judged whether the to-be-transmitted file is the first transmission based on the file Hash corresponding to the to-be-transmitted file. According to the corresponding judgment result, the file Hash, the random number and the group key, the to-be-transmitted file and the file key corresponding to the to-be-transmitted file are encrypted and processed to obtain a target information package. The target information package includes one or more combinations of the file ID corresponding to the to-be-transmitted file, the file key derivation parameter ciphertext and the attribute information of the to-be-transmitted file;

[0007] Distribute the target information package to each user receiving end through the domain server and the center server, so that the user receiving end decrypts the target information package according to the group key to obtain a decrypted file ID, and acquires the to-be-transmitted file based on the decrypted file ID.

[0008] Optionally, before judging whether the user group created exists in the center server after the domain server and the user are registered successfully, the method further comprises:

[0009] Register the domain server to the center server, encrypt a first protection key generated by the center server by using a domain server protection key, and send the encrypted first protection key to each domain server;

[0010] Register the user to the domain server to which the user belongs, encrypt a second protection key generated by the domain server by using a user protection key, and send the encrypted second protection key to each user terminal.

[0011] Optionally, if the user group does not exist, the method further comprises:

[0012] If the user group does not exist, creating the user group and generating the group key through the center server;

[0013] Encrypt and protect the group key based on the first protection key, and distribute the group key to the domain server, so that the domain server performs decryption and encryption operations on the group key based on the first protection key and the second protection key to obtain an encrypted group key, and distributes the encrypted group key to the user terminal based on the user group.

[0014] Optionally, the method further comprises:

[0015] If the to-be-transmitted file is transmitted for the first time, deriving the random number and the file Hash by using a key derivation algorithm to generate the file key corresponding to the to-be-transmitted file;

[0016] Encrypting the to-be-transmitted file based on the file key by using the user sending end to obtain corresponding file ciphertext;

[0017] uploading the file ciphertext to the domain server through the user sending terminal, so that the domain server forwards the file ciphertext to the center server, and the center server generates a file ID corresponding to the file to be transmitted, and returns the file ID to the user sending terminal;

[0018] encrypting the file key by using the group key and the second protection key respectively to obtain first file key derivation parameter ciphertext and second file key derivation parameter ciphertext;

[0019] sending the file ciphertext, the first file key derivation parameter ciphertext, the second file key derivation parameter ciphertext, the file ID and attribute information of the file to be transmitted to the domain server for storage through the user sending terminal, and re-encrypting the second file key derivation parameter ciphertext based on the first protection key through the domain server to obtain third file key derivation parameter ciphertext;

[0020] sending the first file key derivation parameter ciphertext, the third file key derivation parameter ciphertext, the file ID and attribute information of the file to be transmitted to the center server through the domain server, so that the center server saves the third file key derivation parameter ciphertext and the file ID, and distributes the first file key derivation parameter ciphertext, the file ID and attribute information of the file to be transmitted to each domain server to obtain a target information package containing the first file key derivation parameter ciphertext, the file ID and attribute information of the file to be transmitted.

[0021] Optionally, the user sending terminal judges whether the file to be transmitted is transmitted for the first time based on a file Hash corresponding to the file to be transmitted, and according to the corresponding judgment result, the file Hash, a random number and the group key, the file to be transmitted and the file key corresponding to the file to be transmitted are encrypted and processed correspondingly to obtain a target information package, including:

[0022] if the file to be transmitted is not transmitted for the first time and the user's local exists the file key corresponding to the file to be transmitted, the file ID, initial file key derivation parameter ciphertext and attribute information of the file to be transmitted corresponding to the file to be transmitted are directly obtained from the local;

[0023] re-encrypting the file key derivation parameter corresponding to the initial file key derivation parameter ciphertext by using a new group key to determine new file key derivation parameter ciphertext to obtain a target information package containing the new file key derivation parameter ciphertext, the file ID and attribute information of the file to be transmitted.

[0024] Optionally, the user terminal judges whether the to-be-transmitted file is the first transmission based on the file Hash corresponding to the to-be-transmitted file, and performs corresponding encryption and processing on the to-be-transmitted file and the file key corresponding to the to-be-transmitted file according to the corresponding judgment result, the file Hash, the random number and the group key to obtain the target information package, including:

[0025] If the to-be-transmitted file is not the first transmission, and the file key corresponding to the to-be-transmitted file does not exist in the user terminal, and the file key exists in the domain server, the domain server sends the file ID, the file key derivation parameter ciphertext and the attribute information of the to-be-transmitted file encrypted by the second protection key to the user terminal based on the file information acquisition request;

[0026] If the to-be-transmitted file is not the first transmission, and the file key corresponding to the to-be-transmitted file does not exist in the user terminal, and the file key does not exist in the domain server, the domain server forwards the file information acquisition request to the center server, so that the center server performs re-encryption protection on the file ID, the initial file key derivation parameter ciphertext and the attribute information of the to-be-transmitted file based on the first protection key to generate a fourth file key derivation parameter ciphertext, and distributes the file ID, the initial file key derivation parameter ciphertext, the attribute information of the to-be-transmitted file and the fourth file key derivation parameter ciphertext to the domain server;

[0027] The domain server sends the re-encryption protected fourth file key derivation parameter ciphertext to the user terminal based on the second protection key;

[0028] The user terminal performs re-encryption protection on the file key derivation parameter ciphertext based on the data protection key DPK after receiving the response information of the server to obtain local key ciphertext, and locally stores the local key ciphertext, the file ID and the attribute information of the to-be-transmitted file;

[0029] The user terminal performs re-encryption protection on the file key derivation parameter ciphertext based on the group key after receiving the response information of the server to obtain new file key derivation parameter ciphertext, and determines the target information package based on the new file key derivation parameter ciphertext, the file ID and the attribute information of the to-be-transmitted file.

[0030] Optionally, after judging whether the user group has been created in the center server, the method further includes:

[0031] If the user group exists, the group key is directly distributed to the user terminal.

[0032] Optionally, the distributing the target information package to each of the user receiving ends by the domain server and the center server comprises:

[0033] forwarding the target file information to the center server by the domain server, so that the center server distributes the target file information to each of the domain servers, and distributes the target file information to each of the user receiving ends by each of the domain servers.

[0034] Optionally, the distributing the target information package to each of the user receiving ends by the domain server and the center server, so that the user receiving end decrypts the target information package according to the group key to obtain a decrypted file ID, and acquires the to-be-transmitted file based on the decrypted file ID, comprises:

[0035] distributing the target information package to each of the user receiving ends by the domain server and the center server, so that the user receiving end decrypts the target information package according to the group key to obtain a decrypted file ID;

[0036] pulling the file ciphertext corresponding to the to-be-transmitted file from the domain server or the center server based on the file ID, and decrypting the file ciphertext according to the decrypted file ID to obtain the to-be-transmitted file and determine whether the to-be-transmitted file is tampered.

[0037] In a second aspect, the present application discloses a device for supporting cross-domain file encryption transmission, comprising:

[0038] a group judgment module, configured to judge whether there is an already-created user group in the center server after the domain server and the user are respectively registered successfully, and if not, create the user group and generate a group key, and distribute the group key to the user terminal based on the user group; the user terminal comprises a user sending end and a user receiving end;

[0039] a transmission file judgment module, configured to judge whether the to-be-transmitted file is transmitted for the first time by the user sending end based on a file Hash corresponding to the to-be-transmitted file, and encrypt and process the to-be-transmitted file and a file key corresponding to the to-be-transmitted file according to a corresponding judgment result, the file Hash, a random number and the group key to obtain a target information package; wherein the target information package comprises a combination of one or more of a file ID corresponding to the to-be-transmitted file, file key derivation parameter ciphertext and attribute information of the to-be-transmitted file;

[0040] The transmission file obtaining module is configured to distribute the target information package to each user receiving end through the domain server and the center server, so that the user receiving end decrypts the target information package according to the group key to obtain a decrypted file ID, and obtains the to-be-transmitted file based on the decrypted file ID.

[0041] In a third aspect, the present application discloses an electronic device, comprising:

[0042] a memory configured to store a computer program;

[0043] a processor configured to execute the computer program to implement the foregoing cross-domain supported file encryption transmission method.

[0044] In a fourth aspect, the present application discloses a computer readable storage medium configured to store a computer program, which is executed by a processor to implement the foregoing cross-domain supported file encryption transmission method.

[0045] In the present application, when a cross-domain file is encrypted and transmitted, first, after the domain server and the user are successfully registered, it is judged whether there is an already created user group in the center server, if not, the user group is created and the group key is generated, and the group key is distributed to the user terminal based on the user group; the user terminal includes a user sending end and a user receiving end; then, through the user sending end, it is judged whether the to-be-transmitted file is the first transmission based on the file Hash corresponding to the to-be-transmitted file, and the to-be-transmitted file and the file key corresponding to the to-be-transmitted file are encrypted and processed according to the corresponding judgment result, the file Hash, the random number and the group key, to obtain a target information package; wherein the target information package includes one or more combinations of the file ID corresponding to the to-be-transmitted file, the file key derivation parameter ciphertext and the attribute information of the to-be-transmitted file; finally, the target information package is distributed to each user receiving end through the domain server and the center server, so that the user receiving end decrypts the target information package according to the group key to obtain a decrypted file ID, and obtains the to-be-transmitted file based on the decrypted file ID. In this way, the present application encrypts the file through the file Hash and the random number, generates a new session key, and does not need to use HMAC or MAC mode for integrity protection. At the same time, the same file only needs to be transmitted once in the cross-domain network, and the client does not need to download the file repeatedly, thereby reducing the cost and improving the transmission efficiency. The group communication key protection mechanism has lower processing complexity, and the advantage is more significant for large groups, and the file utilization rate on the server is high. BRIEF DESCRIPTION OF DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description only constitute a part of the embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor based on the provided drawings.

[0047] Figure 1 A flow chart of a file encryption transmission method supporting cross-domain disclosed by the present application;

[0048] Figure 2 A registration process schematic diagram disclosed by the present application;

[0049] Figure 3 A group creation schematic diagram disclosed by the present application;

[0050] Figure 4 A cross-domain file sending process schematic diagram disclosed by the present application;

[0051] Figure 5 Another cross-domain file sending process schematic diagram disclosed by the present application;

[0052] Figure 6 A device structure schematic diagram of a file encryption transmission device supporting cross-domain disclosed by the present application;

[0053] Figure 7 A structure diagram of an electronic device disclosed by the present application. DETAILED DESCRIPTION

[0054] The technical solutions in the embodiments of the present application will be described clearly and completely below with the drawings in the embodiments of the present application. Obviously, the described embodiments only constitute a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the present application.

[0055] The file transmission method of the existing instant messaging system generally adopts a digital envelope method to encrypt and transmit the file. This scheme is complex for large group processing, and the sending end needs to maintain a large amount of user public key information, generate multiple file ciphertexts, and distribute them to the corresponding users. Another existing key and file ciphertext separation scheme still needs to generate multiple key ciphertexts, and the server distributes the corresponding key ciphertexts to the designated user receiving end according to the receiver information. In this way, the server processing logic is relatively complex, and the cross-domain transmission scenario is not involved. In order to solve the above technical problems, the present application discloses a file encryption transmission method supporting cross-domain, which can realize file encryption once, transmission once in the whole network, reduce cost, and reduce the complexity of group file cross-domain transmission processing.

[0056] See Figure 1 As shown, this embodiment of the invention discloses a method for cross-domain encrypted file transmission, including:

[0057] Step S11: After the domain server and the user have successfully registered, determine whether there is a user group that has been created in the central server. If not, create the user group and generate a group key, and send the group key to the user terminal based on the user group. The user terminal includes a user sending end and a user receiving end.

[0058] In this embodiment, before the file is transferred, such as Figure 2 As shown, firstly, the domain servers need to be registered with the central server. The first protection key generated by the central server is encrypted using the domain server's protection key, and the encrypted first protection key is sent to each of the domain servers. Secondly, the users need to be registered with the domain server to which they belong. The second protection key generated by the domain server is encrypted using the user's protection key, and the encrypted second protection key is sent to each of the user terminals. Specifically, the domain servers are registered with the central server, the central server generates a key distribution protection key KDK_S, and uses the domain server protection key EPK. domain Encryption protection is distributed to each domain server. Users register with their home domain server, which generates a key distribution protection key KDK_C and uses the user's protection key EPK. usr The protection is distributed to each user terminal. Registration is complete before the next step of file transfer can proceed. However, when sending cross-domain files, users need to create a group on the central server, such as... Figure 3As shown, if the group exists, the group protection key GK is directly issued to the client, and if the group does not exist, the group protection key GK needs to be generated and issued to the client. Therefore, it is necessary to first determine whether the created user group exists in the center server, and if the user group does not exist, the user group is created through the center server and the group key is generated; the group key is encrypted and protected based on the first protection key and distributed to the domain server, so that the domain server performs the operation of first decryption and then encryption on the group key based on the first protection key and the second protection key to obtain the encrypted group key, and distributes the encrypted group key to the user terminal based on the user group. In detail, the center server creates a group and generates a group key, and distributes the group protection key to the domain server for encryption and protection. The domain server is distributed to the user terminal through Enc(KDK_C, Dec(KDK_S, Enc(KDK_S, GK))) (it needs to be understood that this is a process of first decryption and then encryption, and encryption is followed by re-encryption protection). At this point, the user starts to send files, and processes according to whether there is file key related information on the local or server.

[0059] Step S12, the user sending end judges whether the to-be-transmitted file is the first transmission based on the file Hash corresponding to the to-be-transmitted file, and according to the corresponding judgment result, the file Hash, the random number and the group key, the to-be-transmitted file and the file key corresponding to the to-be-transmitted file are processed and encrypted to obtain a target information package; wherein the target information package includes one or more combinations of the file ID corresponding to the to-be-transmitted file, the file key derivation parameter ciphertext and the attribute information of the to-be-transmitted file.

[0060] In this embodiment, when the cross-domain file is sent, the user sending end judges whether the to-be-transmitted file is the first transmission based on the file Hash corresponding to the to-be-transmitted file. If it is the first transmission, there is no file key information in the local and the server. At this time, the random number and the file Hash are derived through a key derivation algorithm to generate the file key corresponding to the to-be-transmitted file. The key derivation algorithm includes but is not limited to KDF (Key derivation function), PBKDF (Password-Based Key Derivation Function), HKDF (HMAC-based Extract-and-Expand Key Derivation Function) and the like. The user sending end encrypts the to-be-transmitted file based on the file key to obtain the corresponding file ciphertext. The user sending end uploads the file ciphertext to the domain server, so that the domain server forwards the file ciphertext to the center server, and the center server generates the file ID (Identity document) corresponding to the to-be-transmitted file and returns the file ID to the user sending end. The group key and the second protection key are used to respectively encrypt the file key to obtain the first file key derivation parameter ciphertext and the second file key derivation parameter ciphertext. Here, specifically, the group key GK and the domain server protection key EPK domain The file key is protected to obtain key derivation parameter ciphertext 1 and ciphertext 2, wherein ciphertext 1 is Enc(GK, key derivation material), and ciphertext 2 is Enc(EPK domain, the key derivation material is random number and file Hash. Then, the user terminal encrypts the key derivation parameter with DPK (the key for encrypting the file, the last password) to obtain local key ciphertext, and stores file related information locally. The file ciphertext, the first file key derivation parameter ciphertext, the second file key derivation parameter ciphertext, the file ID and the attribute information of the file to be transmitted are sent to the domain server for storage, and the domain server re-encrypts the second file key derivation parameter ciphertext based on the first protection key to obtain the third file key derivation parameter ciphertext; the first file key derivation parameter ciphertext, the third file key derivation parameter ciphertext, the file ID and the attribute information of the file to be transmitted are sent to the center server by the domain server, so that the center server saves the third file key derivation parameter ciphertext and the file ID, and distributes the first file key derivation parameter ciphertext, the file ID and the attribute information of the file to be transmitted to each domain server to obtain a target information package containing the first file key derivation parameter ciphertext, the file ID and the attribute information of the file to be transmitted. It needs to be explained in detail that the domain server stores the file related information, and uses the center server protection key EPK center Re-encryption generates ciphertext 3. Ciphertext 1, ciphertext 3, file ID and other attribute information are sent to the center server. Finally, the center server saves ciphertext 3 and file ID, and distributes ciphertext 1, file ID and other file attribute information to each domain server, and then distributes them to each user receiving end by the domain server.

[0061] If the file to be transmitted is not transmitted for the first time, it is necessary to judge again whether the file key information exists in the user local and the server, and according to the judgment result, the key derivation parameter ciphertext information, file ID and other attribute information obtained from the local are processed correspondingly, and finally the user sends ciphertext 1, file ID and other information to the domain server.

[0062] Step S13, the target information package is distributed to each user receiving end by the domain server and the center server, so that the user receiving end decrypts the target information package according to the group key to obtain decrypted file ID, and obtains the file to be transmitted based on the decrypted file ID.

[0063] In this embodiment, the target file information is forwarded to the center server by the domain server, so that the center server distributes the target file information to each domain server, and each domain server distributes the target file information to each user receiving end. Then, the target information package is distributed to each user receiving end by the domain server and the center server, so that the user receiving end decrypts the target information package according to the group key to obtain a decrypted file ID; the file ciphertext corresponding to the to-be-transmitted file is pulled from the domain server or the center server based on the file ID, and the file ciphertext is decrypted according to the decrypted file ID to obtain the to-be-transmitted file and determine whether the to-be-transmitted file is tampered. In detail, when receiving a cross-domain file, the file key derivation parameter, the file ID, and other related information are obtained by decryption through the group protection key GK. It is checked whether the file exists locally. If it exists, it is not necessary to repeat the download, otherwise, the corresponding file ciphertext is pulled according to the file ID, and is pulled from the domain server or the center server as needed. Finally, the file ciphertext is decrypted, and it is judged whether the file is tampered.

[0064] To sum up, when the cross-domain file is encrypted and transmitted, the application first judges whether the user group created exists in the center server after the domain server and the user are successfully registered respectively. If not, the user group is created and the group key is generated, and the group key is distributed to the user terminal based on the user group. The user terminal includes a user sending end and a user receiving end. Then, whether the file to be transmitted is the first transmission is judged based on the file Hash corresponding to the file to be transmitted through the user sending end. According to the corresponding judgment result, the file Hash, the random number and the group key, the file to be transmitted and the file key corresponding to the file to be transmitted are encrypted and processed correspondingly to obtain a target information package. The target information package includes one or more combinations of the file ID corresponding to the file to be transmitted, the file key derivation parameter ciphertext and the attribute information of the file to be transmitted. Finally, the target information package is distributed to each user receiving end through the domain server and the center server, so that the user receiving end decrypts the target information package based on the group key to obtain a decrypted file ID, and obtains the file to be transmitted based on the decrypted file ID. In this way, the file is encrypted by the file Hash and the random number, a new session key is generated, and the HMAC (Hash-based Message Authentication Code, Hash-based Message Authentication Code) or MAC (Media Access Control, Media Access Control) mode is not needed for integrity protection. At the same time, the same file needs to be transmitted only once in the cross-domain network, and the client does not need to download the file repeatedly, thereby reducing the cost and improving the transmission efficiency. The group communication key protection mechanism has lower processing complexity, and the advantage is more significant for large groups, and the file utilization rate on the server is high.

[0065] Based on the last embodiment, when it is determined that the file to be transmitted is not the first transmission, it is necessary to judge again whether the file key information exists in the user local and the server. Next, the corresponding processing process under different judgment results will be described in detail.

[0066] Referring to Figure 4 The application discloses a cross-domain file sending process, which includes:

[0067] Step S21, if the file to be transmitted is not the first transmission, and the file key corresponding to the file to be transmitted exists in the user local, the file ID corresponding to the file to be transmitted, the initial file key derivation parameter ciphertext and the attribute information of the file to be transmitted are directly obtained from the local.

[0068] In this embodiment, the to-be-transmitted file is not the first transmission, and the user has the file key corresponding to the to-be-transmitted file locally. At this time, the file key related information is requested to be acquired, and then the key derivation parameter ciphertext information, the file ID and other attribute information are acquired from the local according to the request.

[0069] In step S22, the initial file key derivation parameter ciphertext is re-encrypted by the new group key to determine the new file key derivation parameter ciphertext, so as to obtain the target information package containing the new file key derivation parameter ciphertext, the file ID and the attribute information of the to-be-transmitted file.

[0070] In this embodiment, the key derivation parameter is re-encrypted by the new group key to obtain ciphertext 1'. Thus, the target information package containing the new file key derivation parameter ciphertext, the file ID and the attribute information of the to-be-transmitted file is obtained.

[0071] In step S23, the target information package is distributed to each user receiving end by the domain server and the center server.

[0072] Then, the user terminal ciphertext 1', ID and other file attribute information are sent to the domain server, the received information is forwarded to the center server by the domain server, the center server is distributed to each domain server, and then the target information package is distributed to each user receiving end by each domain server.

[0073] In this way, the same file needs to be transmitted only once in the cross-domain network, the client does not need to download the file repeatedly, the transmission efficiency is improved, the cost is reduced, and the complexity of processing of the cross-domain file transmission is reduced.

[0074] Referring to Figure 5 The application discloses another cross-domain file sending process, which comprises the following steps:

[0075] In step S31, if the to-be-transmitted file is not the first transmission, and the user does not have the file key corresponding to the to-be-transmitted file locally, but the domain server has the file key, the file ID, the file key derivation parameter ciphertext and the attribute information of the to-be-transmitted file encrypted by the second protection key are sent to the user terminal based on the file information acquisition request of the domain server.

[0076] In this embodiment, if the to-be-transmitted file is not the first transmission, and the user does not have the file key corresponding to the to-be-transmitted file locally, but the domain server has the file key, the user sends a request to acquire the key derivation parameter, the file ID and the attribute information of the to-be-transmitted file related to the file, and the domain server receives the request and distributes the file related information to the client by KDK_C re-encryption protection.

[0077] Step S32, if the file to be transmitted is not the first transmission, and the file key corresponding to the file to be transmitted does not exist in the user locally, and the file key does not exist in the domain server, the domain server forwards the file information acquisition request to the center server, so that the center server re-encrypts the file ID, the initial file key derivation parameter ciphertext and the attribute information of the file to be transmitted based on the first protection key to generate the fourth file key derivation parameter ciphertext, and distributes the file ID, the initial file key derivation parameter ciphertext, the attribute information of the file to be transmitted and the fourth file key derivation parameter ciphertext to the domain server.

[0078] In the embodiment, if the file key does not exist in the domain server, the domain server forwards the request to the center server, the center server re-encrypts the file related information based on KDK_S to generate ciphertext 4, and distributes the file ID, the initial file key derivation parameter ciphertext, the attribute information of the file to be transmitted and the fourth file key derivation parameter ciphertext to the domain server.

[0079] Step S33, the domain server sends the fourth file key derivation parameter ciphertext re-encrypted based on the second protection key to the user terminal.

[0080] In the embodiment, the domain server re-encrypts ciphertext 4 based on KDK_C and distributes it to the client, and the domain server stores the file key ciphertext and the file ID.

[0081] Step S34, the user terminal re-encrypts the file key derivation parameter ciphertext based on the data protection key DPK after receiving the response information of the server to obtain the local key ciphertext, and stores the local key ciphertext, the file ID and the attribute information of the file to be transmitted locally; the user terminal re-encrypts the file key derivation parameter ciphertext based on the group key after receiving the response information of the server to obtain the new file key derivation parameter ciphertext, and determines the target information package based on the new file key derivation parameter ciphertext, the file ID and the attribute information of the file to be transmitted.

[0082] In this embodiment, after receiving the server response, the user uses the group key to re-encrypt the file key derivation parameter ciphertext based on the group key to obtain new file key derivation parameter ciphertext, thereby obtaining a target information package including the new file key derivation parameter ciphertext, the file ID, and attribute information of the to-be-transmitted file. After receiving the server response, the user uses the local data protection key DPK to re-encrypt the file key derivation parameter ciphertext to obtain local key ciphertext, and stores the local key ciphertext, the file ID, and the attribute information of the to-be-transmitted file locally. In this way, the key-related information of the to-be-transmitted file is stored in the user end to be queried locally next time when sending. In summary, the file key is encrypted and protected by the DPK locally, and is sent to the receiving end for protection by the group key.

[0083] Step S35, distributing the target information package to each user receiving end through the domain server and the center server.

[0084] In this embodiment, the user sends the ciphertext 1, the file ID, and other information to the domain server, the domain server sends the received information to the center server, the center server distributes to each domain server, and each domain server distributes to each user receiving end.

[0085] In this way, the same file only needs to be transmitted once in the cross-domain network, the client does not need to repeatedly download the file, the transmission efficiency is improved, the cost is reduced, and the complexity of processing when transmitting the group file across domains is reduced.

[0086] Referring to Figure 6 The embodiment of the application discloses a file encryption transmission device supporting cross-domain, which comprises:

[0087] The group judgment module 11 is used for judging whether there is an already-created user group in the center server after the domain server and the user are successfully registered, creating the user group and generating a group key if there is not, and distributing the group key to the user terminal based on the user group; the user terminal comprises a user sending end and a user receiving end;

[0088] The transmission file judgment module 12 is used for judging whether the to-be-transmitted file is the first transmission based on the file Hash corresponding to the to-be-transmitted file through the user sending end, and performing corresponding encryption and processing on the to-be-transmitted file and the file key corresponding to the to-be-transmitted file according to the corresponding judgment result, the file Hash, a random number, and the group key, to obtain a target information package; wherein the target information package comprises a combination of one or more of the file ID corresponding to the to-be-transmitted file, file key derivation parameter ciphertext, and attribute information of the to-be-transmitted file;

[0089] The transmission file obtaining module 13 is configured to distribute the target information package to each user receiving end through the domain server and the center server, so that the user receiving end decrypts the target information package according to the group key to obtain a decrypted file ID, and obtains the to-be-transmitted file based on the decrypted file ID.

[0090] In the application, when cross-domain files are encrypted and transmitted, firstly, after the domain server and the user are successfully registered, it is judged whether a user group created in the center server exists, if not, the user group is created and a group key is generated, and the group key is distributed to the user terminal based on the user group; the user terminal includes a user sending end and a user receiving end; then, it is judged whether the to-be-transmitted file is transmitted for the first time based on the file Hash corresponding to the to-be-transmitted file through the user sending end, and the to-be-transmitted file and the file key corresponding to the to-be-transmitted file are encrypted and processed according to the corresponding judgment result, the file Hash, the random number and the group key, to obtain a target information package; wherein the target information package includes one or a combination of several of the file ID corresponding to the to-be-transmitted file, the file key derivation parameter ciphertext and the attribute information of the to-be-transmitted file; finally, the target information package is distributed to each user receiving end through the domain server and the center server, so that the user receiving end decrypts the target information package according to the group key to obtain a decrypted file ID, and obtains the to-be-transmitted file based on the decrypted file ID. In this way, the application encrypts the file by using the file Hash and the random number, generates a new session key, and does not need to use HMAC or MAC mode for integrity protection. At the same time, the same file needs to be transmitted only once in the cross-domain network, and the client does not need to download the file repeatedly, thereby reducing the cost and improving the transmission efficiency. The group communication key protection mechanism has lower processing complexity, and the advantage is more significant for large groups, and the file utilization rate on the server is high.

[0091] In some specific embodiments, the device can also be used to register the domain server to the center server, encrypt the first protection key generated by the center server using the domain server protection key, and send the encrypted first protection key to each domain server; register the user to the domain server to which the user belongs, encrypt the second protection key generated by the domain server using the user protection key, and send the encrypted second protection key to each user terminal.

[0092] In some specific embodiments, the group determining module 11 can be specifically configured to create the user group and generate the group key through the center server if the user group does not exist; distribute the group key to the domain server after the group key is encrypted based on the first protection key, so that the domain server performs the operation of first decryption and then encryption on the group key based on the first protection key and the second protection key to obtain an encrypted group key, and distributes the encrypted group key to the user terminal based on the user group.

[0093] In some specific embodiments, the transmission file determining module 12 can be specifically configured to generate the file key corresponding to the to-be-transmitted file by deriving the random number and the file Hash through a key derivation algorithm if the to-be-transmitted file is transmitted for the first time; encrypt the to-be-transmitted file based on the file key through the user sending end to obtain the corresponding file ciphertext; upload the file ciphertext to the domain server through the user sending end, so that the domain server forwards the file ciphertext to the center server, and the center server generates the file ID corresponding to the to-be-transmitted file and returns the file ID to the user sending end; encrypt the file key by using the group key and the second protection key respectively to obtain the first file key derivation parameter ciphertext and the second file key derivation parameter ciphertext; send the file ciphertext, the first file key derivation parameter ciphertext, the second file key derivation parameter ciphertext, the file ID and the attribute information of the to-be-transmitted file to the domain server for storage through the user sending end, and the domain server re-encrypts the second file key derivation parameter ciphertext based on the first protection key to obtain the third file key derivation parameter ciphertext; send the first file key derivation parameter ciphertext, the third file key derivation parameter ciphertext, the file ID and the attribute information of the to-be-transmitted file to the center server through the domain server, so that the center server saves the third file key derivation parameter ciphertext and the file ID, and distributes the first file key derivation parameter ciphertext, the file ID and the attribute information of the to-be-transmitted file to each domain server to obtain a target information package containing the first file key derivation parameter ciphertext, the file ID and the attribute information of the to-be-transmitted file.

[0094] In some specific embodiments, the transmission file judgment module 12 can be specifically configured to, if the to-be-transmitted file is not the first transmission, and the user locally exists the file key corresponding to the to-be-transmitted file, directly acquire the file ID, the initial file key derivation parameter ciphertext and the attribute information of the to-be-transmitted file corresponding to the to-be-transmitted file from the local; perform re-encryption protection on the file key derivation parameter corresponding to the initial file key derivation parameter ciphertext by using a new group key to determine a new file key derivation parameter ciphertext, so as to obtain a target information package containing the new file key derivation parameter ciphertext, the file ID and the attribute information of the to-be-transmitted file.

[0095] In some specific embodiments, the transmission file judgment module 12 can be specifically configured to, if the to-be-transmitted file is not the first transmission, and the user locally exists the file key corresponding to the to-be-transmitted file, directly acquire the file ID, the initial file key derivation parameter ciphertext and the attribute information of the to-be-transmitted file corresponding to the to-be-transmitted file from the local; perform re-encryption protection on the file key derivation parameter corresponding to the initial file key derivation parameter ciphertext by using a new group key to determine a new file key derivation parameter ciphertext, so as to obtain a target information package containing the new file key derivation parameter ciphertext, the file ID and the attribute information of the to-be-transmitted file.

[0096] In some specific embodiments, the device can also be configured to, if the user group exists, directly distribute the group key to the user terminal.

[0097] In some specific embodiments, the transmission file obtaining module 13 can be specifically configured to forward the target file information to the center server through the domain server, so that the center server distributes the target file information to each domain server, and each domain server distributes the target file information to each user receiving end.

[0098] In some specific embodiments, the transmission file obtaining module 13 can be specifically configured to distribute the target information package to each user receiving end through the domain server and the center server, so that the user receiving end decrypts the target information package according to the group key to obtain a decrypted file ID; and based on the file ID, the user receiving end pulls the file ciphertext corresponding to the to-be-transmitted file from the domain server or the center server, and decrypts the file ciphertext according to the decrypted file ID to obtain the to-be-transmitted file and determine whether the to-be-transmitted file is tampered with.

[0099] Further, the embodiment of the present application further discloses an electronic device, Figure 7 is an electronic device 20 structure diagram shown according to an exemplary embodiment, the contents in the figure cannot be considered as any limitation on the use range of the present application.

[0100] Figure 7 A structure diagram of an electronic device 20 provided by the embodiment of the present application is provided. The electronic device 20 can specifically include at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25 and a communication bus 26. Wherein, the memory 22 is used for storing a computer program, the computer program is loaded and executed by the processor 21, to realize the related steps in the support cross-domain file encryption transmission method disclosed in any of the preceding embodiments. In addition, the electronic device 20 in the embodiment of the present application can be an electronic computer.

[0101] In the embodiment, the power supply 23 is used for providing working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol followed by the communication interface 24 can be any communication protocol applicable to the technical solution of the present application, which is not limited here; the input / output interface 25 is used for obtaining external input data or outputting data to the outside, and the specific interface type can be selected according to the specific application needs, which is not limited here.

[0102] In addition, the memory 22 as the carrier of resource storage can be a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., and the resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage mode can be temporary storage or permanent storage.

[0103] The operating system 221 is configured to manage and control the various hardware devices and computer programs 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. The computer programs 222 can further include computer programs capable of performing other specific tasks in addition to the computer programs capable of performing the cross-domain supported file encryption transmission method disclosed by the electronic device 20 in any of the foregoing embodiments.

[0104] Further, the present application also discloses a computer readable storage medium for storing a computer program; wherein the computer program is executed by a processor to implement the cross-domain supported file encryption transmission method disclosed above. The specific steps of the method can refer to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

[0105] The embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts of each embodiment can be referred to each other. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the relevant parts can refer to the method part.

[0106] The skilled person can further realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of both. In order to clearly show the interchangeability of hardware and software, the components and steps of the examples have been described in the above description. Whether the functions are realized by hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0107] The steps of the method or algorithm described in combination with the embodiments disclosed herein can be directly implemented by hardware, software modules executed by a processor, or a combination of both. The software modules can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the art.

[0108] Finally, it needs to be pointed out that in this document, relational terms such as first and second and the like can only be intended to distinguish one entity or operation from another entity or operation without necessarily requiring or implying any actual such relationship or order between such entities or operations. Moreover, the terms "comprising", "including", or any other variant thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without more limitations, an element defined by the statement "comprising a" does not exclude the existence of additional identical elements in the process, method, article, or apparatus including the stated element.

[0109] The above detailed description of the technical solutions provided by the present application has been provided, and the principles and implementation manners of the present application have been described by applying specific examples. The above description of the examples is only for the purpose of helping to understand the method of the present application and its core idea; at the same time, for those skilled in the art, according to the idea of the present application, the specific implementation manner and application range will be changed, and the above description of the content of the specification should not be understood as a limitation of the present application.

Claims

1. A method for supporting cross-domain file encryption transmission, characterized in that, Comprise: After the domain server and the user are registered successfully respectively, it is judged whether the user group created exists in the center server, if not, the user group is created and the group key is generated, and the group key is sent to the user terminal based on the user group; The user terminal includes a user sending end and a user receiving end; Through the user sending end, it is judged whether the file to be transmitted is the first transmission based on the file Hash corresponding to the file to be transmitted, and the file to be transmitted and the file key corresponding to the file to be transmitted are encrypted and processed according to the corresponding judgment result, the file Hash, the random number and the group key, to obtain the target information package; Wherein, the target information package includes one or several combinations of file ID, file key derivative parameter ciphertext and attribute information of the file to be transmitted corresponding to the file to be transmitted; Through the domain server and the center server, the target information package is distributed to each user receiving end, so that the user receiving end decrypts the target information package based on the group key to obtain the decrypted file ID, and obtains the file to be transmitted based on the decrypted file ID.

2. The method for supporting cross-domain encrypted file transfer of claim 1, wherein, Before the domain server and the user are registered successfully respectively, it is judged whether the user group created exists in the center server, it further comprises: The domain server is registered to the center server, and the first protection key generated by the center server is encrypted by the domain server protection key, and the encrypted first protection key is sent to each domain server; The user is registered to the domain server to which the user belongs, and the second protection key generated by the domain server is encrypted by the user protection key, and the encrypted second protection key is sent to each user terminal.

3. The method for supporting cross-domain file encryption transmission according to claim 2, characterized in that, If the user group does not exist, the user group is created and the group key is generated through the center server; After the group key is encrypted and protected based on the first protection key, it is distributed to the domain server, so that the domain server decrypts and encrypts the group key based on the first protection key and the second protection key to obtain the encrypted group key, and sends the encrypted group key to the user terminal based on the user group. If the file to be transmitted is the first transmission, the random number and the file Hash are derived through the key derivation algorithm to generate the file key corresponding to the file to be transmitted; 4. The method for supporting cross-domain file encryption transmission according to claim 2, wherein, ​ ​ The user sending terminal encrypts the to-be-transmitted file based on the file key to obtain corresponding file ciphertext; The user sending terminal uploads the file ciphertext to the domain server, so that the domain server forwards the file ciphertext to the center server, and the center server generates a file ID corresponding to the to-be-transmitted file, and returns the file ID to the user sending terminal; The file key is encrypted by the group key and the second protection key respectively to obtain first file key derivation parameter ciphertext and second file key derivation parameter ciphertext; The user sending terminal sends the file ciphertext, the first file key derivation parameter ciphertext, the second file key derivation parameter ciphertext, the file ID, and attribute information of the to-be-transmitted file to the domain server for storage, and the domain server re-encrypts the second file key derivation parameter ciphertext based on the first protection key to obtain third file key derivation parameter ciphertext; The domain server sends the first file key derivation parameter ciphertext, the third file key derivation parameter ciphertext, the file ID, and the attribute information of the to-be-transmitted file to the center server, so that the center server saves the third file key derivation parameter ciphertext and the file ID, and distributes the first file key derivation parameter ciphertext, the file ID, and the attribute information of the to-be-transmitted file to each domain server to obtain a target information package containing the first file key derivation parameter ciphertext, the file ID, and the attribute information of the to-be-transmitted file.

5. The method for supporting cross-domain file encryption transmission according to claim 1, wherein, The user sending terminal judges whether the to-be-transmitted file is first transmitted based on a file Hash corresponding to the to-be-transmitted file, and according to the corresponding judgment result, the file Hash, a random number, and the group key, the to-be-transmitted file and the file key corresponding to the to-be-transmitted file are encrypted and processed to obtain a target information package, including: If the to-be-transmitted file is not first transmitted, and the user locally exists the file key corresponding to the to-be-transmitted file, the file ID, the initial file key derivation parameter ciphertext, and the attribute information of the to-be-transmitted file corresponding to the to-be-transmitted file are directly obtained from the local; The initial file key derivation parameter ciphertext corresponding to the file key derivation parameter is re-encrypted and protected by a new group key to determine new file key derivation parameter ciphertext to obtain a target information package containing new file key derivation parameter ciphertext, the file ID, and the attribute information of the to-be-transmitted file.

6. The method for supporting cross-domain file encryption transmission according to claim 2, wherein, The user sending terminal judges whether the to-be-transmitted file is first transmitted based on a file Hash corresponding to the to-be-transmitted file, and according to the corresponding judgment result, the file Hash, a random number, and the group key, the to-be-transmitted file and the file key corresponding to the to-be-transmitted file are encrypted and processed to obtain a target information package, including: If the to-be-transmitted file is not the first transmission, and the file key corresponding to the to-be-transmitted file does not exist in the user terminal, and the file key exists in the domain server, the domain server sends the file ID, the file key derivation parameter ciphertext and the attribute information of the to-be-transmitted file encrypted by the second protection key to the user terminal based on the file information acquisition request; If the to-be-transmitted file is not the first transmission, and the file key corresponding to the to-be-transmitted file does not exist in the user terminal, and the file key does not exist in the domain server, the domain server forwards the file information acquisition request to the center server, so that the center server re-encrypts the file ID, the initial file key derivation parameter ciphertext and the attribute information of the to-be-transmitted file based on the first protection key to generate a fourth file key derivation parameter ciphertext, and distributes the file ID, the initial file key derivation parameter ciphertext, the attribute information of the to-be-transmitted file and the fourth file key derivation parameter ciphertext to the domain server; The domain server sends the fourth file key derivation parameter ciphertext after re-encryption to the user terminal based on the second protection key; The user terminal re-encrypts the file key derivation parameter ciphertext based on the data protection key DPK after receiving the response information of the server to obtain local key ciphertext, and locally stores the local key ciphertext, the file ID and the attribute information of the to-be-transmitted file; The user terminal re-encrypts the file key derivation parameter ciphertext based on the group key after receiving the response information of the server to obtain new file key derivation parameter ciphertext, and determines target information based on the new file key derivation parameter ciphertext, the file ID and the attribute information of the to-be-transmitted file.

7. The method for supporting cross-domain file encryption transmission according to claim 1, wherein, After determining whether the user group has been created in the center server, the method further comprises: If the user group exists, the group key is directly distributed to the user terminal.

8. The method for supporting cross-domain encrypted file transfer of claim 1, wherein, The method of distributing the target information package to each user receiving end by the domain server and the center server comprises: The domain server forwards the target file information to the center server, so that the center server distributes the target file information to each domain server, and each domain server distributes the target file information to each user receiving end.

9. The method for supporting cross-domain file encryption transmission according to any one of claims 1 to 8, characterized in that, The method of distributing the target information package to each user receiving end by the domain server and the center server, so that the user receiving end decrypts the target information package based on the group key to obtain a decrypted file ID, and acquires the to-be-transmitted file based on the decrypted file ID, comprises: The domain server and the center server distribute the target information package to each user receiving end, so that the user receiving end decrypts the target information package based on the group key to obtain a decrypted file ID; The domain server and the center server distribute the target information package to each user receiving end, so that the user receiving end decrypts the target information package based on the group key to obtain a decrypted file ID; Pull the file ciphertext corresponding to the to-be-transmitted file from the domain server or the center server based on the file ID, and decrypt the file ciphertext according to the decrypted file ID to obtain the to-be-transmitted file and determine whether the to-be-transmitted file is tampered.

10. A file encryption transmission device supporting cross-domain transmission, characterized in that, Comprise: A group judgment module is used for judging whether there is an already created user group in the center server after the domain server and the user are respectively registered successfully, creating the user group and generating a group key if there is not, and issuing the group key to the user terminal based on the user group; the user terminal comprises a user sending end and a user receiving end; A transmission file judgment module is used for judging whether the to-be-transmitted file is transmitted for the first time based on the file Hash corresponding to the to-be-transmitted file through the user sending end, and performing corresponding encryption and processing on the to-be-transmitted file and the file key corresponding to the to-be-transmitted file according to the corresponding judgment result, the file Hash, a random number and the group key to obtain a target information package; wherein the target information package comprises a combination of one or several of the file ID corresponding to the to-be-transmitted file, file key derivative parameter ciphertext and attribute information of the to-be-transmitted file; A transmission file acquisition module is used for distributing the target information package to each user receiving end through the domain server and the center server, so that the user receiving end decrypts the target information package according to the group key to obtain a decrypted file ID, and acquires the to-be-transmitted file based on the decrypted file ID.

11. An electronic device, comprising: Comprise: A memory is used for saving a computer program; A processor is used for executing the computer program to realize the file encryption transmission method supporting cross-domain as claimed in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, A memory is used for saving a computer program; the computer program is executed by a processor to realize the file encryption transmission method supporting cross-domain as claimed in any one of claims 1 to 9.

Images