A method and system for off-line timed automatic decryption of encrypted files

Abstract

The present invention provides a method and system for automatic offline decryption of encrypted files in the field of offline decryption technology. The method includes: step S10, the client obtains the encrypted file, records the first system time of obtaining the encrypted file, and starts the counter for counting; step S20, the client parses the encrypted file to obtain the encrypted data, the counting threshold, the decryption time, the device serial number, and the first HMAC value, and after verification by the first HMAC value and the device serial number, the encrypted data is stored in the hardware encryption chip, and the counting threshold and the decryption time are stored in the designated path; step S30, the client automatically reads the counting threshold and the decryption time from the designated path through the first script, obtains the current second system time, and the counting result of the counter to perform time verification; step S40, the client automatically decrypts the encrypted data through the second script to obtain the electronic file. The advantages of the present invention are: greatly improving the security and convenience of offline decryption of encrypted files.

Description

Technical Field

[0001] The present invention relates to the technical field of off-line decryption, and in particular to a method and system for off-line timing automatic decryption of encrypted files. Background Art

[0002] With the advent of the information age, a large number of electronic files have been generated. In order to share these electronic files, they need to be sent over the Internet. In order to prevent these electronic files from being stolen and tampered with in plain text during transmission, the electronic files need to be encrypted into encrypted files before transmission.

[0003] In some scenarios, it is necessary to issue encrypted files in advance and decrypt them at a specified time to ensure that everyone obtains the decrypted electronic files at the same time. For example, to organize an exam, the encrypted files obtained by encrypting the test papers need to be stored in the corresponding exam terminals, and the exam terminals can only decrypt the encrypted files at a specified time to ensure the fairness of the exam. For another example, to organize a multi-venue bidding based on the same bidding documents, the encrypted files encrypted based on the bidding documents also need to be decrypted synchronously at a specified time.

[0004] In order to ensure the security of encrypted files, the encrypted files sent by the server are generally transferred to an offline confidential machine (client) through a storage medium. Since the confidential machine is not connected to the Internet, it cannot be decrypted online through the server. When the specified time arrives, it is necessary to import the key sent in advance by the server through the storage medium, and use the key for time verification and decryption. This has the following disadvantages:

[0005] 1. It is impossible to automatically decrypt offline encrypted files, and the key needs to be manually imported through the storage medium for decryption, which is very inconvenient; 2. When the system time of the confidential machine is modified, there is a security risk that the encrypted file will be decrypted in advance; 3. Electronic files are encrypted using only a single encryption algorithm, which makes the security level of the encrypted files poor; 4. It is impossible to verify the decrypted electronic files, and it is impossible to limit the encrypted files to be decrypted only on specific clients.

[0006] Therefore, how to provide a method and system for offline scheduled automatic decryption of encrypted files to improve the security and convenience of offline decryption of encrypted files has become a technical problem that needs to be solved urgently. Summary of the invention

[0007] The technical problem to be solved by the present invention is to provide a method and system for offline scheduled automatic decryption of encrypted files, so as to improve the security and convenience of offline decryption of encrypted files.

[0008] In a first aspect, the present invention provides a method for offline timing automatic decryption of encrypted files, comprising the following steps:

[0009] Step S10: The client obtains an encrypted file, records the first system time when the encrypted file is obtained through a hardware encryption chip, and starts a counter to count;

[0010] Step S20: The client parses the encrypted file to obtain the encrypted data, the counting threshold, the decryption time, the device serial number and the first HMAC value, performs an integrity check through the first HMAC value, performs a legitimacy check through the device serial number, and then stores the encrypted data in the hardware encryption chip, and stores the counting threshold and the decryption time in the specified path;

[0011] Step S30: The client automatically reads the counting threshold and the decryption time from the specified path through a preset first script, obtains the current second system time and the counting result of the counter, and performs time verification based on the second system time, the counting result, the counting threshold and the decryption time;

[0012] Step S40: The client uses a preset second script to automatically decrypt the encrypted data using a hardware encryption chip to obtain an electronic file, and performs integrity verification on the electronic file;

[0013] Step S50: The client records the decryption log in real time, encrypts the decryption log into an encrypted log, and stores and backs up the encrypted log;

[0014] In step S10, the encrypted file is generated as follows:

[0015] Obtain the electronic file to be encrypted and the device serial number of the client to be sent, set a counting threshold and a decryption time, and create a public key and a private key through the ECDSA algorithm;

[0016] Performing HMAC calculation on the electronic file to obtain a second HMAC value, encrypting the electronic file and the second HMAC value by using the private key to obtain primary encrypted data, controlling each character of the primary encrypted data to shift rightward by a preset first shift amount to obtain secondary encrypted data, encrypting the secondary encrypted data by using the IDEA algorithm to obtain third-level encrypted data, mapping each character of the third-level encrypted data by using a preset mapping rule to obtain fourth-level encrypted data, swapping the number 0 and the letter O in the fourth-level encrypted data to obtain fifth-level encrypted data, and encrypting the fifth-level encrypted data by using the ChaCha20 algorithm to obtain sixth-level encrypted data;

[0017] The public key is encrypted by the AES-GCM algorithm to obtain a primary key, each character of the primary key is controlled to shift leftward by a preset second shift amount to obtain a secondary key, and the secondary key is encrypted by the 3DES algorithm to obtain a tertiary key;

[0018] Encapsulating the six-level encrypted data and the three-level key by using the AES-KW algorithm to obtain encrypted data;

[0019] Performing HMAC calculation on the encrypted data, the counting threshold, the decryption time, and the device serial number to obtain a first HMAC value, and generating an encrypted file based on the encrypted data, the counting threshold, the decryption time, the device serial number, and the first HMAC value;

[0020] The specific steps of starting a counter to count are as follows:

[0021] Start a counter and let the counter count based on a preset counting rule;

[0022] The counting rule is specifically: y=ax^bc;

[0023] Where y represents the counting result; x represents the counting factor calculated in minutes; a, b, and c all represent the counting adjustment coefficients.

[0024] Furthermore, the step S20 is specifically as follows:

[0025] The client parses the encrypted file in real time to obtain the encrypted data, the counting threshold, the decryption time, the device serial number and the first HMAC value, performs integrity verification on the encrypted data, the counting threshold, the decryption time and the device serial number through the first HMAC value, performs legitimacy verification on the parsed device serial number through the device serial number of the local machine, and then stores the encrypted data in real time to the hardware encryption chip, and stores the counting threshold and the decryption time in real time to the specified path.

[0026] Furthermore, the step S30 specifically includes:

[0027] Step S31, the client automatically reads the counting threshold and the decryption time from the specified path through a preset first script, obtains the current second system time and the counting result of the counter, and determines whether the second system time is greater than the decryption time. If not, continue monitoring; if yes, proceed to step S32;

[0028] Step S32: based on the counting result, verify the time difference between the second system time and the first system time, and determine whether the time difference is less than a preset time difference threshold. If not, reset the system time, obtain the latest second system time, and proceed to step S31; if yes, proceed to step S33;

[0029] Step S33, determine whether the counting result reaches the counting threshold, if not, control the counter to continue counting; if yes, enter step S40.

[0030] Furthermore, the step S40 is specifically as follows:

[0031] The client automatically calls the hardware encryption chip through the preset second script, and decapsulates the encrypted data through the AES-KW algorithm to obtain the six-level encrypted data and the three-level key;

[0032] Decrypting the level 6 encrypted data by using the ChaCha20 algorithm to obtain level 5 encrypted data, swapping the number 0 and the letter O in the level 5 encrypted data to obtain level 4 encrypted data, mapping each character of the level 4 encrypted data by using a preset mapping rule to obtain level 3 encrypted data, decrypting the level 3 encrypted data by using the IDEA algorithm to obtain level 2 encrypted data, and controlling each character of the level 2 encrypted data to shift to the left by using a preset first shift amount to obtain level 1 encrypted data;

[0033] The third-level key is decrypted by the 3DES algorithm to obtain a second-level key, each character of the second-level key is controlled to shift rightward by a preset second shift amount to obtain a first-level key, and the first-level key is decrypted by the AES-GCM algorithm to obtain a public key;

[0034] The first-level encrypted data is decrypted by the public key to obtain an electronic file and a second HMAC value, and the integrity of the electronic file is checked by the second HMAC value to complete the decryption of the encrypted data.

[0035] Furthermore, the step S50 is specifically as follows:

[0036] The client real-time record includes at least the counting threshold, decryption time, counting result and decryption log of the access record;

[0037] The client encrypts the decrypted log into first encrypted data by using the SM4 algorithm, divides the first encrypted data into a first data block, a second data block, and a third data block, encrypts the first data block by using the ChaCha20 algorithm to obtain a first encrypted data block, encrypts the second data block by using the IDEA algorithm to obtain a second encrypted data block, encrypts the third data block by using the 3DES algorithm to obtain a third encrypted data block, and encrypts the first encrypted data block, the second encrypted data block, and the third encrypted data block into an encrypted log by using the AES256 algorithm;

[0038] The client stores the encrypted log in a designated storage space and performs distributed backup of the encrypted log.

[0039] In a second aspect, the present invention provides an encrypted file offline timed automatic decryption system, comprising the following modules:

[0040] An initialization module is used for the client to obtain an encrypted file, record the first system time of obtaining the encrypted file through a hardware encryption chip, and start a counter to count;

[0041] An encrypted file parsing and verification module is used for the client to parse the encrypted file to obtain encrypted data, counting threshold, decryption time, device serial number and first HMAC value, perform integrity verification through the first HMAC value, perform legitimacy verification through the device serial number, and then store the encrypted data in the hardware encryption chip, and store the counting threshold and decryption time in a specified path;

[0042] A time verification module, used for the client to automatically read the counting threshold and the decryption time from the specified path through a preset first script, obtain the current second system time and the counting result of the counter, and perform time verification based on the second system time, the counting result, the counting threshold and the decryption time;

[0043] The automatic decryption module is used for the client to automatically decrypt the encrypted data to obtain the electronic file by using the hardware encryption chip through a preset second script, and to perform integrity verification on the electronic file;

[0044] The decryption log management module is used for the client to record the decryption log in real time, encrypt the decryption log into an encrypted log, and store and back up the encrypted log;

[0045] In the initialization module, the generation process of the encrypted file is as follows:

[0046] Obtain the electronic file to be encrypted and the device serial number of the client to be sent, set a counting threshold and a decryption time, and create a public key and a private key through the ECDSA algorithm;

[0047] Performing HMAC calculation on the electronic file to obtain a second HMAC value, encrypting the electronic file and the second HMAC value by using the private key to obtain primary encrypted data, controlling each character of the primary encrypted data to shift rightward by a preset first shift amount to obtain secondary encrypted data, encrypting the secondary encrypted data by using the IDEA algorithm to obtain third-level encrypted data, mapping each character of the third-level encrypted data by using a preset mapping rule to obtain fourth-level encrypted data, swapping the number 0 and the letter O in the fourth-level encrypted data to obtain fifth-level encrypted data, and encrypting the fifth-level encrypted data by using the ChaCha20 algorithm to obtain sixth-level encrypted data;

[0048] The public key is encrypted by the AES-GCM algorithm to obtain a primary key, each character of the primary key is controlled to shift leftward by a preset second shift amount to obtain a secondary key, and the secondary key is encrypted by the 3DES algorithm to obtain a tertiary key;

[0049] Encapsulating the six-level encrypted data and the three-level key by using the AES-KW algorithm to obtain encrypted data;

[0050] Performing HMAC calculation on the encrypted data, the counting threshold, the decryption time, and the device serial number to obtain a first HMAC value, and generating an encrypted file based on the encrypted data, the counting threshold, the decryption time, the device serial number, and the first HMAC value;

[0051] The specific steps of starting a counter to count are as follows:

[0052] Start a counter and let the counter count based on a preset counting rule;

[0053] The counting rule is specifically: y=ax^bc;

[0054] Where y represents the counting result; x represents the counting factor calculated in minutes; a, b, and c all represent the counting adjustment coefficients.

[0055] Furthermore, the encrypted file parsing and verification module is specifically used for:

[0056] The client parses the encrypted file in real time to obtain the encrypted data, the counting threshold, the decryption time, the device serial number and the first HMAC value, performs integrity verification on the encrypted data, the counting threshold, the decryption time and the device serial number through the first HMAC value, performs legitimacy verification on the parsed device serial number through the device serial number of the local machine, and then stores the encrypted data in real time to the hardware encryption chip, and stores the counting threshold and the decryption time in real time to the specified path.

[0057] Furthermore, the time verification module specifically includes:

[0058] A decryption time verification unit, used for the client to automatically read the counting threshold and the decryption time from the specified path through a preset first script, obtain the current second system time and the counting result of the counter, and determine whether the second system time is greater than the decryption time. If not, continue monitoring; if yes, enter the time difference verification unit;

[0059] A time difference verification unit, used to verify the time difference between the second system time and the first system time based on the counting result, and determine whether the time difference is less than a preset time difference threshold. If not, reset the system time, obtain the latest second system time, and enter the decryption time verification unit; if yes, enter the counting result verification unit;

[0060] The counting result verification unit is used to determine whether the counting result reaches the counting threshold. If not, the counter is controlled to continue counting; if so, the automatic decryption module is entered.

[0061] Furthermore, the automatic decryption module is specifically used for:

[0062] The client automatically calls the hardware encryption chip through the preset second script, and decapsulates the encrypted data through the AES-KW algorithm to obtain the six-level encrypted data and the three-level key;

[0063] Decrypting the level 6 encrypted data by using the ChaCha20 algorithm to obtain level 5 encrypted data, swapping the number 0 and the letter O in the level 5 encrypted data to obtain level 4 encrypted data, mapping each character of the level 4 encrypted data by using a preset mapping rule to obtain level 3 encrypted data, decrypting the level 3 encrypted data by using the IDEA algorithm to obtain level 2 encrypted data, and controlling each character of the level 2 encrypted data to shift to the left by using a preset first shift amount to obtain level 1 encrypted data;

[0064] The third-level key is decrypted by the 3DES algorithm to obtain a second-level key, each character of the second-level key is controlled to shift rightward by a preset second shift amount to obtain a first-level key, and the first-level key is decrypted by the AES-GCM algorithm to obtain a public key;

[0065] The first-level encrypted data is decrypted by the public key to obtain an electronic file and a second HMAC value, and the integrity of the electronic file is checked by the second HMAC value to complete the decryption of the encrypted data.

[0066] Furthermore, the decryption log management module is specifically used for:

[0067] The client real-time record includes at least the counting threshold, decryption time, counting result and decryption log of the access record;

[0068] The client encrypts the decrypted log into first encrypted data by using the SM4 algorithm, divides the first encrypted data into a first data block, a second data block, and a third data block, encrypts the first data block by using the ChaCha20 algorithm to obtain a first encrypted data block, encrypts the second data block by using the IDEA algorithm to obtain a second encrypted data block, encrypts the third data block by using the 3DES algorithm to obtain a third encrypted data block, and encrypts the first encrypted data block, the second encrypted data block, and the third encrypted data block into an encrypted log by using the AES256 algorithm;

[0069] The client stores the encrypted log in a designated storage space and performs distributed backup of the encrypted log.

[0070] The advantages of the present invention are:

[0071] 1. Obtain the encrypted file through the client, record the first system time obtained by the encrypted file through the hardware encryption chip, start a counter for counting, then parse the encrypted file to obtain the encrypted data, counting threshold, decryption time, device serial number and the first HMAC value, perform integrity verification through the first HMAC value, perform legitimacy verification through the device serial number, and then store the encrypted data in the hardware encryption chip, and store the counting threshold and decryption time in the specified path; then the client automatically reads the counting threshold and decryption time from the specified path through the first script, obtains the current second system time and the counting result of the counter, performs time verification based on the second system time, counting result, counting threshold and decryption time, and uses the second script to automatically decrypt the encrypted data using the hardware encryption chip to obtain the electronic file, and performs integrity verification on the electronic file, records the decryption log in real time and encrypts it into an encrypted log, and stores and backs up the encrypted log That is, the time is automatically verified through the first script, and the decryption is automatically performed through the second script, without the need to manually import the key for decryption through the storage medium as traditionally; the first system time obtained by recording the encrypted file, the counter is started to count, and then the second system time can be judged whether it is correct through the counting result of the first system time and the counter, that is, whether the system time has been modified, and the secondary verification of the counting result is combined with the counting threshold to avoid the encrypted data from being decrypted in advance; and the encrypted data is obtained by encrypting the electronic file based on multiple encryption algorithms, and the decryption operation is performed by the hardware encryption chip to further ensure the security of the decryption, the electronic file can be secondary The integrity check can be performed through the first HMAC value and the second HMAC value carried by the encrypted data, and the legitimacy of the client can be checked through the device serial number carried by the encrypted file to avoid decryption on an illegal client, which ultimately greatly improves the security and convenience of offline decryption of encrypted files.

[0072] 2. Create a pair of public and private keys through the ECDSA algorithm; perform HMAC calculation on the electronic file to obtain a second HMAC value, encrypt the electronic file and the second HMAC value through the private key to obtain the first-level encrypted data, control the characters of the first-level encrypted data to shift to the right through the preset first displacement to obtain the second-level encrypted data, encrypt the second-level encrypted data through the IDEA algorithm to obtain the third-level encrypted data, map the characters of the third-level encrypted data through the preset mapping rule to obtain the fourth-level encrypted data, swap the number 0 and the letter O in the fourth-level encrypted data to obtain the fifth-level encrypted data, encrypt the fifth-level encrypted data through the ChaCha20 algorithm to obtain the sixth-level encrypted data; encrypt the public key through the AES-GCM algorithm to obtain the first-level key, control the characters of the first-level key to shift to the left through the preset second displacement to obtain the second-level key, encrypt the second-level key through the 3DES algorithm to obtain the third-level key; encapsulate the sixth-level encrypted data and the third-level key through the AES-KW algorithm to obtain encrypted data; The first HMAC value is obtained by performing HMAC calculation based on the count threshold, decryption time and device serial number, and an encrypted file is generated based on the encrypted data, count threshold, decryption time, device serial number and the first HMAC value; since the data encrypted by the private key can only be decrypted by the public key, and the electronic file is encrypted multiple times, the public key is also decrypted multiple times, and finally encapsulated to form the encrypted data, HMAC calculation is a message authentication method based on the hash function and the key, which can be used to verify the integrity. Compared with the ordinary hash function, it has higher security. If the corresponding encryption algorithm or data transformation rule is not known, the encrypted file cannot be cracked. At least 14 security measures are taken before and after (ECDSA algorithm, second HMAC value, first displacement, first displacement direction, IDEA algorithm, mapping rule, character swap, ChaCha20 algorithm, AES-GCM algorithm, second displacement, second displacement direction, 3DES algorithm, AES-KW algorithm, first HMAC value), which greatly improves the security of electronic file transmission.

[0073] 3. By setting the counter to count based on the counting rule of y=ax^bc, y represents the counting result, x represents the counting factor calculated in minutes, and a, b, and c all represent the counting adjustment coefficients. Compared with the traditional cumulative counting with a gradient of 1, it has higher complexity, preventing the counting rules from being seen at a glance, thereby greatly improving the security of offline decryption of encrypted files.

[0074] 4. After the integrity of the encrypted data, counting threshold, decryption time and device serial number is verified through the first HMAC value, the legitimacy of the parsed device serial number is verified through the device serial number of the local machine, that is, the legitimacy is verified based on the device serial number that has not been tampered with, which effectively improves the reliability of the device serial number verification, thereby greatly improving the security of offline decryption of encrypted files.

[0075] 5. Real-time recording of at least counting threshold, decryption time, counting result and decryption log of access records facilitates later tracing.

[0076] 6. Encrypt the decrypted log into the first encrypted data through the SM4 algorithm, divide the first encrypted data into the first data block, the second data block and the third data block, encrypt the first data block through the ChaCha20 algorithm to obtain the first encrypted data block, encrypt the second data block through the IDEA algorithm to obtain the second encrypted data block, encrypt the third data block through the 3DES algorithm to obtain the third encrypted data block, encrypt the first encrypted data block, the second encrypted data block and the third encrypted data block into an encrypted log through the AES256 algorithm, store the encrypted log in the specified storage space, and perform distributed backup of the encrypted log; that is, perform multi-level encryption of the decrypted log in blocks. If you don’t know all the encryption algorithms, you will not be able to crack the encrypted log. At least 7 security measures (SM4 algorithm, data block, ChaCha20 algorithm, IDEA algorithm, 3DES algorithm, AES256 algorithm, distributed backup) taken before and after greatly improve the security of the storage and backup of the decrypted log.

[0077] 7. Security is further improved by adopting different encryption schemes for electronic files and decryption logs. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] The present invention will be further described below in conjunction with embodiments with reference to the accompanying drawings.

[0079] Figure 1 The present invention discloses a flow chart of a method for automatically decrypting encrypted files offline at a scheduled time.

[0080] Figure 2 The present invention is a schematic diagram of the structure of an encrypted file offline timed automatic decryption system. DETAILED DESCRIPTION

[0081] The technical solution in the embodiment of the present application has the following overall idea: time verification is automatically performed through a first script, and decryption is automatically performed through a second script, without the need to manually import a key for decryption through a storage medium as traditionally; a first system time obtained by recording an encrypted file and starting a counter for counting can be used to determine whether the second system time is correct, that is, whether the system time has been modified, and a secondary verification of the counting result is performed in combination with a counting threshold to prevent the encrypted data from being decrypted in advance; and the encrypted data is obtained by encrypting an electronic file based on multiple encryption algorithms, and the security of the decryption is further guaranteed by performing a decryption operation through a hardware encryption chip, a secondary integrity check of the electronic file can be performed through the first HMAC value and the second HMAC value carried by the encrypted data, and the legitimacy of the client can be verified through the device serial number carried by the encrypted file to avoid decryption on an illegal client, so as to improve the security and convenience of offline decryption of encrypted files.

[0082] Please refer to Figure 1 to Figure 2 As shown, a preferred embodiment of a method for offline timing automatic decryption of encrypted files of the present invention comprises the following steps:

[0083] Step S10: The client obtains an encrypted file, records the first system time when the encrypted file is obtained through a hardware encryption chip, and starts a counter to count;

[0084] Step S20: The client parses the encrypted file to obtain the encrypted data, the counting threshold, the decryption time, the device serial number and the first HMAC value, performs an integrity check through the first HMAC value, performs a legitimacy check through the device serial number, and then stores the encrypted data in the hardware encryption chip, and stores the counting threshold and the decryption time in the specified path;

[0085] Step S30: The client automatically reads the counting threshold and the decryption time from the specified path through a preset first script, obtains the current second system time and the counting result of the counter, and performs time verification based on the second system time, the counting result, the counting threshold and the decryption time;

[0086] Step S40: The client uses a preset second script to automatically decrypt the encrypted data using a hardware encryption chip to obtain an electronic file, and performs integrity verification on the electronic file;

[0087] Step S50: The client records the decryption log in real time, encrypts the decryption log into an encrypted log, and stores and backs up the encrypted log;

[0088] In step S10, the encrypted file is generated as follows:

[0089] Obtain the electronic file to be encrypted and the device serial number of the client to be sent, set a counting threshold and a decryption time, and create a public key and a private key through the ECDSA algorithm;

[0090] Performing HMAC calculation on the electronic file to obtain a second HMAC value, encrypting the electronic file and the second HMAC value by using the private key to obtain primary encrypted data, controlling each character of the primary encrypted data to shift rightward by a preset first shift amount to obtain secondary encrypted data, encrypting the secondary encrypted data by using the IDEA algorithm to obtain third-level encrypted data, mapping each character of the third-level encrypted data by using a preset mapping rule to obtain fourth-level encrypted data, swapping the number 0 and the letter O in the fourth-level encrypted data to obtain fifth-level encrypted data, and encrypting the fifth-level encrypted data by using the ChaCha20 algorithm to obtain sixth-level encrypted data;

[0091] The public key is encrypted by the AES-GCM algorithm to obtain a primary key, each character of the primary key is controlled to shift leftward by a preset second shift amount to obtain a secondary key, and the secondary key is encrypted by the 3DES algorithm to obtain a tertiary key;

[0092] Encapsulating the six-level encrypted data and the three-level key by using the AES-KW algorithm to obtain encrypted data;

[0093] Performing HMAC calculation on the encrypted data, the counting threshold, the decryption time, and the device serial number to obtain a first HMAC value, and generating an encrypted file based on the encrypted data, the counting threshold, the decryption time, the device serial number, and the first HMAC value;

[0094] A pair of public and private keys are created through the ECDSA algorithm; an HMAC calculation is performed on the electronic file to obtain a second HMAC value, the electronic file and the second HMAC value are encrypted through the private key to obtain the first-level encrypted data, each character of the first-level encrypted data is controlled to shift to the right through the preset first displacement to obtain the second-level encrypted data, the second-level encrypted data is encrypted through the IDEA algorithm to obtain the third-level encrypted data, each character of the third-level encrypted data is mapped through the preset mapping rule to obtain the fourth-level encrypted data, the number 0 and the letter O in the fourth-level encrypted data are swapped to obtain the fifth-level encrypted data, and the fifth-level encrypted data is encrypted through the ChaCha20 algorithm to obtain the sixth-level encrypted data; the public key is encrypted through the AES-GCM algorithm to obtain the first-level key, each character of the first-level key is controlled to shift to the left through the preset second displacement to obtain the second-level key, and the second-level key is encrypted through the 3DES algorithm to obtain the third-level key; the sixth-level encrypted data and the third-level key are encapsulated through the AES-KW algorithm to obtain the encrypted data; the encrypted data and the count The first HMAC value is obtained by HMAC calculation based on the encrypted data, counting threshold, decryption time, and device serial number, and an encrypted file is generated based on the encrypted data, counting threshold, decryption time, device serial number, and the first HMAC value; since the data encrypted by the private key can only be decrypted by the public key, and the electronic file is encrypted multiple times, the public key is also decrypted multiple times, and finally encapsulated to form the encrypted data, HMAC calculation is a message authentication method based on the hash function and the key, which can be used to verify the integrity. Compared with the ordinary hash function, it has higher security. If the corresponding encryption algorithm or data transformation rule is not known, the encrypted file cannot be cracked. At least 14 security measures are taken before and after (ECDSA algorithm, second HMAC value, first displacement, first displacement direction, IDEA algorithm, mapping rule, character swap, ChaCha20 algorithm, AES-GCM algorithm, second displacement, second displacement direction, 3DES algorithm, AES-KW algorithm, first HMAC value), which greatly improves the security of electronic file transmission.

[0095] The specific steps of starting a counter to count are as follows:

[0096] Start a counter and let the counter count based on a preset counting rule;

[0097] The counting rule is specifically: y=ax^bc;

[0098] Among them, y represents the counting result; x represents the counting factor calculated in minutes; a, b, and c all represent the counting adjustment coefficients. In specific implementation, the values ​​of a, b, and c can be selected as needed. For example, when a=2, b=3, and c=1 are set, the counting result of the first minute is 1, and the counting result of the second minute is 15;

[0099] By setting the counter to count based on the counting rule of y=ax^bc, y represents the counting result, x represents the counting factor calculated in minutes, and a, b, and c all represent the counting adjustment coefficients. Compared with the traditional cumulative counting with a gradient of 1, it has higher complexity, preventing the counting pattern from being seen at a glance, thereby greatly improving the security of offline decryption of encrypted files.

[0100] The step S20 is specifically as follows:

[0101] The client parses the encrypted file in real time to obtain the encrypted data, the counting threshold, the decryption time, the device serial number and the first HMAC value, performs integrity verification on the encrypted data, the counting threshold, the decryption time and the device serial number through the first HMAC value, performs legitimacy verification on the parsed device serial number through the device serial number of the local machine, and then stores the encrypted data in real time to the hardware encryption chip, and stores the counting threshold and the decryption time in real time to the specified path.

[0102] After the integrity of the encrypted data, counting threshold, decryption time and device serial number is verified through the first HMAC value, the legitimacy of the parsed device serial number is verified through the local device serial number, that is, the legitimacy is verified based on the device serial number that has not been tampered with, which effectively improves the reliability of the device serial number verification, thereby greatly improving the security of offline decryption of encrypted files.

[0103] The step S30 specifically includes:

[0104] Step S31, the client automatically reads the counting threshold and the decryption time from the specified path through a preset first script, obtains the current second system time and the counting result of the counter, and determines whether the second system time is greater than the decryption time. If not, continue monitoring; if yes, proceed to step S32;

[0105] Step S32: based on the counting result, verify the time difference between the second system time and the first system time, and determine whether the time difference is less than a preset time difference threshold; if not, reset the system time, obtain the latest second system time, and proceed to step S31; if yes, proceed to step S33; since the counting result is obtained by calculating the counting time, the counting result can be converted into a duration and then the time difference is verified;

[0106] Step S33, determine whether the counting result reaches the counting threshold, if not, control the counter to continue counting; if yes, enter step S40.

[0107] That is, the decryption of the encrypted data is strictly controlled by the two parameters of the decryption time and the counting result.

[0108] The step S40 is specifically as follows:

[0109] The client automatically calls the hardware encryption chip through the preset second script, and decapsulates the encrypted data through the AES-KW algorithm to obtain the six-level encrypted data and the three-level key;

[0110] Decrypting the level 6 encrypted data by using the ChaCha20 algorithm to obtain level 5 encrypted data, swapping the number 0 and the letter O in the level 5 encrypted data to obtain level 4 encrypted data, mapping each character of the level 4 encrypted data by using a preset mapping rule to obtain level 3 encrypted data, decrypting the level 3 encrypted data by using the IDEA algorithm to obtain level 2 encrypted data, and controlling each character of the level 2 encrypted data to shift to the left by using a preset first shift amount to obtain level 1 encrypted data;

[0111] The third-level key is decrypted by the 3DES algorithm to obtain a second-level key, each character of the second-level key is controlled to shift rightward by a preset second shift amount to obtain a first-level key, and the first-level key is decrypted by the AES-GCM algorithm to obtain a public key;

[0112] The first-level encrypted data is decrypted by the public key to obtain an electronic file and a second HMAC value, and the integrity of the electronic file is checked by the second HMAC value to complete the decryption of the encrypted data.

[0113] The step S50 is specifically as follows:

[0114] The client's real-time records include at least the counting threshold, decryption time, counting results, and decryption logs of access records; by real-time records including at least the counting threshold, decryption time, counting results, and decryption logs of access records, it is convenient for later tracing.

[0115] The client encrypts the decrypted log into first encrypted data by using the SM4 algorithm, divides the first encrypted data into a first data block, a second data block, and a third data block, encrypts the first data block by using the ChaCha20 algorithm to obtain a first encrypted data block, encrypts the second data block by using the IDEA algorithm to obtain a second encrypted data block, encrypts the third data block by using the 3DES algorithm to obtain a third encrypted data block, and encrypts the first encrypted data block, the second encrypted data block, and the third encrypted data block into an encrypted log by using the AES256 algorithm;

[0116] The client stores the encrypted log in a designated storage space and performs distributed backup of the encrypted log.

[0117] The decrypted log is encrypted into the first encrypted data by the SM4 algorithm, the first encrypted data is equally divided into the first data block, the second data block and the third data block, the first data block is encrypted by the ChaCha20 algorithm to obtain the first encrypted data block, the second data block is encrypted by the IDEA algorithm to obtain the second encrypted data block, the third data block is encrypted by the 3DES algorithm to obtain the third encrypted data block, the first encrypted data block, the second encrypted data block and the third encrypted data block are encrypted into an encrypted log by the AES256 algorithm, the encrypted log is stored in the designated storage space, and the encrypted log is backed up in a distributed manner; that is, the decrypted log is encrypted in blocks at multiple levels. If all encryption algorithms are not known, the encrypted log cannot be cracked. At least 7 security measures (SM4 algorithm, data block, ChaCha20 algorithm, IDEA algorithm, 3DES algorithm, AES256 algorithm, distributed backup) are taken before and after, which greatly improves the security of the storage and backup of the decrypted log.

[0118] Security is further enhanced by adopting different encryption schemes for electronic documents and decryption logs.

[0119] The decryption process of the encrypted log is as follows: decrypting the encrypted log into a first encrypted data block, a second encrypted data block and a third encrypted data block by using the AES256 algorithm, decrypting the first encrypted data block by using the ChaCha20 algorithm to obtain a first data block, decrypting the second encrypted data block by using the IDEA algorithm to obtain a second data block, decrypting the third encrypted data block by using the 3DES algorithm to obtain a third data block, splicing the first data block, the second data block and the third data block to obtain the first encrypted data, and decrypting the first encrypted data into a decrypted log by using the SM4 algorithm.

[0120] A preferred embodiment of an encrypted file offline timed automatic decryption system of the present invention includes the following modules:

[0121] An initialization module is used for the client to obtain an encrypted file, record the first system time of obtaining the encrypted file through a hardware encryption chip, and start a counter to count;

[0122] An encrypted file parsing and verification module is used for the client to parse the encrypted file to obtain encrypted data, counting threshold, decryption time, device serial number and first HMAC value, perform integrity verification through the first HMAC value, perform legitimacy verification through the device serial number, and then store the encrypted data in the hardware encryption chip, and store the counting threshold and decryption time in a specified path;

[0123] A time verification module, used for the client to automatically read the counting threshold and the decryption time from the specified path through a preset first script, obtain the current second system time and the counting result of the counter, and perform time verification based on the second system time, the counting result, the counting threshold and the decryption time;

[0124] The automatic decryption module is used for the client to automatically decrypt the encrypted data to obtain the electronic file by using the hardware encryption chip through a preset second script, and to perform integrity verification on the electronic file;

[0125] The decryption log management module is used for the client to record the decryption log in real time, encrypt the decryption log into an encrypted log, and store and back up the encrypted log;

[0126] In the initialization module, the generation process of the encrypted file is as follows:

[0127] Obtain the electronic file to be encrypted and the device serial number of the client to be sent, set a counting threshold and a decryption time, and create a public key and a private key through the ECDSA algorithm;

[0128] Performing HMAC calculation on the electronic file to obtain a second HMAC value, encrypting the electronic file and the second HMAC value by using the private key to obtain primary encrypted data, controlling each character of the primary encrypted data to shift rightward by a preset first shift amount to obtain secondary encrypted data, encrypting the secondary encrypted data by using the IDEA algorithm to obtain third-level encrypted data, mapping each character of the third-level encrypted data by using a preset mapping rule to obtain fourth-level encrypted data, swapping the number 0 and the letter O in the fourth-level encrypted data to obtain fifth-level encrypted data, and encrypting the fifth-level encrypted data by using the ChaCha20 algorithm to obtain sixth-level encrypted data;

[0129] The public key is encrypted by the AES-GCM algorithm to obtain a primary key, each character of the primary key is controlled to shift leftward by a preset second shift amount to obtain a secondary key, and the secondary key is encrypted by the 3DES algorithm to obtain a tertiary key;

[0130] Encapsulating the six-level encrypted data and the three-level key by using the AES-KW algorithm to obtain encrypted data;

[0131] Performing HMAC calculation on the encrypted data, the counting threshold, the decryption time, and the device serial number to obtain a first HMAC value, and generating an encrypted file based on the encrypted data, the counting threshold, the decryption time, the device serial number, and the first HMAC value;

[0132] A pair of public and private keys are created through the ECDSA algorithm; an HMAC calculation is performed on the electronic file to obtain a second HMAC value, the electronic file and the second HMAC value are encrypted through the private key to obtain the first-level encrypted data, each character of the first-level encrypted data is controlled to shift to the right through the preset first displacement to obtain the second-level encrypted data, the second-level encrypted data is encrypted through the IDEA algorithm to obtain the third-level encrypted data, each character of the third-level encrypted data is mapped through the preset mapping rule to obtain the fourth-level encrypted data, the number 0 and the letter O in the fourth-level encrypted data are swapped to obtain the fifth-level encrypted data, and the fifth-level encrypted data is encrypted through the ChaCha20 algorithm to obtain the sixth-level encrypted data; the public key is encrypted through the AES-GCM algorithm to obtain the first-level key, each character of the first-level key is controlled to shift to the left through the preset second displacement to obtain the second-level key, and the second-level key is encrypted through the 3DES algorithm to obtain the third-level key; the sixth-level encrypted data and the third-level key are encapsulated through the AES-KW algorithm to obtain the encrypted data; the encrypted data and the count The first HMAC value is obtained by HMAC calculation based on the encrypted data, counting threshold, decryption time, and device serial number, and an encrypted file is generated based on the encrypted data, counting threshold, decryption time, device serial number, and the first HMAC value; since the data encrypted by the private key can only be decrypted by the public key, and the electronic file is encrypted multiple times, the public key is also decrypted multiple times, and finally encapsulated to form the encrypted data, HMAC calculation is a message authentication method based on the hash function and the key, which can be used to verify the integrity. Compared with the ordinary hash function, it has higher security. If the corresponding encryption algorithm or data transformation rule is not known, the encrypted file cannot be cracked. At least 14 security measures are taken before and after (ECDSA algorithm, second HMAC value, first displacement, first displacement direction, IDEA algorithm, mapping rule, character swap, ChaCha20 algorithm, AES-GCM algorithm, second displacement, second displacement direction, 3DES algorithm, AES-KW algorithm, first HMAC value), which greatly improves the security of electronic file transmission.

[0133] The specific steps of starting a counter to count are as follows:

[0134] Start a counter and let the counter count based on a preset counting rule;

[0135] The counting rule is specifically: y=ax^bc;

[0136] Among them, y represents the counting result; x represents the counting factor calculated in minutes; a, b, and c all represent the counting adjustment coefficients. In specific implementation, the values ​​of a, b, and c can be selected as needed. For example, when a=2, b=3, and c=1 are set, the counting result of the first minute is 1, and the counting result of the second minute is 15;

[0137] By setting the counter to count based on the counting rule of y=ax^bc, y represents the counting result, x represents the counting factor calculated in minutes, and a, b, and c all represent the counting adjustment coefficients. Compared with the traditional cumulative counting with a gradient of 1, it has higher complexity, preventing the counting pattern from being seen at a glance, thereby greatly improving the security of offline decryption of encrypted files.

[0138] The encrypted file parsing and verification module is specifically used for:

[0139] The client parses the encrypted file in real time to obtain the encrypted data, the counting threshold, the decryption time, the device serial number and the first HMAC value, performs integrity verification on the encrypted data, the counting threshold, the decryption time and the device serial number through the first HMAC value, performs legitimacy verification on the parsed device serial number through the device serial number of the local machine, and then stores the encrypted data in real time to the hardware encryption chip, and stores the counting threshold and the decryption time in real time to the specified path.

[0140] After the integrity of the encrypted data, counting threshold, decryption time and device serial number is verified through the first HMAC value, the legitimacy of the parsed device serial number is verified through the local device serial number, that is, the legitimacy is verified based on the device serial number that has not been tampered with, which effectively improves the reliability of the device serial number verification, thereby greatly improving the security of offline decryption of encrypted files.

[0141] The time verification module specifically includes:

[0142] A decryption time verification unit, used for the client to automatically read the counting threshold and the decryption time from the specified path through a preset first script, obtain the current second system time and the counting result of the counter, and determine whether the second system time is greater than the decryption time. If not, continue monitoring; if yes, enter the time difference verification unit;

[0143] A time difference verification unit, used to verify the time difference between the second system time and the first system time based on the counting result, and determine whether the time difference is less than a preset time difference threshold. If not, reset the system time, obtain the latest second system time, and enter the decryption time verification unit; if yes, enter the counting result verification unit; since the counting result is obtained by calculating the counting time, the counting result can be converted into a duration and then the time difference is verified;

[0144] The counting result verification unit is used to determine whether the counting result reaches the counting threshold. If not, the counter is controlled to continue counting; if so, the automatic decryption module is entered.

[0145] That is, the decryption of the encrypted data is strictly controlled by the two parameters of the decryption time and the counting result.

[0146] The automatic decryption module is specifically used for:

[0147] The client automatically calls the hardware encryption chip through the preset second script, and decapsulates the encrypted data through the AES-KW algorithm to obtain the six-level encrypted data and the three-level key;

[0148] Decrypting the level 6 encrypted data by using the ChaCha20 algorithm to obtain level 5 encrypted data, swapping the number 0 and the letter O in the level 5 encrypted data to obtain level 4 encrypted data, mapping each character of the level 4 encrypted data by using a preset mapping rule to obtain level 3 encrypted data, decrypting the level 3 encrypted data by using the IDEA algorithm to obtain level 2 encrypted data, and controlling each character of the level 2 encrypted data to shift to the left by using a preset first shift amount to obtain level 1 encrypted data;

[0149] The third-level key is decrypted by the 3DES algorithm to obtain a second-level key, each character of the second-level key is controlled to shift rightward by a preset second shift amount to obtain a first-level key, and the first-level key is decrypted by the AES-GCM algorithm to obtain a public key;

[0150] The first-level encrypted data is decrypted by the public key to obtain an electronic file and a second HMAC value, and the integrity of the electronic file is checked by the second HMAC value to complete the decryption of the encrypted data.

[0151] The decryption log management module is specifically used for:

[0152] The client's real-time records include at least the counting threshold, decryption time, counting results, and decryption logs of access records; by real-time records including at least the counting threshold, decryption time, counting results, and decryption logs of access records, it is convenient for later tracing.

[0153] The client encrypts the decrypted log into first encrypted data by using the SM4 algorithm, divides the first encrypted data into a first data block, a second data block, and a third data block, encrypts the first data block by using the ChaCha20 algorithm to obtain a first encrypted data block, encrypts the second data block by using the IDEA algorithm to obtain a second encrypted data block, encrypts the third data block by using the 3DES algorithm to obtain a third encrypted data block, and encrypts the first encrypted data block, the second encrypted data block, and the third encrypted data block into an encrypted log by using the AES256 algorithm;

[0154] The client stores the encrypted log in a designated storage space and performs distributed backup of the encrypted log.

[0155] The decrypted log is encrypted into the first encrypted data by the SM4 algorithm, the first encrypted data is equally divided into the first data block, the second data block and the third data block, the first data block is encrypted by the ChaCha20 algorithm to obtain the first encrypted data block, the second data block is encrypted by the IDEA algorithm to obtain the second encrypted data block, the third data block is encrypted by the 3DES algorithm to obtain the third encrypted data block, the first encrypted data block, the second encrypted data block and the third encrypted data block are encrypted into an encrypted log by the AES256 algorithm, the encrypted log is stored in the designated storage space, and the encrypted log is backed up in a distributed manner; that is, the decrypted log is encrypted in blocks at multiple levels. If all encryption algorithms are not known, the encrypted log cannot be cracked. At least 7 security measures (SM4 algorithm, data block, ChaCha20 algorithm, IDEA algorithm, 3DES algorithm, AES256 algorithm, distributed backup) are taken before and after, which greatly improves the security of the storage and backup of the decrypted log.

[0156] Security is further enhanced by adopting different encryption schemes for electronic documents and decryption logs.

[0157] The decryption process of the encrypted log is as follows: decrypting the encrypted log into a first encrypted data block, a second encrypted data block and a third encrypted data block by using the AES256 algorithm, decrypting the first encrypted data block by using the ChaCha20 algorithm to obtain a first data block, decrypting the second encrypted data block by using the IDEA algorithm to obtain a second data block, decrypting the third encrypted data block by using the 3DES algorithm to obtain a third data block, splicing the first data block, the second data block and the third data block to obtain the first encrypted data, and decrypting the first encrypted data into a decrypted log by using the SM4 algorithm.

[0158] In summary, the advantages of the present invention are:

[0159] 1. Obtain the encrypted file through the client, record the first system time obtained by the encrypted file through the hardware encryption chip, start a counter for counting, then parse the encrypted file to obtain the encrypted data, counting threshold, decryption time, device serial number and the first HMAC value, perform integrity verification through the first HMAC value, perform legitimacy verification through the device serial number, and then store the encrypted data in the hardware encryption chip, and store the counting threshold and decryption time in the specified path; then the client automatically reads the counting threshold and decryption time from the specified path through the first script, obtains the current second system time and the counting result of the counter, performs time verification based on the second system time, counting result, counting threshold and decryption time, and uses the second script to automatically decrypt the encrypted data using the hardware encryption chip to obtain the electronic file, and performs integrity verification on the electronic file, records the decryption log in real time and encrypts it into an encrypted log, and stores and backs up the encrypted log That is, the time is automatically verified through the first script, and the decryption is automatically performed through the second script, without the need to manually import the key for decryption through the storage medium as traditionally; the first system time obtained by recording the encrypted file, the counter is started to count, and then the second system time can be judged whether it is correct through the counting result of the first system time and the counter, that is, whether the system time has been modified, and the secondary verification of the counting result is combined with the counting threshold to avoid the encrypted data from being decrypted in advance; and the encrypted data is obtained by encrypting the electronic file based on multiple encryption algorithms, and the decryption operation is performed by the hardware encryption chip to further ensure the security of the decryption, the electronic file can be secondary The integrity check can be performed through the first HMAC value and the second HMAC value carried by the encrypted data, and the legitimacy of the client can be checked through the device serial number carried by the encrypted file to avoid decryption on an illegal client, which ultimately greatly improves the security and convenience of offline decryption of encrypted files.

[0160] 2. Create a pair of public and private keys through the ECDSA algorithm; perform HMAC calculation on the electronic file to obtain a second HMAC value, encrypt the electronic file and the second HMAC value through the private key to obtain the first-level encrypted data, control the characters of the first-level encrypted data to shift to the right through the preset first displacement to obtain the second-level encrypted data, encrypt the second-level encrypted data through the IDEA algorithm to obtain the third-level encrypted data, map the characters of the third-level encrypted data through the preset mapping rule to obtain the fourth-level encrypted data, swap the number 0 and the letter O in the fourth-level encrypted data to obtain the fifth-level encrypted data, encrypt the fifth-level encrypted data through the ChaCha20 algorithm to obtain the sixth-level encrypted data; encrypt the public key through the AES-GCM algorithm to obtain the first-level key, control the characters of the first-level key to shift to the left through the preset second displacement to obtain the second-level key, encrypt the second-level key through the 3DES algorithm to obtain the third-level key; encapsulate the sixth-level encrypted data and the third-level key through the AES-KW algorithm to obtain encrypted data; The first HMAC value is obtained by performing HMAC calculation based on the count threshold, decryption time and device serial number, and an encrypted file is generated based on the encrypted data, count threshold, decryption time, device serial number and the first HMAC value; since the data encrypted by the private key can only be decrypted by the public key, and the electronic file is encrypted multiple times, the public key is also decrypted multiple times, and finally encapsulated to form the encrypted data, HMAC calculation is a message authentication method based on the hash function and the key, which can be used to verify the integrity. Compared with the ordinary hash function, it has higher security. If the corresponding encryption algorithm or data transformation rule is not known, the encrypted file cannot be cracked. At least 14 security measures are taken before and after (ECDSA algorithm, second HMAC value, first displacement, first displacement direction, IDEA algorithm, mapping rule, character swap, ChaCha20 algorithm, AES-GCM algorithm, second displacement, second displacement direction, 3DES algorithm, AES-KW algorithm, first HMAC value), which greatly improves the security of electronic file transmission.

[0161] 3. By setting the counter to count based on the counting rule of y=ax^bc, y represents the counting result, x represents the counting factor calculated in minutes, and a, b, and c all represent the counting adjustment coefficients. Compared with the traditional cumulative counting with a gradient of 1, it has higher complexity, preventing the counting rules from being seen at a glance, thereby greatly improving the security of offline decryption of encrypted files.

[0162] 4. After the integrity of the encrypted data, counting threshold, decryption time and device serial number is verified through the first HMAC value, the legitimacy of the parsed device serial number is verified through the device serial number of the local machine, that is, the legitimacy is verified based on the device serial number that has not been tampered with, which effectively improves the reliability of the device serial number verification, thereby greatly improving the security of offline decryption of encrypted files.

[0163] 5. Real-time recording of at least counting threshold, decryption time, counting result and decryption log of access records facilitates later tracing.

[0164] 6. Encrypt the decrypted log into the first encrypted data through the SM4 algorithm, divide the first encrypted data into the first data block, the second data block and the third data block, encrypt the first data block through the ChaCha20 algorithm to obtain the first encrypted data block, encrypt the second data block through the IDEA algorithm to obtain the second encrypted data block, encrypt the third data block through the 3DES algorithm to obtain the third encrypted data block, encrypt the first encrypted data block, the second encrypted data block and the third encrypted data block into an encrypted log through the AES256 algorithm, store the encrypted log in the specified storage space, and perform distributed backup of the encrypted log; that is, perform multi-level encryption of the decrypted log in blocks. If you don’t know all the encryption algorithms, you will not be able to crack the encrypted log. At least 7 security measures (SM4 algorithm, data block, ChaCha20 algorithm, IDEA algorithm, 3DES algorithm, AES256 algorithm, distributed backup) taken before and after greatly improve the security of the storage and backup of the decrypted log.

[0165] 7. Security is further improved by adopting different encryption schemes for electronic files and decryption logs.

[0166] Although the specific implementation modes of the present invention are described above, those skilled in the art should understand that the specific implementation modes described are only illustrative and are not intended to limit the scope of the present invention. Equivalent modifications and changes made by those skilled in the art in accordance with the spirit of the present invention should be included in the scope of protection of the claims of the present invention.

Claims

1. A method for automatic offline decryption of encrypted files, characterized by: The steps include: Step S10: The client obtains an encrypted file, records the first system time when the encrypted file is obtained through a hardware encryption chip, and starts a counter to count; Step S20: The client parses the encrypted file to obtain the encrypted data, the counting threshold, the decryption time, the device serial number and the first HMAC value, performs an integrity check through the first HMAC value, performs a legitimacy check through the device serial number, and then stores the encrypted data in the hardware encryption chip, and stores the counting threshold and the decryption time in the specified path; Step S30: The client automatically reads the counting threshold and the decryption time from the specified path through a preset first script, obtains the current second system time and the counting result of the counter, and performs time verification based on the second system time, the counting result, the counting threshold and the decryption time; Step S40: The client uses a preset second script to automatically decrypt the encrypted data using a hardware encryption chip to obtain an electronic file, and performs integrity verification on the electronic file; Step S50: The client records the decryption log in real time, encrypts the decryption log into an encrypted log, and stores and backs up the encrypted log; In step S10, the encrypted file is generated as follows: Obtain the electronic file to be encrypted and the device serial number of the client to be sent, set a counting threshold and a decryption time, and create a public key and a private key through the ECDSA algorithm; Performing HMAC calculation on the electronic file to obtain a second HMAC value, encrypting the electronic file and the second HMAC value by using the private key to obtain primary encrypted data, controlling each character of the primary encrypted data to shift rightward by a preset first shift amount to obtain secondary encrypted data, encrypting the secondary encrypted data by using the IDEA algorithm to obtain third-level encrypted data, mapping each character of the third-level encrypted data by using a preset mapping rule to obtain fourth-level encrypted data, swapping the number 0 and the letter O in the fourth-level encrypted data to obtain fifth-level encrypted data, and encrypting the fifth-level encrypted data by using the ChaCha20 algorithm to obtain sixth-level encrypted data; The public key is encrypted by the AES-GCM algorithm to obtain a primary key, each character of the primary key is controlled to shift leftward by a preset second shift amount to obtain a secondary key, and the secondary key is encrypted by the 3DES algorithm to obtain a tertiary key; Encapsulating the six-level encrypted data and the three-level key by using the AES-KW algorithm to obtain encrypted data; Performing HMAC calculation on the encrypted data, the counting threshold, the decryption time, and the device serial number to obtain a first HMAC value, and generating an encrypted file based on the encrypted data, the counting threshold, the decryption time, the device serial number, and the first HMAC value; The specific steps of starting a counter to count are as follows: Start a counter and let the counter count based on a preset counting rule; The counting rule is specifically: y=ax^bc; Where y represents the counting result; x represents the counting factor calculated in minutes; a, b, and c all represent the counting adjustment coefficients; The step S30 specifically includes: Step S31, the client automatically reads the counting threshold and the decryption time from the specified path through a preset first script, obtains the current second system time and the counting result of the counter, and determines whether the second system time is greater than the decryption time. If not, continue monitoring; if yes, proceed to step S32; Step S32: based on the counting result, verify the time difference between the second system time and the first system time, and determine whether the time difference is less than a preset time difference threshold. If not, reset the system time, obtain the latest second system time, and proceed to step S31; if yes, proceed to step S33; Step S33, determine whether the counting result reaches the counting threshold, if not, control the counter to continue counting; if yes, enter step S40.

2. The method for automatic offline decryption of encrypted files as claimed in claim 1, characterized in that: The step S20 is specifically as follows: The client parses the encrypted file in real time to obtain the encrypted data, the counting threshold, the decryption time, the device serial number and the first HMAC value, performs integrity verification on the encrypted data, the counting threshold, the decryption time and the device serial number through the first HMAC value, performs legitimacy verification on the parsed device serial number through the device serial number of the local machine, and then stores the encrypted data in real time to the hardware encryption chip, and stores the counting threshold and the decryption time in real time to the specified path.

3. The method for offline timed automatic decryption of encrypted files as claimed in claim 1, characterized in that: The step S40 is specifically as follows: The client automatically calls the hardware encryption chip through the preset second script, and decapsulates the encrypted data through the AES-KW algorithm to obtain the six-level encrypted data and the three-level key; Decrypting the level 6 encrypted data by using the ChaCha20 algorithm to obtain level 5 encrypted data, swapping the number 0 and the letter O in the level 5 encrypted data to obtain level 4 encrypted data, mapping each character of the level 4 encrypted data by using a preset mapping rule to obtain level 3 encrypted data, decrypting the level 3 encrypted data by using the IDEA algorithm to obtain level 2 encrypted data, and controlling each character of the level 2 encrypted data to shift to the left by using a preset first shift amount to obtain level 1 encrypted data; The third-level key is decrypted by the 3DES algorithm to obtain a second-level key, each character of the second-level key is controlled to shift rightward by a preset second shift amount to obtain a first-level key, and the first-level key is decrypted by the AES-GCM algorithm to obtain a public key; The first-level encrypted data is decrypted by the public key to obtain an electronic file and a second HMAC value, and the integrity of the electronic file is checked by the second HMAC value to complete the decryption of the encrypted data.

4. The method for automatic offline decryption of encrypted files as claimed in claim 1, characterized in that: The step S50 is specifically as follows: The client real-time record includes at least the counting threshold, decryption time, counting result and decryption log of the access record; The client encrypts the decrypted log into first encrypted data by using the SM4 algorithm, divides the first encrypted data into a first data block, a second data block, and a third data block, encrypts the first data block by using the ChaCha20 algorithm to obtain a first encrypted data block, encrypts the second data block by using the IDEA algorithm to obtain a second encrypted data block, encrypts the third data block by using the 3DES algorithm to obtain a third encrypted data block, and encrypts the first encrypted data block, the second encrypted data block, and the third encrypted data block into an encrypted log by using the AES256 algorithm; The client stores the encrypted log in a designated storage space and performs distributed backup of the encrypted log.

5. An off-line timed automatic decryption system for encrypted files, characterized by: Includes the following modules: An initialization module is used for the client to obtain an encrypted file, record the first system time of obtaining the encrypted file through a hardware encryption chip, and start a counter to count; An encrypted file parsing and verification module is used for the client to parse the encrypted file to obtain encrypted data, counting threshold, decryption time, device serial number and first HMAC value, perform integrity verification through the first HMAC value, perform legitimacy verification through the device serial number, and then store the encrypted data in the hardware encryption chip, and store the counting threshold and decryption time in a specified path; A time verification module, used for the client to automatically read the counting threshold and the decryption time from the specified path through a preset first script, obtain the current second system time and the counting result of the counter, and perform time verification based on the second system time, the counting result, the counting threshold and the decryption time; The automatic decryption module is used for the client to automatically decrypt the encrypted data to obtain the electronic file by using the hardware encryption chip through a preset second script, and to perform integrity verification on the electronic file; The decryption log management module is used for the client to record the decryption log in real time, encrypt the decryption log into an encrypted log, and store and back up the encrypted log; In the initialization module, the generation process of the encrypted file is as follows: Obtain the electronic file to be encrypted and the device serial number of the client to be sent, set a counting threshold and a decryption time, and create a public key and a private key through the ECDSA algorithm; Performing HMAC calculation on the electronic file to obtain a second HMAC value, encrypting the electronic file and the second HMAC value by using the private key to obtain primary encrypted data, controlling each character of the primary encrypted data to shift rightward by a preset first shift amount to obtain secondary encrypted data, encrypting the secondary encrypted data by using the IDEA algorithm to obtain third-level encrypted data, mapping each character of the third-level encrypted data by using a preset mapping rule to obtain fourth-level encrypted data, swapping the number 0 and the letter O in the fourth-level encrypted data to obtain fifth-level encrypted data, and encrypting the fifth-level encrypted data by using the ChaCha20 algorithm to obtain sixth-level encrypted data; The public key is encrypted by the AES-GCM algorithm to obtain a primary key, each character of the primary key is controlled to shift leftward by a preset second shift amount to obtain a secondary key, and the secondary key is encrypted by the 3DES algorithm to obtain a tertiary key; Encapsulating the six-level encrypted data and the three-level key by using the AES-KW algorithm to obtain encrypted data; Performing HMAC calculation on the encrypted data, the counting threshold, the decryption time, and the device serial number to obtain a first HMAC value, and generating an encrypted file based on the encrypted data, the counting threshold, the decryption time, the device serial number, and the first HMAC value; The specific steps of starting a counter to count are as follows: Start a counter and let the counter count based on a preset counting rule; The counting rule is specifically: y=ax^bc; Where y represents the counting result; x represents the counting factor calculated in minutes; a, b, and c all represent the counting adjustment coefficients; The time verification module specifically includes: A decryption time verification unit, used for the client to automatically read the counting threshold and the decryption time from the specified path through a preset first script, obtain the current second system time and the counting result of the counter, and determine whether the second system time is greater than the decryption time. If not, continue monitoring; if yes, enter the time difference verification unit; A time difference verification unit, used to verify the time difference between the second system time and the first system time based on the counting result, and determine whether the time difference is less than a preset time difference threshold. If not, reset the system time, obtain the latest second system time, and enter the decryption time verification unit; if yes, enter the counting result verification unit; The counting result verification unit is used to determine whether the counting result reaches the counting threshold. If not, the counter is controlled to continue counting; if so, the automatic decryption module is entered.

6. The system for automatically decrypting encrypted files offline according to claim 5, characterized in that: The encrypted file parsing and verification module is specifically used for: The client parses the encrypted file in real time to obtain the encrypted data, the counting threshold, the decryption time, the device serial number and the first HMAC value, performs integrity verification on the encrypted data, the counting threshold, the decryption time and the device serial number through the first HMAC value, performs legitimacy verification on the parsed device serial number through the device serial number of the local machine, and then stores the encrypted data in real time to the hardware encryption chip, and stores the counting threshold and the decryption time in real time to the specified path.

7. The system for automatically decrypting encrypted files offline according to claim 5, characterized in that: The automatic decryption module is specifically used for: The client automatically calls the hardware encryption chip through the preset second script, and decapsulates the encrypted data through the AES-KW algorithm to obtain the six-level encrypted data and the three-level key; Decrypting the level 6 encrypted data by using the ChaCha20 algorithm to obtain level 5 encrypted data, swapping the number 0 and the letter O in the level 5 encrypted data to obtain level 4 encrypted data, mapping each character of the level 4 encrypted data by using a preset mapping rule to obtain level 3 encrypted data, decrypting the level 3 encrypted data by using the IDEA algorithm to obtain level 2 encrypted data, and controlling each character of the level 2 encrypted data to shift to the left by using a preset first shift amount to obtain level 1 encrypted data; The third-level key is decrypted by the 3DES algorithm to obtain a second-level key, each character of the second-level key is controlled to shift rightward by a preset second shift amount to obtain a first-level key, and the first-level key is decrypted by the AES-GCM algorithm to obtain a public key; The first-level encrypted data is decrypted by the public key to obtain an electronic file and a second HMAC value, and the integrity of the electronic file is checked by the second HMAC value to complete the decryption of the encrypted data.

8. The system for automatically decrypting encrypted files offline according to claim 5, characterized in that: The decryption log management module is specifically used for: The client real-time record includes at least the counting threshold, decryption time, counting result and decryption log of the access record; The client encrypts the decrypted log into first encrypted data by using the SM4 algorithm, divides the first encrypted data into a first data block, a second data block, and a third data block, encrypts the first data block by using the ChaCha20 algorithm to obtain a first encrypted data block, encrypts the second data block by using the IDEA algorithm to obtain a second encrypted data block, encrypts the third data block by using the 3DES algorithm to obtain a third encrypted data block, and encrypts the first encrypted data block, the second encrypted data block, and the third encrypted data block into an encrypted log by using the AES256 algorithm; The client stores the encrypted log in a designated storage space and performs distributed backup of the encrypted log.

Images