File encryption method and system based on CP-ABE and USBKEY

Abstract

The present invention belongs to the field of information security technology, and provides a file encryption method and system based on CP‑ABE and USBKEY. The technical scheme is as follows: using the CP‑ABE algorithm to protect the file encryption key, it can be ensured that only a pre-set user group can decrypt the file encryption key ciphertext, effectively protecting the security of the key, and at the same time, the key can be transferred without a dedicated or secure channel, and even if it is maliciously acquired by an unauthorized third party, the unauthorized third party cannot decrypt the file encryption key plaintext. The present invention uses a combination of multiple algorithms and cryptographic devices, and uses USBKEY to store user private keys and file encryption key ciphertexts, so that the key plaintext does not need to leave the device, ensuring the security of the keys in each link of the entire system.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to a file encryption method and system based on CP-ABE (Ciphertext PolicyAttribute Based Encryption, i.e., ciphertext policy attribute based encryption system) and USBKEY. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] File encryption system is an important means of protecting data security and is widely used in the fields of personal privacy protection, enterprise data confidentiality, etc. At present, file encryption technology mainly includes symmetric encryption algorithms (such as AES), asymmetric encryption algorithms (such as RSA), and hybrid encryption modes. Symmetric encryption algorithms are favored for their high speed and efficiency, but they require secure sharing of keys. Asymmetric encryption solves the key distribution problem, but the computational complexity is relatively high.

[0004] With the development of cloud computing and big data technology, file encryption systems are also evolving to adapt to new application scenarios. For example, full disk encryption technology can encrypt the entire storage device, while transparent encryption technology can protect data without changing user habits. In addition, with the rise of quantum computing, traditional encryption algorithms may face new challenges. Therefore, the research on post-quantum encryption algorithms has also become a hot topic in the encryption field. Overall, file encryption systems are developing in a safer, more efficient and smarter direction.

[0005] Existing file encryption systems mainly rely on symmetric encryption and asymmetric encryption technologies. Although they can protect data security to a certain extent, they still face many problems. Symmetric encryption faces the problem of difficult key management in large-scale applications, and asymmetric encryption is limited in its use in big data scenarios due to its high computational overhead. In addition, the access control granularity of existing systems is generally coarse, making it difficult to meet complex multi-user access requirements, and software encryption has low security and is vulnerable to attacks. Although hardware encryption provides higher security, it causes cost and management complexity. Summary of the invention

[0006] In order to solve at least one technical problem existing in the above-mentioned background technology, the present invention provides a file encryption method and system based on CP-ABE and USBKEY. CP-ABE provides fine-grained access control and dynamically generates keys through user attributes to ensure that only users who meet specific conditions can decrypt and access data. USBKEY, as a hardware device, securely stores keys and performs encryption and decryption operations, thereby enhancing the security and reliability of key management. This combination not only improves the security of the system, but also optimizes key management and access control, and adapts to complex and changeable application scenarios.

[0007] In order to achieve the above object, the present invention adopts the following technical solution:

[0008] The first aspect of the present invention provides a file encryption method based on CP-ABE and USBKEY, which is applied to a server and includes the following steps:

[0009] Receive the public key in the SM2 signature key pair generated in the application and container created by the user in USBKEY;

[0010] Generate the user's CP-ABE private key according to the public key in the SM2 signature key pair, the user's identity information and attributes; after encrypting the user's CP-ABE private key with the public key in the SM2 signature key pair, send the user's CP-ABE private key ciphertext to the user end and store it in the corresponding application and container of USBKEY;

[0011] Receive a file encryption request instruction, a file attribute to be encrypted, and a decryptable user group attribute sent by a user terminal;

[0012] Generate a file encryption key, and encrypt the generated file encryption key using the CP-ABE master key, the file attribute to be encrypted, and the decryptable user group attribute to obtain the file encryption key ciphertext;

[0013] The file encryption key ciphertext is sent to the user end and stored in the corresponding application and container of USBKEY.

[0014] Furthermore, the attributes of the file to be encrypted include the file hash value, the file creation time, the file size, the number of times the file can be read, and whether the file can be copied out of the USBKEY.

[0015] Furthermore, the user's identity information includes work number, identity ID, and email address, and the user's attributes include department, role, and location.

[0016] Furthermore, the file encryption key adopts SM4-GCM.

[0017] A second aspect of the present invention provides a file encryption method based on CP-ABE and USBKEY, which is applied to a client and includes:

[0018] Create applications and containers in USBKEY, and generate SM2 signature key pairs in the corresponding applications and containers;

[0019] Send the public key pair in the SM2 signature key pair to the server;

[0020] Receive the user's CP-ABE private key ciphertext generated by the server based on the SM2 signature key pair, the user's identity information and attributes, and store it in the corresponding application and container of USBKEY;

[0021] Send a file encryption request instruction, and send the file attributes to be encrypted and the decryptable user group attributes to the server; the receiving server uses the CP-ABE public parameters, the file attributes to be encrypted and the decryptable user group attributes to encrypt the generated file encryption key, and obtains the file encryption key ciphertext;

[0022] Use the private key in the SM2 signature key pair to decrypt the CP-ABE private key ciphertext to obtain the CP-ABE private key;

[0023] Decrypt the file encryption key ciphertext using the CP-ABE private key to obtain the file encryption key plaintext;

[0024] The file encryption key plaintext obtained by decryption is used to encrypt and decrypt the file.

[0025] Furthermore, after obtaining the plaintext of the file encryption key, the SM4-GCM algorithm interface is called using the USBKEY internal algorithm interface to encrypt the file and calculate the GCM-MAC, and the file ciphertext and file GCM-MAC value are stored together in the storage medium of the USBKEY.

[0026] A third aspect of the present invention provides a file encryption method based on CP-ABE and USBKEY, comprising the following steps:

[0027] Create applications and containers in the user-side USBKEY, and generate SM2 signature key pairs in the corresponding applications and containers;

[0028] The client sends the public key pair in the SM2 signature key pair to the server;

[0029] The server generates the user's CP-ABE private key based on the public key in the SM2 signature key pair, the user's identity information and attributes; after encrypting the user's CP-ABE private key with the public key in the SM2 signature key pair, the user's CP-ABE private key ciphertext is sent to the user end and stored in the corresponding application and container of USBKEY;

[0030] The client sends a file encryption request instruction, and sends the file attributes to be encrypted and the decryptable user group attributes to the server;

[0031] The server generates a file encryption key, encrypts the generated file encryption key using the CP-ABE master key, the file attributes to be encrypted, and the decryptable user group attributes, obtains the file encryption key ciphertext, and sends it to the user end to be stored in the corresponding application and container of USBKEY;

[0032] The user end uses the private key in the SM2 signature key pair to decrypt the CP-ABE private key ciphertext to obtain the CP-ABE private key; uses the CP-ABE private key to decrypt the file encryption key ciphertext to obtain the file encryption key plaintext; and uses the decrypted file encryption key plaintext to encrypt and decrypt files.

[0033] A fourth aspect of the present invention provides a file encryption system based on CP-ABE and USBKEY, which is applied to a server and includes:

[0034] The public key receiving module is configured to: receive the public key in the SM2 signature key pair generated in the application and container created by the user end in USBKEY;

[0035] The CP-ABE private key generation module is configured to: generate a user CP-ABE private key according to the public key in the SM2 signature key pair, the user's identity information and attributes; encrypt the user CP-ABE private key with the public key in the SM2 signature key pair, send the user CP-ABE private key ciphertext to the user end, and store it in the corresponding application and container of USBKEY;

[0036] The encryption request receiving module is configured to: receive a file encryption request instruction, a file attribute to be encrypted, and a decryptable user group attribute sent by a user terminal;

[0037] The file encryption key encryption module is configured to: generate a file encryption key, encrypt the generated file encryption key using the CP-ABE master key, the file attribute to be encrypted and the decryptable user group attribute, and obtain the file encryption key ciphertext;

[0038] The key ciphertext sending module is configured to: send the file encryption key ciphertext to the user end and store it in the corresponding application and container of USBKEY.

[0039] A fifth aspect of the present invention provides a file encryption system based on CP-ABE and USBKEY, which is applied to a user end and includes:

[0040] The key generation module is configured to: create an application and a container in the USBKEY, generate an SM2 signature key pair in the corresponding application and container; and send the public key pair in the SM2 signature key pair to the server;

[0041] The CP-ABE private key receiving module is configured to: receive the user CP-ABE private key ciphertext generated by the server according to the SM2 signature key pair, the user's identity information and attributes, and store it in the corresponding application and container of USBKEY;

[0042] The encryption request module is configured to: send a file encryption request instruction, and send the file attributes to be encrypted and the decryptable user group attributes to the server;

[0043] The encryption key encryption module is configured to: receive the file encryption key ciphertext obtained by the server side encrypting the generated file encryption key using the CP-ABE public parameters, the file attributes to be encrypted and the decryptable user group attributes;

[0044] The encryption key decryption module is configured to: decrypt the file encryption key ciphertext by using the CP-ABE private key to obtain the file encryption key plaintext;

[0045] The file encryption and decryption module is configured to: encrypt and decrypt the file using the plain text of the file encryption key obtained by decryption.

[0046] A sixth aspect of the present invention provides a file encryption system based on CP-ABE and USBKEY, including a user end and a server end;

[0047] Create applications and containers in the client USBKEY, and generate SM2 signature key pairs in the corresponding applications and containers; the client sends the public key pair in the SM2 signature key pair to the server;

[0048] The server generates the user's CP-ABE private key based on the public key in the SM2 signature key pair, the user's identity information and attributes; after encrypting the user's CP-ABE private key with the public key in the SM2 signature key pair, the user's CP-ABE private key ciphertext is sent to the user end and stored in the corresponding application and container of USBKEY;

[0049] The client sends a file encryption request instruction, and sends the file attributes to be encrypted and the decryptable user group attributes to the server;

[0050] The server generates a file encryption key, encrypts the generated file encryption key using the CP-ABE master key, the file attributes to be encrypted, and the decryptable user group attributes, obtains the file encryption key ciphertext, and sends it to the user end to be stored in the corresponding application and container of USBKEY;

[0051] The user end uses the private key in the SM2 signature key pair to decrypt the CP-ABE private key ciphertext to obtain the CP-ABE private key; uses the CP-ABE private key to decrypt the file encryption key ciphertext to obtain the file encryption key plaintext; and uses the decrypted file encryption key plaintext to encrypt and decrypt files.

[0052] Compared with the prior art, the present invention has the following beneficial effects:

[0053] 1. The present invention uses the CP-ABE algorithm to protect the file encryption key, which can ensure that only the pre-set user group can decrypt the file encryption key ciphertext, effectively protecting the security of the key; at the same time, the key can be transmitted without a dedicated or secure channel, and even if it is maliciously obtained by an unauthorized third party, the unauthorized third party cannot decrypt the file encryption key plaintext.

[0054] 2. The present invention combines multiple algorithms and cryptographic devices, and uses USBKEY to store user private keys and file encryption key ciphertext, so that the key plaintext does not need to leave the device, ensuring the security of the keys in each link of the entire system. The SM4-GCM algorithm ensures the confidentiality and integrity of the file.

[0055] 3. The storage medium in USBKEY uses a dedicated file system, which cannot be read in common systems on the market. The files can only be operated through the supporting host computer software.

[0056] 4. Users can set the number of file reads through the host computer software, and automatically delete the file when the upper limit of the file reads is reached. Because the file attributes are written in the file ciphertext, even if the file is copied or transferred many times, the function of automatically deleting the file after the upper limit of the file reads can still be effectively executed.

[0057] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0059] Figure 1 It is a file encryption system framework based on CP-ABE and USBKEY provided by an embodiment of the present invention;

[0060] Figure 2 This is the user registration and CP-ABE private key distribution process provided by the embodiment of the present invention;

[0061] Figure 3This is the file encryption key application process provided by the embodiment of the present invention. DETAILED DESCRIPTION

[0062] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0063] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0064] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0065] Explanation of terms

[0066] USBKEY: It is a hardware device with a USB interface. It has a built-in single-chip microcomputer or smart card chip and a certain amount of storage space, which can store the user's private key and digital certificate.

[0067] MAC: MAC stands for Message Authentication Code, which is a fixed value generated by a key and ciphertext.

[0068] GCM: GCM stands for Galois / Counter Mode, G refers to GMAC, and C refers to CTR. GCM uses a variant of the Counter mode of operation to ensure data confidentiality.

[0069] In order to solve the problems mentioned in the background technology, the existing file encryption system has coarse access control granularity, which is difficult to meet complex multi-user access requirements, and the software encryption has low security and is vulnerable to attacks. Although hardware encryption provides higher security, it brings costs and management complexity.

[0070] The present invention proposes a high-security file encryption method based on CP-ABE and USBKEY to effectively solve these problems. CP-ABE provides fine-grained access control, dynamically generates keys through user attributes, and ensures that only users who meet specific conditions can decrypt and access data. As a hardware device, USBKEY safely stores keys and performs encryption and decryption operations, thereby enhancing the security and reliability of key management. At the same time, the USBKEY storage module uses a self-developed file system to ensure that the data in the storage module can only be read by the supporting host computer software, and cannot be directly read by the common system on the market. This combination not only improves the security of the system, but also optimizes key management and access control, and adapts to complex and changeable application scenarios.

[0071] like Figure 1 As shown, the system of the present invention includes three modules: a key management system, client software, and USBKEY.

[0072] The key management system is responsible for CP-ABE master key generation and management, user private key generation and distribution, CP-ABE encryption policy management, user authentication and authorization, file data encryption key generation, update, revocation and distribution, etc.

[0073] The client software is responsible for downloading keys, USBKEY file system management (encrypted file display, encrypted file attribute setting, encrypted file donation, deletion, modification, and query functions), and USBKEY management (creating users, creating and managing applications and containers).

[0074] USBKEY consists of two parts: ukey and storage medium. ukey is responsible for user private key storage, data encryption key storage, file encryption and decryption, and the storage medium is responsible for storing encrypted files.

[0075] Step 1: User registration and CP-ABE key distribution

[0076] like Figure 2 The figure shows the process of user registration and CP-ABE key distribution, which includes the following steps:

[0077] Step 101: Create an application and a container in USBKEY, and generate an SM2 signature key pair in the corresponding application and container;

[0078] In this embodiment, the SM2 signature key pair includes an SM2 public key and an SM2 private key;

[0079] The user uses the client software to create a user name and password, and uses the USBKEY management function of the client software to create applications and containers. Generate an SM2 signature key pair in the corresponding application and container, and send the public key and necessary identity information (such as work number, identity ID, email address, etc.), as well as related attributes (such as department, role, location, etc.) to the server through the client software.

[0080] Step 102: The server reads the user's identity information and verifies the user's identity information. After the verification is passed, the server distributes identity attributes according to the user's identity and the attribute policy customized by the system;

[0081] For example, the identity attributes distributed are "(administrator AND weekly work hours) OR (technician AND device type = mobile device)".

[0082] Step 103: Based on the user's identity attributes, CP-ABE master key and selected random data, the user's CP-ABE private key is calculated. After the user's CP-ABE private key is generated, the user's CP-ABE private key, identity information and identity attributes are encrypted using the SM2 public key to obtain the encrypted key ciphertext;

[0083] Step 104: The user uses the SM2 private key to decrypt the key ciphertext to obtain the corresponding CP-ABE private key and information, and saves them in the corresponding application and container in the USBKEY.

[0084] Step 2: File encryption key generation and distribution

[0085] like Figure 3 The following is the file encryption key application process, which includes the following steps:

[0086] Step 201: receiving a file encryption key request instruction and attributes of a file to be encrypted;

[0087] In this embodiment, the user sets the file attributes through the client. The file attributes to be encrypted include the file hash value, file creation time, file size, whether the file is encrypted, the number of times the file can be read, whether the file can be copied out of the USBKEY, the user group attributes that can be decrypted (such as department, role, location, etc.), etc. The user uses the client to initiate the file encryption function and request the file encryption key (symmetric key) from the server.

[0088] Step 202: The server receives the request from the client, generates a random number as the file data encryption key, and encrypts the file data encryption key using the CP-ABE master key according to the attributes of the file to be encrypted and the attributes of the decryptable user group to obtain the file data encryption key ciphertext;

[0089] Step 203: The server sends the file data encryption key to the server, and imports the key ciphertext into the corresponding application and container of USBKEY through the server.

[0090] Step 3: File encryption and decryption and transmission of ciphertext

[0091] Step 301: When encrypting a file to be encrypted, the USBKEY internally calls the CP-ABE algorithm and uses the CP-ABE private key to decrypt the file data encryption key ciphertext to obtain the file encryption key plaintext;

[0092] The plaintext key of this process is not visible to the user and will not be transmitted outside the USBKEY.

[0093] Step 302: After obtaining the plaintext of the file encryption key, use the USBKEY internal algorithm interface to call the SM4-GCM algorithm interface to encrypt the file and calculate the GCM-MAC to ensure the confidentiality and integrity of the file, and store the file ciphertext and the file GCM-MAC value together in the USBKEY storage medium;

[0094] Step 303: When receiving the instruction to transfer the ciphertext of the file, the ciphertext of the file, the GCM-MAC value of the file and the encryption key of the file data in the USBKEY storage medium are read and sent to the recipient;

[0095] Step 304: When the receiving party decrypts the encrypted file ciphertext, the USBKEY internally calls the CP-ABE algorithm and uses the CP-ABE private key to decrypt the file data encryption key ciphertext;

[0096] Step 305: Use the USBKEY internal algorithm interface to call the SM4-GCM algorithm interface to decrypt the file and calculate the GCM-MAC to obtain the file plaintext and verify the integrity of the file.

[0097] In addition, the storage medium in the USBKEY uses a dedicated file system, which cannot be read in common systems on the market, and the files can only be operated through the supporting host computer software.

[0098] The user can set the number of file reads through the host computer software, and automatically delete the file when the upper limit is reached. Because the file attributes are written in the file ciphertext, even if the file is copied or transferred multiple times, the function of automatically deleting the file after the upper limit is reached can still be effectively executed.

[0099] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A file encryption method based on CP-ABE and USBKEY, applied to the server, characterized in that: include: Receive the public key in the SM2 signature key pair generated in the application and container created by the user in USBKEY; Generate the user's CP-ABE private key according to the public key in the SM2 signature key pair, the user's identity information and attributes; after encrypting the user's CP-ABE private key with the public key in the SM2 signature key pair, send the user's CP-ABE private key ciphertext to the user end and store it in the corresponding application and container of USBKEY; Receive a file encryption request instruction, a file attribute to be encrypted, and a decryptable user group attribute sent by a user terminal; Generate a file encryption key, and encrypt the generated file encryption key using the CP-ABE master key, the file attribute to be encrypted, and the decryptable user group attribute to obtain the file encryption key ciphertext; The file encryption key ciphertext is sent to the user end and stored in the corresponding application and container of USBKEY.

2. The file encryption method based on CP-ABE and USBKEY as claimed in claim 1, characterized in that: The attributes of the file to be encrypted include the file hash value, file creation time, file size, number of times the file can be read, and whether the file can be copied out of the USBKEY.

3. The file encryption method based on CP-ABE and USBKEY as claimed in claim 1, characterized in that: The user's identity information includes work number, identity ID, and email address, and the user's attributes include department, role, and location.

4. The file encryption method based on CP-ABE and USBKEY as claimed in claim 1, characterized in that: The file encryption key uses SM4-GCM.

5. The file encryption method based on CP-ABE and USBKEY is applied to the client, characterized in that: include: Create applications and containers in USBKEY, and generate SM2 signature key pairs in the corresponding applications and containers; Send the public key in the SM2 signature key pair to the server; Receive the user's CP-ABE private key ciphertext generated by the server based on the SM2 signature key pair, the user's identity information and attributes, and store it in the corresponding application and container of USBKEY; Send a file encryption request instruction, and send the file attributes to be encrypted and the decryptable user group attributes to the server; the receiving server uses the CP-ABE public parameters, the file attributes to be encrypted and the decryptable user group attributes to encrypt the generated file encryption key, and obtains the file encryption key ciphertext; Use the private key in the SM2 signature key pair to decrypt the CP-ABE private key ciphertext to obtain the CP-ABE private key; Decrypt the file encryption key ciphertext using the CP-ABE private key to obtain the file encryption key plaintext; The file encryption key plaintext obtained by decryption is used to encrypt and decrypt the file.

6. The file encryption method based on CP-ABE and USBKEY as claimed in claim 5, characterized in that: After obtaining the plaintext of the file encryption key, use the USBKEY internal algorithm interface to call the SM4-GCM algorithm interface to encrypt the file and calculate the GCM-MAC, and store the file ciphertext and file GCM-MAC value together in the storage medium of the USBKEY.

7. The file encryption method based on CP-ABE and USBKEY is characterized in that: The steps include: Create applications and containers in the user-side USBKEY, and generate SM2 signature key pairs in the corresponding applications and containers; The client sends the public key in the SM2 signature key pair to the server; The server generates the user's CP-ABE private key based on the public key in the SM2 signature key pair, the user's identity information and attributes; after encrypting the user's CP-ABE private key with the public key in the SM2 signature key pair, the user's CP-ABE private key ciphertext is sent to the user end and stored in the corresponding application and container of USBKEY; The client sends a file encryption request instruction, and sends the file attributes to be encrypted and the decryptable user group attributes to the server; The server generates a file encryption key, encrypts the generated file encryption key using the CP-ABE master key, the file attributes to be encrypted, and the decryptable user group attributes, obtains the file encryption key ciphertext, and sends it to the user end to be stored in the corresponding application and container of USBKEY; The user end uses the private key in the SM2 signature key pair to decrypt the CP-ABE private key ciphertext to obtain the CP-ABE private key; The CP-ABE private key is used to decrypt the file encryption key ciphertext to obtain the file encryption key plaintext; the decrypted file encryption key plaintext is used to encrypt and decrypt the file.

8. The file encryption system based on CP-ABE and USBKEY is applied to the server, which is characterized by: include: The public key receiving module is configured to: receive the public key in the SM2 signature key pair generated in the application and container created by the user end in USBKEY; The CP-ABE private key generation module is configured to: generate a user CP-ABE private key according to the public key in the SM2 signature key pair, the user's identity information and attributes; encrypt the user CP-ABE private key with the public key in the SM2 signature key pair, send the user CP-ABE private key ciphertext to the user end, and store it in the corresponding application and container of USBKEY; The encryption request receiving module is configured to: receive a file encryption request instruction, a file attribute to be encrypted, and a decryptable user group attribute sent by a user terminal; The file encryption key encryption module is configured to: generate a file encryption key, encrypt the generated file encryption key using the CP-ABE master key, the file attribute to be encrypted and the decryptable user group attribute, and obtain the file encryption key ciphertext; The key ciphertext sending module is configured to: send the file encryption key ciphertext to the user end and store it in the corresponding application and container of USBKEY.

9. The file encryption system based on CP-ABE and USBKEY is applied to the user end, characterized in that: include: The key generation module is configured to: create an application and a container in USBKEY, and generate an SM2 signature key pair in the corresponding application and container; Send the public key in the SM2 signature key pair to the server; The CP-ABE private key receiving module is configured to: receive the user CP-ABE private key ciphertext generated by the server according to the SM2 signature key pair, the user's identity information and attributes, and store it in the corresponding application and container of USBKEY; The encryption request module is configured to: send a file encryption request instruction, and send the file attributes to be encrypted and the decryptable user group attributes to the server; The encryption key encryption module is configured to: receive the file encryption key ciphertext obtained by the server side encrypting the generated file encryption key using the CP-ABE public parameters, the file attributes to be encrypted and the decryptable user group attributes; The encryption key decryption module is configured to: decrypt the file encryption key ciphertext by using the CP-ABE private key to obtain the file encryption key plaintext; The file encryption and decryption module is configured to: encrypt and decrypt the file using the plain text of the file encryption key obtained by decryption.

10. The file encryption system based on CP-ABE and USBKEY is characterized by: Including the user side and the server side; Create applications and containers in the client USBKEY, and generate SM2 signature key pairs in the corresponding applications and containers; the client sends the public key in the SM2 signature key pair to the server; The server generates the user's CP-ABE private key based on the public key in the SM2 signature key pair, the user's identity information and attributes; after encrypting the user's CP-ABE private key with the public key in the SM2 signature key pair, the user's CP-ABE private key ciphertext is sent to the user end and stored in the corresponding application and container of USBKEY; The client sends a file encryption request instruction, and sends the file attributes to be encrypted and the decryptable user group attributes to the server; The server generates a file encryption key, encrypts the generated file encryption key using the CP-ABE master key, the file attributes to be encrypted, and the decryptable user group attributes, obtains the file encryption key ciphertext, and sends it to the user end to be stored in the corresponding application and container of USBKEY; The user end uses the private key in the SM2 signature key pair to decrypt the CP-ABE private key ciphertext to obtain the CP-ABE private key; The CP-ABE private key is used to decrypt the file encryption key ciphertext to obtain the file encryption key plaintext; the decrypted file encryption key plaintext is used to encrypt and decrypt the file.

Images