A security protection method for file data stream

Abstract

The present invention relates to a security protection method for a file data stream, comprising an encryption end and a decryption end; the encryption end performs salt encryption processing on the content to obtain mixed content, then performs Huffman processing on the mixed content to obtain a Huffman tree and a Huffman code, and stores the Huffman code in a decryption end; when the decryption end requests to obtain content, the encryption end sends both the Huffman tree and the salt of the mixed content to the decryption end, the decryption end retrieves the corresponding Huffman code and combines the Huffman tree to restore the mixed content, and then uses the mixed content and the salt to decrypt and obtain the content. The security protection method for a file data stream of the present invention realizes that hackers cannot effectively capture files or data streams during task transmission, and the capture results cannot be parsed; the encryption end and the decryption end do not retain the original files and temporary files, and cannot directly obtain files by logging into the operating system; two layers of ID are added, and the preview and download operations of the decryption end can be monitored and traced.

Description

Technical Field

[0001] The present invention relates to the technical field of data encryption and compression, and in particular to a security protection method for file data streams. Background Art

[0002] The problem of secure storage of file data is becoming increasingly prominent. Whenever a user previews or views a file (various formats such as doc, docx, txt, ppt, pptx, xls, xlsx, pdf, ofd, rar, zip, arj, z, gz, bmp, gif, jpg, pic, png, tif, wps, html, wav, aif, au, mp3, ram, wma, mmf, amr, aac, flacwav, aif, au, mp3, ram, wma, mmf, amr, aac, flac, avi, rm, iso, int, sys, dll, adt, c, asm, for, lib, lst, msg, obj, pas, wki, bas, java, py, map, tmp, dot, bak, mid), the complete plaintext of the temporary file will be stored in advance in a certain system path, thus creating exposure risks. Because the operating system and application software reuse cached files efficiently, they often do not delete the files immediately, that is, the file that the user previews or views each time is the same temporary local file. At this time, if the user closes the preview or performs other non-downloading operations (if downloading, the system will generally delete temporary files after downloading), the temporary files will continue to remain on the local machine.

[0003] In systems with a high level of security and confidentiality, many files are often only intended to be visible to users of various clients but not to be downloaded. At the same time, it is necessary to prevent the files from being completely captured during the transmission process. Even if there is no such strict requirement, internal files with commercial secrets and copyrighted audio and video files should also be reasonably protected. When a file leak occurs, often only the name of the leaked file is known, and there is a lack of practical and effective control and tracing methods. Summary of the invention

[0004] The embodiment of the present invention provides a file data stream security protection method to solve the problem in the prior art that temporary files will continue to remain in the local machine after the user previews the file, which may lead to easy leakage.

[0005] In order to achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0006] A method for protecting the security of a file data stream comprises an encryption end and a decryption end; the encryption end performs salt encryption processing on the content to obtain mixed content, then performs Huffman processing on the mixed content to obtain a Huffman tree and a Huffman code, and stores the Huffman code in the decryption end; when the decryption end requests to obtain the content, the encryption end sends the Huffman tree and the salt of the mixed content to the decryption end, the decryption end retrieves the corresponding Huffman code and combines it with the Huffman tree to restore the mixed content, and then uses the mixed content and the salt to decrypt and obtain the content.

[0007] Furthermore, the Huffman code is symmetrically encrypted and then stored in the decryption end; the decryption end retrieves the Huffman code and performs symmetrical decryption to obtain the Huffman code.

[0008] Furthermore, the encryption end performs symmetrical encryption on the Huffman tree and the salt respectively.

[0009] Furthermore, the encryption end adds a Huffman tree salt to the Huffman code, fuses the mixed Huffman code, and stores it in the decryption end; when the decryption end requests to obtain content, the encryption end sends both the Huffman tree and the Huffman tree salt to the decryption end, and the decryption end uses the mixed Huffman code and the Huffman tree salt to restore the Huffman code, and then uses the Huffman code and the Huffman tree to restore the mixed content.

[0010] Furthermore, symmetric encryption is respectively adopted for the hybrid Huffman coding and the Huffman tree salt.

[0011] Furthermore, the Huffman tree construction method includes: converting the content into a file stream, the node is a character in the file stream, the weight is the number of times the character appears repeatedly in the file stream, sorting the nodes from small to large according to the weight, taking out the two nodes with the smallest weight, adding their weights to form a new node, deleting the two added nodes, adding the new node to the sequence, sorting again, and repeating the above process until only one node is left, which is the root node.

[0012] Furthermore, the decryption end deletes the content after finishing using the content, and informs the encryption end of the end of use.

[0013] Furthermore, the decryption end configures a content ID for the content, and the content ID is sent to the encryption end together with the content data.

[0014] Furthermore, the encryption end adds an application ID for the application software corresponding to the content, and when the encryption segment sends decryption information to the decryption end, the application ID is also sent.

[0015] The embodiments of the present invention have the following advantages:

[0016] A file data stream security protection method provided by the present invention realizes that hackers cannot effectively capture files or data streams during task transmission, and the capture results cannot be parsed; neither the encryption end nor the decryption end retains the original files and temporary files, and the files cannot be directly obtained by logging into the operating system; the "content index" and "content data" are stored in the encryption end and the decryption end respectively, which not only reduces the storage pressure, but also effectively prevents the file leakage caused by hackers after occupying the client; and two layers of ID are added, so that the preview and download operations of the decryption end can be monitored and traced. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the implementation methods or the description of the prior art. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0018] The structures, proportions, sizes, etc. illustrated in this specification are only used to match the contents disclosed in the specification so as to facilitate understanding and reading by persons familiar with the technology. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantial technical significance. Any structural modification, change in proportion or adjustment of size shall still fall within the scope of the technical contents disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention.

[0019] Figure 1 A data flow diagram of a file data stream security protection method provided by an embodiment of the present invention;

[0020] Figure 2 A method flow chart of a file data stream security protection method provided by an embodiment of the present invention;

[0021] Figure 3 A method flow chart of another file data stream security protection method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0022] The following is a description of the implementation of the present invention by specific embodiments. People familiar with the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] A security protection method for file data stream includes an encryption end and a decryption end.

[0024] like Figure 1 As shown, the encryption end is a system center such as a server or a control center, and the decryption end is a user end. When uploading content, the user needs to initiate an upload request to the decryption end, and the decryption end performs actual content algorithm processing and upload to the encryption end. The encryption end encrypts the content and stores the index content, and deletes the content data. In this way, the "content index" and "content data" can be stored in the encryption end and the decryption end respectively, which not only reduces storage pressure, but also effectively prevents file leakage after hackers occupy the client.

[0025] In order to increase the traceability of the content, before the content is uploaded, the decryption end configures a content ID for the content, and sends the content ID together with the content data to the encryption end; when the encryption end sends decryption information to the decryption end, it will also send the content ID for traceability and identification of the content.

[0026] The encryption end is equipped with application software such as OA, instant messaging, and email. If the user wants to preview the content, he needs to call the relevant application software. In order to facilitate the management of the traceability mark of the content, the encryption end adds an application ID to the application software corresponding to the encrypted content. The encryption end generates an application ID after the application software is registered, and the encryption end performs unified records and maintenance. When the encryption end sends decryption information to the decryption end, it will also send the application ID. When the application software is used on the decryption end, it implements the file call interface as required. When the user previews or views the file in the application software, he needs to initiate a request to the decryption end, and the decryption end and the encryption end perform algorithm processing to actually display the previewed or viewed content data.

[0027] The encryption methods for content in this technology include:

[0028] like Figure 2 As shown, the encryption end performs salt encryption on the content to obtain mixed content. For example, the password configured by the encryption end for the content is "password123456", and the content salt is "breadandmilk", which is "breadandmilkpassword123456" after splicing. This technology is not limited to the technical solution of superimposing the content salt and the password before and after. The salt encryption methods in the prior art are all applicable to this technology. Doing so can enhance the degree of encryption. If a hacker breaks into this layer, he can only obtain mixed content. With the addition and mixing of content salt, the hacker cannot determine the correct password, and even the hacker does not know the existence of the content salt. Only the person who makes the content salt knows the mixed content salt and how to remove the content salt. In order to increase the encryption effect, the content salt can be symmetrically encrypted. In this embodiment, symmetrical encryption uses AES encryption.

[0029] Then the mixed content is Huffman processed to obtain a Huffman tree and a Huffman code, and then the Huffman code is stored in the decryption end. In order to increase the encryption effect, the Huffman tree and the Huffman code are first symmetrically encrypted respectively, and then the symmetrically encrypted Huffman code is stored in the decryption end. The symmetrical encryption of this embodiment adopts AES encryption.

[0030] A Huffman tree, also known as an optimal tree, is a binary tree with the shortest weighted path. In this technology, a Huffman tree is similar to an index file of a file, that is, the composition order of the file content; Huffman coding is the simplest content after data splitting and merging, and the frequency of the same letters is recorded. A method for constructing a Huffman tree in this technology includes: no matter whether the file, image, audio, or video can be converted into a text stream, the content is converted into a file stream, and the file stream in this embodiment uses the binary file stream of the content to be converted into a hexadecimal file stream. The node is the character in the file stream, and the weight is the number of times the character appears repeatedly in the file stream. The nodes are sorted from small to large according to the weight, and the two nodes with the smallest weight are taken out, and their weights are added to form a new node, and the two added nodes are deleted, and the new node is added to the sequence, sorted again, and the above process is repeated until only one node is left, which is the root node.

[0031] Hackers can obtain the encrypted Huffman tree, Huffman code and salt during network transmission, and then they can piece together the file and steal the content if they know the algorithm principle. In order to prevent this possibility, Figure 3 As shown, the encryption end adds a Huffman tree salt to the Huffman tree, and the mixture is combined to obtain a mixed Huffman tree. For example, Huffman code "1011011100" + Huffman tree salt "11100010100010001" obtains a mixed Huffman tree "101101110011100010100010001". This technology is not limited to adding a Huffman tree salt after the Huffman code. The salt encryption fusion method in the prior art is applicable to this technology. When the decryption end requests to obtain content, the encryption end sends both the mixed Huffman tree and the Huffman tree salt to the decryption end. The decryption end uses the mixed Huffman tree and the Huffman tree salt to restore the Huffman tree. The decryption end removes the Huffman tree salt from the mixed Huffman tree to obtain a restored Huffman tree. In order to increase the encryption effect, the mixed Huffman tree and the Huffman tree salt can be symmetrically encrypted before transmission. In this embodiment, the symmetric encryption uses AES encryption.

[0032] The decryption method for content in this technology includes:

[0033] When the decryption end requests to obtain content, the encryption end sends the Huffman tree and content salt corresponding to the content to the decryption end. The decryption end retrieves the Huffman code corresponding to the content and combines it with the Huffman tree and content salt to decrypt the content. In order to prevent the lack of effective management and tracing methods in the event of a file leak, the encryption end transmits the software ID and content ID together with the Huffman tree and salt. When the leak occurs, the corresponding problem content and the time, port and other related content related to the leak can be found through the software ID and content ID.

[0034] If the Huffman code stored on the decryption end has been symmetrically encrypted, it needs to be symmetrically decrypted first to obtain the Huffman code, and then proceed to the subsequent decryption steps. If the decryption end receives the symmetrically encrypted Huffman tree, content salt, hybrid Huffman tree, and Huffman tree salt, it needs to be symmetrically decrypted first to obtain the corresponding Huffman tree, content salt, hybrid Huffman tree, and Huffman tree salt, and then proceed to the subsequent decryption steps.

[0035] The decryption at the decryption end includes (if symmetric encryption is used, the following data will be decrypted symmetrically):

[0036] In case 1, the decryption end uses the Huffman tree and Huffman coding to synthesize the mixed content, and then uses the mixed content and salt processing algorithm to remove the content salt from the mixed content to obtain the content.

[0037] In case 2, the decryption end uses a hybrid Huffman tree, a Huffman tree salt, and a salt processing algorithm to remove the Huffman tree salt from the hybrid Huffman tree to obtain a Huffman tree, and then combines the Huffman tree with its stored Huffman code to restore the mixed content, and then uses the hybrid content and content salt processing algorithm to remove the content salt from the mixed content to obtain the content.

[0038] Although the present invention has been described in detail above by general description and specific embodiments, it is obvious to those skilled in the art that some modifications or improvements can be made to the present invention. Therefore, these modifications or improvements made without departing from the spirit of the present invention all belong to the scope of protection claimed by the present invention.

Claims

1. A method for protecting file data stream security, characterized in that: Including encryption end and decryption end; The encryption end performs salt encryption processing on the content to obtain mixed content, then performs Huffman processing on the mixed content to obtain a Huffman tree and a Huffman code, and stores the Huffman code in the decryption end; When the decryption end requests to obtain the content, the encryption end sends the Huffman tree and salt of the mixed content to the decryption end. The decryption end retrieves the corresponding Huffman code and combines it with the Huffman tree to restore the mixed content, and then uses the mixed content and salt to decrypt the content. After the decryption end finishes using the content, it deletes the content and informs the encryption end of the end of use. The Huffman tree construction method comprises: converting the content into a file stream, wherein the node is a character in the file stream, the weight is the number of times the character appears repeatedly in the file stream, sorting the nodes in ascending order according to the weight, taking out the two nodes with the smallest weight, adding their weights to form a new node, deleting the two added nodes, adding the new node to the sequence, sorting again, and repeating the above process until only one node is left, and the node is the root node; The decryption end configures a content ID for the content, and sends the content ID together with the content data to the encryption end; The encryption end adds an application ID to the application software corresponding to the content, and when the encryption segment sends decryption information to the decryption end, the application ID is sent together.

2. The method for protecting the security of a file data stream according to claim 1, characterized in that: The Huffman code is symmetrically encrypted and then stored in the decryption end; The decryption end retrieves the Huffman code and performs symmetric decryption to obtain the Huffman code.

3. The method for protecting the security of a file data stream according to claim 1, characterized in that: The encryption end performs symmetrical encryption on the Huffman tree and the salt respectively.

4. The method for protecting the security of a file data stream according to claim 1, characterized in that: The encryption end adds a Huffman tree salt to the Huffman code, fuses the Huffman code to obtain a hybrid Huffman code, and stores the mixed Huffman code in the decryption end; When the decryption end requests to obtain content, the encryption end sends both the Huffman tree and the Huffman tree salt to the decryption end. The decryption end uses the mixed Huffman code and the Huffman tree salt to restore the Huffman code, and then uses the Huffman code and the Huffman tree to restore the mixed content.

5. A file data stream security protection method according to claim 4, characterized in that: Symmetric encryption is used for the hybrid Huffman coding and the Huffman tree salt respectively.

Images