Document security protection method and device, electronic equipment and computer program product

Abstract

The application discloses a document security protection method and device, electronic equipment, and a computer program product. The method comprises the following steps: obtaining an initial document created by a document creator, and injecting an encryption public key corresponding to the initial document and a snapshot macro file in the initial document; in the process of editing the circulated document by at least one document editor, based on the obtained circulated document, performing snapshot processing by using the encryption public key and the snapshot macro file to generate a snapshot verification file corresponding to each document editor; obtaining a target document submitted by a last document editor; and performing verification on the target document according to the snapshot verification file corresponding to each document editor by adopting a reverse sequence verification strategy to obtain a document verification result. The document security protection scheme can realize offline content protection of a read-only document, realize tamper-proof protection of a full life cycle of a read-only document in a public link circulation by a snapshot mode, and realize traceability of a legal modification in a whole process.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of document security, and particularly relates to a document security protection method and device, electronic equipment and computer program product. BACKGROUND

[0002] Office Open XML (OpenXML) is an open standard proposal for word processing documents, presentations and spreadsheets, which can be freely implemented by multiple applications on multiple platforms. OpenXML (OOXML) is a new document format proposed by Microsoft in Office 2007, and Word, Excel and PowerPoint in Office 2007 all use OpenXML format by default. In 2008, it was changed to OXML (Open XML, OXML) standard when it was certified by ISO standard. The new standard integrates XML standard document content and format, and is packaged through Zip compression technology. In the word office document of docx, multiple xml files are used to represent the object format of the document, and finally packaged into Zip form to express the entire document content.

[0003] The flow document supports free editing, and the layout calculation and drawing are performed in the flow layout when browsing. The flow file generally includes metadata, style, bookmark, hyperlink, object, section (the largest layout unit, and the document content of different page styles forms different sections), paragraph, sentence and other elements and attributes. These contents are described in a certain hierarchical structure, which forms the format of the flow document. The word document is a typical flow file, and users can edit, add and delete the content in the document. Due to the editable feature, the flow file may cause inconsistent content effects of the document display due to different reader versions, operating system versions and other environmental factors, which is commonly known as the "runout" phenomenon.

[0004] At present, the docx suffix flow document supported by mainstream office software all follows the OpenXML protocol standard, and the standard document has relatively wide circulation. In the OpenXML standard, various object information and attributes of the document are represented by different XML, including user-defined XML, embedded code / macro, document attribute, chart, picture, audio / video file, annotation, etc. Finally, these XML files are packaged through the Zip compression protocol. However, in the OpenXML standard, the read-only permission control ability of the document is weak, mainly by injecting read-only protection and password restriction into the setting.xml setting information of the document. In the read-only document flow process, the intruder without editing permission can easily remove the read-only protection setting in the setting.xml by decompressing the Zip package, so as to break through the read-only restriction.

[0005] The existing read-only protection mechanism for docx documents on the market mainly relies on online permission control and transfer management to protect document transfer. These methods cannot achieve offline encryption read-only protection of the document, full life cycle protection of the document, read-only protection document modification snapshot, and scene rollback. SUMMARY

[0006] Embodiments of the present application provide a document security protection method, device, electronic equipment and computer program product to achieve tamper-proof protection of document content.

[0007] Embodiments of the present application adopt the following technical solutions:

[0008] In a first aspect, the embodiments of the present application provide a document security protection method, which comprises:

[0009] obtaining an initial document created by a document creator, the initial document being injected with an encryption public key corresponding to the initial document and a snapshot macro file;

[0010] In the process of editing the transferred document by at least one document editor, based on the obtained transferred document, the encryption public key and the snapshot macro file are used for snapshot processing to generate a snapshot verification file corresponding to each document editor;

[0011] obtaining a target document submitted by the last document editor;

[0012] According to the snapshot verification file corresponding to each document editor, a reverse order verification strategy is adopted to verify the target document to obtain a document verification result.

[0013] Optionally, the obtaining of the initial document created by the document creator comprises:

[0014] obtaining an initial document written by a document creator and compressing the initial document to obtain a first compressed document;

[0015] generating an encryption public key corresponding to the initial document by using an asymmetric encryption algorithm;

[0016] generating a snapshot macro file corresponding to the initial document by using a macro command;

[0017] injecting the encryption public key corresponding to the initial document and the snapshot macro file into a document designated directory.

[0018] Optionally, in the process of editing the transferred document by at least one document editor, based on the obtained transferred document, the encryption public key and the snapshot macro file are used for snapshot processing to generate a snapshot verification file corresponding to each document editor, which comprises:

[0019] obtaining an editing permission password set by a document creator;

[0020] decrypting the obtained document in read-only mode by using the editing permission password to obtain a pre-editing document corresponding to each document editor;

[0021] based on the pre-editing document corresponding to each document editor, performing snapshot processing by using the encryption public key and the snapshot macro file to generate a snapshot verification file corresponding to each document editor;

[0022] writing the snapshot verification file into a document designated directory.

[0023] Optionally, the snapshot verification file includes a snapshot verification file in an initial state and a snapshot verification file in a saved state, and the snapshot processing based on the pre-editing document corresponding to each document editor by using the encryption public key and the snapshot macro file to generate a snapshot verification file corresponding to each document editor includes:

[0024] before the document editor performs editing, performing snapshot processing by using the encryption public key and the snapshot macro file based on the pre-editing document to generate a snapshot verification file in an initial state corresponding to the document editor;

[0025] after the document editor completes editing and saves an edited document, performing snapshot processing by using the encryption public key and the snapshot macro file based on the pre-editing document and the edited document to generate a snapshot verification file in a saved state corresponding to the document editor.

[0026] Optionally, the snapshot processing before the document editor performs editing by using the encryption public key and the snapshot macro file based on the pre-editing document to generate a snapshot verification file in an initial state corresponding to the document editor includes:

[0027] compressing the pre-editing document by using a snapshot macro file and a hash algorithm to obtain a second compressed document and a hash result;

[0028] fusing the second compressed document and the editing permission password as initial saved content of the pre-editing document;

[0029] encrypting the initial saved content of the pre-editing document by using the encryption public key to obtain the snapshot verification file in the initial state.

[0030] Optionally, the snapshot processing based on the pre-editing document and the post-editing document after the document editor completes editing and saves the edited document, using the encryption public key and the snapshot macro file to generate the snapshot verification file of the saving state corresponding to the document editor comprises:

[0031] comparing the pre-editing document with the post-editing document to generate a difference document;

[0032] encrypting the difference document using the encryption public key to obtain the snapshot verification file of the saving state.

[0033] Optionally, the snapshot verification file comprises a snapshot verification file of an initial state and a snapshot verification file of a saving state, and the checking the target document according to the snapshot verification file corresponding to each document editor to obtain a document checking result comprises:

[0034] decrypting the snapshot verification file of the saving state using a private key of the asymmetric encryption algorithm to obtain a difference document;

[0035] restoring the pre-editing document corresponding to the document editor according to the difference document and the post-editing document corresponding to the document editor;

[0036] decrypting the snapshot verification file of the initial state using a private key of the asymmetric encryption algorithm to obtain the initial saving content of the pre-editing document;

[0037] checking the pre-editing document corresponding to the document editor and the initial saving content of the pre-editing document to obtain a document checking result.

[0038] Optionally, the initial saving content of the pre-editing document comprises a first hash result of the pre-editing document and an editing permission password, and the checking the pre-editing document corresponding to the document editor and the initial saving content of the pre-editing document to obtain a document checking result comprises:

[0039] determining whether the editing permission password corresponding to the document editor is consistent with an editing permission password set by a document creator to obtain a first determination result;

[0040] hash processing the restored pre-editing document corresponding to the document editor to obtain a second hash result of the pre-editing document, and determining whether the second hash result of the pre-editing document is consistent with the first hash result to obtain a second determination result;

[0041] if the first determination result and the second determination result corresponding to all document editors are consistent, it is determined that the document checking is passed;

[0042] Otherwise, it is determined that the document verification fails.

[0043] In a second aspect, the embodiments of the present application further provide a document security protection device, which comprises:

[0044] A first obtaining unit is configured to obtain an initial document created by a document creator, wherein the initial document is injected with an encryption public key corresponding to the initial document and a snapshot macro file;

[0045] A snapshot processing unit is configured to, in a process in which at least one document editor obtains the circulated document and edits the circulated document, perform snapshot processing on the circulated document based on the encryption public key and the snapshot macro file, and generate a snapshot verification file corresponding to each document editor;

[0046] A second obtaining unit is configured to obtain a target document submitted by a last document editor;

[0047] A verification unit is configured to perform verification on the target document according to the snapshot verification file corresponding to each document editor by adopting a reverse-order verification strategy, and obtain a document verification result.

[0048] In a third aspect, the embodiments of the present application further provide an electronic device, which comprises:

[0049] A processor; and

[0050] A memory arranged to store computer executable instructions, which, when executed, cause the processor to perform any of the aforementioned document security protection methods.

[0051] In a fourth aspect, the embodiments of the present application further provide a computer program product, which comprises a computer program or instructions, and the computer program or instructions, when executed by a processor, implement any of the aforementioned document security protection methods.

[0052] The at least one technical solution adopted by the embodiments of the present application can achieve the following beneficial effects: the document security protection method of the embodiments of the present application first acquires an initial document created by a document creator, the initial document being injected with an encryption public key corresponding to the initial document and a snapshot macro file; then, in the process of editing the initial document by at least one document editor, based on the initial document, the snapshot macro file and the encryption public key are used to perform snapshot processing to generate a snapshot verification file corresponding to each document editor; then, a target document submitted by a last document editor is acquired; finally, according to the snapshot verification file corresponding to each document editor, a reverse sequence checking strategy is adopted to check the target document to obtain a document checking result. The document security protection scheme of the embodiments of the present application can realize offline content protection of a read-only document, realize full-life-cycle tamper-proof protection of a read-only document public link transfer and full-process legal modification traceability through a snapshot mode. BRIEF DESCRIPTION OF DRAWINGS

[0053] The accompanying drawings, which are included to provide a further understanding of the present application and constitute a part of this application, illustrate certain illustrative embodiments of the present application and together with the description serve to explain the present application. In the drawings:

[0054] Figure 1 It is an intrusion schematic diagram of an OpenXML protocol word document read-only protection;

[0055] Figure 2 It is a flowchart of a document protection method in the embodiments of the present application;

[0056] Figure 3 It is a logical structure schematic diagram of an openXML standard document in the embodiments of the present application;

[0057] Figure 4 It is a generation flowchart of a snapshot verification file in the embodiments of the present application;

[0058] Figure 5 It is another generation flowchart of a snapshot verification file in the embodiments of the present application;

[0059] Figure 6 It is a flowchart of a document reverse sequence checking in the embodiments of the present application;

[0060] Figure 7 It is a structure schematic diagram of a document protection device in the embodiments of the present application;

[0061] Figure 8 It is a structure schematic diagram of an electronic device in the embodiments of the present application. DETAILED DESCRIPTION

[0062] In order to make the purposes, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described below in connection with specific embodiments of the present application and corresponding drawings. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0063] The technical solutions provided by the embodiments of the present application will be described in detail below in connection with the drawings.

[0064] In order to facilitate the understanding of the embodiments of the present application, first, the main technical terms involved in the present application are introduced:

[0065] 1) OpenXML: Office Open XML (OpenXML) is an open standard proposal for word processing documents, presentations and spreadsheets, which can be freely implemented by multiple applications on multiple platforms. OpenXML (OOXML) is a new document format proposed by Microsoft in Office 2007, and Word, Excel and PowerPoint in Office 2007 all use OpenXML format by default. In 2008, it was changed to OXML (Open XML, OXML) standard when it was certified by ISO standard. The new standard integrates XML standard document content and format, and is packaged through Zip compression technology. In the docx word office document, multiple XML files are used to represent the object format of the document, and finally packaged into Zip form to express the entire document content.

[0066] 2) Flow file: Flow file supports free editing, and performs layout calculation and drawing in the flow layout mode when browsing. The flow file generally includes metadata, style, bookmark, hyperlink, object, section (the largest layout unit, and different page styles form different sections), paragraph, sentence and other elements and attributes. These contents are described in a certain hierarchical structure, which forms the format of the flow document. Word document is a typical flow file, and users can edit, add and delete content in the document. Due to the editable feature, the flow file may cause inconsistent content effects of the document display due to different reader versions, operating system versions and other environmental factors, which is commonly known as the "runout" phenomenon.

[0067] 3) Asymmetric encryption algorithm: Asymmetric encryption algorithm uses two completely different but completely matched pair of keys, public key and private key. When using asymmetric encryption algorithm to encrypt the file, only using the matching pair of public key and private key, the encryption and decryption process of plaintext can be completed. When encrypting plaintext, public key is used for encryption, and private key is used for decryption. The classic asymmetric encryption algorithm is RSA algorithm, and the asymmetric encryption algorithm currently recommended in China is SM2, which is more secure and has higher password complexity, faster processing speed and smaller machine performance consumption than traditional RSA algorithm.

[0068] 4) Hash function: The input original message is split into multiple groups, and each group is padded, grouped, expanded, iteratively compressed, etc. Finally, a certain number of digest values are output. The current mainstream method is MD5, SM3 and other algorithms.

[0069] 5) Macro: Macro is a batch processing program command. In office software, macros can be used to implement program-type work in document processing. Office document processing software such as WPS, Microsoft, etc. allows users to write macros, and the programming language is VBA. Users increase the flexibility of document processing by writing macro scripts to achieve the function of expanding functions.

[0070] In the OpenXML standard, the existing scheme has weak document read-only permission control capability, mainly by injecting read-only protection and password restriction into the setting.xml information of the document. In the read-only document flow process, malicious intruders without editing permission can easily remove the read-only protection settings in setting.xml by decompressing the Zip package, so as to break through the read-only restriction. If a password is applied during the compression process Zip, the content cannot be browsed, and the content reading purpose is achieved. As shown in Figure 1 , an OpenXML protocol word document read-only protection intrusion schematic diagram is provided.

[0071] The embodiment of the present application provides a document security protection method, as shown in Figure 2 , a flowchart of a document protection method in the embodiment of the present application is provided, and the document security protection method at least includes the following steps S110 to S140:

[0072] Step S110, obtaining an initial document created by a document creator, wherein the initial document is injected with an encryption public key corresponding to the initial document and a snapshot macro file.

[0073] The document security protection method of the embodiment of the present application is mainly for a read-only document created based on the OpenXML standard. In the OpenXML standard, the control ability of the read-only permission of the document is weak. Therefore, the document security protection method proposed in the embodiment of the present application is used to strengthen the control of the editing permission of the read-only document in the OpenXML standard.

[0074] In the life cycle of the read-only document, first, the document creator writes the document content. When the creation is completed, a pair of public and private keys (KeyPublic, KeyPrivate) belonging to the document need to be generated. The public key is responsible for the encryption processing of the specific content in the subsequent process, and the private key is used to decrypt the content encrypted by the public key.

[0075] In addition, a snapshot macro file MacroSnap, i.e., a program command file for generating a snapshot, needs to be created. The snapshot macro of the embodiment of the present application is mainly used to save the snapshot of the document related content at a specific node in the document public circulation editing process, to record the document editing process, and to serve as the basis for subsequent document verification.

[0076] In step S120, in the process of editing the circulated document by at least one document editor, based on the obtained circulated document, the snapshot macro file and the encryption public key are used to perform snapshot processing, to generate a snapshot verification file corresponding to each document editor.

[0077] When the creator completes the editing and setting of the read-only document, the document enters the subsequent circulation link of the public link. In the circulation link, at least three types of users will be faced, i.e., a read-only user, a user with editing permission, and an illegal intruder. The read-only user only has the right to browse and cannot modify the content, and has no publishing value of the modified content. The user with editing permission and the illegal intruder both have the ability to modify the document. How to distinguish and protect the modified content is the key to distinguishing the legal and illegal editors.

[0078] Based on the actual business scenario, a document may need to be edited by multiple editors in the public circulation process. For any document editor, after obtaining the circulated document and having the editing permission, the snapshot macro file and the encryption public key are used to perform snapshot processing on the obtained circulated document, to generate a snapshot verification file corresponding to the document editor. The snapshot macro file is used to save the snapshot of the document related content at a specific node after the document editor obtains the circulated document, and the snapshot verification file is encrypted by using the encryption public key. The generated snapshot verification file records the related operation information of the document editor on the document, and can be used as the basis for subsequent verification of whether the document content is tampered.

[0079] In step S130, the target document submitted by the last document editor is obtained.

[0080] After all the document editors complete the editing, a submission feedback of the document is performed by the last document editor to obtain the target document edited by the plurality of document editors.

[0081] In step S140, the target document is verified according to the snapshot verification file corresponding to each document editor by adopting a reverse verification strategy to obtain a document verification result.

[0082] In the process of document disclosure circulation, an illegal intruder may erase the editing permission password in the settings.xml to perform illegal editing, resulting in tampering of the document content. Therefore, the embodiment of the present application needs to further verify whether the finally obtained document content is tampered with by an illegal intruder in the circulation process. Specifically, the snapshot verification file attached to the document can be used to verify the entire circulation process of the target document by adopting a reverse verification strategy. For example, there are S+n document editors, and the initial state created by the Sth document creator is verified in reverse order to the (S+n)th document creator. When the snapshot verification of all document editors passes the verification, it indicates that the full life cycle of the read-only document has no intrusion tampering behavior, and the final content of the document is trustworthy, otherwise, the document content is not completely trustworthy.

[0083] The document security protection scheme of the embodiment of the present application can realize offline content protection of a read-only document, full life cycle anti-tampering protection of a read-only document disclosure link circulation and full process legal modification traceability through a snapshot method.

[0084] In some embodiments of the present application, the obtaining of the initial document created by the document creator includes: obtaining the initial document written by the document creator and compressing to obtain a first compressed document; generating an encryption public key corresponding to the initial document by using an asymmetric encryption algorithm; generating a snapshot macro file corresponding to the initial document by using a macro command; and injecting the encryption public key and the snapshot macro file corresponding to the initial document into a document designated directory.

[0085] In the life cycle of a read-only document, first, a document creator writes document content. When the creation is completed, a pair of public and private keys (Key Public , Key Private ) belonging to the document need to be generated based on an asymmetric encryption algorithm. Here, the specific asymmetric encryption algorithm used includes but is not limited to RSA, SM2, etc., which mainly has the characteristics of public key public encryption, private key independent decryption and inability to decrypt the content with the public key, and the specific encryption algorithm can be flexibly selected according to actual needs.

[0086] After the document creator S completes the content writing, the document content is determined as The public key Key Public is injected into the OpenXML protocol standard documentPublic , snapshot macro file Macro Snap The public key and the snapshot macro are attached to the document as an attachment and do not affect the writing of the content of the document. The public key is responsible for encrypting specific content in the subsequent process, and the snapshot macro is used to encrypt and save the content involved in the snapshot when each editor obtains editing permission and completes editing. The encryption uses the public key, and the saving is performed in a specific directory of the OpenXML document, such as being stored in the Embedding directory in the form of an attachment.

[0087] When the creator completes the injection of the public key and the snapshot macro file of the document, the read-only permission of the document can be locked, and an editing permission password Password edit is set. Setting the read-only permission constraint of the document completes the compliance with the OpenXML standard, and only the read-only setting is injected into settings.xml as a configuration.

[0088] In order to facilitate the understanding of the above embodiments, as shown in Figure 3 , a logical structure diagram of an openXML standard document in the embodiments of the present application is provided.

[0089] In some embodiments of the present application, in the process of editing the transferred document by at least one document editor, based on the obtained transferred document, the encryption public key and the snapshot macro file are used for snapshot processing to generate a snapshot verification file corresponding to each document editor, which includes: obtaining an editing permission password set by a document creator; using the editing permission password to perform read-only decryption on the obtained transferred document to obtain a pre-editing document corresponding to each document editor; based on the pre-editing document corresponding to each document editor, using the encryption public key and the snapshot macro file to perform snapshot processing to generate a snapshot verification file corresponding to each document editor; and writing the snapshot verification file into a specified directory of the document.

[0090] When a legal editor S+i obtains the transferred document and has editing permission, the document can be decrypted read-only by using the editing permission password Password edit , and the original document content before editing is obtained. After obtaining the document content before editing, the encryption public key Key Public and the snapshot macro file Macro Snap are used for snapshot encryption processing to generate a snapshot verification file corresponding to each document editor, and finally the snapshot verification file is written into the Embedding directory attached to the document. With the continuous transfer of the document, the snapshot verification file generated after each editing process is written into the Embedding directory, so that all snapshot verification files in the whole life cycle of the document transfer are saved in the Embedding directory.

[0091] In some embodiments of the present application, the snapshot verification file includes a snapshot verification file of an initial state and a snapshot verification file of a saved state, and the generating of the snapshot verification file corresponding to each document editor based on the document before editing, by using the encryption public key and the snapshot macro file, includes: before the document editor performs editing, generating the snapshot verification file of the initial state corresponding to the document editor based on the document before editing, by using the encryption public key and the snapshot macro file; after the document editor completes editing and obtains a document after editing, generating the snapshot verification file of the saved state corresponding to the document editor based on the document before editing and the document after editing, by using the encryption public key and the snapshot macro file.

[0092] The snapshot file generated by the embodiments of the present application includes a snapshot verification file of an initial state and a snapshot verification file of a saved state, the snapshot verification file of the initial state refers to initial state information related to a document generated by a document editor before starting editing on an obtained document in circulation, and the snapshot verification file of the saved state refers to saved state information related to a document generated by a document editor after completing editing on an obtained document in circulation. That is, the snapshot verification file of the initial state and the snapshot verification file of the saved state are records of the beginning and end states of the document editor editing the content of the document.

[0093] For the snapshot verification file of the initial state, the snapshot encryption processing on the document before editing can be performed by using the encryption public key and the snapshot macro file at the moment when the document editor obtains the document before editing after performing read-only decryption on the document in circulation.

[0094] For the snapshot verification file of the saved state, the snapshot encryption processing can be performed by using the encryption public key and the snapshot macro file at the moment when the document editor completes editing and obtains the document after editing, in combination with the document before editing and the document after editing, to generate the snapshot verification file of the saved state corresponding to the document editor.

[0095] In some embodiments of the present application, the generating of the snapshot verification file of the initial state corresponding to the document editor before the document editor performs editing, by using the encryption public key and the snapshot macro file, includes: compressing the document before editing by using the snapshot macro file and a hash algorithm to obtain a second compressed document and a hash result; fusing the second compressed document with the editing permission password as initial saved content of the document before editing; and encrypting the initial saved content of the document before editing by using the encryption public key to obtain the snapshot verification file of the initial state.

[0096] AsFigure 4 As shown, a flowchart for generating a snapshot verification file is provided. First, a snapshot macro Macro Snap The decrypted document content is compressed. The compression method can be a hash processing method such as MD5, SM3, or the like. The compressed document initial content is obtained The corresponding hash result Then, the compression result is fused with the editing permission password Password edit to obtain the initial saved content of the edited document. Finally, the initial saved content is encrypted by a public key to obtain the snapshot verification file in the initial state The encrypted snapshot verification file in the initial state as an attachment in the Embedding directory of the OpenXML document.

[0097] In some embodiments of the present application, after the document editor completes editing and saves the edited document, the snapshot verification file in the saved state of the document editor is generated based on the pre-editing document and the edited document, using the encryption public key and the snapshot macro file, which includes: comparing the pre-editing document with the edited document to generate a difference document; and encrypting the difference document using the encryption public key to obtain the snapshot verification file in the saved state.

[0098] As shown in Figure 4 After the document editor completes editing and saves the document, the updated document content is The snapshot macro compares the content difference between the current content and the initial state content of the document, and the comparison algorithm can be a difference algorithm such as LCS (Longest Common Subsequence). By comparing the content difference between the initial state and the current state, a difference document content is generated The generated difference document content after editing is saved, and the public key is used to perform encryption to obtain the snapshot verification file in the saved state and as an attachment with the snapshot verification file in the initial state corresponding to the Embedding directory of the OpenXML document.

[0099] After the legitimate editor S+1 completes editing and saves, the document is continued to be put into the public circulation link. The read-only document is used as a public file, and can also be decrypted and modified by other editors in the public circulation link. When the S+i editor completes the editing task, the document attachments are injected and

[0100] For the convenience of understanding the above-mentioned embodiments, as shown in Figure 5 FIG. 2, a flowchart of another generation process of a snapshot verification file in the embodiments of the present application is provided.

[0101] In some embodiments of the present application, the snapshot verification file includes a snapshot verification file of an initial state and a snapshot verification file of a saved state, and the checking of the target document according to the snapshot verification file corresponding to each document editor by adopting a reverse sequence checking strategy to obtain a document checking result includes: decrypting the snapshot verification file of the saved state by using a private key of an asymmetric encryption algorithm to obtain a difference document; restoring the document before editing corresponding to the document editor according to the difference document and the document after editing corresponding to the document editor; decrypting the snapshot verification file of the initial state by using the private key of the asymmetric encryption algorithm to obtain initial saved content of the document before editing; and checking the document before editing corresponding to the document editor and the initial saved content of the document before editing to obtain the document checking result.

[0102] When the read-only document is edited by n editors in the whole disclosure process, and the submission feedback of the document is performed by the last editor S+n. The document accepter can perform reverse sequence checking based on the snapshot content attached to the document.

[0103] As shown in Figure 6 FIG. 3, a flowchart of a document reverse sequence checking process in the embodiments of the present application is provided. The prerequisite of the reverse sequence checking is the content of the document after being edited by the S+n editor Editor permission password Password edit and private key Key of asymmetric encryption Private .

[0104] The reverse sequence checking process of the S+n editor is as follows: firstly, the contents of two snapshot verification files corresponding to the steps are extracted and The snapshot verification file of the saved state is decrypted by using the private key to obtain the content The difference record is compared and operated to restore the initial document content when the S+n editor starts editing

[0105] Then, the snapshot verification file of the initial state is decrypted to obtain the fusion content of the hash result of the initial state content when the S+n editor starts editing and the editor permission password

[0106]

[0107] ​​Finally, based on the restored initial document content when the S+nth editor started editing And the hash result of the initial state content when editing starts and the fusion content of the editing permission password Perform verification and obtain the document verification result.

[0108] In some embodiments of the present application, the initial saved content of the pre-editing document includes a first hash result and an editing permission password of the pre-editing document, and the verification is performed based on the pre-editing document corresponding to the document editor and the initial saved content of the pre-editing document to obtain a document verification result, including: determining whether the editing permission password corresponding to the document editor is consistent with the editing permission password set by the document creator, and obtaining a first determination result; hashing the restored pre-editing document corresponding to the document editor to obtain a second hash result of the pre-editing document, and determining whether the second hash result of the pre-editing document is consistent with the first hash result, and obtaining a second determination result; if the first determination results and the second determination results corresponding to all document editors are consistent, it is determined that the document verification has passed; otherwise, it is determined that the document verification has failed.

[0109] The verification process of the embodiment of this application mainly includes two aspects:

[0110] 1) Verification of editing permission password: Verify the snapshot verification file of the initial state After decryption, The actual editing password Password edit Is it consistent?

[0111] 2) Verification of the original content of the S+nth editor: Determine the hash result of the restored original content Verify the file against a snapshot of the initial state After decryption, Are they consistent?

[0112] If both parts of the content are verified, it means that the S+nth person is a legitimate editor. If the verification conditions cannot be met, it means that the document has been invaded and tampered with during the circulation process, the document's read-only protection has been destroyed, and the content cannot be trusted.

[0113] According to the document's circulation process, the initial document status of the S+nth editor is also the final status of the S+n-1th editor. The reverse verification process will enter the two snapshot content verification of the S+n-1th editor and repeat the above verification process.

[0114] Through the whole reverse sequence snapshot verification process, the initial state created by the document creator from the S+n bit reverse verification to the S bit is verified. If all user editing snapshots pass the decryption verification, it means that the whole life cycle of the read-only document has no intrusive tampering behavior, and the final content of the document is trustworthy.

[0115] In summary, the key points of the document security protection method of the application are mainly as follows:

[0116] 1) A new read-only protection method for OpenXML standard documents is proposed, which can prevent information intrusion in the life cycle of the read-only document, and realize encryption protection of the document content throughout its life cycle through asymmetric encryption, hash, snapshot macro, etc.

[0117] 2) A method of performing initial state snapshot encryption and final state snapshot encryption during document editing is proposed, which realizes offline saving and encryption processing of the content of a single node in the life cycle of the document.

[0118] 3) A method of checking the content of the reverse sequence document life cycle by means of node editing initial snapshot and editing saving snapshot is proposed, which realizes the legality of the document content at each link by decrypting the snapshot content in reverse order, and finally verifies the legality of the content of the read-only document throughout its life cycle.

[0119] The document security protection method of the application at least achieves the following technical effects:

[0120] The application proposes a new read-only protection method and strategy for OpenXML documents, which is based on asymmetric encryption, hash, snapshot macro integration, obtains the snapshot of the read-only document in the specific scene, and obtains the content difference state snapshot when the editing authorization is completed, and injects it into the read-only document as an attachment. During the public link circulation of the document, all authorized editors will add relevant snapshot information to the document. Finally, the document completes the public link circulation and submits for acceptance. The acceptance checker realizes reverse content verification according to the snapshot method, and checks the legality of the authorized editors during the whole circulation period. This method can realize offline content protection of the read-only document, and can also realize the legality verification of the content change of the read-only document in the whole life cycle of the public link circulation through the snapshot method.

[0121] The application embodiment further provides a document security protection device 700, as shown in Figure 7 The structure schematic diagram of the document protection device in the application embodiment is provided, and the document security protection device 700 comprises a first acquisition unit 710, a snapshot processing unit 720, a second acquisition unit 730 and a verification unit 740, wherein:

[0122] The first obtaining unit 710 is configured to obtain an initial document created by a document creator, wherein the initial document is injected with an encryption public key corresponding to the initial document and a snapshot macro file;

[0123] The snapshot processing unit 720 is configured to, during editing of the circulated document by at least one document editor, perform snapshot processing on the circulated document based on the encryption public key and the snapshot macro file, to generate a snapshot verification file corresponding to each document editor.

[0124] The second obtaining unit 730 is configured to obtain a target document submitted by a last document editor.

[0125] The checking unit 740 is configured to check the target document according to the snapshot verification file corresponding to each document editor, by adopting a reverse-order checking strategy, to obtain a document checking result.

[0126] In some embodiments of the present application, the first obtaining unit 710 is specifically configured to: obtain an initial document written by a document creator and compress the initial document to obtain a first compressed document; generate an encryption public key corresponding to the initial document by using an asymmetric encryption algorithm; generate a snapshot macro file corresponding to the initial document by using a macro command; and inject the encryption public key and the snapshot macro file corresponding to the initial document into a document designated directory.

[0127] In some embodiments of the present application, the snapshot processing unit 720 is specifically configured to: obtain an editing permission password set by a document creator; perform read-only decryption on the obtained circulated document by using the editing permission password, to obtain a pre-editing document corresponding to each document editor; perform snapshot processing on the pre-editing document corresponding to each document editor by using the encryption public key and the snapshot macro file, to generate a snapshot verification file corresponding to each document editor; and write the snapshot verification file into the document designated directory.

[0128] In some embodiments of the present application, the snapshot verification file includes a snapshot verification file of an initial state and a snapshot verification file of a saved state, and the snapshot processing unit 720 is specifically configured to: perform snapshot processing on the pre-editing document by using the encryption public key and the snapshot macro file, to generate a snapshot verification file of an initial state corresponding to the document editor, before the document editor performs editing; and perform snapshot processing on the pre-editing document and an edited document obtained after the document editor completes editing and saving, by using the encryption public key and the snapshot macro file, to generate a snapshot verification file of a saved state corresponding to the document editor.

[0129] In some embodiments of the present application, the snapshot processing unit 720 is specifically configured to: compress the pre-edit document by using a snapshot macro file and a hash algorithm to obtain a second compressed document and a hash result; fuse the second compressed document and the edit permission password as initial saving content of the pre-edit document; and encrypt the initial saving content of the pre-edit document by using the encryption public key to obtain the snapshot verification file in the initial state.

[0130] In some embodiments of the present application, the snapshot processing unit 720 is specifically configured to: compare the pre-edit document with the post-edit document to generate a difference document; and encrypt the difference document by using the encryption public key to obtain the snapshot verification file in the saved state.

[0131] In some embodiments of the present application, the snapshot verification file includes the snapshot verification file in the initial state and the snapshot verification file in the saved state, and the verification unit 740 is specifically configured to: decrypt the snapshot verification file in the saved state by using a private key of the asymmetric encryption algorithm to obtain a difference document; restore the pre-edit document corresponding to the document editor according to the difference document and the post-edit document corresponding to the document editor; decrypt the snapshot verification file in the initial state by using the private key of the asymmetric encryption algorithm to obtain initial saving content of the pre-edit document; and verify the pre-edit document corresponding to the document editor and the initial saving content of the pre-edit document to obtain a document verification result.

[0132] In some embodiments of the present application, the initial saving content of the pre-edit document includes a first hash result of the pre-edit document and an edit permission password, and the verification unit 740 is specifically configured to: determine whether the edit permission password corresponding to the document editor is consistent with the edit permission password set by the document creator to obtain a first determination result; perform hash processing on the restored pre-edit document corresponding to the document editor to obtain a second hash result of the pre-edit document, and determine whether the second hash result of the pre-edit document is consistent with the first hash result to obtain a second determination result; if the first determination result and the second determination result corresponding to all document editors are consistent, it is determined that the document verification passes; otherwise, it is determined that the document verification fails.

[0133] It can be understood that the above-mentioned document security protection device can realize each step of the document security protection method provided in the foregoing embodiments, and the related explanations about the document security protection method are all applicable to the document security protection device, which will not be repeated here.

[0134] Figure 8 FIG. 1 is a structural schematic diagram of an electronic device according to an embodiment of the present application. Please refer to Figure 8At the hardware level, the electronic device includes a processor, and optionally further includes an internal bus, a network interface, and a memory. The memory can include a memory such as a random-access memory (RAM), and can further include a non-volatile memory such as at least one disk memory. Of course, the electronic device can further include other hardware required by a business.

[0135] The processor, the network interface, and the memory can be connected to each other through the internal bus, which can be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one bidirectional arrow is used in the figure, but it does not mean that there is only one bus or only one type of bus.

[0136] The memory is used to store a program. Specifically, the program can include program code including computer operation instructions. The memory can include a memory and a non-volatile memory, and provide instructions and data to the processor.

[0137] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs, and forms a document security protection device at the logical level. The processor executes the program stored in the memory, and is specifically used for executing the following operations:

[0138] Obtain an initial document created by a document creator, the initial document being injected with an encryption public key corresponding to the initial document and a snapshot macro file;

[0139] In the process of editing the circulated document by at least one document editor, based on the obtained circulated document, the encryption public key and the snapshot macro file are used for snapshot processing to generate a snapshot verification file corresponding to each document editor;

[0140] Obtain a target document submitted by a last document editor;

[0141] According to the snapshot verification file corresponding to each document editor, an inverse order verification strategy is adopted to verify the target document to obtain a document verification result.

[0142] The above as described in the present application Figure 1The method executed by the document security protection device disclosed in the embodiment can be applied to a processor or implemented by the processor. The processor can be an integrated circuit chip with signal processing capability. In the implementation, each step of the above method can be completed by integrated logic circuit of hardware in the processor or instructions in the form of software. The processor can be a general processor, including a central processing unit (CPU), a network processor (NP), etc.; or a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component. Each method, step and logic block disclosed in the embodiment can be implemented or executed. The general processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiment can be directly embodied as a hardware decoding processor for execution or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a mature storage medium in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and combines the hardware to complete the steps of the above method.

[0143] The embodiment of the present application further provides a computer program product, including a computer program or instructions, which are executed by a processor to implement the aforementioned document security protection method and are specifically used for executing the following steps:

[0144] obtaining an initial document created by a document creator, wherein the initial document is injected with an encryption public key corresponding to the initial document and a snapshot macro file;

[0145] in the process of editing the circulated document obtained by at least one document editor, performing snapshot processing based on the circulated document, the encryption public key and the snapshot macro file to generate a snapshot verification file corresponding to each document editor;

[0146] obtaining a target document submitted by a last document editor;

[0147] performing verification on the target document according to the snapshot verification file corresponding to each document editor by adopting a reverse sequence verification strategy to obtain a document verification result.

[0148] Those skilled in the art will appreciate that embodiments of the present application can be readily used as a method, a system or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer readable storage media (including, but not limited to, disk memory, CD-ROMs, optical storage devices, etc.) embodying computer readable program code.

[0149] The present application is described in reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing device or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams block or blocks. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams block or blocks. Figure 1 means for performing the function specified by the flowchart illustrations and / or block diagrams block or blocks.

[0150] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the flowchart illustrations and / or block diagrams block or blocks. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams block or blocks. Figure 1 means for performing the function specified by the flowchart illustrations and / or block diagrams block or blocks.

[0151] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the flowchart illustrations and / or block diagrams block or blocks. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams block or blocks. Figure 1 means for performing the function specified by the flowchart illustrations and / or block diagrams block or blocks.

[0152] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0153] The memory can include non-persistent memory, random access memory (RAM), and / or non-volatile memory, such as read only memory (ROM) or flash memory, among others. The memory is an example of computer readable media.

[0154] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0155] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0156] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0157] The foregoing is merely an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A document security protection method, characterized in that: The document security protection method includes: Obtaining an initial document created by a document creator, wherein the initial document is injected with an encryption public key corresponding to the initial document and a snapshot macro file; During the process of editing the circulating document after obtaining it, at least one document editor performs snapshot processing based on the obtained circulating document using the encryption public key and the snapshot macro file to generate a snapshot verification file corresponding to each document editor; Get the target document submitted by the last document editor; Verify the target document using a reverse verification strategy based on the snapshot verification file corresponding to each document editor to obtain a document verification result; In the process of editing the circulating document after obtaining it, the at least one document editor performs snapshot processing based on the obtained circulating document using the encryption public key and the snapshot macro file to generate a snapshot verification file corresponding to each document editor, including: Get the editing permission password set by the document creator; Using the editing permission password, the obtained circulating document is read-only decrypted to obtain the pre-editing document corresponding to each document editor; Based on the pre-editing document corresponding to each document editor, snapshot processing is performed using the encryption public key and the snapshot macro file to generate a snapshot verification file corresponding to each document editor; Write the snapshot verification file into the document specified directory.

2. The document security protection method according to claim 1, characterized in that: The obtaining of the initial document created by the document creator includes: Obtaining an initial document written by a document creator and compressing the document to obtain a first compressed document; Generate an encryption public key corresponding to the initial document using an asymmetric encryption algorithm; generating a snapshot macro file corresponding to the initial document using a macro command; The encryption public key and snapshot macro file corresponding to the initial document are injected into the document designated directory.

3. The document security protection method according to claim 1, characterized in that: The snapshot verification file includes a snapshot verification file in an initial state and a snapshot verification file in a saved state. The snapshot processing is performed based on the pre-editing document corresponding to each document editor using the encryption public key and the snapshot macro file to generate the snapshot verification file corresponding to each document editor. The generation includes: Before the document editor performs editing, based on the pre-edited document, snapshot processing is performed using the encryption public key and the snapshot macro file to generate a snapshot verification file of the initial state corresponding to the document editor; After the document editor completes editing and saves the edited document, snapshot processing is performed based on the pre-edited document and the edited document using the encryption public key and the snapshot macro file to generate a snapshot verification file of the saved state corresponding to the document editor.

4. The document security protection method according to claim 3, characterized in that: Before the document editor performs editing, based on the pre-edited document, snapshot processing is performed using the encryption public key and the snapshot macro file to generate a snapshot verification file of the initial state corresponding to the document editor, including: Compressing the pre-edited document using a snapshot macro file and a hash algorithm to obtain a second compressed document and a hash result; Merging the second compressed document with the editing permission password as the initial saved content of the document before editing; The initial saved content of the document before editing is encrypted using the encryption public key to obtain the snapshot verification file of the initial state.

5. The document security protection method according to claim 3, characterized in that: After the document editor completes editing and saves the edited document, performing snapshot processing based on the pre-edited document and the edited document using the encryption public key and the snapshot macro file to generate a snapshot verification file of the saved state corresponding to the document editor includes: Comparing the document before editing with the document after editing to generate a difference document; The differential document is encrypted using the encryption public key to obtain a snapshot verification file of the saved state.

6. The document security protection method according to claim 1, characterized in that: The snapshot verification file includes a snapshot verification file of an initial state and a snapshot verification file of a saved state. The target document is verified using a reverse verification strategy based on the snapshot verification file corresponding to each document editor. The document verification results include: Decrypting the saved snapshot verification file using a private key of an asymmetric encryption algorithm to obtain a difference document; Restoring the pre-editing document corresponding to the document editor based on the difference document and the edited document corresponding to the document editor; Decrypting the snapshot verification file in the initial state using a private key of an asymmetric encryption algorithm to obtain the initial saved content of the document before editing; Verification is performed based on the pre-editing document corresponding to the document editor and the initially saved content of the pre-editing document to obtain a document verification result.

7. The document security protection method according to claim 6, characterized in that: The initially saved content of the pre-edited document includes a first hash result of the pre-edited document and an editing permission password. The verification is performed based on the pre-edited document corresponding to the document editor and the initially saved content of the pre-edited document, and the document verification result obtained includes: Determining whether the editing permission password corresponding to the document editor is consistent with the editing permission password set by the document creator, to obtain a first determination result; Performing hash processing on the restored pre-edit document corresponding to the document editor to obtain a second hash result of the pre-edit document, and determining whether the second hash result of the pre-edit document is consistent with the first hash result to obtain a second determination result; If the first determination results and the second determination results corresponding to all document editors are consistent, the document verification is determined to be passed; Otherwise, it is determined that the document verification has failed.

8. A document security protection device, characterized in that: The document security protection device comprises: A first acquisition unit is configured to acquire an initial document created by a document creator, wherein the initial document is injected with an encryption public key and a snapshot macro file corresponding to the initial document; a snapshot processing unit configured to, during the process of editing a circulating document after obtaining it, perform snapshot processing based on the obtained circulating document using the encryption public key and the snapshot macro file to generate a snapshot verification file corresponding to each document editor; The second acquiring unit is used to acquire the target document submitted by the last document editor; A verification unit, configured to verify the file according to the snapshot corresponding to each document editor, and adopt a reverse verification strategy to verify the target document to obtain a document verification result; The snapshot processing unit is specifically configured to: Get the editing permission password set by the document creator; Using the editing permission password, the obtained circulating document is read-only decrypted to obtain the pre-editing document corresponding to each document editor; Based on the pre-editing document corresponding to each document editor, snapshot processing is performed using the encryption public key and the snapshot macro file to generate a snapshot verification file corresponding to each document editor; Write the snapshot verification file into the document specified directory.

9. An electronic device comprising: processor; as well as A memory arranged to store computer-executable instructions, wherein when the instructions are executed, the processor executes the document security protection method according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program or instructions, wherein when the computer program or instructions are executed by a processor, the document security protection method according to any one of claims 1 to 7 is implemented.

Images