Data transparent encryption and decryption method and system based on cloud authentication

Abstract

The invention discloses a data transparent encryption and decryption method and system based on cloud authentication, the system comprises an encrypted file server, a cloud server and an electronic device, the cloud server deploys a cloud authentication system, the cloud authentication system comprises a cloud authentication platform and a UTOFS file system running on the electronic device; the cloud authentication system performs user creation, authentication and key generation, the electronic device logs in the cloud authentication system, authenticates and mounts an encrypted file, and performs file encryption and decryption based on the key; the encryption and decryption process is realized on a system layer of the computer, binary files are used, the data protection level is high, leakage of the files is avoided from the source, and data cannot be read normally after the computer leaves an authorized environment; meanwhile, the encryption and decryption process does not depend on the network to carry out transparent encryption and decryption, and the real-time performance of data encryption and decryption is guaranteed.

Description

Technical Field

[0001] The present invention belongs to the technical field of data processing, and relates to encryption and decryption of data, and specifically to a method and system for transparent encryption and decryption of data based on cloud authentication. Background Art

[0002] Nowadays, enterprises, government agencies and individual users often have a large amount of sensitive information, such as trade secrets, customer data, intellectual property, personal privacy, etc. If these data are stored in plain text, there are certain security risks. Once the storage medium is lost, stolen or attacked maliciously, it is very easy to cause information leakage, resulting in economic losses, reputation damage and even legal liability; many industries and regional laws and regulations (such as GDPR, HIPAA, PCI DSS, etc.) have strict regulations on the protection of sensitive information, requiring enterprises to encrypt and store specific types of data to ensure that even if data leakage occurs, personal information remains unrecognizable and reduces the impact on the data subject. Data leakage usually includes many aspects, and transparent encryption ensures that data is always protected at the storage level. Transparent encryption is an automatic encryption technology that is transparent to users and does not require manual operation, which improves work efficiency and user experience. If the data after transparent encryption is taken out of the authorized environment, it cannot be read normally, reducing the risk of data leakage.

[0003] Existing transparent encryption schemes only use methods such as watermarks to encrypt and protect files, which have a low protection level and make it easier to obtain encrypted files. In addition, some schemes rely on the network to perform transparent encryption and decryption of files in real time. When the network environment is poor, the encryption and decryption efficiency cannot be guaranteed and the stability is poor. Summary of the invention

[0004] In view of the above problems, the main purpose of the present invention is to design a method and system for transparent data encryption and decryption based on cloud authentication, so as to solve the problems of poor data encryption efficiency and stability and avoid leakage of encrypted data.

[0005] In order to achieve the above purpose, the present invention adopts the following technical solutions: A data transparent encryption and decryption system based on cloud authentication, the system comprises an encrypted file server, a cloud server and an electronic device, the cloud server deploys a cloud authentication system, the cloud authentication system comprises a cloud authentication platform, and a UTOFS file system running on the electronic device; The cloud authentication platform is used for user creation, user authentication and key generation. User names and login passwords are created through the web page and stored through the cloud server. The electronic device is used to write a key in the read-only area for credit authorization, log in to the UTOFS file system for authentication, and encrypt and decrypt files based on the key; The UTOFS file system performs login authentication on the electronic device based on the user name and login password, and mounts the encrypted file on the electronic device with the credit authentication; The encrypted file server is used to store encrypted files.

[0006] As a further description of the present invention, the cloud authentication platform includes the setting of a username and a password during the user creation process, encrypts the password to obtain a HASH password, and stores the HASH password as a login password and a username in a cloud server; When logging in to the UTOFS file system, if the user name and login password you enter correspond to the user name and login password of the cloud server, the authentication will pass; otherwise, the authentication will fail.

[0007] As a further description of the present invention, the generation of the key includes the generation of a file name encryption key and a file content encryption key; The encryption of the original file includes file name encryption and file content encryption, and the original file name and the original file content are encrypted by the file name encryption key and the file content encryption key to obtain the encrypted file name and the encrypted file content; The decryption of the encrypted file includes decryption of the encrypted file name and decryption of the encrypted file content. The encrypted file name and the encrypted file content are decrypted by the file name encryption key and the file content encryption key to obtain the original file name and the original file content.

[0008] A method for transparent data encryption and decryption based on cloud authentication, based on the above system, wherein the method includes encryption and decryption of files, specifically comprising the following steps: Step 1: The administrator accesses the cloud server and creates a user through the cloud authentication platform. The cloud authentication platform automatically generates a unique string as the login password, and the user is uniquely located through the string; Step 2: The cloud authentication platform obtains the corresponding master key from the user's login password through the Scrypt algorithm, and derives the master key into two sub-keys through the HKDF derivation function, one of which is used to encrypt the file name and the other is used to encrypt the file content. The sub-keys are written into the read-only area of ​​the electronic device for electronic device credit authorization; Step 3: The user accesses the cloud server on the electronic device after being authorized, logs in with the username and password through the UTOFS file system, and after successful authentication, the UTOFS file system is automatically called up, and the encrypted files of the encrypted file server are mounted to the authorized electronic device through the network protocol; Step 4: Encrypt and decrypt the encrypted file using the key obtained in step 2; including file name encryption, file name decryption, file content encryption, and file content decryption, to obtain the encrypted file name, original file name, encrypted file content, and original file content; Step 5: The original file name and original file content obtained in step 4 are used normally on the trusted electronic device, and the encrypted file name and encrypted file content obtained are synchronously stored on the encrypted file server.

[0009] As a further description of the present invention, in step 2, the master key is generated by combining the user's password and the random salt through the Scrypt algorithm, including the following steps: S21: Randomly generate a piece of data as a salt value to obtain a random salt; S22: Set the parameters of the Scrypt algorithm, including difficulty factor, buffer block size, and parallel parameters; S23: Take the password, random salt, and set parameters as input, calculate through the Scrypt algorithm, and obtain the output master key.

[0010] As a further description of the present invention, in step 2, the master key generates two sub-keys through the HKDF derivation function, one of which is used to generate a key for file name encryption through the HKDF-SHA256 derivation function, and the other sub-key is used in the AES-256-GCM encryption algorithm to obtain a key for file content encryption.

[0011] As a further description of the present invention, in step 4, the process of encrypting the file name includes the following steps: S401: using a random number generator to generate a random vector for file name encryption, and creating an AES encryption object of the file name by using the random vector for file name encryption and a key for file name encryption; S402: Create a PKSC7 filler through the AES encryption object of the file name, and use the PKSC7 filler to fill the file name to obtain a filled file name; S403: Encrypt the filled file name using the AES encryption object of the file name to obtain an encrypted file name, and concatenate the random vector of the file name encryption and the encrypted file name to obtain concatenated data; S404: Perform Base64 encoding on the concatenated data to obtain a Base64 encoded string of the encrypted file name, thereby achieving file name encryption.

[0012] As a further description of the present invention, in step 4, the process of file name decryption is the reverse process of file name encryption, including the following steps: S411: Obtain the encrypted file name, and perform Base64 decoding on the encrypted file name to obtain the concatenated data of the original file name; S412: extracting the encrypted ciphertext of the file name and the random vector when the file name is encrypted from the data after the original file name is concatenated; S413: Create an AES decryption object for the file name using the key for file name encryption and the random vector for file name encryption, and use the AES decryption object for file name to decrypt the ciphertext encrypted by the file name to obtain the filled file name; S414: Remove the PKCS7 padding from the padded file name to obtain the original file name, thereby decrypting the file name.

[0013] As a further description of the present invention, in step 4, the process of encrypting the file content includes the following steps: S421: Generate a random vector for file content encryption using a random number generator, and create an AES encryption object of the file content using the random vector for file content encryption and a key for file content encryption; S422: Read the binary content of the original file content, and encrypt the file binary content using the AES encryption object of the file content to obtain the encrypted binary content; S423: Obtain the authentication tag of the AES encryption object of the file content, and write the random vector, the authentication tag, and the encrypted binary content into the file at the same time to generate an encrypted file, thereby realizing file content encryption.

[0014] As a further description of the present invention, in step 4, the process of decrypting the file content is the reverse process of encrypting the file content, and includes the following steps: S431: Obtain the encrypted file, read its binary content, and parse out the ciphertext binary content, the authentication tag, and the random vector when the file content is encrypted; S432: Create an AES decryption object of the file content using the authentication tag, the random vector encrypted by the file content, and the key encrypted by the file content; S433: Decrypt the ciphertext binary content using the AES decryption object of the file content to obtain the restored original file binary content; S434: verifying the restored binary content of the original file using the authentication tag to obtain the verified binary content of the original file; S435: Write the verified original binary content into a new file to obtain the original file content, thereby decrypting the file content.

[0015] Compared with the prior art, the technical effects of the present invention are: The invention provides a method and system for transparent data encryption and decryption based on cloud authentication, the system comprises an encrypted file server, a cloud server and an electronic device; the cloud server deploys a cloud authentication system, the cloud authentication system comprises a cloud authentication platform, a server, a web page, and a UTOFS file system running on the electronic device; the cloud authentication platform is used for user creation, user authentication and key generation, a user name and a login password are created through the web page, and the user name and the login password are stored through the server; the electronic device is used for writing a key in a read-only area for credit authorization, logging in to the UTOFS file system for authentication, and encrypting and decrypting files; the UTOFS file system performs login authentication on the electronic device based on the user name and the login password, and mounts the encrypted file on the electronic device with credit authorization and authentication; the encrypted file server is used for storing the encrypted file; in the encryption and decryption process, user creation, authentication and key generation are performed through the cloud authentication system, the electronic device logs in to the cloud authentication system, authenticates and mounts the encrypted file, and the file name is encrypted, the file name is decrypted, the file content is encrypted, and the file content is decrypted based on the key. In the encryption and decryption process, binary type files are used, and the data protection level is high and the security is good. The encryption and decryption process is implemented at the system layer of the computer, including the credit of the electronic device and the authentication of the user. The encrypted file can only be viewed on the trusted device after successful authentication, eliminating the leakage of files from the source. After leaving the authorized environment, the data cannot be read normally, reducing the risk of data leakage. The encryption and decryption process does not rely on the network for transparent encryption and decryption of files, ensuring the real-time encryption and decryption of data. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A schematic diagram of the operating principle of the system of the present invention when executing the encryption and decryption method; Figure 2 It is a schematic diagram of the system coordination of the present invention; Figure 3 It is a schematic diagram of the authentication logic of the cloud authentication system of the present invention; Figure 4 A schematic diagram of the electronic device credit authorization process of the present invention; Figure 5 It is a schematic diagram of the key generation process of the present invention; Figure 6 This is a schematic diagram of the master key generation process of the present invention; Figure 7 This is a schematic diagram of the file name encryption process of the present invention; Figure 8 It is a schematic diagram of the file name decryption process of the present invention; Fig. 9 This is a schematic diagram of the file content encryption process of the present invention; Fig.10It is a schematic diagram of the file content decryption process of the present invention. DETAILED DESCRIPTION

[0017] The present invention is described in detail below in conjunction with the accompanying drawings: In one embodiment of the present invention, a system for transparent encryption and decryption of data based on cloud authentication is disclosed, such as Figure 1-4 As shown in the figure, the system can realize encryption and decryption of data, and can identify and authenticate the user's identity through the cloud to achieve transparent encryption and decryption of data. Figure 1 The system operation principle is disclosed, and the system includes: an encrypted file server, a cloud server and an electronic device; the cloud server deploys a cloud authentication system, and the cloud authentication system includes a cloud authentication platform and a UTOFS file system running on the electronic device; the cloud authentication platform includes a web page for user creation, user authentication and key generation, and the user name and login password are created through the web page, and the user name and login password are stored through the cloud server; the electronic device is used to write a key in a read-only area for credit, log in to the UTOFS file system for authentication, and encrypt and decrypt files based on the key; the UTOFS file system performs login authentication on the electronic device based on the user name and login password, and mounts the encrypted file on the electronic device for credit authentication; the encrypted file server is used to store encrypted files.

[0018] In this embodiment, encrypted files are stored on the above-mentioned encrypted file server. The encrypted file server allows users to use the remote mounting method through the network file protocol to mount the stored encrypted files on the trusted electronic device. When the user needs to read the encrypted file, the user performs identity authentication through the cloud authentication system. After the authentication is passed, the user can see the decrypted plaintext data in the mounted file directory. When the user identity is not authenticated, the user will not be able to see the decrypted plaintext data. Figure 2 shown.

[0019] In this embodiment, the electronic device is a trusted device authenticated by the cloud authentication system, including computers and other devices. The cloud authentication platform includes the setting of username and password in the user creation process, encrypts the password to obtain a HASH password, and stores the HASH password as the login password and username in the cloud server; when logging in to the UTOFS system, if the username and login password entered correspond to the username and login password on the server, the authentication is passed and the authorization operation is performed; if they do not correspond, the authentication fails. Figure 3 shown.

[0020] It should be noted that the above-mentioned encryption of the password is a certain HASH encryption of the password. In this embodiment, the use of a certain HASH algorithm is not limited. Any algorithm in the prior art can encrypt the password to obtain a HASH password, such as MD5, SHA-1 and other algorithms.

[0021] In addition, in this embodiment, the UTOFS file system running on the electronic device is a user space file system FUSE technology, that is, the user can customize and implement his own file system in the user space through fuse.

[0022] In this embodiment, Figure 4 As shown, the generation of the above-mentioned keys includes the generation of a file name encryption key and a file content encryption key, and the key file is written into the read-only area of ​​the electronic device to realize the credit authorization of the electronic device; specifically, the encryption of the original file includes file name encryption and file content encryption, and the original file name and the original file content are encrypted by the file name encryption key and the file content encryption key to obtain the encrypted file name and the encrypted file content; the decryption of the encrypted file includes the decryption of the encrypted file name and the decryption of the encrypted file content, and the encrypted file name and the encrypted file content are decrypted by the file name encryption key and the file content encryption key to obtain the original file name and the original file content.

[0023] In another embodiment of the present invention, a method for transparent encryption and decryption of data based on cloud authentication is disclosed, such as Figure 5-10 As shown, the method is implemented based on the above system, and the method includes encryption and decryption of files (data), specifically including the following steps: Step 1: The administrator accesses the cloud server and creates a user through the cloud authentication platform. The cloud authentication platform automatically generates a unique string as the login password, and the user is uniquely located through the string; Step 2: The cloud authentication platform obtains the corresponding master key from the user's login password through the Scrypt algorithm, and derives the master key into two sub-keys through the HKDF derivation function, one of which is used to encrypt the file name and the other is used to encrypt the file content. The sub-keys are written into the read-only area of ​​the electronic device for electronic device credit authorization; Step 3: The user accesses the cloud server on the electronic device after being authorized, logs in with the username and password through the UTOFS system, and after successful authentication, the UTOFS system is automatically called up to mount the encrypted file of the encrypted file server to the authorized electronic device through the network protocol; Step 4: Encrypt and decrypt the encrypted file using the key obtained in step 2; including file name encryption, file name decryption, file content encryption, and file content decryption, to obtain the encrypted file name, original file name, encrypted file content, and original file content; Step 5: The original file name and original file content obtained in step 4 are used normally on the trusted electronic device, and the encrypted file name and encrypted file content obtained are synchronously stored on the encrypted file server.

[0024] like Figure 5 As shown in the figure, it is the process of generating the key in step 2 above. The user token is a unique identifier automatically generated by the cloud authentication system when the user is created. It is essentially a 32-bit random string that uniquely locates the user. The user token can obtain a corresponding master key through the Scrypt algorithm. The master key subsequently generates two other component keys for file name encryption and file content encryption. The master key is essentially a string, and its generation process is as follows: Figure 6 Specifically, the master key is generated by combining the user's password (user token) and random salt through the Scrypt algorithm, including the following steps: S21: Randomly generate a piece of data as a salt value to obtain a random salt; S22: Set the parameters of the Scrypt algorithm, including difficulty factor, buffer block size, and parallel parameters; S23: Take the password, random salt, and set parameters as input, calculate through the Scrypt algorithm, and obtain the output master key.

[0025] From the above process, we can see that the generation process of the master key is related to random salt, difficulty factor, buffer block size, parallel parameters, key length requirements, etc. The Scrypt algorithm is a password-derived function designed to resist hardware-based brute force attacks and rainbow table attacks. It increases the difficulty of cracking by utilizing a large amount of memory and sequential calculations, making hash operations more difficult in resource-constrained environments. The Scrypt algorithm is often used in scenarios such as password storage and key generation to enhance security.

[0026] In this embodiment, in the above step 2, the generation of the sub-key is derived from the main key. Specifically, the above-mentioned more secure main key string is obtained through the user token. Starting from the main key, two sub-key strings are generated through the HKDF derivation function and the encryption algorithm to be used is specified. One of the sub-keys is used to generate a key for file name encryption through the HKDF-SHA256 derivation function, and the other sub-key is used in the AES-256-GCM encryption algorithm to obtain a key for file content encryption.

[0027] HKDF (HMAC-based Extract-and-Expand Key Derivation Function) is a key derivation function based on HMAC, which is designed to securely derive key material from shared secret information of arbitrary length. HKDF is usually used in two main stages: Extract and Expand.

[0028] Extraction: Mainly to deal with the situation where the original shared secret may not be a truly random number. If the original key material (IKM, Initial Key Material) is not random or has potential weaknesses, HKDF uses a strong pseudo-random function (PRF), usually HMAC-SHA256, to create a key material (SK, Salted Key) that is closer to a truly random number.

[0029] Extension: After extraction, the obtained SK can be used to derive multiple keys. This process uses HMAC as PRF again, adding an information (Info) field and an optional sequence number (L) to generate the output key material (OKM, Output Key Material) of the required length. This can derive keys for different purposes, such as encryption keys, authentication keys, etc.

[0030] The main advantage of HKDF is its flexibility and adaptability. It can accept any type of input key material (e.g., passwords, shared keys, random numbers, etc.) and can derive keys suitable for specific application scenarios. In addition, due to the use of HMAC, HKDF also has good security guarantees.

[0031] In this embodiment, Figure 7 As shown, in the above step 4, the file name encryption process is the CBC mode of the AES symmetric encryption algorithm, including the following steps: S401: using a random number generator to generate a random vector for file name encryption, and creating an AES encryption object of the file name by using the random vector for file name encryption and a key for file name encryption; S402: Create a PKSC7 filler through the AES encryption object of the file name, and use the PKSC7 filler to fill the file name to obtain a filled file name; S403: Encrypt the filled file name using the AES encryption object of the file name to obtain an encrypted file name, and concatenate the random vector of the file name encryption and the encrypted file name to obtain concatenated data; S404: Perform Base64 encoding on the concatenated data to obtain a Base64 encoded string of the encrypted file name, thereby achieving file name encryption.

[0032] In this embodiment, Figure 8 As shown, in the above step 4, the process of file name decryption is the reverse process of file name encryption, including the following steps: S411: Obtain the encrypted file name, and perform Base64 decoding on the encrypted file name to obtain the concatenated data of the original file name; S412: extracting the encrypted ciphertext of the file name and the random vector when the file name is encrypted from the data after the original file name is concatenated; S413: Create an AES decryption object for the file name using the key for file name encryption and the random vector for file name encryption, and use the AES decryption object for file name to decrypt the ciphertext encrypted by the file name to obtain the filled file name; S414: Remove the PKCS7 padding from the padded file name to obtain the original file name, thereby decrypting the file name.

[0033] In this embodiment, Fig. 9 As shown, in the above step 4, the process of encrypting the file content includes the following steps: S421: Generate a random vector for file content encryption using a random number generator, and create an AES encryption object of the file content using the random vector for file content encryption and a key for file content encryption; S422: Read the binary content of the original file content, and encrypt the file binary content using the AES encryption object of the file content to obtain the encrypted binary content; S423: Obtain the authentication tag of the AES encryption object of the file content, and write the random vector, the authentication tag, and the encrypted binary content into the file at the same time to generate an encrypted file, thereby realizing file content encryption.

[0034] In this embodiment, Fig.10 As shown, in the above step 4, the process of file content decryption is the reverse process of file content encryption, including the following steps: S431: Obtain the encrypted file, read its binary content, and parse out the ciphertext binary content, the authentication tag, and the random vector when the file content is encrypted; S432: Create an AES decryption object of the file content using the authentication tag, the random vector encrypted by the file content, and the key encrypted by the file content; S433: Decrypt the ciphertext binary content using the AES decryption object of the file content to obtain the restored original file binary content; S434: verifying the restored binary content of the original file using the authentication tag to obtain the verified binary content of the original file; S435: Write the verified original binary content into a new file to obtain the original file content, thereby decrypting the file content.

[0035] Through the above content, the present invention discloses a system and method including permission management and data encryption and decryption. The system identifies and authenticates permissions through the user identity authenticated by the cloud, as well as generates and uses keys to achieve the functions of transparent encryption and decryption of data and permission control.

[0036] Compared with the prior art, the present invention has the following advantages: 1. In the encryption and decryption process of the present invention, binary type files are used, the data protection level is high and the security is good; 2. The encryption and decryption process of the present invention is implemented at the system level of the computer, including the authorization of electronic devices and the authentication of users. Encrypted files can only be viewed on the authorized device after successful authentication, thus preventing file leakage from the source. After leaving the authorized environment, data cannot be read normally, thus reducing the risk of data leakage; 3. The encryption and decryption process of the present invention is implemented at the system level of the computer, and does not rely on the network to perform transparent encryption and decryption of files, thereby ensuring the real-time performance of data encryption and decryption.

[0037] The above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Other modifications or equivalent substitutions made to the technical solution of the present invention by ordinary technicians in this field should be included in the scope of the claims of the present invention as long as they do not depart from the spirit and scope of the technical solution of the present invention.

Claims

1. A data transparent encryption and decryption system based on cloud authentication, characterized by: The system includes an encrypted file server, a cloud server and an electronic device, wherein the cloud server deploys a cloud authentication system, and the cloud authentication system includes a cloud authentication platform and a UTOFS file system running on the electronic device; The cloud authentication platform is used for user creation, user authentication and key generation. User names and login passwords are created through the web page and stored through the cloud server. The electronic device is used to write a key in the read-only area for credit authorization, log in to the UTOFS file system for authentication, and encrypt and decrypt files based on the key; The UTOFS file system performs login authentication on the electronic device based on the user name and login password, and mounts the encrypted file on the electronic device with the credit authentication; The encrypted file server is used to store encrypted files.

2. According to claim 1, a data transparent encryption and decryption system based on cloud authentication is characterized in that: The cloud authentication platform includes the setting of username and password in the process of user creation, encrypts the password to obtain a HASH password, and stores the HASH password as the login password and username in the cloud server; When logging in to the UTOFS file system, if the username and login password you enter correspond to the username and login password of the cloud server, the authentication will pass; otherwise, the authentication will fail.

3. According to the cloud-based authentication data transparent encryption and decryption system of claim 1, it is characterized by: The generation of the key includes the generation of a file name encryption key and a file content encryption key; The encryption of the original file includes file name encryption and file content encryption, and the original file name and the original file content are encrypted by the file name encryption key and the file content encryption key to obtain the encrypted file name and the encrypted file content; The decryption of the encrypted file includes decryption of the encrypted file name and decryption of the encrypted file content. The encrypted file name and the encrypted file content are decrypted by the file name encryption key and the file content encryption key to obtain the original file name and the original file content.

4. A method for transparent data encryption and decryption based on cloud authentication according to any one of claims 1 to 3, characterized in that: The method includes encryption and decryption of files, and specifically includes the following steps: Step 1: The administrator accesses the cloud server and creates a user through the cloud authentication platform. The cloud authentication platform automatically generates a unique string as the login password, and the user is uniquely located through the string; Step 2: The cloud authentication platform obtains the corresponding master key from the user's login password through the Scrypt algorithm, and derives the master key into two sub-keys through the HKDF derivation function, one of which is used to encrypt the file name and the other is used to encrypt the file content. The sub-keys are written into the read-only area of ​​the electronic device for electronic device credit authorization; Step 3: The user accesses the cloud server on the electronic device after being authorized, logs in with the username and password through the UTOFS file system, and after successful authentication, the UTOFS file system is automatically called up, and the encrypted files of the encrypted file server are mounted to the authorized electronic device through the network protocol; Step 4: Encrypt and decrypt the encrypted file using the key obtained in step 2; including file name encryption, file name decryption, file content encryption, and file content decryption, to obtain the encrypted file name, original file name, encrypted file content, and original file content; Step 5: The original file name and original file content obtained in step 4 are used normally on the trusted electronic device, and the encrypted file name and encrypted file content obtained are synchronously stored on the encrypted file server.

5. The method for transparent data encryption and decryption based on cloud authentication according to claim 4, characterized in that: In step 2, the master key is generated by combining the user's password and random salt through the Scrypt algorithm, including the following steps: S21: Randomly generate a piece of data as a salt value to obtain a random salt; S22: Set the parameters of the Scrypt algorithm, including difficulty factor, buffer block size, and parallel parameters; S23: Take the password, random salt, and set parameters as input, calculate through the Scrypt algorithm, and obtain the output master key.

6. The method for transparent data encryption and decryption based on cloud authentication according to claim 4, characterized in that: In step 2, the master key generates two sub-keys through the HKDF derivation function, one of which is used to generate a key for file name encryption through the HKDF-SHA256 derivation function, and the other sub-key is used in the AES-256-GCM encryption algorithm to obtain a key for file content encryption.

7. The method for transparent data encryption and decryption based on cloud authentication according to claim 4, characterized in that: In step 4, the process of encrypting the file name includes the following steps: S401: using a random number generator to generate a random vector for file name encryption, and creating an AES encryption object of the file name by using the random vector for file name encryption and a key for file name encryption; S402: Create a PKSC7 filler through the AES encryption object of the file name, and use the PKSC7 filler to fill the file name to obtain a filled file name; S403: Encrypt the filled file name using the AES encryption object of the file name to obtain an encrypted file name, and concatenate the random vector of the file name encryption and the encrypted file name to obtain concatenated data; S404: Perform Base64 encoding on the concatenated data to obtain a Base64 encoded string of the encrypted file name, thereby achieving file name encryption.

8. The method for transparent data encryption and decryption based on cloud authentication according to claim 7, characterized in that: In step 4, the process of file name decryption is the reverse process of file name encryption, including the following steps: S411: Obtain the encrypted file name, and perform Base64 decoding on the encrypted file name to obtain the concatenated data of the original file name; S412: extracting the encrypted ciphertext of the file name and the random vector when the file name is encrypted from the data after the original file name is concatenated; S413: Create an AES decryption object for the file name using the key for file name encryption and the random vector for file name encryption, and use the AES decryption object for file name to decrypt the ciphertext encrypted by the file name to obtain the filled file name; S414: Remove the PKCS7 padding from the padded file name to obtain the original file name, thereby decrypting the file name.

9. The method for transparent data encryption and decryption based on cloud authentication according to claim 4, characterized in that: In step 4, the process of encrypting the file content includes the following steps: S421: Generate a random vector for file content encryption using a random number generator, and create an AES encryption object of the file content using the random vector for file content encryption and a key for file content encryption; S422: Read the binary content of the original file content, and encrypt the file binary content using the AES encryption object of the file content to obtain the encrypted binary content; S423: Obtain the authentication tag of the AES encryption object of the file content, and write the random vector, the authentication tag, and the encrypted binary content into the file at the same time to generate an encrypted file, thereby realizing file content encryption.

10. The method for transparent data encryption and decryption based on cloud authentication according to claim 9, characterized in that: In step 4, the process of decrypting the file content is the reverse process of encrypting the file content, and includes the following steps: S431: Obtain the encrypted file, read its binary content, and parse out the ciphertext binary content, the authentication tag, and the random vector when the file content is encrypted; S432: Create an AES decryption object of the file content using the authentication tag, the random vector encrypted by the file content, and the key encrypted by the file content; S433: Decrypt the ciphertext binary content using the AES decryption object of the file content to obtain the restored original file binary content; S434: verifying the restored binary content of the original file using the authentication tag to obtain the verified binary content of the original file; S435: Write the verified original binary content into a new file to obtain the original file content, thereby decrypting the file content.

Images