Safe and easy-to-use file safe box implementation method and system based on eCryptfs

Abstract

The invention discloses a safe and easy-to-use file safe box implementation method and system based on eCryptfs. A user inputs a first character string as an input password bPassword; a random password ePassword is generated, and the ePassword is used for encrypting or decrypting a file of the eCryptfs; the ePassword and the bPassword are spliced, so that an'ePassword 'and a'bPassword' are formed, and then the'ePassword 'and the'bPassword' are formed; the bPassword is used as a secret key, and the'ePassword 'and the bPassword' are encrypted and stored in a database; and generating a random password, encrypting the bPassword by using the password as a key, and storing the encrypted bPassword in a database. According to the application, the password and the password are controlled in the form of the secret key, and the plaintext password and the plaintext secret key are not stored in the database, so that the security is ensured.

Description

Technical Field

[0001] The present invention relates to the field of data security, and specifically relates to a method and system for implementing a secure and easy-to-use file safe based on eCryptfs. Background Art

[0002] File encryption is a key data protection technology in the Linux operating system. To meet user demands for file security, Linux offers a variety of encrypted file system solutions, such as EncFS. These encrypted file systems encrypt data at the file system level, providing a powerful protection mechanism for user data.

[0003] EncFS is an encrypted file system based on FUSE (File System in Userspace), developed and open-sourced by Valiant Gough. EncFS runs in user space and uses the interface provided by FUSE to interact with the kernel to implement file encryption and decryption. EncFS uses its own encryption algorithm for file encryption, supporting multiple algorithms such as AES and Bluefish. The encryption key is primarily derived from the user's password. EncFS's encryption method is relatively simple, focusing on providing basic file encryption capabilities. Primarily for individual users, EncFS offers an easy-to-use encrypted file system solution.

[0004] These encrypted file systems mainly provide underlying file system encryption capabilities and are relatively unusable: 1) Since the set password is used as a key to encrypt files, if the password needs to be changed, the file system must be decrypted using the original password, and then the encryption password must be reset and the file system re-encrypted with the new password. This entire process is both time-consuming and cumbersome. Since the encrypted file system needs to be decrypted during this process, other privileged users can steal the decrypted files at this point, posing a security risk. 2) In cloud computing or cloud storage scenarios, a large number of users share computing and storage resources, making it impossible to uniformly manage the large number of encrypted file systems created by users. 3) If a user forgets the password, the file will no longer be open.

[0005] Application Contents

[0006] In order to overcome the shortcomings of the existing technology, the present application provides a safe and easy-to-use file safe implementation method and system based on eCryptfs, which can support the modification of the password of the file safe without decrypting the encrypted files; prevent other users from stealing files when accessing the file safe; provide the ability to uniformly manage the file safe; and when the password is forgotten, it can be retrieved through a password or other means.

[0007] In order to achieve the above objectives, this application adopts the following technical solutions:

[0008] A method for implementing a secure and easy-to-use file safe based on eCryptfs, comprising creating the file safe, wherein the creating the file safe comprises:

[0009] The user enters the first string as the input password bPassword;

[0010] Generate a random second character string as the eCryptfs password ePassword, where the ePassword is used to encrypt or decrypt files in the eCryptfs;

[0011] Concatenate the ePassword and the bPassword to form a plaintext string "ePassword+bPassword";

[0012] Using the bPassword as a key, encrypting the “ePassword+bPassword” and storing it in a database; and

[0013] A random third character string is generated as a password, and the password is used as a key to encrypt the bPassword and store the encrypted data in a database.

[0014] Furthermore, the method further includes opening the document safe, wherein the opening of the document safe includes:

[0015] The user establishes a dbus connection to the backend service;

[0016] The user enters a first password;

[0017] Read the "ePassword+bPassword" and decrypt it using the bPassword to verify whether the first password is the bPassword; and

[0018] If so, the file safe is opened, and when the user opens the encrypted file, the encrypted file is decrypted using eCryptfs through the ePassword, and the decrypted file is placed in the backend service.

[0019] Furthermore, the method further includes deleting the document safe, wherein the deleting the document safe includes:

[0020] The user establishes a dbus connection to the backend service;

[0021] The user enters a first password;

[0022] Read the "ePassword+bPassword" and decrypt it using the bPassword to verify whether the first password is the bPassword; and

[0023] If so, the document safe is deleted.

[0024] Furthermore, the method further includes modifying the password of the file safe, wherein modifying the password of the file safe includes:

[0025] The user enters a second password;

[0026] Read the "ePassword+bPassword" and decrypt it using the bPassword to verify whether the second password is the bPassword;

[0027] If not, password modification is not allowed;

[0028] If so, the third password is allowed to be input, and the third password is used as the new input password bPassword. The third password is used as the key to encrypt the "ePassword+new input password bPassword" and store it in the database.

[0029] Furthermore, the method further includes retrieving the password of the document safe, wherein retrieving the password of the document safe includes:

[0030] The user inputs the password;

[0031] The encrypted bPassword is read, and the encrypted bPassword is decrypted using the password to obtain the decrypted bPassword.

[0032] In addition, this application also provides a secure and easy-to-use file safe implementation system based on eCryptfs, including:

[0033] database;

[0034] eCryptfs; and

[0035] A service module, configured to receive a first character string input by a user as an input password bPassword; the service module is further configured to generate a random second character string as an eCryptfs password ePassword, wherein the ePassword is used to encrypt or decrypt files in eCryptfs;

[0036] The service module is further configured to concatenate the ePassword and the bPassword to form a plaintext string "ePassword+bPassword"; and, using the bPassword as a key, encrypt the "ePassword+bPassword" and store the encrypted string in the database.

[0037] The service module is further configured to generate a random third character string as a password, and the service module is further configured to use the password as a key to encrypt the bPassword and store the encrypted data in the database.

[0038] Furthermore, it also includes:

[0039] Backend service, used to establish a dbus connection with the user;

[0040] When the user enters the first password, the service module is configured to read the "ePassword+bPassword" and decrypt it using the bPassword to verify whether the first password is the bPassword; if so, the user opens the file safe;

[0041] When the user opens the encrypted file, the eCryptfs is further used to decrypt the encrypted file through the ePassword, and the decrypted file is placed in the backend service.

[0042] Furthermore, it also includes:

[0043] Backend service, used to establish a dbus connection with the user;

[0044] When the user enters the first password, the service module is further configured to read the "ePassword+bPassword" and decrypt it using the bPassword to verify whether the first password is the bPassword; if so, the user deletes the file safe.

[0045] Further, including:

[0046] When the user enters a second password, the service module is further configured to read the "ePassword+bPassword" and decrypt it using the bPassword to verify whether the second password is the bPassword;

[0047] If not, the user is not allowed to change the password;

[0048] If so, the user is allowed to enter a third password. The service module is further configured to use the third password as a new input password bPassword, and use the third password as a key to encrypt the "ePassword+new input password bPassword" and store it in the database.

[0049] Further, including:

[0050] When the user inputs the password, the service module is further configured to read the encrypted bPassword and decrypt the encrypted bPassword using the password to obtain the decrypted bPassword.

[0051] Compared with the prior art, this application has the following advantages:

[0052] Through the use of this application, passwords and passphrases are controlled in the form of keys. Plain text passwords and keys are not stored in the database, ensuring security. When changing a password, only the encrypted "ePassword + bPassword" string needs to be replaced, without the need to encrypt or decrypt data files, ensuring efficient and secure password changes. Password retrieval is supported. When accessing a file safe, other users are prevented from stealing files. Provides the ability to centrally manage file safes. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application but do not constitute an improper limitation on the present application. In the drawings:

[0054] Figure 1 A flowchart for creating a document safe for this application;

[0055] Figure 2 An example diagram of creating a document safe for this application;

[0056] Figure 3 This is an example diagram of opening a document safe for this application;

[0057] Figure 4 This is an example diagram of changing the password of the file safe for this application;

[0058] Figure 5 This is an example diagram of retrieving the password for the document safe in this application;

[0059] Figure 6 This is an example diagram of each operation of this application;

[0060] Figure 7 The framework of the system for this application Figure 1;

[0061] Figure 8 The framework of the system for this application Figure 2 .

[0062] Figure 9-19 This is a presentation operation method of a specific embodiment of the present application. DETAILED DESCRIPTION

[0063] In order to enable people skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0064] In the description of this application, it should be understood that the orientation or positional relationship indicated by terms and the like is based on the orientation or positional relationship shown in the accompanying drawings, and is only for the convenience of describing this application and simplifying the description, rather than indicating or implying that the device, element, module, system, platform or device referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on this application. The following description of this application is only to be understood as a description of individual embodiments of the technical solution of this application. Other embodiments are not reflected in the following description, but it does not mean that this application excludes these other embodiments, and the technical solution of this application is not limited to the specific implementation methods described below, and the scope of protection of this application is not limited to only the specific implementation methods described below. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work should fall within the scope of protection of this application.

[0065] It should be noted that, if the terms "first", "second", etc. appear in the specification and claims of the present application and the above-mentioned drawings, the description is only used to distinguish similar objects and is not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0066] In some embodiments, the present application provides a method for implementing a secure and easy-to-use file safe based on eCryptfs, including creating the file safe, opening the file safe, deleting the file safe, modifying the password of the file safe, and retrieving the password of the file safe.

[0067] In some embodiments, specifically, the operation of creating the document safe is as follows: Figure 1 As shown, including:

[0068] S1: The user enters the first character string as the input password bPassword;

[0069] S2: Generate a random second character string as the eCryptfs password ePassword, which is used to encrypt or decrypt files in eCryptfs;

[0070] S3: Concatenate the ePassword and the bPassword to form a plaintext string "ePassword+bPassword";

[0071] S4: Using the bPassword as a key, encrypt the “ePassword+bPassword” and store it in a database; and

[0072] S5: Generate a random third character string as a password, use the password as a key to encrypt the bPassword, and store the encrypted data in a database.

[0073] Specifically, such as Figure 2 As shown, the specific process of creating a safe can be as follows:

[0074] 1) Generate a random number as the ePassword. The ePassword is never exposed to the user during the encryption and decryption process, and is not stored in plain text, so it does not need to be modified.

[0075] 2) Using the user's password (bPassword) as the key, encrypt "ePassword + bPassword" and store it in the database. The reason bPassword is included here is to verify whether the entered password is correct when the safe is opened later.

[0076] 3) Generate a random string as a password and provide it to the user. The user can use this password to retrieve the password. For security reasons, the password cannot be stored in the system in plain text. Therefore, the password is used as the key to symmetrically encrypt bPassword and then store it in the database.

[0077] In some embodiments, specifically, the operation of opening the document safe includes:

[0078] The user establishes a dbus connection to the backend service;

[0079] The user enters a first password;

[0080] Read the "ePassword+bPassword" and decrypt it using the bPassword to verify whether the first password is the bPassword; and

[0081] If so, the file safe is opened, and when the user opens the encrypted file, the encrypted file is decrypted using eCryptfs through the ePassword, and the decrypted file is placed in the backend service.

[0082] Specifically, opening the safe requires decrypting the encrypted file system. The eCryptfs decryption method is to mount the encrypted file system, and the plaintext data is stored in the mounted path. The disadvantage is that other privileged users can access it, which poses a certain security risk.

[0083] like Figure 3 As shown, the operation of opening the document safe can be as follows:

[0084] This application provides a separate backend service that stores the decrypted data in memory. Users request the backend service through a dbus connection. Each connection will have a unique identifier. Only when the identifier successfully opens the safe can the data in the safe be operated.

[0085] In some embodiments, specifically, the operation of deleting the document safe may include:

[0086] The user establishes a dbus connection to the backend service;

[0087] The user enters a first password;

[0088] Read the "ePassword+bPassword" and decrypt it using the bPassword to verify whether the first password is the bPassword; and

[0089] If so, the document safe is deleted.

[0090] It can be seen that when deleting a safe, you need to verify the password first. The safe can only be deleted after the password is verified.

[0091] In some embodiments, specifically, the operation of modifying the password of the document safe may include:

[0092] The user enters a second password;

[0093] Read the "ePassword+bPassword" and decrypt it using the bPassword to verify whether the second password is the bPassword;

[0094] If not, password modification is not allowed;

[0095] If so, the third password is allowed to be input, and the third password is used as the new input password bPassword. The third password is used as the key to encrypt the "ePassword+new input password bPassword" and store it in the database.

[0096] Specifically, such as Figure 4 As shown, the operation of modifying the password of the file safe can be specifically as follows:

[0097] 1) When changing the password, the user will first enter the old password. After entering the password, the previously encrypted "ePassword+bPassword" will be retrieved from the database and then decrypted using the old password as the key;

[0098] 2) After decryption, the plaintext string "ePassword+bPassword" is obtained. The old password entered by the user is compared with the bPassword in the plaintext string to determine whether the entered password is correct. If it is incorrect, the password cannot be changed;

[0099] 3) If the old password is correct, enter the new password and use it as the key to re-encrypt the "ePassword + bPassword" combination. bPassword is now replaced with the new password. Since the ePassword remains unchanged throughout the process, there's no need to decrypt and re-encrypt the file system, ensuring efficiency and security throughout the entire process.

[0100] In some embodiments, specifically, the operation of retrieving the password of the document safe may include:

[0101] The user inputs the password;

[0102] The encrypted bPassword is read, and the encrypted bPassword is decrypted using the password to obtain the decrypted bPassword.

[0103] Specifically, such as Figure 5 As shown, when retrieving the password, the user needs to first enter the password set when creating the safe, then retrieve the data of the original password encrypted with the password, and use the password entered by the user as the key to decrypt the data to obtain the password.

[0104] In some embodiments, specifically, Figure 6The process of creating the file safe, opening the file safe, deleting the file safe, modifying the password of the file safe and retrieving the password of the file safe is shown.

[0105] In some embodiments, as Figure 7 As shown, the present application also provides a secure and easy-to-use file safe implementation system 1 based on eCryptfs, including:

[0106] Database 11;

[0107] eCryptfs12; and

[0108] The service module 13 is configured to receive a first character string input by a user as an input password bPassword; the service module 13 is further configured to generate a random second character string as an eCryptfs password ePassword, wherein the ePassword is used to encrypt or decrypt files in the eCryptfs;

[0109] The service module 13 is further configured to concatenate the ePassword and the bPassword to form a plain text string "ePassword+bPassword"; and, using the bPassword as a key, encrypt the "ePassword+bPassword" and store the encrypted string in the database.

[0110] The service module 13 is further configured to generate a random third character string as a password, and the service module 12 is further configured to use the password as a key to encrypt the bPassword and store the encrypted data in the database.

[0111] In some embodiments, as Figure 8 As shown, it also includes:

[0112] Backend service 14, used to establish a dbus connection with the user;

[0113] When the user enters the first password, the service module 12 is configured to read the "ePassword+bPassword" and decrypt it using the bPassword to verify whether the first password is the bPassword; if so, the user opens the file safe;

[0114] When the user opens the encrypted file, the eCryptfs 13 is further used to decrypt the encrypted file using the ePassword, and the decrypted file is stored in the backend service 14 .

[0115] In some embodiments, when the user enters the first password, the service module 12 is further configured to read the "ePassword+bPassword" and decrypt it using the bPassword to verify whether the first password is the bPassword; if so, the user deletes the file safe.

[0116] In some embodiments, when the user enters the second password, the service module 12 is further configured to read the "ePassword+bPassword" and decrypt it using the bPassword to verify whether the second password is the bPassword;

[0117] If not, the user is not allowed to change the password;

[0118] If so, the user is allowed to enter a third password. The service module 12 is further configured to use the third password as a new input password bPassword, and use the third password as a key to encrypt the "ePassword+new input password bPassword" and store it in the database.

[0119] In some embodiments, when the user enters the password, the service module 12 is further configured to read the encrypted bPassword and decrypt the encrypted bPassword using the password to obtain the decrypted bPassword.

[0120] In some embodiments, specifically, the specific presentation of the solution of the present application can be as follows:

[0121] 1) If Figure 9-10 As shown, click New, a dialog box for creating a safe will pop up, enter the name (test) and password (boxtest123), click the Confirm button, if the creation is successful, a box will pop up to display the password of the safe.

[0122] 2) If Figure 11-13 As shown, double-click the safe, an unlock dialog box pops up, enter the correct password, and a dialog box pops up to prompt that the unlock is successful. Double-click the safe again to open it.

[0123] 3) If Figure 14-15 As shown, right-click on the safe to display the pop-up menu, select Change Password, and a Change Password dialog box will pop up. Enter the current password (boxtest123) and the new password (boxtest124) and click Confirm. If the verification is correct, a Change Success dialog box will pop up.

[0124] 4) If Figure 16-17As shown, right-click on the safe to display the pop-up menu, select Retrieve Password, and a Retrieve Password dialog box will pop up. Enter the password returned in step 1 (23c1 f313) and click OK. If the password is correct, the current password (boxtest124) will be returned.

[0125] 5) If Figure 18-19 As shown in the figure, right-click the safe location to pop up the menu, select Delete, and the Delete Safe dialog box will pop up. Enter the current password and click Confirm. If the password is correct, the Delete Success dialog box will pop up.

[0126] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0127] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A method for implementing a safe and easy-to-use file safe based on eCryptfs, comprising creating the file safe, characterized in that: The step of creating the document safe comprises: The user enters the first string as the input password bPassword; Generate a random second character string as the password ePassword of eCryptfs, wherein the ePassword is used to encrypt or decrypt files of eCryptfs; Concatenate the ePassword and the bPassword to form a plain text string "ePassword+bPassword"; Using the bPassword as a key, encrypting the "ePassword+bPassword" and storing it in a database; and A random third character string is generated as a password, and the password is used as a key to encrypt the bPassword and store it in a database.

2. The method for implementing a safe and easy-to-use file safe based on eCryptfs according to claim 1, characterized in that: The method further includes opening the document safe, wherein the opening of the document safe includes: The user establishes a dbus connection to the backend service; The user inputs a first password; Read the "ePassword+bPassword" and use the bPassword to decrypt it, and verify whether the first password is the bPassword; and If so, the file safe is opened, and when the user opens the encrypted file, the encrypted file is decrypted using eCryptfs through the ePassword, and the decrypted file is placed in the backend service.

3. The method for implementing a safe and easy-to-use file safe based on eCryptfs according to claim 1, characterized in that: The method further includes deleting the document safe, wherein the deleting the document safe includes: The user establishes a dbus connection to the backend service; The user inputs a first password; Read the "ePassword+bPassword" and use the bPassword to decrypt it, and verify whether the first password is the bPassword; and If so, the document safe is deleted.

4. The method for implementing a safe and easy-to-use file safe based on eCryptfs according to claim 1, 2 or 3, characterized in that: The method further includes modifying the password of the file safe, wherein modifying the password of the file safe includes: The user inputs a second password; Read the "ePassword+bPassword" and use the bPassword to decrypt it, and verify whether the second password is the bPassword; If not, password modification is not allowed; If so, the third password is allowed to be input, and the third password is used as the new input password bPassword. The third password is used as the key to encrypt the "ePassword+new input password bPassword" and store it in the database.

5. The method for implementing a safe and easy-to-use file safe based on eCryptfs according to claim 1, characterized in that: The method further includes retrieving the password of the document safe, wherein retrieving the password of the document safe includes: The user inputs the password; The encrypted bPassword is read, and the encrypted bPassword is decrypted using the password to obtain the decrypted bPassword.

6. A safe and easy-to-use file safe implementation system based on eCryptfs, characterized in that: include: database; eCryptfs; as well as A service module, used for receiving a first character string input by a user as an input password bPassword; The service module is further used to generate a random second string as the password ePassword of eCryptfs, and the ePassword is used to encrypt or decrypt files of eCryptfs; The service module is further used to concatenate the ePassword and the bPassword to form a plain text string "ePassword+bPassword"; And, using the bPassword as a key, encrypting the "ePassword+bPassword" and storing it in the database; The service module is further used to generate a third random character string as a password. The service module is further used to use the password as a key to encrypt the bPassword and store it in the database.

7. The secure and easy-to-use file safe implementation system based on eCryptfs according to claim 6, characterized in that: Also includes: A backend service, used to establish a dbus connection with the user; When the user enters the first password, the service module is used to read the "ePassword+bPassword" and use the bPassword to decrypt it, and verify whether the first password is the bPassword; If yes, the user opens the document safe; When the user opens the encrypted file, the eCryptfs is also used to decrypt the encrypted file through the ePassword, and the decrypted file is placed in the backend service.

8. The secure and easy-to-use file safe implementation system based on eCryptfs according to claim 6, characterized in that: Also includes: A backend service, used to establish a dbus connection with the user; When the user inputs the first password, the service module is further used to read the "ePassword+bPassword" and use the bPassword to decrypt it, and verify whether the first password is the bPassword; If so, the user deletes the document safe.

9. The secure and easy-to-use file safe implementation system based on eCryptfs according to claim 6, 7 or 8, characterized in that: include: When the user enters the second password, the service module is further used to read the "ePassword+bPassword" and use the bPassword to decrypt it, and verify whether the second password is the bPassword; If not, the user is not allowed to change the password; If so, the user is allowed to input a third password, and the service module is further configured to use the third password as a new input password bPassword, and use the third password as a key to encrypt the "ePassword+new input password bPassword" and store it in the database.

10. The secure and easy-to-use file safe implementation system based on eCryptfs according to claim 6, characterized in that: include: When the user inputs the password, the service module is further configured to read the encrypted bPassword and decrypt the encrypted bPassword using the password to obtain the decrypted bPassword.

Images