OFD file encryption method

Abstract

The invention relates to the field of OFD file encryption. The invention discloses an OFD file encryption method. The method comprises the steps that a user adopts an encryption server to encrypt an OFD file plaintext, the encryption server sends an OFD file ciphertext to a file user client, and the user client decrypts the OFD file ciphertext after being authorized. Encryption protection is divided into two layers, one layer belongs to a service part, a secret key is updated regularly, and encryption protection of a file is achieved; and the other layer belongs to the system part, and the reading server encrypts the key pair used in the service and the encrypted file again by using the encryption capability of the reading server to form double-layer protection. The method is very convenient to use, the defects of an encryption mode of an existing desktop encryption system are eliminated, double encryption security control over the OFD file is achieved, management is convenient, and the confidentiality effect is good.

Description

Technical Field

[0001] The present invention relates to the field of OFD file encryption, and in particular to an OFD file encryption method. Background Art

[0002] At present, OFD files have begun to be used in various industries, and more and more OFD files with certification information and license information are used in various industries. These files have signature information, which is sufficient to prove that the information is correct, but electronic files are easy to collect and store, and the data inside is easy to extract. In this way, the OFD files issued may become the target of collection by individuals with intentions. Once a large number of such files are collected and a large amount of private information is extracted, it will have a negative impact on individuals, units, groups and even society.

[0003] Although there are some file encryption methods on the market, they are very troublesome to use.

[0004] The desktop encryption system can achieve file-to-file encryption protection, but the installation control of desktop programs is very embarrassing. If the control is not strict, it may be installed anywhere, and anyone who installs the program can open the protected file, and protection becomes empty talk. If the desktop program is strictly controlled, it will bring great inconvenience to the actual business system. With the adjustment of business, the replacement of old and new computers, and the adjustment of personnel, a large amount of desktop program control work will be brought. Over time, the control personnel will give up strict control measures for convenience.

[0005] In addition, there are basically two forms of key control in desktop encryption systems: program integration and plug-in Ukey. When using program integration keys, the program usually cannot be updated in time, so it is difficult to achieve timely update of keys. If the number of encrypted files increases, there will be greater risks; using the Ukey method, it is also inconvenient to update the key pair, and the cost of distributing public keys will increase a lot. Once the Ukey is lost, it will cause more inconvenience. If the private key in the Ukey is used for decryption, each UKey's private key is different, so the public key of the Ukey must be used when encrypting. This can only be done for directional encryption protection, that is, this file can only be distributed to specific readers. If multiple units need to use it at the same time, then multiple units must be encrypted and protected separately, which will bring great inconvenience to the business. UKEY can only be used for one computer terminal, and all business needs to be viewed on the same computer, which will become the biggest bottleneck for business handling.

[0006] Therefore, a safe and convenient OFD file encryption method is urgently needed. Summary of the invention

[0007] The object of the present invention is to provide an OFD file encryption method; An OFD file encryption method, comprising the following steps: (1) The user uses the encryption server to encrypt the plaintext of the OFD file. The encryption server loads the file to be encrypted and generates a verification code. The encryption server generates a random number. (2) The encryption server generates a random password as the secondary password, uses the secondary password to encrypt the encrypted file, the checksum, and the random number, and generates secondary ciphertext data; the secondary password generated by the encryption server is sent to the reading server; (3) Using an asymmetric national secret algorithm to encrypt the secondary password and generate the secondary password ciphertext; (4) The encryption server generates a random password as the first-level password, and uses the first-level password to encrypt the file ID, authorization information, and second-level password ciphertext to generate first-level ciphertext data; the first-level password generated by the encryption server is sent to the reading server; (5) Use an asymmetric national secret algorithm to encrypt the first-level password and generate the first-level password ciphertext; (6) Generate encrypted file header data by using the file identification and version to be encrypted, file ID, authorization mark, and first-level password ciphertext; (7) Save the encrypted file header data, first-level ciphertext data, and second-level ciphertext data as OFD file ciphertext; (8) The encryption server sends the OFD file ciphertext to the file user client; (9) The file user client loads the OFD file ciphertext, the user client communicates with the reader server, obtains the first-level password, and decrypts the first-level ciphertext; (10) The user client obtains the ID of the file to be encrypted and the authorization mark in the first-level ciphertext data, verifies the authorization, and exits if the user client authorization verification fails; (11) If the user client passes the authorization verification, the user client communicates with the reader server, obtains the secondary password through the key service, decrypts the secondary ciphertext data, obtains the source file, and the client loads the source file and performs on-demand display processing; (12) The decrypted plaintext OFD file in step (11) is stored in the memory of the user's client. When the reading terminal is closed, the decrypted plaintext OFD file is automatically cleared.

[0008] Preferably, in step (4), the authorization information includes an authorization time parameter or an authorized number of inquiries, and the OFD file ciphertext cannot be opened after exceeding the authorization limit time.

[0009] Preferably, outdated password pairs are permanently eliminated, and files that have been encrypted with these passwords are permanently sealed.

[0010] Preferably, in step (2) and step (4), the encryption server generates a random password including a long-term key pair and a short-term key pair. If the file needs to be set to a longer period, it is encrypted with the long-term key pair; if the file needs to be set to a shorter period, it is encrypted with the short-term key pair.

[0011] Preferably, in step (4), the file ID is used to determine the number of times the file has been viewed.

[0012] Preferably, password protection can be added. After decryption through steps (9) to (11), the user's password is still required to further unlock and view the file; or Ukey protection can be added, with targeted encryption for a specific Ukey. After decryption through steps (9) to (11), only the file user who has the Ukey can read the file content.

[0013] Compared with the prior art, the present invention has the following beneficial effects: It is very convenient to use, eliminates the drawbacks of the existing desktop encryption system, realizes double encryption control of OFD files, is easy to manage, and has good confidentiality effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a schematic diagram of the method of the present invention; Figure 2 It is a schematic diagram of the encryption and decryption process of the present invention; Figure 3 A schematic diagram of a long-term key pair and a short-term key pair of the present invention; Figure 4 A schematic diagram of a method for a user of the present invention to obtain a file; Figure 5 A schematic diagram of obtaining authorization from a reading server for a reading terminal of the present invention; Figure 6 It is the encryption flow chart of the present invention; Figure 7 Decryption flow chart for the consumer client. DETAILED DESCRIPTION

[0015] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technical personnel in this field without creative work are within the scope of protection of the present invention.

[0016] An OFD file encryption method, comprising the following steps: (1) The user uses the encryption server to encrypt the plaintext of the OFD file. The encryption server loads the file to be encrypted and generates a verification code. The encryption server generates a random number. (2) The encryption server generates a random password as the secondary password, uses the secondary password to encrypt the encrypted file, the checksum, and the random number, and generates secondary ciphertext data; the secondary password generated by the encryption server is sent to the reading server; (3) Using an asymmetric national secret algorithm to encrypt the secondary password and generate the secondary password ciphertext; (4) The encryption server generates a random password as the first-level password, and uses the first-level password to encrypt the file ID, authorization information, and second-level password ciphertext to generate first-level ciphertext data; the first-level password generated by the encryption server is sent to the reading server; (5) Use an asymmetric national secret algorithm to encrypt the first-level password and generate the first-level password ciphertext; (6) Generate encrypted file header data by using the file identification and version to be encrypted, file ID, authorization mark, and first-level password ciphertext; (7) Save the encrypted file header data, first-level ciphertext data, and second-level ciphertext data as OFD file ciphertext; (8) The encryption server sends the ciphertext of the OFD file to the file user client; the encrypted file can be distributed to the user through various channels, such as email, network download, personal storage device, etc. At this time, the file is difficult to crack and there is no need to worry about the file being lost or copied during the distribution process.

[0017] When the file user obtains the OFD file ciphertext, the file user's user client is authorized, and the user can access the reading server through the web. After the WEB-based reader that cooperates with the reading server obtains the reading server's key, it can decrypt it.

[0018] (9) The file user client loads the OFD file ciphertext, the user client communicates with the reader server, obtains the first-level password, and decrypts the first-level ciphertext; (10) The user client obtains the ID of the file to be encrypted and the authorization mark in the first-level ciphertext data, verifies the authorization, and exits if the user client authorization verification fails; (11) If the user client passes the authorization verification, the user client communicates with the reader server, obtains the secondary password through the key service, decrypts the secondary ciphertext data, obtains the source file, and the client loads the source file and performs on-demand display processing; (12) The decrypted plaintext OFD file in step (11) is stored in the memory of the user's client. When the reading terminal is closed, the decrypted plaintext OFD file is automatically cleared.

[0019] In step (4), the authorization information includes the authorization time parameter or the authorized access times. The OFD file ciphertext cannot be opened after the authorization time limit has exceeded. Therefore, it is only used for display. After closing the reader, the data in the memory is also destroyed and no trace is left on the disk.

[0020] Permanently eliminate obsolete password pairs, and files that have been encrypted with these passwords will be permanently sealed.

[0021] In step (2) and step (4), the encryption server generates a random password including a long-term key pair and a short-term key pair. If the file needs to be set to a longer period, it is encrypted with the long-term key pair; if the file is set to a shorter period, it is encrypted with the short-term key pair. The protected file has a time limit, and the confidential file will no longer be opened after the time limit. It cannot be opened normally with non-designated readers to prevent illegal personnel from arbitrarily opening and viewing confidential files.

[0022] In step (4), the file ID is used to determine the number of times the file has been viewed.

[0023] Password protection can be added. After decryption through steps (9) to (11), the user's password is still required to further unlock and view the file; or Ukey protection can be added, with targeted encryption for a specific Ukey. After decryption through steps (9) to (11), only the file user who has the Ukey can read the file content.

[0024] Encryption protection is divided into two layers. One layer belongs to the business part, which regularly updates the public key and the secret key to realize the encryption protection of the file. The other layer belongs to the system part. The reading server uses its own encryption capability to encrypt the key pair used in the business and the encrypted file again, forming a double layer of protection. The key pair used for business is generated and distributed by the business operator, while the key of the reading server is handled by the system maintenance personnel. The two layers of cryptographic keys are managed separately to enhance the protection capability.

[0025] The above shows and describes the basic principles, main features and advantages of the present invention. Technical personnel in this industry should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only preferred examples of the present invention and are not used to limit the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. An OFD file encryption method, characterized in that: The steps include: (1) The user uses the encryption server to encrypt the plaintext of the OFD file. The encryption server loads the file to be encrypted and generates a verification code. The encryption server generates a random number. (2) The encryption server generates a random password as the secondary password, and uses the secondary password to encrypt the encrypted file, the checksum, and the random number to generate secondary ciphertext data; The secondary password generated by the encryption server is sent to the reading server; (3) Using an asymmetric national secret algorithm to encrypt the secondary password and generate the secondary password ciphertext; (4) The encryption server generates a random password as the first-level password, and uses the first-level password to encrypt the file ID, authorization information, and second-level password ciphertext to generate first-level ciphertext data; the first-level password generated by the encryption server is sent to the reading server; (5) Use an asymmetric national secret algorithm to encrypt the first-level password and generate the first-level password ciphertext; (6) Generate encrypted file header data by using the file identification and version to be encrypted, file ID, authorization mark, and first-level password ciphertext; (7) Save the encrypted file header data, first-level ciphertext data, and second-level ciphertext data as OFD file ciphertext; (8) The encryption server sends the OFD file ciphertext to the file user client; (9) The file user client loads the OFD file ciphertext, the user client communicates with the reader server, obtains the first-level password, and decrypts the first-level ciphertext; (10) The user client obtains the ID of the file to be encrypted and the authorization mark in the first-level ciphertext data, verifies the authorization, and exits if the user client authorization verification fails; (11) If the user client passes the authorization verification, the user client communicates with the reader server, obtains the secondary password through the key service, decrypts the secondary ciphertext data, obtains the source file, and the client loads the source file and performs on-demand display processing; (12) The decrypted plaintext OFD file in step (11) is stored in the memory of the user's client. When the reading terminal is closed, the decrypted plaintext OFD file is automatically cleared.

2. The OFD file encryption method according to claim 1, characterized in that: In step (4), the authorization information includes the authorization time parameter or the authorized number of accesses. The OFD file ciphertext cannot be opened after exceeding the authorization limit.

3. The OFD file encryption method according to claim 1, characterized in that: Permanently eliminate obsolete password pairs, and files that have been encrypted with these passwords will be permanently sealed.

4. The OFD file encryption method according to claim 1, characterized in that: In step (2) and step (4), the encryption server generates a random password including a long-term key pair and a short-term key pair. If the file needs to be set to a longer period, it is encrypted with the long-term key pair; if the file is set to a shorter period, it is encrypted with the short-term key pair.

5. The OFD file encryption method according to claim 1, characterized in that: In step (4), the file ID is used to determine the number of times the file has been viewed.

6. The OFD file encryption method according to claim 1, characterized in that: Password protection can be added. After decryption through steps (9) to (11), the user's password is still required to further unlock and view the file; or Ukey protection can be added, with targeted encryption for a specific Ukey. After decryption through steps (9) to (11), only the file user who has the Ukey can read the file content.

Images