A OFD file encryption method

Abstract

The present invention relates to the field of OFD file encryption. The present invention discloses an OFD file encryption method. The steps include: a user uses an encryption server to encrypt the plaintext of the OFD file, the encryption server sends the ciphertext of the OFD file to the file user client, and the user client decrypts it after being authorized. The encryption protection is divided into two layers. One layer belongs to the business part, and the key is updated regularly to realize encryption protection of the file; the other layer belongs to the system part. The reading server uses its own encryption capability to encrypt the key pair used in the business and the encrypted file again, forming a double-layer protection. This method is very convenient to use, eliminates the drawbacks of the encryption method of the existing desktop encryption system, realizes the double encryption security control of the OFD file, is easy to manage, and has a good confidentiality effect.

Description

Technical Field

[0001] The present invention relates to the field of OFD file encryption, and in particular to an OFD file encryption method. Background Art

[0002] Currently, OFD files are being used across various industries, with an increasing number of them containing certification and license information. These documents are signed, providing sufficient proof of the accuracy of the information. However, electronic files are easily collected and stored, and their data easily extracted. Distributed OFD files can become targets for malicious individuals. The collection of large numbers of these files, and the extraction of vast amounts of private information, can negatively impact individuals, organizations, groups, and even society.

[0003] Although there are some file encryption methods on the market, they are very troublesome to use.

[0004] Desktop encryption systems can provide file-by-file encryption protection, but controlling the installation of desktop programs is challenging. Without strict control, programs can be installed anywhere, allowing anyone to open protected files, rendering protection meaningless. Strict control of desktop programs can be a significant inconvenience in real-world business systems. With business adjustments, the replacement of old computers with new ones, and personnel changes, the workload of managing desktop programs increases significantly. Over time, management personnel may abandon strict control measures for the sake of convenience.

[0005] Furthermore, desktop encryption systems generally manage keys in two ways: program integration and plug-in UKey. With program integration, the program often cannot be updated in a timely manner, making it difficult to keep up to date with key updates. This poses a significant risk if the number of encrypted files increases. Using UKey also makes key pair updates inconvenient, and the cost of distributing public keys increases significantly. Losing a UKey can cause even more inconvenience. If decryption is done using the private key within the UKey, each UKey has a different private key, requiring encryption with the UKey's public key. This provides only targeted encryption, meaning that the file can only be distributed to specific readers. If multiple units need to use the system simultaneously, separate encryption must be implemented for each unit, creating significant operational inconvenience. The UKey can only be used on a single computer terminal, requiring all transactions to be accessed from the same computer, creating a significant bottleneck in business operations.

[0006] Therefore, a safe and convenient OFD file encryption method is urgently needed. Summary of the Invention

[0007] The object of the present invention is to provide an OFD file encryption method;

[0008] An OFD file encryption method, comprising the following steps:

[0009] (1) The user uses the encryption server to encrypt the plaintext of the OFD file. The encryption server loads the file to be encrypted and generates a verification code. The encryption server also generates a random number.

[0010] (2) The encryption server generates a random password as the secondary password, uses the secondary password to encrypt the encrypted file, the check code, and the random number to generate secondary ciphertext data; the secondary password generated by the encryption server is sent to the reading server;

[0011] (3) Using an asymmetric national secret algorithm to encrypt the secondary password and generate the secondary password ciphertext;

[0012] (4) The encryption server generates a random password as the first-level password, and uses the first-level password to encrypt the file ID, authorization information, and second-level password ciphertext to generate first-level ciphertext data; the first-level password generated by the encryption server is sent to the reading server;

[0013] (5) Use an asymmetric national secret algorithm to encrypt the first-level password and generate the first-level password ciphertext;

[0014] (6) Generate encrypted file header data by using the file identifier and version, file ID, authorization mark, and first-level password ciphertext to encrypt the file;

[0015] (7) Save the encrypted file header data, first-level ciphertext data, and second-level ciphertext data as OFD file ciphertext;

[0016] (8) The encryption server sends the OFD file ciphertext to the file user client;

[0017] (9) The file user client loads the OFD file ciphertext, the user client communicates with the reader server, obtains the first-level password, and decrypts the first-level ciphertext;

[0018] (10) The user client obtains the ID of the file to be encrypted and the authorization mark in the first-level ciphertext data, verifies the authorization, and exits if the user client authorization verification fails;

[0019] (11) If the user client passes the authorization verification, the user client communicates with the reader server, obtains the secondary password through the key service, decrypts the secondary ciphertext data, obtains the source file, and the client loads the source file and performs on-demand display processing;

[0020] (12) The decrypted plaintext OFD file in step (11) is stored in the memory of the user client. When the reading terminal is closed, the decrypted plaintext OFD file is automatically cleared.

[0021] Preferably, in step (4), the authorization information includes an authorization time parameter or an authorized number of accesses, and the ciphertext of the OFD file cannot be opened after exceeding the authorization limit time.

[0022] Preferably, outdated password pairs are permanently eliminated, and files that have been encrypted with these passwords are permanently sealed.

[0023] Preferably, in step (2) and step (4), the encryption server generates a random password including a long-term key pair and a short-term key pair. If the file needs to be set to a longer period, it is encrypted with the long-term key pair; if the file needs to be set to a shorter period, it is encrypted with the short-term key pair.

[0024] Preferably, in step (4), the file ID is used to determine the number of times the file has been viewed.

[0025] Preferably, password protection can be added. After decryption through steps (9) to (11), the user's password is still required to further unlock and view the file; or Ukey protection can be added. Targeted encryption is performed for a specific Ukey. After decryption through steps (9) to (11), only the file user who has the Ukey can read the file content.

[0026] Compared with the prior art, the present invention has the following beneficial effects:

[0027] It is very easy to use, eliminates the drawbacks of the existing desktop encryption system, and realizes double encryption control of OFD files, which is easy to manage and has good confidentiality effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 Schematic diagram of the method of the present invention;

[0029] Figure 2 This is a schematic diagram of the encryption and decryption process of the present invention;

[0030] Figure 3 Schematic diagram of a long-term key pair and a short-term key pair of the present invention;

[0031] Figure 4 A schematic diagram of a method for users of the present invention to obtain files;

[0032] Figure 5 A schematic diagram of a reading terminal of the present invention obtaining authorization from a reading server;

[0033] Figure 6 It is the encryption flow chart of the present invention;

[0034] Figure 7 Decryption flow chart for the user client. DETAILED DESCRIPTION

[0035] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0036] An OFD file encryption method, comprising the following steps:

[0037] (1) The user uses the encryption server to encrypt the plaintext of the OFD file. The encryption server loads the file to be encrypted and generates a verification code. The encryption server also generates a random number.

[0038] (2) The encryption server generates a random password as the secondary password, uses the secondary password to encrypt the encrypted file, the check code, and the random number to generate secondary ciphertext data; the secondary password generated by the encryption server is sent to the reading server;

[0039] (3) Using an asymmetric national secret algorithm to encrypt the secondary password and generate the secondary password ciphertext;

[0040] (4) The encryption server generates a random password as the first-level password, and uses the first-level password to encrypt the file ID, authorization information, and second-level password ciphertext to generate first-level ciphertext data; the first-level password generated by the encryption server is sent to the reading server;

[0041] (5) Use an asymmetric national secret algorithm to encrypt the first-level password and generate the first-level password ciphertext;

[0042] (6) Generate encrypted file header data by using the file identifier and version, file ID, authorization mark, and first-level password ciphertext to encrypt the file;

[0043] (7) Save the encrypted file header data, first-level ciphertext data, and second-level ciphertext data as OFD file ciphertext;

[0044] (8) The encryption server sends the ciphertext of the OFD file to the file user client; the encrypted file can be distributed to the user through various channels, such as email, network download, personal storage device, etc. At this time, the file is difficult to crack and there is no need to worry about the file being lost or copied during the distribution channel.

[0045] When the file user obtains the OFD file ciphertext, the file user's user client is authorized and the user can access the reading server through the web. The web-based reader that cooperates with the reading server can decrypt after obtaining the reading server's key.

[0046] (9) The file user client loads the OFD file ciphertext, the user client communicates with the reader server, obtains the first-level password, and decrypts the first-level ciphertext;

[0047] (10) The user client obtains the ID of the file to be encrypted and the authorization mark in the first-level ciphertext data, verifies the authorization, and exits if the user client authorization verification fails;

[0048] (11) If the user client passes the authorization verification, the user client communicates with the reader server, obtains the secondary password through the key service, decrypts the secondary ciphertext data, obtains the source file, and the client loads the source file and performs on-demand display processing;

[0049] (12) The plaintext of the OFD file decrypted in step (11) is stored in the memory of the user client. When the reading terminal is closed, the decrypted plaintext of the OFD file is automatically cleared.

[0050] In step (4), the authorization information includes the authorization time parameter or the authorized number of accesses. The OFD file ciphertext cannot be opened after the authorization time limit is exceeded. Therefore, it is only used for display. After closing the reader, the data in the memory is also destroyed and no trace is left on the disk.

[0051] Permanently eliminate outdated password pairs, and files encrypted with these passwords will be permanently sealed.

[0052] In steps (2) and (4), the encryption server generates a random password including a long-term key pair and a short-term key pair. If the file needs to be set to a longer period, it is encrypted with the long-term key pair; if the file needs to be set to a shorter period, it is encrypted with the short-term key pair. The protected file has a time limit, and the confidential file will not be opened after the time limit expires. It cannot be opened normally with non-designated readers to prevent illegal personnel from opening and viewing confidential files at will.

[0053] In step (4), the file ID is used to determine the number of times the file has been viewed.

[0054] Password protection can be added. After decryption through steps (9) to (11), the user's password is still required to further unlock and view the file; or Ukey protection can be added. Targeted encryption is performed for a specific Ukey. After decryption through steps (9) to (11), only the file user who has the Ukey can read the file content.

[0055] Encryption protection is divided into two layers. One layer is for the business side, with regularly updated public and private keys to encrypt files. The other layer is for the system side, where the reading server uses its own encryption capabilities to re-encrypt the key pairs used in the business and the encrypted files, creating a double layer of protection. The business key pairs are generated and distributed by the business operators, while the reading server keys are managed by system maintenance personnel. The two layers of cryptographic keys are managed separately to enhance protection capabilities.

[0056] The above shows and describes the basic principles, main features and advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are merely preferred examples of the present invention and are not intended to limit the present invention. Various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention, and such changes and modifications fall within the scope of the present invention. The scope of protection claimed in the present invention is defined by the appended claims and their equivalents.

Claims

1. An OFD file encryption method, characterized by: The steps include: (1) The user uses the encryption server to encrypt the plaintext of the OFD file. The encryption server loads the file to be encrypted and generates a verification code. The encryption server also generates a random number. (2) The encryption server generates a random password as the secondary password, and uses the secondary password to encrypt the encrypted file, the check code, and the random number to generate the secondary ciphertext data; The secondary password generated by the encryption server is sent to the reading server; (3) Using an asymmetric national secret algorithm to encrypt the secondary password and generate the secondary password ciphertext; (4) The encryption server generates a random password as the first-level password, and uses the first-level password to encrypt the file ID, authorization information, and second-level password ciphertext to generate first-level ciphertext data; the first-level password generated by the encryption server is sent to the reading server; (5) Use an asymmetric national secret algorithm to encrypt the first-level password and generate the first-level password ciphertext; (6) Generate encrypted file header data by using the file identifier and version, file ID, authorization mark, and first-level password ciphertext to encrypt the file; (7) Save the encrypted file header data, first-level ciphertext data, and second-level ciphertext data as OFD file ciphertext; (8) The encryption server sends the OFD file ciphertext to the file user client; (9) The file user client loads the OFD file ciphertext, the user client communicates with the reader server, obtains the first-level password, and decrypts the first-level ciphertext; (10) The user client obtains the ID of the file to be encrypted and the authorization mark in the first-level ciphertext data, verifies the authorization, and exits if the user client authorization verification fails; (11) If the user client passes the authorization verification, the user client communicates with the reader server, obtains the secondary password through the key service, decrypts the secondary ciphertext data, obtains the source file, and the client loads the source file and performs on-demand display processing; (12) The decrypted plaintext OFD file in step (11) is stored in the memory of the user client. When the reading terminal is closed, the decrypted plaintext OFD file is automatically cleared.

2. The OFD file encryption method according to claim 1, wherein: In step (4), the authorization information includes the authorization time parameter or the authorized number of accesses. The OFD file ciphertext cannot be opened after exceeding the authorization limit.

3. The OFD file encryption method according to claim 1, wherein: Permanently eliminate outdated password pairs, and files encrypted with these passwords will be permanently sealed.

4. The OFD file encryption method according to claim 1, wherein: In step (2) and step (4), the encryption server generates a random password including a long-term key pair and a short-term key pair. If the file needs to be set to a longer period, it is encrypted with the long-term key pair; if the file needs to be set to a shorter period, it is encrypted with the short-term key pair.

5. The OFD file encryption method according to claim 1, wherein: In step (4), the file ID is used to determine the number of times the file has been viewed.

6. The OFD file encryption method according to claim 1, wherein: Add password protection. After decryption through steps (9) to (11), the user's password is required to further unlock and view the file; or add Ukey protection. Targeted encryption is performed for a specific Ukey. After decryption through steps (9) to (11), only the file user who has the Ukey can read the file content.

Images