File protection method and system based on secure portable device

Abstract

The invention provides a file protection method and system based on a secure portable device. The file protection method comprises the following steps: connecting the secure portable device with general computer equipment; during encryption, an encryption key is generated for each file based on the secure portable device, and the corresponding file is encrypted through the encryption key to obtain an encrypted file; each encryption key is associated with a key index; the encrypted file and the corresponding key index are jointly linked and then stored to any storage position of the secure portable device and / or the universal computer equipment; and the encryption key of each file and the key index associated with the encryption key are jointly linked and then stored in a security isolation storage area of the security portable device. And during decryption, based on the key index corresponding to the encrypted file, obtaining the encryption key associated with the key index in the security isolation storage area of the security portable device, and decrypting the encrypted file through the encryption key so as to obtain the plaintext file of the encrypted file.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a file protection method and system based on a secure portable device. Background Art

[0002] Data security has always been a key issue in the field of computer science and information technology. With the popularization of cloud computing, mobile devices, and large-scale data storage, the protection of data privacy and confidentiality has become particularly important.

[0003] Traditional data encryption and decryption solutions generally use software encryption or provide an encrypted USB flash drive. However, these solutions have some problems to a greater or lesser extent. For example, software encryption uses pseudo-random numbers, and the keys it generates have been predicted and cracked; the files in the encrypted USB flash drive are stored centrally, and they need to be decrypted and taken out before use; and all its files use the same encryption key. Once the key is cracked, all files will be threatened; in addition, these USB flash drives need to set passwords in advance before use, and generally require the installation of additional host computer software for configuration. In addition, there are some common disadvantages such as: the keys generated and stored on general computing devices are vulnerable to viruses and malware; the keys appear in plain text in the user state during encryption and decryption operations, and are easy to obtain, etc. Summary of the invention

[0004] In order to overcome the above technical defects, the purpose of the present invention is to provide a file protection method and system based on a secure portable device, which enhances security while providing portability of stored files.

[0005] The present invention discloses a file protection method based on a secure portable device, comprising: connecting the secure portable device to a general-purpose computer device; generating an encryption key for each file based on the secure portable device, encrypting the corresponding file by using the encryption key to obtain an encrypted file; each of the encryption keys is associated with a key index; the encrypted file and the corresponding key index are linked together and stored in any storage location of the secure portable device and / or the general-purpose computer device; the encryption key of each file and the key index associated with the encryption key are linked together and stored in a secure isolation storage area of ​​the secure portable device; based on the key index corresponding to the encrypted file, obtaining the encryption key associated with the key index in the secure isolation storage area of ​​the secure portable device, decrypting the encrypted file by using the encryption key to obtain the plaintext file of the encrypted file.

[0006] Preferably, the encryption key of each file and the key index associated with the encryption key are linked together and stored in the secure isolation storage area of ​​the secure portable device, including: the file ID of each file, the encryption key of the file, and the key index associated with the encryption key are linked together and stored in the secure isolation storage area of ​​the secure portable device.

[0007] Preferably, each of the encryption keys is associated with a key index; the encrypted file and the corresponding key index are linked together and stored in any storage location of the secure portable device and / or the general-purpose computer device; the encryption key of each file and the key index associated with the encryption key are linked together and stored in a secure isolation storage area of ​​the secure portable device, including: each of the encryption keys is associated with a key index root; the encrypted file and the corresponding key index root are linked together and stored in any storage location of the secure portable device and / or the general-purpose computer device; the key index table of each file is stored in the secure isolation storage area of ​​the secure portable device; the key index table includes several key index roots and the encryption key corresponding to each key index root; in each key index table, only one pair of key index roots and encryption keys are truly corresponding.

[0008] Preferably, the key index table of each file is stored in the secure isolation storage area of ​​the secure portable device, including: the file ID of each file and the key index table of the file are linked together and stored in the secure isolation storage area of ​​the secure portable device.

[0009] Preferably, the encrypted file and the corresponding key index are linked together and stored in any storage location of the secure portable device and / or the general-purpose computer device, including: the encrypted file, the corresponding key index, and the ID of the secure portable device are linked together and stored in any storage location of the secure portable device and / or the general-purpose computer device; the ID of the secure portable device is the ID of the secure portable device that generates the encryption key of the encrypted file.

[0010] Preferably, the method of generating an encryption key for each file based on the secure portable device, or the method of generating the key index corresponding to the encrypted file based on the secure portable device, before obtaining the encryption key associated with the key index in the secure isolation storage area of ​​the secure portable device also includes: based on the currently running application, determining whether the file has the permission to be encrypted or decrypted; if so, continuing the encryption or decryption action; if not, prohibiting encryption or decryption of the file.

[0011] Preferably, the method of generating an encryption key for each file based on the secure portable device, or the method of generating the key index corresponding to the encrypted file based on the secure portable device, before obtaining the encryption key associated with the key index in the secure isolation storage area of ​​the secure portable device also includes: determining whether the current operating user has the authority to perform encryption or decryption; if so, continuing the encryption or decryption; if not, prohibiting the user from encrypting or decrypting files.

[0012] Preferably, said generating an encryption key for each file based on said secure portable device comprises: said secure portable device using a true random number to generate said encryption key for the file.

[0013] The present invention also discloses a file protection system based on a secure portable device, comprising a general-purpose computer device and a secure portable device, wherein the secure portable device is connected to the general-purpose computer device; the secure portable device comprises a key module and an encryption / decryption module; the key module of the secure portable device generates an encryption key for each file, and the corresponding file is encrypted by the encryption / decryption module based on the encryption key to obtain an encrypted file; the general-purpose computer device comprises a common storage area, and the secure portable device comprises a secure isolation storage area and a common storage area; each of the encryption keys is associated with a key index, and the encrypted file and the corresponding key index are linked together and stored in the common storage area of ​​the secure portable device and / or the general-purpose computer device; the encryption key of each file and the key index associated with the encryption key are linked together and stored in the secure isolation storage area of ​​the secure portable device; based on the key index corresponding to the encrypted file, the encryption key associated with the key index is obtained in the secure isolation storage area of ​​the secure portable device, and the encrypted file is decrypted by the encryption / decryption module based on the encryption key to obtain the plaintext file of the encrypted file.

[0014] Preferably, the secure portable device includes a USB flash drive or a removable solid-state hard drive.

[0015] Compared with the prior art, the above technical solution has the following beneficial effects:

[0016] 1. Based on the secure portable device of the present invention, a unique encryption key is assigned to each file, so even if the key of a certain file is lost, it will not affect other files; and the present invention separates the encrypted file from its corresponding key and embeds a binding relationship in the file. The key is stored in a storage space with higher security, and the encrypted file can be stored arbitrarily without affecting the user's original file storage structure. Compared with traditional software encryption solutions, the present invention can achieve higher security protection; compared with ordinary encrypted USB flash drive solutions, the present invention does not require additional host computer software configuration, and in terms of searching and accessing files, there is no need for deliberate file copying or transfer, which enhances user convenience. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A flowchart of a file protection method based on a secure portable device provided by the present invention;

[0018] Figure 2 A module diagram of a file protection system based on a secure portable device provided by the present invention;

[0019] Figure 3 A flowchart of a preferred embodiment of the encryption process of the file protection method based on a secure portable device provided by the present invention;

[0020] Figure 4 The present invention is a flowchart of a preferred embodiment of the decryption process of the file protection method based on the secure portable device provided by the present invention. DETAILED DESCRIPTION

[0021] The advantages of the present invention are further described below in conjunction with the accompanying drawings and specific embodiments.

[0022] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0023] The terms used in this disclosure are for the purpose of describing specific embodiments only and are not intended to limit the disclosure. The singular forms of "a", "said" and "the" used in this disclosure and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0024] It should be understood that although the terms first, second, third, etc. may be used in the present disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present disclosure, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0025] In the description of the present invention, it is necessary to understand that the terms "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0026] In the description of the present invention, unless otherwise specified and limited, it should be noted that the terms "installed", "connected" and "connected" should be understood in a broad sense. For example, it can be a mechanical connection or an electrical connection, or it can be the internal connection between two components. It can be a direct connection or an indirect connection through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to the specific circumstances.

[0027] In the following description, the suffixes such as "module", "component" or "unit" used to represent elements are only used to facilitate the description of the present invention, and have no specific meanings. Therefore, "module" and "component" can be used interchangeably.

[0028] See attached Figure 1 The present invention discloses a file protection method based on a secure portable device, comprising:

[0029] S100, connecting the secure portable device to a general computer device;

[0030] S200, generating an encryption key for each file based on the secure portable device, and encrypting the corresponding file using the encryption key to obtain an encrypted file;

[0031] S300, each encryption key is associated with a key index; the encrypted file and the corresponding key index are linked together and stored in any storage location of the secure portable device and / or general computer equipment; the encryption key of each file and the key index associated with the encryption key are linked together and stored in a secure isolation storage area of ​​the secure portable device;

[0032] S400. Based on the key index corresponding to the encrypted file, an encryption key associated with the key index is obtained in a secure isolation storage area of ​​the secure portable device, and the encrypted file is decrypted by the encryption key to obtain a plain text file of the encrypted file.

[0033] Among them, step S100 is a precondition, that is, to encrypt or decrypt the encrypted files in the general-purpose computer, a secure portable device must be connected, and the secure portable device has built-in security hardware (it can be a security chip or a smart IC card), which can provide hard isolation area, true random number generation, key management and encryption and decryption processing capabilities. Combined with the above security functions of the secure portable device and based on the CPU processing power of the general-purpose computer, the file is encrypted and decrypted.

[0034] Steps S200 to S300 can be understood as an encryption process, where the key generation is implemented by a secure portable device, which uses a true random number to generate an encryption key for a file. The present invention generates a separate encryption key for each file, and the encryption key for each file is different. After the encryption key is generated, the secure portable device encrypts the file in combination with the basic processing power of a general-purpose computer to obtain a ciphertext of the file.

[0035] The encrypted file can be stored anywhere on the secure portable device and / or general-purpose computer, that is, it can be stored anywhere without the need to store the encrypted file in a specific location, which greatly facilitates the user. The encryption key is stored in the secure isolation storage area of ​​the secure portable device, and the encryption key is strictly protected.

[0036] Specifically, in order to prevent the encryption key information of the file from being exposed at the file storage location, the present invention associates the encryption key of each file with a key index, that is, for each encrypted file, the file, the key index, and the encryption key correspond one to one.

[0037] When storing, the ciphertext of each encrypted file and the key index corresponding to the file are linked together and stored in any storage location of the secure portable device and / or general computer equipment. The encryption key of the file and the key index corresponding to the file (also corresponding to the encryption key) are linked together and stored in the secure isolation storage area of ​​the secure portable device. The common link here can be generally understood as data packaging or data link, that is, after the user sees the ciphertext of the encrypted file at any storage location of the secure portable device and / or general computer equipment, he can also see a key index at the same time; after the user sees the key index in the secure isolation storage area of ​​the secure portable device, he can also see an encryption key at the same time. On this basis, it can also be understood that there are as many data packets / data links of this form as there are encrypted files.

[0038] Step S400 can be understood as a decryption process. Based on the key index associated with the encrypted file, the encryption key corresponding to the key index is searched in the secure isolation storage area in the secure portable device, thereby obtaining the encryption key of the encrypted file. Then, based on the security function of the secure portable device, the encrypted file is decrypted using the encryption key to obtain the plaintext file.

[0039] Therefore, when the present invention encrypts and decrypts files in a general-purpose computer, it must be connected to a secure portable device, rather than being able to achieve encryption and decryption on the computer alone. The secure portable device can be understood as a key. Without the key, it is impossible to encrypt and decrypt files in the computer, thereby preliminarily ensuring the security of the files. Moreover, when encrypting, when using hardware encryption and decryption, a unique encryption key is assigned to each file, so even if the key of a certain file is lost, it will not affect other files. In addition, the present invention separates the encrypted file from its corresponding key, and embeds a binding relationship in the file. The key is stored in a storage space with higher security, and the encrypted file can be stored arbitrarily without affecting the user's original file storage structure.

[0040] Regarding the specific implementation form of encrypted file-encryption key-key index, the present invention provides two preferred embodiments.

[0041] In the first preferred embodiment, the file ID of the associated file is embedded in each data packet / data link to facilitate user search and selection. Moreover, in this embodiment, the key index should be understood as a key clue, that is, it only contains one piece of data (which is different from the index table of the second preferred embodiment). Specifically, the file ID of each file, the encryption key of the file, and the key index associated with the encryption key are linked together and stored in a secure isolation storage area of ​​the secure portable device. Click on the file ID and check the encryption index. After confirming that it is correct (one-to-one correspondence), it can be determined that the encryption key of the file to be found is in this data packet / data link, and the encryption key in the data packet / data link can be directly obtained.

[0042] In a second preferred embodiment, the key index stored in the secure isolation storage area of ​​the secure portable device is an index table, which includes an "index root" column and an "encryption key" column. The "index root" column includes a number of key index root data, and the "encryption key" column includes a number of encryption key data. Each index root data corresponds to an encryption key data. Each encryption key is associated with a key index root, and the encrypted file and the corresponding key index root are linked together and stored in any storage location of the secure portable device and / or general computer equipment; the key index table of each file is stored in the secure isolation storage area of ​​the secure portable device.

[0043] In this embodiment, the key index is embedded in a table, and the content of the key index table of each file is different, so it is impossible to obtain the encryption key of other files through the index table of one file (with the help of the key index of other files).

[0044] Moreover, among all the "index root" data and "encryption key" data in the index table of each file, only one is correct, that is, the encryption key corresponding to the key index root associated with the file is one-to-one and correctly usable, and the other data are randomly generated, erroneous and unusable data. Of course, in form, all "index root" data are consistent, as are all "encryption key" data. Therefore, if the user cannot know the key index root associated with the file to be decrypted, then the truly usable key index cannot be obtained from the index table.

[0045] As an extension of the second preferred embodiment, the file ID of the associated file is further embedded in each key index table to facilitate user search and selection, that is, the file ID of each file and the key index table of the file are linked together and stored in a secure isolation storage area of ​​the secure portable device.

[0046] Preferably, when decrypting a file, after obtaining the encryption key, it is also necessary to perform the decryption action based on the secure portable device used to encrypt the file. In other words, the file can be encrypted by different secure portable devices, but it should be noted that if a secure portable device is used for encryption, only that secure portable device can be used for decryption later.

[0047] During decryption, the system will determine whether the ID of the secure portable device is consistent with the one used to encrypt the file. If not, decryption cannot be performed. In this regard, the ID of the secure portable device is also embedded in the data packet / data link where the encrypted file is stored, that is, the encrypted file, the corresponding key index, and the ID of the secure portable device are linked together and stored in any storage location of the secure portable device and / or general-purpose computer equipment.

[0048] Further, optionally, in addition to verifying the ID of the secure portable device when decrypting the file, the ID of the secure portable device is also subject to authority judgment when encrypting the file. If the secure portable device does not have authority to perform the encryption action, the system will reject the encryption action. In this way, the role of the secure portable device as a "key" is further utilized to ensure the security of the file.

[0049] Further optionally, before encryption or decryption, based on the currently running application, determine whether the file has permission to be encrypted or decrypted; if so, continue with the encryption or decryption action; if not, prohibit encryption or decryption of the file.

[0050] Further optionally, before encryption or decryption, it is determined whether the current operating user has the authority to perform encryption or decryption; if so, the encryption or decryption action continues; if not, the user is prohibited from encrypting or decrypting the file.

[0051] See attached Figure 2 The present invention also discloses a file protection system based on a secure portable device, which is used to implement the above-mentioned file protection method based on a secure portable device. The file protection system includes a general-purpose computer device and a secure portable device. The secure portable device performs encryption and decryption after being connected to the general-purpose computer device. The general-purpose computing device can be a desktop computer, a notebook, etc., which provides basic functions such as a read-write interface module and a network module, and has a computing device such as a CPU. The secure portable device can be a USB flash drive, or a mobile storage device such as a removable solid-state hard drive. Among them, the ID of the file is a unique identifier representing the file, which is used to judge, query and filter specific files. The unique ID of the secure portable device is a unique identifier representing the secure portable device, which is used to judge whether it is a legal device. The key information index represents the binding relationship with the key information for encrypting the file, and is used to retrieve and query the key information of the file. The ciphertext body is the actual data generated after the file plaintext is encrypted (i.e., the encrypted file). The file encryption key is the actual data of the file encryption key.

[0052] The file protection system of the present invention also includes security software, which can be understood as an integrated user working environment that supports one or more operating system options, such as Debian live, isos, Windows, MacOS, etc. The security application built into the security software uses the random number and key generated by the secure portable device to call the encryption and decryption interface of the secure portable device to encrypt and protect user data and files.

[0053] The secure portable device mainly includes a key module, an encryption and decryption module, and a storage module. The storage module includes a secure isolation storage area and a common storage area. The key module is responsible for generating random numbers and key derivation, using true random numbers to generate keys for users and files, and using the root key of the key module to protect the data content in the secure isolation storage area of ​​the secure portable device. The encryption and decryption module is used to encrypt and decrypt user data or files. The storage module is used to store user data, files, and user work environment images. The secure portable device also includes a communication interface module for high-speed communication with a computer, and a main control module for coordinating and controlling the key module, the encryption and decryption module, and the storage module.

[0054] During encryption, the key module generates an encryption key for each file, and based on the encryption key, the encryption and decryption module encrypts the corresponding file to obtain an encrypted file. Since each file is assigned a unique key for encryption, one file has one key, and even if the protected file is obtained by other users, it cannot be read or used normally.

[0055] When generating encryption keys, a key index is generated for each key, and the key index is embedded in the encrypted file, thereby binding the file with its key information. After binding, the key information (encryption key and key index associated with the encryption key) will be stored in a highly secure secure isolation storage area in the secure portable device, and the encrypted file and the corresponding key index can be linked together and stored in any location, such as a general storage area of ​​a secure portable device or a general storage area of ​​a general computer device.

[0056] During decryption, based on the key index corresponding to the encrypted file, the encryption key associated with the key index is obtained in the secure isolation storage area of ​​the secure portable device, and the encrypted file is decrypted based on the encryption key through the encryption and decryption module to obtain the plaintext file of the encrypted file.

[0057] See attached Figure 3 Taking the Debian Live working environment as an example, the present invention provides an embodiment of the encryption process.

[0058] Step 1: The application sends a request for file encryption.

[0059] Step 2: The system intercepts the request and communicates with the secure portable device to obtain the unique ID of the secure portable device.

[0060] Step 3: The system determines whether the current application and user have permission to encrypt files.

[0061] Step 4: The system communicates with the key module to derive a unique file encryption key and generate a corresponding key index.

[0062] Step 5: The encryption and decryption module encrypts the file, and the system embeds information such as the file ID, secure portable device ID, and key index in the encrypted file.

[0063] Step 6: The key module opens the secure isolation storage area, embeds the file ID, key information index, etc. in the key information, and places the key file in the secure isolation storage area of ​​the security device.

[0064] Step 7: The key module closes and protects the secure isolated storage area again, and the encrypted file is returned to the application, and the file encryption is completed.

[0065] See attached Figure 4Taking the Debian Live working environment as an example, the present invention provides an embodiment of the decryption process.

[0066] Step 1: The application sends a decryption request.

[0067] Step 2: The system intercepts the request and communicates with the secure portable device to obtain the unique ID of the secure portable device.

[0068] Step 3: The system determines whether the current application and user have permission to decrypt the file.

[0069] Step 4: The system obtains the secure portable device ID, key index, etc. by parsing the encrypted file, and determines whether the current secure portable device has the authority to decrypt the file.

[0070] Step 5: The system opens the secure isolation storage area and retrieves the actual data of the query file encryption key based on the key index.

[0071] Step 6: After the query, the system shuts down and re-protects the secure isolation storage area, and transmits the encryption key to the encryption and decryption module for decryption.

[0072] Step 7: Return the plaintext data of the file to the application and the decryption is completed.

[0073] It should be noted that the embodiments of the present invention have better practicability and do not impose any form of limitation on the present invention. Any technician familiar with the field may use the technical content disclosed above to change or modify it into an equivalent effective embodiment. However, any modification or equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention are still within the scope of the technical solution of the present invention.

Claims

1. A file protection method based on a secure portable device, characterized in that: include: connecting the secure portable device to a general purpose computer device; Generate an encryption key for each file based on the secure portable device, and encrypt the corresponding file using the encryption key to obtain an encrypted file; Each of the encryption keys is associated with a key index; the encrypted file and the corresponding key index are linked together and stored in any storage location of the secure portable device and / or the general computer device; the encryption key of each file and the key index associated with the encryption key are linked together and stored in a secure isolation storage area of ​​the secure portable device; Based on the key index corresponding to the encrypted file, the encryption key associated with the key index is obtained in the secure isolation storage area of ​​the secure portable device, and the encrypted file is decrypted by the encryption key to obtain the plaintext file of the encrypted file.

2. The file protection method based on a secure portable device according to claim 1, characterized in that: The encryption key of each file and the key index associated with the encryption key are linked together and stored in the secure isolation storage area of ​​the secure portable device, including: The file ID of each file, the encryption key of the file, and the key index associated with the encryption key are linked together and stored in the secure isolation storage area of ​​the secure portable device.

3. The file protection method based on a secure portable device according to claim 1, characterized in that: Each of the encryption keys is associated with a key index; the encrypted file and the corresponding key index are linked together and stored in any storage location of the secure portable device and / or the general computer device; the encryption key of each file and the key index associated with the encryption key are linked together and stored in the secure isolation storage area of ​​the secure portable device, including: Each of the encryption keys is associated with a key index root; the encrypted file and the corresponding key index root are linked together and stored in any storage location of the secure portable device and / or the general computer device; The key index table of each file is stored in the secure isolation storage area of ​​the secure portable device; the key index table includes several key index roots and an encryption key corresponding to each key index root; in each key index table, only one pair of key index roots and encryption keys are truly corresponding.

4. The file protection method based on a secure portable device according to claim 3, characterized in that: The key index table of each file is stored in the secure isolation storage area of ​​the secure portable device, including: The file ID of each file and the key index table of the file are linked together and stored in the secure isolation storage area of ​​the secure portable device.

5. The file protection method based on a secure portable device according to claim 1, characterized in that: The encrypted file and the corresponding key index are linked together and stored in any storage location of the secure portable device and / or the general computer device, including: The encrypted file, the corresponding key index, and the ID of the secure portable device are linked together and stored in any storage location of the secure portable device and / or the general computer device; The ID of the secure portable device is the ID of the secure portable device that generates the encryption key of the encrypted file.

6. The file protection method based on a secure portable device according to claim 1, characterized in that: The step of generating an encryption key for each file based on the secure portable device, or generating the key index corresponding to the encrypted file based on the secure portable device, before obtaining the encryption key associated with the key index in the secure isolation storage area of ​​the secure portable device, further comprises: Based on the currently running application, determine whether the file has permission to be encrypted or decrypted; If yes, continue the encryption or decryption action; If not, encryption or decryption of the file is prohibited.

7. The file protection method based on a secure portable device according to claim 1, characterized in that: The step of generating an encryption key for each file based on the secure portable device, or generating the key index corresponding to the encrypted file based on the secure portable device, before obtaining the encryption key associated with the key index in the secure isolation storage area of ​​the secure portable device, further comprises: Determine whether the current operating user has the authority to perform encryption or decryption operations; If yes, continue the encryption or decryption action; If not, the user is prohibited from encrypting or decrypting the file.

8. The file protection method based on a secure portable device according to claim 1, characterized in that: Generating an encryption key for each file based on the secure portable device comprises: The secure portable device generates the encryption key for the file using true random numbers.

9. A file protection system based on a secure portable device, characterized in that: It includes a general computer device and a secure portable device, wherein the secure portable device is connected to the general computer device; the secure portable device includes a key module and an encryption and decryption module; Generate an encryption key for each file based on the key module of the secure portable device, and encrypt the corresponding file based on the encryption key and through the encryption and decryption module to obtain an encrypted file; The general computer device includes a common storage area, and the secure portable device includes a secure isolation storage area and a common storage area; Each of the encryption keys is associated with a key index, and the encrypted file and the corresponding key index are linked together and stored in the common storage area of ​​the secure portable device and / or the general computer device; the encryption key of each file and the key index associated with the encryption key are linked together and stored in the secure isolation storage area of ​​the secure portable device; Based on the key index corresponding to the encrypted file, the encryption key associated with the key index is obtained in the secure isolation storage area of ​​the secure portable device, and based on the encryption key, the encrypted file is decrypted by the encryption and decryption module to obtain the plaintext file of the encrypted file.

10. The file protection system based on a secure portable device according to claim 9, characterized in that: The secure portable device includes a USB flash drive and a removable solid-state hard drive.

Images