File protection method and system based on secure portable device

Abstract

The present invention provides a file protection method and system based on a secure portable device, comprising: connecting the secure portable device to a general-purpose computer device; during encryption, generating an encryption key for each file based on the secure portable device, encrypting the corresponding file using the encryption key to obtain an encrypted file; each encryption key is associated with a key index; the encrypted file and the corresponding key index are linked together and stored in any storage location of the secure portable device and / or the general-purpose computer device; the encryption key of each file and the key index associated with the encryption key are linked together and stored in a secure isolation storage area of ​​the secure portable device. During decryption, based on the key index corresponding to the encrypted file, the encryption key associated with the key index is obtained from the secure isolation storage area of ​​the secure portable device, and the encrypted file is decrypted using the encryption key to obtain the plaintext file of the encrypted file.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a file protection method and system based on a secure portable device. Background Art

[0002] Data security has always been a key issue in the fields of computer science and information technology. With the popularization of cloud computing, mobile devices, and large-scale data storage, protecting data privacy and confidentiality has become particularly important.

[0003] Traditional data encryption and decryption solutions typically rely on software encryption or an encrypted USB flash drive. However, these solutions all present various challenges. For example, software encryption uses pseudorandom numbers, and the keys generated by these encryption methods are known to be predictable and crackable. Files on encrypted USB flash drives are centrally stored and must be decrypted before use. Furthermore, all files use the same encryption key, so if the key is compromised, all files are compromised. Furthermore, these USB flash drives require a password to be set before use, which typically requires the installation of additional host software for configuration. Furthermore, these solutions also share several common drawbacks: keys generated and stored on general-purpose computing devices are vulnerable to viruses and malware; and keys appear in plaintext in user mode during encryption and decryption operations, making them easily accessible. Summary of the Invention

[0004] In order to overcome the above technical defects, the purpose of the present invention is to provide a file protection method and system based on a secure portable device, which enhances security while providing portability of stored files.

[0005] The present invention discloses a file protection method based on a secure portable device, comprising: connecting the secure portable device to a general-purpose computer device; generating an encryption key for each file based on the secure portable device, encrypting the corresponding file using the encryption key to obtain an encrypted file; each encryption key is associated with a key index; the encrypted file and the corresponding key index are linked together and stored in any storage location of the secure portable device and / or the general-purpose computer device; the encryption key of each file and the key index associated with the encryption key are linked together and stored in a secure isolation storage area of ​​the secure portable device; based on the key index corresponding to the encrypted file, obtaining the encryption key associated with the key index in the secure isolation storage area of ​​the secure portable device, decrypting the encrypted file using the encryption key to obtain the plaintext file of the encrypted file.

[0006] Preferably, the encryption key of each file and the key index associated with the encryption key are linked together and stored in the secure isolation storage area of ​​the secure portable device, including: the file ID of each file, the encryption key of the file, and the key index associated with the encryption key are linked together and stored in the secure isolation storage area of ​​the secure portable device.

[0007] Preferably, each of the encryption keys is associated with a key index; the encrypted file and the corresponding key index are linked together and stored in any storage location of the secure portable device and / or the general-purpose computer device; the encryption key of each file and the key index associated with the encryption key are linked together and stored in the secure isolation storage area of ​​the secure portable device, including: each of the encryption keys is associated with a key index root; the encrypted file and the corresponding key index root are linked together and stored in any storage location of the secure portable device and / or the general-purpose computer device; the key index table of each file is stored in the secure isolation storage area of ​​the secure portable device; the key index table includes several key index roots and the encryption key corresponding to each key index root; in each key index table, only one pair of key index roots and encryption keys are truly corresponding.

[0008] Preferably, the key index table of each file is stored in the secure isolation storage area of ​​the secure portable device, including: the file ID of each file and the key index table of the file are linked together and stored in the secure isolation storage area of ​​the secure portable device.

[0009] Preferably, the encrypted file and the corresponding key index are linked together and stored in any storage location of the secure portable device and / or the general-purpose computer device, including: the encrypted file, the corresponding key index, and the ID of the secure portable device are linked together and stored in any storage location of the secure portable device and / or the general-purpose computer device; the ID of the secure portable device is the ID of the secure portable device that generates the encryption key of the encrypted file.

[0010] Preferably, the secure portable device generates an encryption key for each file, or the key index corresponding to the encrypted file, and before obtaining the encryption key associated with the key index in the secure isolation storage area of ​​the secure portable device, it also includes: based on the currently running application, determining whether the file has the permission to be encrypted or decrypted; if so, continuing the encryption or decryption action; if not, prohibiting encryption or decryption of the file.

[0011] Preferably, the secure portable device generates an encryption key for each file, or the key index corresponding to the encrypted file, and before obtaining the encryption key associated with the key index in the secure isolation storage area of ​​the secure portable device, it also includes: judging whether the current operating user has the authority to perform encryption or decryption; if so, continuing the encryption or decryption action; if not, prohibiting the user from encrypting or decrypting the file.

[0012] Preferably, said generating an encryption key for each file based on said secure portable device comprises: said secure portable device using a true random number to generate said encryption key for the file.

[0013] The present invention also discloses a file protection system based on a secure portable device, comprising a general-purpose computer device and a secure portable device, wherein the secure portable device is connected to the general-purpose computer device; the secure portable device comprises a key module and an encryption / decryption module; the key module of the secure portable device generates an encryption key for each file, and based on the encryption key, the corresponding file is encrypted by the encryption / decryption module to obtain an encrypted file; the general-purpose computer device comprises a general storage area, and the secure portable device comprises a secure isolation storage area and a general storage area; each encryption key is associated with a key index, and the encrypted file and the corresponding key index are linked together and stored in the general storage area of ​​the secure portable device and / or the general-purpose computer device; the encryption key of each file and the key index associated with the encryption key are linked together and stored in the secure isolation storage area of ​​the secure portable device; based on the key index corresponding to the encrypted file, the encryption key associated with the key index is obtained in the secure isolation storage area of ​​the secure portable device, and based on the encryption key, the encrypted file is decrypted by the encryption / decryption module to obtain the plaintext file of the encrypted file.

[0014] Preferably, the secure portable device includes a USB flash drive or a removable solid-state hard drive.

[0015] Compared with the existing technology, the above technical solution has the following beneficial effects:

[0016] 1. Based on the secure portable device of the present invention, each file is assigned a unique encryption key. Therefore, even if the key of a file is lost, it will not affect other files. In addition, the present invention separates the encrypted file from its corresponding key and embeds a binding relationship within the file. The key is stored in a more secure storage space, and the encrypted file can be stored anywhere without affecting the user's original file storage structure. Compared with traditional software encryption solutions, the present invention can achieve higher security protection. Compared with ordinary encrypted USB flash drive solutions, the present invention does not require additional host computer software configuration, and when searching and accessing files, there is no need for deliberate file copying or transfer, which enhances user convenience. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A flowchart of a file protection method based on a secure portable device provided by the present invention;

[0018] Figure 2 A module diagram of a file protection system based on a secure portable device provided by the present invention;

[0019] Figure 3 A flowchart of a preferred embodiment of the encryption process of the file protection method based on a secure portable device provided by the present invention;

[0020] Figure 4 The present invention provides a flowchart of a preferred embodiment of the decryption process of the file protection method based on the secure portable device. DETAILED DESCRIPTION

[0021] The advantages of the present invention are further described below with reference to the accompanying drawings and specific embodiments.

[0022] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all possible embodiments consistent with the present disclosure. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present disclosure, as detailed in the appended claims.

[0023] The terms used in this disclosure are for the purpose of describing specific embodiments only and are not intended to limit the disclosure. As used in this disclosure and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0024] It should be understood that although the terms first, second, third, etc. may be used in this disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this disclosure, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining."

[0025] In the description of the present invention, it should be understood that the terms "longitudinal", "transverse", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention.

[0026] In the description of the present invention, unless otherwise specified and limited, it should be noted that the terms "installed", "connected" and "connected" should be understood in a broad sense. For example, it can be a mechanical connection or an electrical connection, or it can be the internal communication between two components. It can be a direct connection or an indirect connection through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to the specific circumstances.

[0027] In the following description, the suffixes such as "module", "component" or "unit" used to represent elements are only used to facilitate the description of the present invention and have no specific meaning. Therefore, "module" and "component" can be used interchangeably.

[0028] See attached Figure 1 The present invention discloses a file protection method based on a secure portable device, comprising:

[0029] S100, connecting the secure portable device to a general computer device;

[0030] S200, generating an encryption key for each file based on the secure portable device, and encrypting the corresponding file using the encryption key to obtain an encrypted file;

[0031] S300, each encryption key is associated with a key index; the encrypted file and the corresponding key index are linked together and stored in any storage location of the secure portable device and / or general-purpose computer device; the encryption key of each file and the key index associated with the encryption key are linked together and stored in a secure isolated storage area of ​​the secure portable device;

[0032] S400. Based on the key index corresponding to the encrypted file, obtain the encryption key associated with the key index in the secure isolation storage area of ​​the secure portable device, decrypt the encrypted file using the encryption key to obtain the plaintext file of the encrypted file.

[0033] Step S100 is a prerequisite. To encrypt or decrypt files encrypted on a general-purpose computer, a secure portable device must be connected. This secure portable device has built-in security hardware (which can be a security chip or a smart IC card) that provides a hard-isolated area, true random number generation, key management, and encryption and decryption processing capabilities. File encryption and decryption are performed by combining the aforementioned security features of the secure portable device with the CPU processing power of the general-purpose computer.

[0034] Steps S200 through S300 can be understood as the encryption process. Key generation is performed by the secure portable device, which uses true random numbers to generate encryption keys for files. The present invention generates a unique encryption key for each file, resulting in a different encryption key for each file. After the encryption key is generated, the secure portable device, utilizing the basic processing power of a general-purpose computer, encrypts the file to produce the ciphertext.

[0035] The encrypted file can be stored anywhere on a secure portable device and / or general-purpose computer, eliminating the need for encrypted files to be stored in a specific location, greatly facilitating access to the user. The encryption key is stored in a secure, isolated storage area on the secure portable device, ensuring strict protection of the encryption key.

[0036] Specifically, in order to prevent the encryption key information of the file from being exposed at the file storage location, the present invention associates the encryption key of each file with a key index. That is, for each encrypted file, the file, key index, and encryption key correspond one to one.

[0037] During storage, the ciphertext of each encrypted file and the key index corresponding to that file are linked together and stored in any storage location on the secure portable device and / or general-purpose computer equipment. The file's encryption key and the key index corresponding to that file (and also corresponding to the encryption key) are then linked together and stored in a secure, isolated storage area on the secure portable device. The "joint link" here can be generally understood as data packaging or data linking. That is, when a user sees the ciphertext of an encrypted file at any storage location on the secure portable device and / or general-purpose computer equipment, they can also uniquely see a key index; and when a user sees the key index in the secure, isolated storage area on the secure portable device, they can also uniquely see an encryption key. Furthermore, it can also be understood that there are as many data packets / data links of this type as there are encrypted files.

[0038] Step S400 can be understood as the decryption process. Based on the key index associated with the encrypted file, the encryption key corresponding to the key index is searched in the secure isolated storage area of ​​the secure portable device, thereby obtaining the encryption key for the encrypted file. Then, based on the security features of the secure portable device, the encrypted file is decrypted using the encryption key to obtain the plaintext file.

[0039] Therefore, when encrypting and decrypting files in a general-purpose computer, the present invention requires a secure portable device to be connected, rather than simply performing encryption and decryption on the computer. The secure portable device can be understood as a key; without the key, encryption and decryption of files in the computer cannot be performed, thereby preliminarily ensuring the security of the files. Furthermore, when encrypting and decrypting using hardware, a unique encryption key is assigned to each file, so even if the key for a particular file is lost, it will not affect other files. Furthermore, the present invention separates the encrypted file from its corresponding key and embeds a binding relationship within the file. The key is stored in a more secure storage space, while the encrypted file can be stored arbitrarily without affecting the user's original file storage structure.

[0040] Regarding the specific implementation of encrypted file-encryption key-key index, the present invention provides two preferred embodiments.

[0041] In the first preferred embodiment, the file ID of the associated file is embedded in each data packet / data link to facilitate user search and selection. In addition, in this embodiment, the key index should be understood as a key clue, that is, it only contains one piece of data (which is different from the index table of the second preferred embodiment). Specifically, the file ID of each file, the encryption key of the file, and the key index associated with the encryption key are linked together and stored in the secure isolation storage area of ​​the secure portable device. Click on the file ID and check the encryption index. After confirming that it is correct (one-to-one correspondence), it can be determined that the encryption key of the file to be found is in this data packet / data link, and the encryption key in the data packet / data link can be directly obtained.

[0042] In a second preferred embodiment, the key index stored in the secure, isolated storage area of ​​the secure portable device is an index table. The index table includes an "index root" column and an "encryption key" column. The "index root" column includes multiple key index root data items, and the "encryption key" column includes multiple encryption key data items. Each index root data item corresponds to a piece of encryption key data. Each encryption key is associated with a key index root. The encrypted file and the corresponding key index root are linked together and stored in any storage location on the secure portable device and / or general-purpose computer. The key index table for each file is stored in the secure, isolated storage area of ​​the secure portable device.

[0043] This embodiment embeds the key index in a table, and the content of the key index table of each file is different. Therefore, the encryption key of other files cannot be obtained through the index table of one file (with the help of the key index of other files).

[0044] Moreover, among all the "index root" data and "encryption key" data in the index table of each file, only one is correct, that is, the encryption key corresponding to the key index root associated with the file is one-to-one corresponding and correctly usable, and the other data are randomly generated, erroneous and unusable data. Of course, in form, all "index root" data and all "encryption key" data are consistent. Therefore, if the user cannot know the key index root associated with the file to be decrypted, he cannot obtain the real usable key index from the index table.

[0045] As an extension of the second preferred embodiment, the file ID of the associated file is further embedded in each key index table to facilitate user search and selection, that is, the file ID of each file and the key index table of the file are linked together and stored in the secure isolation storage area of ​​the secure portable device.

[0046] Preferably, when decrypting a file, after obtaining the encryption key, the decryption action can only be performed based on the secure portable device used to encrypt the file. In other words, the file can be encrypted by different secure portable devices, but it should be noted that if a secure portable device is used for encryption, only that secure portable device can be used for decryption later.

[0047] During decryption, the system checks whether the secure portable device ID matches the one used to encrypt the file. If not, decryption fails. To address this, the secure portable device ID is embedded in the data packet / data link where the encrypted file is stored. This means the encrypted file, the corresponding key index, and the secure portable device ID are linked together and stored in any storage location on the secure portable device and / or general-purpose computer.

[0048] Optionally, in addition to verifying the secure portable device's ID during file decryption, the system can also verify its permissions during encryption. If the secure portable device lacks permission to perform encryption, the system will reject the encryption. This further enhances the secure portable device's role as a "key" to ensure file security.

[0049] Further optionally, before encryption or decryption, based on the currently running application, it is determined whether the file has permission to be encrypted or decrypted; if so, the encryption or decryption action is continued; if not, encryption or decryption of the file is prohibited.

[0050] Further optionally, before encryption or decryption, it is determined whether the current operating user has the authority to perform encryption or decryption; if so, the encryption or decryption action continues; if not, the user is prohibited from encrypting or decrypting the file.

[0051] See attached Figure 2 The present invention also discloses a file protection system based on a secure portable device, which is used to implement the above-mentioned file protection method based on a secure portable device. The file protection system includes a general-purpose computer device and a secure portable device. The secure portable device performs encryption and decryption after being connected to the general-purpose computer device. The general-purpose computing device can be a desktop computer, a notebook computer, or the like, which provides basic functions such as a read-write interface module and a network module, and has a computing device such as a CPU. The secure portable device can be a USB flash drive or a mobile storage device such as a removable solid-state hard drive. Among them, the file ID is a unique identifier representing the file, which is used to judge, query and filter specific files. The unique ID of the secure portable device is a unique identifier representing the secure portable device, which is used to judge whether it is a legal device. The key information index represents the binding relationship with the key information for encrypting the file, and is used to retrieve and query the key information of the file. The ciphertext body is the actual data generated after the file plaintext is encrypted (i.e., the encrypted file). The file encryption key is the actual data of the file encryption key.

[0052] The file protection system of the present invention also includes security software, which can be understood as an integrated user work environment that supports one or more operating systems, such as Debian Live, ISOs, Windows, and MacOS. The security application built into the security software uses random numbers and keys generated by the secure portable device to invoke the device's encryption and decryption interfaces to encrypt and protect user data and files.

[0053] The secure portable device primarily comprises a key module, an encryption / decryption module, and a storage module. The storage module includes a secure isolated storage area and a general storage area. The key module is responsible for generating random numbers and key derivation, using true random numbers to generate keys for users and files. The key module's root key protects the data in the secure isolated storage area of ​​the secure portable device. The encryption / decryption module encrypts and decrypts user data or files. The storage module stores user data, files, and images of the user's work environment. The secure portable device also includes a communication interface module for high-speed communication with a computer and a main control module for coordinating and controlling the key module, encryption / decryption module, and storage module.

[0054] During encryption, the key module generates an encryption key for each file. Using this key, the encryption module then encrypts the corresponding file, resulting in an encrypted file. Because each file is assigned a unique encryption key, each file has its own unique key. Even if another user obtains the protected file, they cannot read or use it properly.

[0055] When the encryption key is generated, a key index is generated for each key and embedded in the encrypted file, thus binding the file to its key information. After binding, the key information (encryption key and key index associated with the encryption key) is stored in a highly secure, isolated storage area on the secure portable device. The encrypted file and the corresponding key index are linked together and can be stored anywhere, such as in the normal storage area of ​​the secure portable device or a general-purpose computer device.

[0056] During decryption, based on the key index corresponding to the encrypted file, the encryption key associated with the key index is obtained in the secure isolation storage area of ​​the secure portable device, and the encrypted file is decrypted based on the encryption key through the encryption and decryption module to obtain the plaintext file of the encrypted file.

[0057] See attached Figure 3 Taking the Debian Live working environment as an example, the present invention provides an embodiment of the encryption process.

[0058] Step 1: The application sends a request for file encryption.

[0059] Step 2: The system intercepts the request and communicates with the secure portable device to obtain the unique ID of the secure portable device.

[0060] Step 3: The system determines whether the current application and user have permission to encrypt files.

[0061] Step 4: The system communicates with the key module to derive a unique file encryption key and generate a corresponding key index.

[0062] Step 5: The encryption and decryption module encrypts the file, and the system embeds information such as the file ID, secure portable device ID, and key index in the encrypted file.

[0063] Step 6: The key module opens the secure isolation storage area, embeds the file ID, key information index, etc. in the key information, and places the key file in the secure isolation storage area of ​​the security device.

[0064] Step 7: The key module closes and protects the secure isolated storage area again, and the encrypted file is returned to the application, completing the file encryption.

[0065] See attached Figure 4Taking the Debian Live working environment as an example, the present invention provides an embodiment of the decryption process.

[0066] Step 1: The application sends a decryption request.

[0067] Step 2: The system intercepts the request and communicates with the secure portable device to obtain the unique ID of the secure portable device.

[0068] Step 3: The system determines whether the current application and user have permission to decrypt the file.

[0069] Step 4: The system obtains the secure portable device ID, key index, etc. by parsing the encrypted file, and determines whether the current secure portable device has the authority to decrypt the file.

[0070] Step 5: The system opens the secure isolation storage area and retrieves the actual data of the query file encryption key based on the key index.

[0071] Step 6: After the query is completed, the system shuts down and re-protects the secure isolated storage area, and transmits the encryption key to the encryption and decryption module for decryption.

[0072] Step 7: Return the plaintext data of the file to the application, and decryption is completed.

[0073] It should be noted that the embodiments of the present invention have better practicability and do not impose any form of limitation on the present invention. Any technician familiar with the field may use the technical content disclosed above to change or modify it into an equivalent effective embodiment. However, any modification or equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention are still within the scope of the technical solution of the present invention.

Claims

1. A file protection method based on a secure portable device, characterized in that: include: connecting the secure portable device to a general purpose computer device; Generate an encryption key for each file based on the secure portable device, and encrypt the corresponding file using the encryption key to obtain an encrypted file; Each encryption key is associated with a key index; the encrypted file and the corresponding key index are linked together and stored in any storage location of the secure portable device and / or the general-purpose computer device; the encryption key of each file and the key index associated with the encryption key are linked together and stored in a secure isolated storage area of ​​the secure portable device; Based on the key index corresponding to the encrypted file, the encryption key associated with the key index is obtained in the secure isolation storage area of ​​the secure portable device, and the encrypted file is decrypted using the encryption key to obtain the plaintext file of the encrypted file.

2. The file protection method based on a secure portable device according to claim 1, characterized in that: The encryption key of each file and the key index associated with the encryption key are linked together and stored in the secure isolation storage area of ​​the secure portable device, including: The file ID of each file, the encryption key of the file, and the key index associated with the encryption key are linked together and stored in the secure isolation storage area of ​​the secure portable device.

3. The file protection method based on a secure portable device according to claim 1, characterized in that: Each of the encryption keys is associated with a key index; the encrypted file and the corresponding key index are linked together and stored in any storage location of the secure portable device and / or the general-purpose computer device; the encryption key of each file and the key index associated with the encryption key are linked together and stored in the secure isolation storage area of ​​the secure portable device, including: Each of the encryption keys is associated with a key index root; the encrypted file and the corresponding key index root are linked together and stored in any storage location of the secure portable device and / or the general computer device; The key index table of each file is stored in the secure isolation storage area of ​​the secure portable device; the key index table includes several key index roots and an encryption key corresponding to each key index root; in each key index table, only one pair of key index roots and encryption keys are truly corresponding.

4. The file protection method based on a secure portable device according to claim 3, characterized in that: The key index table of each file is stored in the secure isolation storage area of ​​the secure portable device, including: The file ID of each file and the key index table of the file are linked together and stored in the secure isolation storage area of ​​the secure portable device.

5. The file protection method based on a secure portable device according to claim 1, characterized in that: The encrypted file and the corresponding key index are linked together and stored in any storage location of the secure portable device and / or the general computer device, including: The encrypted file, the corresponding key index, and the ID of the secure portable device are linked together and stored in any storage location of the secure portable device and / or the general computer device; The ID of the secure portable device is the ID of the secure portable device that generates the encryption key of the encrypted file.

6. The file protection method based on a secure portable device according to claim 1, characterized in that: The step of generating an encryption key for each file based on the secure portable device, or generating the key index corresponding to the encrypted file based on the secure portable device, and obtaining the encryption key associated with the key index in the secure isolation storage area of ​​the secure portable device, further comprises: Based on the currently running application, determine whether the file has permission to be encrypted or decrypted; If yes, continue with the encryption or decryption action; If not, encryption or decryption of the file is prohibited.

7. The file protection method based on a secure portable device according to claim 1, characterized in that: The step of generating an encryption key for each file based on the secure portable device, or generating the key index corresponding to the encrypted file based on the secure portable device, and obtaining the encryption key associated with the key index in the secure isolation storage area of ​​the secure portable device, further comprises: Determine whether the current operating user has the authority to perform encryption or decryption operations; If yes, continue with the encryption or decryption action; If not, the user is prohibited from encrypting or decrypting the file.

8. The file protection method based on a secure portable device according to claim 1, characterized in that: Generating an encryption key for each file based on the secure portable device includes: The secure portable device generates the encryption key for the file using a true random number.

9. A file protection system based on a secure portable device, characterized in that: The invention comprises a general computer device and a secure portable device, wherein the secure portable device is connected to the general computer device; the secure portable device comprises a key module and an encryption and decryption module; Generate an encryption key for each file based on the key module of the secure portable device, and encrypt the corresponding file using the encryption and decryption module based on the encryption key to obtain an encrypted file; The general computer device includes a common storage area, and the secure portable device includes a secure isolation storage area and a common storage area; Each encryption key is associated with a key index, and the encrypted file and the corresponding key index are linked together and stored in the general storage area of ​​the secure portable device and / or the general computer device; the encryption key of each file and the key index associated with the encryption key are linked together and stored in the secure isolation storage area of ​​the secure portable device; Based on the key index corresponding to the encrypted file, the encryption key associated with the key index is obtained in the secure isolation storage area of ​​the secure portable device, and based on the encryption key, the encrypted file is decrypted by the encryption and decryption module to obtain the plaintext file of the encrypted file.

10. The file protection system based on a secure portable device according to claim 9, characterized in that: The secure portable device includes a USB flash drive and a removable solid-state hard drive.

Images