Data protection method and system and electronic equipment

Abstract

The invention discloses a data protection method and system and electronic equipment, and is applied to the technical field of computers, in the scheme, a file receiver access end downloads a target file from a file receiver server, and decrypts and verifies the target file in a local area network of the file receiver access end; namely, in the file receiver network, decryption and verification of the target file are completed in the network by means of the file receiver server, the file receiver access end and the terminal, communication with the file provider network is not needed, local verification and file decryption are achieved, the security of the file is guaranteed to the maximum extent, and the file security is improved. Decryption and security authentication of encrypted files in a file provider network and a file receiver network are realized.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data protection method, system and electronic device. Background Art

[0002] Usually, for network security reasons, the file recipient network is not connected to the external network, and generally does not frequently communicate with the file provider network. If the encrypted file in the file provider network is transferred to the file recipient network, then due to the communication security requirements of the file recipient network and the file provider network, the terminal in the file recipient network may not be able to communicate with the file recipient network to decrypt and authenticate the encrypted file, resulting in the obstruction of the file decryption process and information verification process. Summary of the invention

[0003] In view of this, the purpose of the present application is to provide a data protection method, system and electronic device to achieve decryption and security authentication of encrypted files in mutually isolated networks.

[0004] In order to solve the above technical problems, the present application provides a data protection method, which is applied to a file receiving access terminal, including:

[0005] Download the target file from the file receiving server;

[0006] In response to an access instruction to the target file, displaying an identifiable code in the target file;

[0007] In response to a scanning instruction of the identifiable code by a terminal in the same local area network as the file receiving party access terminal, generating a verification code based on the identifiable code, and sending the verification code to the terminal;

[0008] Based on the consistency between the to-be-verified code received from the human-computer interaction interface of the file recipient access terminal and the verification code generated by the file recipient access terminal, the protected data in the target file is decrypted and displayed.

[0009] Optionally, generating a verification code based on the identifiable code includes:

[0010] Decrypting the identifiable code to obtain a file number corresponding to the protected data;

[0011] Generate a target ciphertext based on the file number and the current timestamp;

[0012] Target characters are intercepted from the target ciphertext, and the verification code is generated based on the target characters.

[0013] Optionally, intercepting target characters from the target ciphertext and generating the verification code based on the target characters includes:

[0014] Extract N characters at the current position from the target ciphertext as the target characters;

[0015] Convert the target character into a hexadecimal number to obtain a target value;

[0016] The quotient of the target value and the set value is calculated, and the remainder is used as the verification code.

[0017] The present application also provides a data protection method, which is applied to a file provider server, comprising:

[0018] Receive protected data submitted by the file submission end;

[0019] Encrypting the protected data using the file number of the protected data to obtain data ciphertext;

[0020] Encrypting the file number to obtain a number ciphertext, and generating an identifiable code based on the number ciphertext;

[0021] Packing the data ciphertext, the number ciphertext and the identifiable code to obtain a target file;

[0022] The target file is pushed to a file receiving server so that the file receiving server stores the target file.

[0023] Optionally, the protected data is symmetrically encrypted using the file number.

[0024] Optionally, encrypting the file number to obtain a number ciphertext, and generating an identifiable code based on the number ciphertext includes:

[0025] Encrypting the file number using a preset secret key to obtain the number ciphertext;

[0026] The numbered ciphertext is base64 encoded to obtain the identifiable code.

[0027] Optionally, pushing the target file to a file receiving server includes:

[0028] Determining the address information of the file receiving server according to the routing configuration information corresponding to the target file;

[0029] The target file is pushed to the file receiving server according to the address information.

[0030] The present application also provides a data protection method, which is applied to a file receiving server, comprising:

[0031] Receiving a request for access to protected data sent by a file receiving access terminal;

[0032] In response to the access request, query and send the target file storing the protected data to the file recipient access terminal, so that the file recipient access terminal downloads the target file from the file recipient server; in response to the access instruction of the target file, display the identifiable code in the target file; in response to the scanning instruction of the identifiable code by a terminal in the same local area network as the file recipient access terminal, generate a verification code based on the identifiable code, and send the verification code to the terminal; based on the consistency between the received verification code and the generated verification code, decrypt and display the protected data in the target file.

[0033] The present application also provides a data protection system, comprising:

[0034] The file provider server is used to receive the protected data submitted by the file submitter; encrypt the protected data using the file number of the protected data to obtain data ciphertext; encrypt the file number to obtain the numbered ciphertext, and generate an identifiable code based on the numbered ciphertext; package the data ciphertext, the numbered ciphertext and the identifiable code to obtain a target file; and push the target file to the file receiver server;

[0035] The file receiving server is used to store the target file; receive an access request for protected data sent by the file receiving access terminal; and query and send the target file storing the protected data to the file receiving access terminal in response to the access request;

[0036] The file receiver access terminal is used to download the target file from the file receiver server; in response to an access instruction of the target file, display the identifiable code in the target file; in response to a scanning instruction of the identifiable code by a terminal in the same local area network as the file receiver access terminal, generate a verification code based on the identifiable code and send the verification code to the terminal; based on the consistency between the received verification code and the generated verification code, decrypt and display the protected data in the target file.

[0037] The present application also provides an electronic device, including a memory and a processor, wherein:

[0038] The memory is used to store the computer program;

[0039] The processor is used to execute the computer program to implement the above-mentioned data protection method.

[0040] The present application also provides a computer-readable storage medium for storing a computer program, wherein the computer program implements the above-mentioned data protection method when executed by a processor.

[0041] The data protection method provided in the present application is applied to a file recipient access terminal, including: downloading a target file from a file recipient server; displaying an identifiable code in the target file in response to an access instruction of the target file; generating a verification code based on the identifiable code in response to a scanning instruction of the identifiable code by a terminal in the same local area network as the file recipient access terminal, and sending the verification code to the terminal; decrypting and displaying the protected data in the target file based on the consistency between the code to be verified received from the human-computer interaction interface of the file recipient access terminal and the verification code generated by the file recipient access terminal.

[0042] It can be seen that in the present application, after the file recipient access terminal (such as: a client of a file recipient server installed on a terminal in a file recipient network) downloads the target file from the file recipient server, the file recipient access terminal responds to the access instruction of the target file, displays the identifiable code in the target file, and then the terminal in the same local area network as the file recipient access terminal scans the identifiable code, and then the file recipient access terminal responds to the scanning instruction, generates a verification code based on the identifiable code, and sends the verification code to the terminal; based on the confirmation by the file recipient access terminal that the code to be verified received from the human-computer interaction interface of the file recipient access terminal is consistent with the verification code generated by the file recipient access terminal, the file recipient access terminal decrypts and displays the protected data in the target file. In this scheme, the file receiver access terminal downloads the target file from the file receiver server, and completes decryption and verification of the target file in its own local area network; that is: the present application completes the decryption and verification of the target file in the file receiver network with the help of the file receiver server, the file receiver access terminal and the terminal, without communicating with the file provider network, thereby realizing local verification and file decryption, ensuring the security of the file to the greatest extent, and realizing the decryption and security authentication of encrypted files in the file provider network and the file receiver network.

[0043] In addition, the present application also provides a data protection system, an electronic device and a computer-readable storage medium, which also have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0045] Figure 1 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0046] Figure 2 A flow chart of a data protection method provided in an embodiment of the present application;

[0047] Figure 3 Another data protection method flow chart provided in the embodiment of the present application;

[0048] Figure 4 A flow chart of a third data protection method provided in an embodiment of the present application;

[0049] Figure 5 A schematic diagram of the structure of a data protection system provided in an embodiment of the present application;

[0050] Figure 6 A flowchart of the fourth data protection method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0052] Each step in this application can be performed by a designated electronic device, the form of which is not limited, for example, it can be a general computing device such as a computer or a server. Figure 1 , Figure 1 The electronic device 100 may include a processor 101 and a memory 102 , and may further include one or more of a multimedia component 103 , an information input / information output (I / O) interface 104 , and a communication component 105 .

[0053] The processor 101 is used to control the overall operation of the electronic device 100 to complete all or part of the steps in the above-mentioned data protection method; the memory 102 is used to store various types of data to support the operation of the electronic device 100, and these data may include, for example, instructions for any application or method used to operate on the electronic device 100, and data related to the application. The memory 102 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0054] The multimedia component 103 may include a screen and an audio component. The screen may be, for example, a touch screen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone, which is used to receive external audio signals. The received audio signal may be further stored in the memory 102 or sent through the communication component 105. The audio component also includes at least one speaker for outputting audio signals. The I / O interface 104 provides an interface between the processor 101 and other interface modules, and the above-mentioned other interface modules may be a keyboard, a mouse, buttons, etc. These buttons may be virtual buttons or physical buttons. The communication component 105 is used for wired or wireless communication between the electronic device 100 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G or 4G, or a combination of one or more of them, so the corresponding communication component 105 may include: Wi-Fi component, Bluetooth component, NFC component.

[0055] The electronic device 100 can be implemented by one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic components to execute the data protection method proposed in this application.

[0056] Please refer to Figure 2 , Figure 2 A flowchart of a data protection method provided in an embodiment of the present application. The method is applied to a file receiving access terminal, and includes:

[0057] S201. Download a target file from a file receiving server.

[0058] In one example, the target file stored in the file receiving server is obtained from the file providing server. That is, the file providing server stores the target file, and the file receiving server obtains the target file from the file providing server. The target file always remains in a ciphertext state during storage, transmission, etc. The file receiving access terminal can be a client of the file receiving server, and the file receiving access terminal can be installed on any terminal in the file receiving network.

[0059] Specifically, the target file stored in the file provider server is submitted by the file submission terminal. The file provider server can receive the protected data submitted by the file submission terminal; encrypt the protected data using the file number of the protected data to obtain data ciphertext; encrypt the file number to obtain the numbered ciphertext, and generate an identifiable code (such as a QR code, barcode, etc.) based on the numbered ciphertext; then package the data ciphertext, the numbered ciphertext and the identifiable code to obtain the target file; and then push the target file to the file recipient server. In one example, the file provider can be a device design manufacturer, and the file recipient can be a device manufacturer. For example, if the file number is YPXQ-20231228001, the CAD file is encrypted with this file number to obtain the data ciphertext; then the file number is encrypted with the set key (such as 1234567890123456) to obtain the number ciphertext: 6YFXTXhj7gpTIb291HUyDQUBh6DN5amHLLqwkatz5VM=, and the number ciphertext is base64 encoded to generate a QR code as an identifiable code. Then the data ciphertext of the CAD file, its number ciphertext and QR code are packaged to form a file as the target file.

[0060] S202: In response to an access instruction to a target file, display an identifiable code in the target file.

[0061] S203 , in response to a scanning instruction of the identifiable code from a terminal in the same local area network as the file recipient access terminal, generating a verification code based on the identifiable code, and sending the verification code to the terminal.

[0062] After downloading the target file from the file receiver server to the file receiver access terminal, the user can operate on the file receiver access terminal, for example: click the file open button displayed on the file receiver access terminal to access the target file; accordingly, the file receiver access terminal responds to the access instruction and displays the identifiable code in the target file on the corresponding display interface, so that the user can scan the identifiable code using a terminal in the same local area network as the file receiver access terminal. After the scan is completed, the file receiver access terminal responds to the scan instruction, generates a verification code based on the identifiable code, and sends the verification code to the terminal. Accordingly, the file receiver access terminal displays the input interface of the verification code, the user inputs the verification code received by the terminal to the file receiver access terminal, and clicks the OK submission button. The file receiver access terminal compares the verification code entered by the user with the aforementioned verification code generated by itself to complete the security authentication of the file.

[0063] In one embodiment, generating a verification code based on the identifiable code includes: decrypting the identifiable code to obtain a file number corresponding to the protected data; generating a target ciphertext based on the file number and the current timestamp; intercepting a target character from the target ciphertext, and generating a verification code based on the target character. In one embodiment, intercepting a target character from the target ciphertext, and generating a verification code based on the target character includes: intercepting N characters at the current position from the target ciphertext as the target character; converting the target character into a hexadecimal number to obtain a target value; calculating the quotient of the target value and the set value, and using the remainder as the verification code. Referring to the generation process of the identifiable code in the above example, the identifiable code is reversely decrypted to obtain the file number YPXQ-20231228001, and the file number YPXQ-20231228001 and the current timestamp (such as: 1723538798225) are concatenated to obtain the concatenation result YPXQ-202312280011723538798225. The concatenation result is subjected to HmacSHA1 to generate the ciphertext weV7JFbbFr2gtSMFVIvazp8QkNo=, the last 4 digits of the ciphertext are intercepted, and the hexadecimal interception result is divided by 1000000 to obtain the remainder, and the 6-digit string 360527 (0 is added in front if it is less than the value) is obtained as the verification code.

[0064] S204: If the verification code received from the human-computer interaction interface of the file recipient access terminal is consistent with the verification code generated by the file recipient access terminal, the protected data in the target file is decrypted and displayed.

[0065] In this embodiment, if the verification code received from the human-computer interaction interface of the file receiving party access terminal is consistent with the verification code generated by the file receiving party access terminal, the file security authentication is considered to be passed, and the protected data in the target file is decrypted and displayed. The decryption algorithm used for decryption here corresponds to the encryption algorithm used by the file provider server to encrypt the protected data using the file number of the protected data.

[0066] It can be seen that in this embodiment, after the file recipient access terminal (such as: a client of the file recipient server installed on a terminal in the file recipient network) downloads the target file from the file recipient server, the file recipient access terminal responds to the access instruction of the target file, displays the identifiable code in the target file, and then the terminal in the same local area network as the file recipient access terminal scans the identifiable code, and then the file recipient access terminal responds to the scanning instruction, generates a verification code based on the identifiable code, and sends the verification code to the terminal; if the file recipient access terminal confirms that the verification code received from the human-computer interaction interface of the file recipient access terminal is consistent with the verification code generated by the file recipient access terminal, the file recipient access terminal decrypts and displays the protected data in the target file. In this solution, the file receiver access terminal downloads the target file from the file receiver server and completes decryption and verification of the target file in its own local area network; that is: in the file receiver network, with the help of the file receiver server, the file receiver access terminal and the terminal, the decryption and verification of the target file are completed in the network without communicating with the file provider network, thus realizing local verification and file decryption, ensuring the security of the file to the greatest extent, and realizing the decryption and security authentication of encrypted files in the file provider network and the file receiver network.

[0067] Another data protection method provided in an embodiment of the present application is introduced below. The data protection method described below and the data protection methods described in other embodiments can be referenced to each other.

[0068] Please refer to Figure 3 , Figure 3 Another data protection method process provided in an embodiment of the present application is applied to a file provider server, including:

[0069] S301, receiving protected data submitted by a file submission terminal.

[0070] S302: Encrypt the protected data using its file number to obtain data ciphertext.

[0071] In one implementation, the protected data is symmetrically encrypted using the file number.

[0072] S303, encrypt the file number to obtain a number ciphertext, and generate an identifiable code based on the number ciphertext.

[0073] In one implementation, encrypting a file number to obtain a numbered ciphertext and generating an identifiable code based on the numbered ciphertext includes: encrypting the file number using a preset key to obtain the numbered ciphertext; and base64 encoding the numbered ciphertext to obtain the identifiable code.

[0074] S304, packing the data ciphertext, the number ciphertext and the identifiable code to obtain the target file.

[0075] For example, the file number of the CAD drawing file as the protected data is: YPXQ-20231228001. The CAD drawing file is encrypted with this file number to obtain the data ciphertext. Then, the file number is encrypted with the set key (such as: 1234567890123456) to obtain the number ciphertext: 6YFXTXhj7gpTIb291HUyDQUBh6DN5amHLLqwkatz5VM=, and the number ciphertext is base64 encoded to generate a QR code as an identifiable code. Then, the data ciphertext of the CAD drawing file, its number ciphertext and QR code are packaged to form a file as the target file.

[0076] S305: Push the target file to the file receiving server, so that the file receiving server stores the target file.

[0077] In one embodiment, pushing the target file to the file receiver server includes: determining the address information of the file receiver server according to the routing configuration information corresponding to the target file; and pushing the target file to the file receiver server according to the address information. After the file receiver server stores the target file, it can receive an access request for protected data sent by the file receiver access terminal; in response to the access request, query and send the target file storing the protected data to the file receiver access terminal, so that the file receiver access terminal downloads the target file from the file receiver server; in response to the access instruction of the target file, display the identifiable code in the target file; in response to the scanning instruction of the identifiable code by a terminal in the same local area network as the file receiver access terminal, generate a verification code based on the identifiable code, and send the verification code to the terminal; if the received verification code is consistent with the generated verification code, decrypt and display the protected data in the target file.

[0078] In this embodiment, the file provider server encrypts and stores the protected data submitted by the file submitter, and pushes it to the file receiver server, so that the file ciphertext can be shared in the file provider network and the file receiver network.

[0079] The third data protection method provided in an embodiment of the present application is introduced below. The third data protection method described below and the data protection methods described in other embodiments can be referenced to each other.

[0080] Please refer to Figure 4 , Figure 4 The third data protection method process provided in the embodiment of the present application is applied to the file receiving server, including:

[0081] S401: Receive a request for accessing protected data sent by a file receiving access terminal.

[0082] S402. In response to an access request, query and send a target file storing protected data to a file recipient access terminal, so that the file recipient access terminal downloads the target file from a file recipient server; in response to an access instruction to the target file, display an identifiable code in the target file; in response to a scanning instruction of the identifiable code by a terminal in the same local area network as the file recipient access terminal, generate a verification code based on the identifiable code, and send the verification code to the terminal; based on the consistency between the received verification code and the generated verification code, decrypt and display the protected data in the target file.

[0083] In one embodiment, generating a verification code based on an identifiable code includes: decrypting the identifiable code to obtain a file number corresponding to the protected data; generating a target ciphertext based on the file number and a current timestamp; intercepting target characters from the target ciphertext, and generating a verification code based on the target characters.

[0084] In one embodiment, target characters are intercepted from a target ciphertext, and a verification code is generated based on the target characters, including: intercepting N characters at a current position from the target ciphertext as target characters; converting the target characters into hexadecimal numbers to obtain a target value; calculating the quotient of the target value and a set value, and using the remainder as the verification code.

[0085] In this embodiment, the file receiver server responds to the access request for protected data sent by the file receiver access terminal, thereby realizing the decryption and verification process of the target file. The entire process is completed independently in the file receiver network with the help of the file receiver server, the file receiver access terminal and the terminal, without the need to communicate with the file provider network, realizing the local verification and file decryption of the file receiver, maximally ensuring the security of the file, and realizing the decryption and security authentication of the encrypted file in the file provider network and the file receiver network.

[0086] A data protection system provided in an embodiment of the present application is introduced below. The data protection system described below and the data protection methods described in other embodiments can be referenced to each other.

[0087] Please refer to Figure 5 , Figure 5 A schematic diagram of the structure of a data protection system provided in an embodiment of the present application includes:

[0088] The file provider server is used to receive the protected data submitted by the file submitter; encrypt the protected data using the file number of the protected data to obtain data ciphertext; encrypt the file number to obtain the numbered ciphertext, and generate an identifiable code based on the numbered ciphertext; package the data ciphertext, the numbered ciphertext and the identifiable code to obtain the target file; and push the target file to the file receiver server;

[0089] The file receiving server is used to store the target file; receive the access request of the protected data sent by the file receiving access terminal; in response to the access request, query and send the target file storing the protected data to the file receiving access terminal;

[0090] The file receiver access terminal is used to download the target file from the file receiver server; in response to the access instruction of the target file, the identifiable code in the target file is displayed; in response to the scanning instruction of the identifiable code by the terminal in the same local area network as the file receiver access terminal, a verification code is generated based on the identifiable code, and the verification code is sent to the terminal; based on the consistency between the received verification code and the generated verification code, the protected data in the target file is decrypted and displayed.

[0091] In one embodiment, the file submission terminal is also arranged in the data protection system. A proxy server may also be arranged for the file provider server, and data transmission between the file provider server and the file recipient server is realized through the proxy server.

[0092] In this embodiment, the file submission end, the file provider server, the file recipient server and the file recipient access end constitute a data protection system, through which the encrypted storage, shared transmission, decryption and security authentication of the file ciphertext can be realized, and the decryption and security authentication are completed in the file provider network, which maximizes the security of the file and realizes the decryption and security authentication of the encrypted file in the file provider network and the file recipient network. The file submission end is the client of the file provider server.

[0093] In one example, the file provider may be a device design manufacturer, and the file recipient may be a device manufacturer. The device design manufacturer sends the CAD drawing file to the device manufacturer for processing and manufacturing, and the CAD drawing file itself is a confidential file, and the device design manufacturer's intranet does not allow arbitrary external access. In order to ensure the security of the CAD drawing file, after the device design manufacturer sends the encrypted CAD drawing file in its own file provider server to the manufacturer's server, the encrypted CAD drawing file also needs to be managed, which mainly includes the following two parts: encryption of the CAD drawing file and file encryption and security authentication in the local area network where the file recipient server is located.

[0094] 1. Encryption of CAD drawing files: CAD drawing files are sent in batches. Different batches of CAD drawing files use their file numbers (different batches have different file numbers, and the same batch has the same file number) as the secret key for AES encryption. At the same time, the file number is encrypted with a fixed secret key and placed in a txt file under the CAD directory. A QR code is generated based on the encrypted file number. The above three types of files are packaged and sent to the file receiving server.

[0095] 2. After the file recipient obtains the file, he first uses the mobile client (i.e. the client installed on the terminal in the same LAN as the file recipient's access terminal) to scan the QR code and AES decrypt to obtain the file number. Then, when the foxenc client (i.e. the file recipient's access terminal) is used to open the CAD drawing file, a verification code input box pops up. Enter the 6-digit verification code obtained by the mobile client from the file recipient's access terminal to the foxenc client, so that the Foxenc client parses and decrypts the txt file to obtain the file number, and verifies the file number and the input verification code; if the verification is correct, the CAD drawing file is decrypted and the local CAD program is called to open the decrypted CAD drawing file. Among them, the generation logic of the 6-digit verification code is: the decrypted file number plus the current time divided by 60, that is, the number of minutes, is used as a string, and then HmacSHA1 encryption is performed to obtain the last 4 hexadecimal digits of the encrypted ciphertext, and convert it into a decimal number, and finally the last 6 digits of the decimal number are intercepted as the verification code.

[0096] See also Figure 6 , the fourth data protection method process includes:

[0097] 1: Use the file number as the secret key to encrypt the CAD drawing file, with the encryption suffix enc.

[0098] The CAD drawing files are encrypted symmetrically with AES using the file number. The file number corresponding to each batch is different to avoid confusion of the secret keys of different batches of CAD drawing files sent to the file provider. At the same time, the file provider provides the PC application Foxenc, which is bound to the file with the enc suffix during installation. This can be achieved: when the user double-clicks the enc file, the client Foxenc is automatically called, which is convenient for user operation. If the file number is: YPXQ-20231228001, then the CAD drawing file is encrypted using this file number as the secret key.

[0099] Among them, a CAD file management system can be deployed on the file provider's server, and users can submit CAD files to the CAD file management system through the client of the system. The CAD file management system will review, encrypt and distribute the CAD files. Specifically, when submitting CAD files, users can specify the file recipient, and the CAD file management system can also automatically select the corresponding file recipient according to the file number.

[0100] 2: Use AES to encrypt the file number with a fixed key and save it in a txt file.

[0101] The file number as a secret key also needs to be protected, so in this step, the file number is encrypted with a fixed secret key, and base64 encoded to generate a QR code. The generated ciphertext is saved in the newly created enc.txt file. Since the file number is a regular string generated according to fixed rules, if it is not encrypted, directly pushing it in plain text may cause confidential files to be leaked and cause data security risks. For example: the file number can be encrypted with a fixed secret key as the public key (such as: 1234567890123456) to generate the ciphertext 6YFXTXhj7gpTIb291HUyDQUBh6DN5amHLLqwkatz5VM=, and the above ciphertext can be placed in a txt file for subsequent use.

[0102] 3: Generate a QR code with the escaped file number.

[0103] In this embodiment, the encrypted string of the file number is converted into a QR code, and the mobile phone obtains the escaped file number by scanning the code, which is more convenient for users in operation.

[0104] 4: Package the encrypted image files, txt files and QR code files, and transfer them to the file receiving server via a proxy.

[0105] It should be noted that the encrypted CAD drawing file, the file number ciphertext string txt and the QR code are packaged and transmitted to the file receiving server in a proxy manner. Among them, the enc file is used as an encrypted file, the txt file stores the escaped file number for client verification and decryption, and the QR code is used for mobile phone terminals to scan the code to bind the file number and randomly generate the verification code.

[0106] 5: The recipient unzips the file and uses the provided mobile phone to scan the QR code to bind the file number of this batch.

[0107] The recipient downloads the compressed file from its own FTP server and decompresses it, scans the QR code on a mobile phone to obtain the QR code content, i.e., the ciphertext, and decrypts the ciphertext using AES with a fixed public key (e.g., 1234567890123456) to obtain the file number YPXQ-20231228001.

[0108] 6: Install Foxenc client on the PC in the receiving party's LAN and bind the enc suffix file.

[0109] After installing the Foxenc client, the files with the enc suffix are automatically associated. This program serves as the entry point for opening files, ensuring that encrypted files can only be opened with this client and subsequently verified.

[0110] 7: When you double-click the enc file, an input box pops up. The password comes from the real-time verification code generated by the current batch obtained on the mobile phone.

[0111] Specifically, when a user double-clicks to open a confidential file, the Foxenc client first verifies whether a txt file exists in the current directory. If not, it means that the encrypted file has been copied out, and a notification message "Failed to obtain the decryption key" is prompted. If it exists, an input box pops up to receive a random verification code. At this time, open the mobile phone to obtain the random verification code generated by the file number and enter the verification code on the client.

[0112] For example, add the file number YPXQ-20231228001 and the current minute (such as 1723538798225), YPXQ-202312280011723538798225, perform HmacSHA1 to generate the ciphertext weV7JFbbFr2gtSMFVIvazp8QkNo=, get the hexadecimal number from the last 4 digits of the ciphertext and divide it by 1000000 to get a 6-digit string (fill in the leading 0 if it is less than 360527).

[0113] 8: Decrypt the current file and call the local CAD program to open the file.

[0114] The client reads the txt file content 6YFXTXhj7gpTIb291HUyDQUBh6DN5amHLLqwkatz5VM= in the current directory, and decrypts it with the public key 1234567890123456 to obtain the file number, and then uses the file number and the current minute as the Secret to generate a random verification code according to the same logic. If the random verification code manually entered by the user is the same as the random verification code generated by the client, the file is decrypted according to the file number and the local CAD program is called to open the file. If they are different, a notification message "Verification code input error" is prompted.

[0115] If you exit the Foxenc program, you will exit the CAD program accordingly. In addition, the CAD drawing files are protected during design, that is, printing and saving as are prohibited to ensure the security of the files to the maximum extent.

[0116] It can be seen that this embodiment can realize local decryption and verification of CAD drawing files in the recipient's network when the recipient's network is not connected to the Internet, and the security of the file can be guaranteed to the maximum extent in the whole process. If the recipient wants to open the file, he must ask the mobile phone to scan the QR code to bind the file number. Different batches of files have different file numbers, which can prevent different batches of files from verifying and opening each other, thus achieving the protection of confidential files sent out.

[0117] The computer-readable storage medium provided in an embodiment of the present application is introduced below. The computer-readable storage medium described below and the data protection methods described in other embodiments can be referenced to each other.

[0118] The present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned data protection method are implemented.

[0119] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0120] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0121] Those skilled in the art may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0122] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0123] Finally, it should be noted that, in this article, relationships such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms include, include or any other variations are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0124] Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A data protection method, characterized in that: Applied to the file receiving end, including: Download the target file from the file receiving server; In response to an access instruction to the target file, displaying an identifiable code in the target file; In response to a scanning instruction of the identifiable code by a terminal in the same local area network as the file receiving party access terminal, generating a verification code based on the identifiable code, and sending the verification code to the terminal; Based on the consistency between the to-be-verified code received from the human-computer interaction interface of the file recipient access terminal and the verification code generated by the file recipient access terminal, the protected data in the target file is decrypted and displayed.

2. The method according to claim 1, characterized in that The generating a verification code based on the identifiable code comprises: Decrypting the identifiable code to obtain a file number corresponding to the protected data; Generate a target ciphertext based on the file number and the current timestamp; Target characters are intercepted from the target ciphertext, and the verification code is generated based on the target characters.

3. The method according to claim 2, characterized in that The step of extracting target characters from the target ciphertext and generating the verification code based on the target characters includes: Extract N characters at the current position from the target ciphertext as the target characters; Convert the target character into a hexadecimal number to obtain a target value; The quotient of the target value and the set value is calculated, and the remainder is used as the verification code.

4. A data protection method, characterized in that: Applicable to the file provider server, including: Receive protected data submitted by the file submission end; Encrypting the protected data using the file number of the protected data to obtain data ciphertext; Encrypting the file number to obtain a number ciphertext, and generating an identifiable code based on the number ciphertext; Packing the data ciphertext, the number ciphertext and the identifiable code to obtain a target file; Push the target file to the file receiving server.

5. The method according to claim 4, characterized in that The step of encrypting the protected data by using the file number of the protected data comprises: The protected data is symmetrically encrypted using the file number.

6. The method according to claim 4, characterized in that The encrypting the file number to obtain a number ciphertext, and generating an identifiable code based on the number ciphertext, includes: Encrypting the file number using a preset secret key to obtain the number ciphertext; The numbered ciphertext is base64 encoded to obtain the identifiable code.

7. The method according to claim 4, characterized in that The step of pushing the target file to the file receiving server comprises: Determining the address information of the file receiving server according to the routing configuration information corresponding to the target file; The target file is pushed to the file receiving server according to the address information.

8. A data protection method, characterized in that: Applicable to the file receiving server, including: Receiving a request for access to protected data sent by a file receiving access terminal; In response to the access request, query and send the target file storing the protection data to the file receiving party access terminal, so that the file receiving party access terminal downloads the target file from the file receiving party server; In response to an access instruction to the target file, displaying an identifiable code in the target file; In response to a scanning instruction of the identifiable code by a terminal in the same local area network as the file receiving party access terminal, generating a verification code based on the identifiable code, and sending the verification code to the terminal; Based on the received to-be-verified code being consistent with the generated verification code, the protected data in the target file is decrypted and displayed.

9. A data protection system, characterized in that: include: The file provider server is used to receive the protected data submitted by the file submitter; Encrypting the protected data using the file number of the protected data to obtain data ciphertext; encrypting the file number to obtain numbered ciphertext, and generating an identifiable code based on the numbered ciphertext; packaging the data ciphertext, the numbered ciphertext and the identifiable code to obtain a target file; Pushing the target file to a file receiving server; The file receiving server is used to store the target file; Receiving a request for access to protected data sent by a file receiving access terminal; In response to the access request, query and send the target file storing the protection data to the file receiving access terminal; The file receiver access terminal is used to download the target file from the file receiver server; In response to an access instruction to the target file, displaying an identifiable code in the target file; in response to a scanning instruction of the identifiable code by a terminal in the same local area network as the file receiving party access terminal, generating a verification code based on the identifiable code, and sending the verification code to the terminal; Based on the received to-be-verified code being consistent with the generated verification code, the protected data in the target file is decrypted and displayed.

10. An electronic device, characterized in that: comprising a memory and a processor, wherein: The memory is used to store the computer program; The processor is configured to execute the computer program to implement the method according to any one of claims 1 to 8.

Images