Secure development management system based on file transparent encryption

Abstract

The invention relates to the technical field of file management, and discloses a security development management system based on file transparent encryption, which comprises a system module assembly, the system module assembly comprises a host security protection subsystem deployed on a user host and a security management service subsystem deployed on a company server, and the host security protection subsystem comprises a transparent encryption filter driver, a security control assembly, a host configuration assembly and a security transmission assembly. Through the transparent encryption technology, the file with a specific directory and a suffix name is encrypted, the safety of code assets in the full life cycle of development, archiving, joint debugging and the like is ensured, the key with timeliness is distributed through the safety USB key, a developer can conveniently carry an encrypted source code to other places for joint debugging or technical guarantee, and the development efficiency is improved. Code leakage risks do not need to be worried about.

Description

Technical Field

[0001] The present invention relates to the technical field of file management, and in particular to a secure development and management system based on transparent file encryption. Background Art

[0002] Sensitive files such as source code, design files, and technical documents are core assets of enterprises and other institutions. Traditional development and office environments lack effective protection for sensitive data. Especially in local development environments, sensitive files such as source code usually exist in plain text and are easily accessed or leaked by unauthorized personnel. With the development of information technology, data leakage incidents have occurred frequently, causing huge losses to enterprises and individuals. Although traditional file encryption methods can provide a certain degree of security, due to their operational complexity and interference with users' daily work, there are many inconveniences in actual applications. It is also easy for files to not be encrypted or encrypted thoroughly due to human negligence.

[0003] Some transparent encryption technologies, such as BitLocker, VeraCrypt and other software, use disks, partitions or large files as storage encryption carriers, and provide virtual partitions with transparent file access, thus achieving the security of file storage. However, the protection granularity is relatively rough. As long as the user identity or password verification is passed and the virtual partition is successfully mounted, the plaintext data of sensitive files can be read, copied and transferred in any way. This type of method cannot solve the security protection problem of sensitive data throughout its life cycle, so a security development management system based on transparent file encryption is proposed. Summary of the invention

[0004] 1. Technical issues to be resolved

[0005] In view of the deficiencies in the prior art, the present invention provides a secure development management system based on transparent file encryption. By integrating multiple security technologies and functional modules, it automatically encrypts and decrypts sensitive files, thereby achieving comprehensive management and protection of the development environment, data storage and transmission, and user permissions.

[0006] (II) Technical solution

[0007] In order to achieve the above object, the present invention adopts the following technical solutions:

[0008] A security development management system based on transparent file encryption includes a system module assembly, wherein the system module assembly includes a host security protection subsystem deployed on a user host and a security management service subsystem deployed on a company server. The host security protection subsystem includes a transparent encryption filter driver, a security control component, a host configuration component, and a secure transmission component. The security management service subsystem includes a user management component, a host management component, a key management component, a service configuration component, a key management component, and an audit log component. For authorized hosts, the security control component sends keys and policies to the transparent encryption filter driver, and then transparent encryption and decryption of files are performed through the transparent encryption filter driver to promote the authorization process. The transparent encryption filter driver interacts with unauthorized processes through ciphertext data. The transparent encryption filter driver is connected to an operating system file system, and the operating system file system is connected to a disk storage device and transmits encrypted files. For unauthorized hosts, the operating system file system interacts with the disk storage device to exchange encrypted files, and then the operating system file system interacts with any process to exchange encrypted files.

[0009] Furthermore, the transparent encryption filter driver can identify preset file types and automatically apply encryption policies when files are created, modified or read, ensuring that files are stored in encrypted form on the disk and presented in plain text in the application.

[0010] On the basis of the above scheme, the security control component is connected to the security management subsystem to complete the user's identity authentication and login authorization, obtain the distributed file keys and security protection rules, etc., and report the host status information and audit logs, interact with the transparent encryption filter driver, inject file keys and encryption policies, and access the secure USB key for outbound joint debugging and security scenarios. After identity authentication, the file keys that are kept for a limited time are read to achieve normal development and office work under offline conditions. It is responsible for the security protection of the host, preventing users from copying sensitive file data opened by authorized software to unauthorized software, and preventing tampering of each component of the subsystem.

[0011] As a further solution of the present invention, the host configuration component is used to provide a user-friendly interface and configure the necessary parameters of the host security protection subsystem. The secure transmission component solves the problem of securely transmitting encrypted codes between the development machine and the code repository and between different development machines. The authorized sender and receiver establish a secure channel. The sender decrypts the file and then transmits it using the secure transmission channel. The receiver decrypts the file after receiving it and then uses the local file key to encrypt and store it.

[0012] Furthermore, the user management component provides user registration, login, and role assignment to ensure that only authenticated users can access system resources. The host management component centrally manages all hosts deployed with the host security protection subsystem. The service configuration component performs parameter configuration, user configuration, host configuration, and policy configuration on the security management service subsystem, allowing IDEs, compilers, and debuggers to transparently read and write encrypted files.

[0013] Based on the above solution, the key management component includes the production and recycling of secure USB keys, writing of time-limited access file keys and user identity authentication.

[0014] Furthermore, the audit log component collects and summarizes user operations and abnormal file access logs reported by each host.

[0015] The beneficial effects of the present invention are:

[0016] 1. In the present invention, transparent encryption technology is used to encrypt files in specific directories and suffixes to ensure the security of code assets throughout the entire life cycle of development, archiving, and joint debugging.

[0017] 2. In the present invention, the host security control software is responsible for transparent encryption control of the host, integration with development software and office software, authentication and authorization with the server or security USB key, and management of host access control strategy.

[0018] 3. In the present invention, by configuring registration, IDE, compiler, debugger and other software are allowed to transparently read and write encrypted files, without the need for additional encryption and decryption operations during the development process, thus simplifying the development process.

[0019] 4. In the present invention, time-limited keys are distributed through secure USB keys, which makes it easy for developers to carry encrypted source code to other places for joint debugging or technical support without worrying about the risk of code leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a schematic diagram of the system framework structure of a secure development management system based on transparent file encryption proposed by the present invention.

[0021] Figure 2 This is a schematic diagram of the basic principle of a transparent encryption filter driver for a secure development management system based on transparent file encryption proposed by the present invention. DETAILED DESCRIPTION

[0022] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. It should be noted that, unless otherwise clearly specified and limited, the terms "installation", "connection" and "setting" should be understood in a broad sense. For ordinary technicians in this field, the specific meanings of the above terms in this patent can be understood according to specific circumstances.

[0023] Example 1

[0024] Reference Figure 1-2 A security development management system based on transparent file encryption includes a system module assembly, which includes a host security protection subsystem deployed on a user host and a security management service subsystem deployed on a company server. The host security protection subsystem includes a transparent encryption filter driver, a security control component, a host configuration component, and a secure transmission component. The security management service subsystem includes a user management component, a host management component, a key management component, a service configuration component, a key management component, and an audit log component. For authorized hosts, the security control component sends keys and policies to the transparent encryption filter driver, and then transparent encryption and decryption of files are performed through the transparent encryption filter driver to promote the authorization process. The transparent encryption filter driver interacts with unauthorized processes through ciphertext data. The transparent encryption filter driver is connected to an operating system file system, and the operating system file system is connected to a disk storage device and transmits encrypted files. For unauthorized hosts, the operating system file system interacts with the disk storage device to exchange encrypted files, and then the operating system file system interacts with any process to exchange encrypted files.

[0025] In the present invention, the transparent encryption filter driver can identify the preset file type and automatically apply the encryption policy when the file is created, modified or read, ensuring that the file is stored in encrypted form on the disk and presented in plain text in the application. Through transparent encryption technology, encryption processing is implemented for files in specific directories and suffixes to ensure the security of code assets throughout the entire life cycle of development, archiving, and joint debugging. The security control component is connected to the security management subsystem to complete the user's identity authentication and login authorization, obtain the distributed file keys and security protection rules, etc., and report the host status information and audit logs, interact with the transparent encryption filter driver, inject file keys and encryption policies, and access a secure USB key for outbound joint debugging and security scenarios. After identity authentication, the file keys that are stored for a limited time are read to achieve normal development and Office is responsible for the security protection of the host to prevent users from copying sensitive file data opened by authorized software to unauthorized software, as well as tamper-proofing of various components of the subsystem. It is responsible for transparent encryption control of the host through the host security control software, integration with development software and office software, authentication and authorization with the server or secure USB key, and management of host access control policies. The host configuration component is used to provide a user-friendly interface and configure the necessary parameters of the host security protection subsystem, such as the address of the security management service, the process file path for authorized access to sensitive files, etc. The secure transmission component solves the problem of secure transmission of encrypted codes between the development machine and the code repository and between different development machines. The authorized sender and receiver establish a secure channel. The sender decrypts the file and then uses the secure transmission channel to transmit it. The receiver decrypts it after receiving it and then uses the local file key for encrypted storage.

[0026] Example 2

[0027] Reference Figure 1-2 A security development management system based on transparent file encryption includes a system module assembly, which includes a host security protection subsystem deployed on a user host and a security management service subsystem deployed on a company server. The host security protection subsystem includes a transparent encryption filter driver, a security control component, a host configuration component, and a secure transmission component. The security management service subsystem includes a user management component, a host management component, a key management component, a service configuration component, a key management component, and an audit log component. For authorized hosts, the security control component sends keys and policies to the transparent encryption filter driver, and then transparent encryption and decryption of files are performed through the transparent encryption filter driver to promote the authorization process. The transparent encryption filter driver interacts with unauthorized processes through ciphertext data. The transparent encryption filter driver is connected to an operating system file system, and the operating system file system is connected to a disk storage device and transmits encrypted files. For unauthorized hosts, the operating system file system interacts with the disk storage device to exchange encrypted files, and then the operating system file system interacts with any process to exchange encrypted files.

[0028] In the present invention, the transparent encryption filter driver can identify the preset file type and automatically apply the encryption policy when the file is created, modified or read, ensuring that the file is stored in encrypted form on the disk and presented in plain text in the application. Through transparent encryption technology, encryption processing is implemented for files in specific directories and suffixes to ensure the security of code assets throughout the entire life cycle of development, archiving, and joint debugging. The security control component is connected to the security management subsystem to complete the user's identity authentication and login authorization, obtain the distributed file keys and security protection rules, etc., and report the host status information and audit logs, interact with the transparent encryption filter driver, inject file keys and encryption policies, and access a secure USB key for outbound joint debugging and security scenarios. After identity authentication, the file keys that are stored for a limited time are read to achieve normal development and Office is responsible for the security protection of the host to prevent users from copying sensitive file data opened by authorized software to unauthorized software, as well as tamper-proofing of various components of the subsystem. It is responsible for transparent encryption control of the host through the host security control software, integration with development software and office software, authentication and authorization with the server or secure USB key, and management of host access control policies. The host configuration component is used to provide a user-friendly interface and configure the necessary parameters of the host security protection subsystem, such as the address of the security management service, the process file path for authorized access to sensitive files, etc. The secure transmission component solves the problem of secure transmission of encrypted codes between the development machine and the code repository and between different development machines. The authorized sender and receiver establish a secure channel. The sender decrypts the file and then uses the secure transmission channel to transmit it. The receiver decrypts it after receiving it and then uses the local file key for encrypted storage.

[0029] In particular, the user management component provides user registration, login, and role assignment to ensure that only authenticated users can access system resources. The host management component centrally manages all hosts deployed with the host security protection subsystem, including status monitoring, remote configuration distribution, etc. The service configuration component performs parameter configuration, user configuration, host configuration, and policy configuration on the security management service subsystem, allowing IDE, compilers, debuggers, and other software to transparently read and write encrypted files. Through configuration registration, IDE, compilers, debuggers, and other software are allowed to transparently read and write encrypted files without the need for additional encryption and decryption operations during the development process, simplifying the development process. The key management component includes the production and recycling of secure USB keys, writing time-limited access file keys and user identity authentication to ensure secure access to sensitive files on the host by out-of-town users. Time-sensitive keys are distributed through secure USB keys, making it easy for developers to carry encrypted source code to other places for joint debugging or technical support without worrying about the risk of code leakage. The audit log component collects and summarizes user operations and abnormal file access logs reported by each host, providing efficient query and statistical means to identify security risks.

[0030] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A secure development management system based on transparent file encryption, including a system module assembly, characterized in that: The system module assembly includes a host security protection subsystem deployed on the user host and a security management service subsystem deployed on the company server. The host security protection subsystem includes a transparent encryption filter driver, a security control component, a host configuration component, and a secure transmission component. The security management service subsystem includes a user management component, a host management component, a key management component, a service configuration component, a key management component, and an audit log component. For authorized hosts, the security control component sends keys and policies to the transparent encryption filter driver, and then transparent encryption and decryption of files are performed through the transparent encryption filter driver to promote the authorization process. The transparent encryption filter driver interacts with unauthorized processes through ciphertext data. The transparent encryption filter driver is connected to an operating system file system, and the operating system file system is connected to a disk storage device and transmits encrypted files. For unauthorized hosts, the operating system file system interacts with the disk storage device for encrypted files, and then the operating system file system interacts with any process for encrypted files.

2. According to claim 1, a secure development management system based on transparent file encryption is characterized in that: The transparent encryption filter driver can identify preset file types and automatically apply encryption policies when files are created, modified or read, ensuring that files are stored in encrypted form on the disk and presented in plain text in the application.

3. A secure development management system based on transparent file encryption according to claim 2, characterized in that: The security control component is connected to the security management subsystem to complete user authentication and login authorization, obtain distributed file keys and security protection rules, etc., and report host status information and audit logs, interact with the transparent encryption filter driver, inject file keys and encryption policies, access a secure USB key for outbound joint debugging and security scenarios, and after identity authentication, read the file keys that are stored for a limited time to achieve normal development and office work under offline conditions. It is responsible for the security protection of the host, preventing users from copying sensitive file data opened by authorized software to unauthorized software, and preventing tampering of each component of the subsystem.

4. A secure development management system based on transparent file encryption according to claim 3, characterized in that: The host configuration component is used to provide a user-friendly interface and configure the necessary parameters of the host security protection subsystem. The secure transmission component solves the problem of securely transmitting encrypted codes between the development machine and the code repository and between different development machines. The authorized sender and receiver establish a secure channel. The sender decrypts the file and transmits it using the secure transmission channel. The receiver decrypts it after receiving it and then uses the local file key to encrypt and store it.

5. A secure development management system based on transparent file encryption according to claim 1, characterized in that: The user management component provides user registration, login, and role assignment to ensure that only authenticated users can access system resources. The host management component centrally manages all hosts deployed with the host security protection subsystem. The service configuration component performs parameter configuration, user configuration, host configuration, and policy configuration on the security management service subsystem, allowing IDEs, compilers, and debuggers to transparently read and write encrypted files.

6. A secure development management system based on transparent file encryption according to claim 5, characterized in that: The key management component includes the production and recycling of secure USB keys, writing of time-limited access file keys and user identity authentication.

7. A secure development management system based on transparent file encryption according to claim 6, characterized in that: The audit log component collects and summarizes user operations and abnormal file access logs reported by each host.

Images