A method, device, equipment and storage medium for accessing encrypted files

Abstract

The present application discloses an encrypted file access method, device, equipment and storage medium, which relates to the field of data processing technology and is applied to a trusted operating system integrated with a hardware password card, including: recording an index value corresponding to a target key generated by a target hardware password card, and then generating an extended attribute to be encrypted based on a file to be expanded, so as to encrypt the extended attribute to be encrypted in the target hardware password card using the index value to obtain an encrypted extended attribute; storing the encrypted extended attribute in the file to be expanded to obtain the file to be encrypted, and encrypting the file to be encrypted in the target hardware password card based on the index value to obtain an encrypted file; using an access center generated by a preset access mechanism to determine whether a file access request meets a preset attribute access condition, and if so, calling the target hardware password card to decrypt the encrypted extended attribute, and then accessing the encrypted file based on the obtained extended attribute information. This can improve the security of file access.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to an encrypted file access method, device, equipment and storage medium. Background Art

[0002] With the rapid development of information technology, the security requirements for operating systems in the field of trusted operating systems are constantly increasing, and data security, confidentiality and access control have become core concerns. Traditional operating system access control has the following four problems:

[0003] First, most operating systems rely on static control strategies based on user and group permissions, with coarse control granularity, which makes them unable to adapt to modern and diversified security needs.

[0004] Second, in the face of escalating cybersecurity threats, the existing permission control system lacks flexibility and security and cannot effectively protect sensitive data from illegal access.

[0005] Third, traditional operating systems rely on encryption algorithms implemented in software, which makes it difficult to ensure the absolute security of keys. Especially in the face of high-intensity attacks, software key management solutions are vulnerable to attacks and cracking.

[0006] Fourth, the existing access control system lacks full integration and application of hardware password cards, and cannot effectively combine the hardware security module with the dynamic access control strategy of the operating system.

[0007] As can be seen from the above, how to improve the security, flexibility and adaptability of file access to national encryption standards during the encrypted file access process is an urgent problem to be solved. Summary of the invention

[0008] In view of this, the purpose of the present invention is to provide an encrypted file access method, device, equipment and storage medium, which can improve the security, flexibility and adaptability of the file access process to the national encryption standard when accessing encrypted files. The specific scheme is as follows:

[0009] In a first aspect, the present application provides an encrypted file access method, which is applied to a trusted operating system integrated with a hardware password card, comprising:

[0010] Recording the index value corresponding to the target key generated by the target hardware password card, and then generating the corresponding extended attribute to be encrypted based on the file to be extended, so as to encrypt the extended attribute to be encrypted in the target hardware password card by using the index value to obtain the encrypted extended attribute; the target hardware password card includes a national secret algorithm;

[0011] The encrypted extended attribute is stored in the file to be extended to obtain the file to be encrypted, and the file to be encrypted is encrypted in the target hardware password card based on the index value to obtain the encrypted file;

[0012] An access center is generated using a preset access mechanism to determine whether the identity information in a file access request satisfies a preset attribute access condition. If so, the target hardware password card is called to decrypt the encrypted extended attribute to obtain extended attribute information, and then the encrypted file is accessed based on the extended attribute information.

[0013] Optionally, the recording of the index value corresponding to the target key generated by the target hardware password card includes:

[0014] Loading a preset device driver to use the preset device driver to identify the initial hardware password card, and initializing the initial hardware password card to obtain a target hardware password card; the target hardware password card is integrated and connected with the Xinchuang operating system through a preset physical interface;

[0015] Record the index value corresponding to the target key generated by the target hardware password card using the national secret algorithm, and store the target key and the corresponding index value to the target hardware password card, so as to use the target key determined based on the index value to perform encryption and decryption operations on data; the types of the target key include symmetric keys and asymmetric keys.

[0016] Optionally, the generating a corresponding extended attribute to be encrypted based on the file to be expanded, and encrypting the extended attribute to be encrypted in the target hardware password card by using the index value to obtain the encrypted extended attribute, includes:

[0017] Generate corresponding extended attributes to be encrypted based on the file to be extended by using a preset attribute generation tool; the extended attributes to be encrypted include a basic permission attribute describing the access rights of the file, a time control attribute describing the access rights of a specific time period, and a special permission attribute describing the access rights of a specific user to the file; the basic permission attribute, the time control attribute, and the special permission attribute have the same corresponding structure;

[0018] The index value is used to determine a corresponding target key in the target hardware password card, so as to encrypt the extended attribute to be encrypted in the target hardware password card using the target key to obtain the encrypted extended attribute.

[0019] Optionally, after generating the corresponding extended attribute to be encrypted based on the file to be extended, the method further includes:

[0020] Generate an extended attribute copy corresponding to the first extended attribute corresponding to the file to be extended, and perform a preset operation on the extended attribute copy corresponding to the file to be extended based on the developer's requirements to obtain a second extended attribute; the preset operation includes an add operation, a delete operation, and a modify operation;

[0021] An encryption operation is performed on the second extended attribute to obtain a new encrypted extended attribute, and the new encrypted extended attribute is stored in the file to be expanded.

[0022] Optionally, the using a preset access mechanism to generate an access center, and using the access center to determine whether the identity information in the file access request meets a preset attribute access condition, and if so, calling the target hardware password card to decrypt the encrypted extended attribute, includes:

[0023] A plurality of access centers are generated by using a preset access mechanism; each of the access centers can share information and corresponds to a different execution order;

[0024] Calling the corresponding access center in the execution order so that the access center calls a preset hook, and then using the preset hook to determine whether the identity information in the file access request meets the preset security condition, and if the identity information meets the preset security condition, determining whether the identity information has attribute access rights;

[0025] If the identity information has the attribute access permission, the target hardware password card is called to decrypt the encrypted extended attribute.

[0026] Optionally, the using the preset hook to determine whether the identity information in the file access request meets a preset security condition includes:

[0027] Determine the priorities of the access centers based on the developer's needs;

[0028] Using the preset hooks respectively corresponding to the plurality of access centers to judge whether the identity information meets the preset security condition, so as to obtain respectively corresponding judgment results;

[0029] If each of the judgment results indicates that the identity information satisfies the preset security condition, then determining that the identity information in the file access request satisfies the preset security condition;

[0030] If the characterization results corresponding to each of the judgment results are different, then the target judgment result corresponding to the access center with the highest priority is determined from each of the judgment results; if the target judgment result represents that the identity information satisfies the preset security conditions, then it is determined that the identity information in the file access request satisfies the preset security conditions; otherwise, it is determined that the identity information in the file access request does not satisfy the preset security conditions.

[0031] Optionally, after generating a plurality of access centers by using a preset access mechanism, the method further includes:

[0032] Using a preset access mechanism and registering several plug-ins based on user needs, so as to use the plug-ins to expand the corresponding functions of the access center; each of the plug-ins has an information sharing function;

[0033] The operation information corresponding to each of the access centers is recorded in a preset operation log, so as to perform a security assessment operation based on the preset operation log; the operation information includes the execution time, the execution result and the identity of the user who performs the operation.

[0034] In a second aspect, the present application provides an encrypted file access device, which is applied to a trusted operating system integrated with a hardware password card, including:

[0035] The extended attribute generation module is used to record the index value corresponding to the target key generated by the target hardware password card, and then generate the corresponding extended attribute to be encrypted based on the file to be extended, so as to encrypt the extended attribute to be encrypted in the target hardware password card by using the index value to obtain the encrypted extended attribute; the target hardware password card includes a national secret algorithm;

[0036] An encrypted file determination module is used to store the encrypted extended attribute in the file to be extended to obtain the file to be encrypted, and encrypt the file to be encrypted in the target hardware password card based on the index value to obtain the encrypted file;

[0037] The file access module is used to generate an access center using a preset access mechanism, so as to use the access center to determine whether the identity information in the file access request meets the preset attribute access condition. If so, the target hardware password card is called to decrypt the encrypted extended attribute to obtain the extended attribute information, and then the encrypted file is accessed based on the extended attribute information.

[0038] In a third aspect, the present application provides an electronic device, including:

[0039] Memory, used to store computer programs;

[0040] The processor is used to execute the computer program to implement the aforementioned encrypted file access method.

[0041] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned encrypted file access method when executed by a processor.

[0042] As can be seen from the above, before accessing the encrypted file, the present application needs to record the index value corresponding to the target key generated by the target hardware password card, and then generate the corresponding extended attribute to be encrypted based on the file to be expanded, so as to use the index value to encrypt the extended attribute to be encrypted in the target hardware password card to obtain the encrypted extended attribute; the target hardware password card includes a national secret algorithm; the encrypted extended attribute is stored in the file to be expanded to obtain the file to be encrypted, and the file to be encrypted is encrypted in the target hardware password card based on the index value to obtain the encrypted file; an access center is generated using a preset access mechanism, so as to use the access center to determine whether the identity information in the file access request meets the preset attribute access condition, and if so, the target hardware password card is called to decrypt the encrypted extended attribute to obtain the extended attribute information, and then the encrypted file is accessed based on the extended attribute information.

[0043] It can be seen that the present application first records the index value corresponding to the target key generated by the target hardware password card, and then generates the corresponding extended attribute to be encrypted based on the file to be expanded, so as to encrypt the extended attribute to be encrypted in the target hardware password card using the index value to obtain the encrypted extended attribute; then, the encrypted extended attribute is stored in the file to be expanded to obtain the file to be encrypted, and the file to be encrypted is encrypted in the target hardware password card based on the index value to obtain the encrypted file; finally, the access center is generated using the preset access mechanism, so as to use the access center to determine whether the identity information in the file access request meets the preset attribute access condition, and if so, the target hardware password card is called to decrypt the encrypted extended attribute to obtain the extended attribute information, and then the encrypted file is accessed based on the extended attribute information. In this way, the security, flexibility and adaptability of file access to the national encryption standard are improved when accessing the encrypted file, thereby improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0045] Figure 1 A flow chart of an encrypted file access method disclosed in this application;

[0046] Figure 2 This is a schematic diagram of the structure of an encrypted file access device disclosed in this application;

[0047] Figure 3This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] In the field of trusted operating systems, the security requirements for operating systems are constantly increasing, and data security, confidentiality and access control have become core concerns. Traditional operating system access control has the following four problems: First, most operating systems rely on static control strategies based on user and group permissions, and the control granularity is relatively coarse; second, in the face of escalating network security threats, the existing permission control system lacks flexibility and security; third, traditional operating systems rely on software-implemented encryption algorithms, which makes it difficult to ensure the absolute security of keys; fourth, existing access control systems lack full integration and application of hardware password cards. To this end, this application provides an encrypted file access method that can improve the security, flexibility and adaptability of file access to national encryption standards when accessing encrypted files.

[0050] See also Figure 1 As shown, an embodiment of the present invention discloses an encrypted file access method, which is applied to a trusted operating system integrated with a hardware password card, comprising:

[0051] Step S11, recording the index value corresponding to the target key generated by the target hardware password card, and then generating the corresponding extended attribute to be encrypted based on the file to be expanded, so as to encrypt the extended attribute to be encrypted in the target hardware password card by using the index value to obtain the encrypted extended attribute; the target hardware password card includes a national secret algorithm.

[0052] In this embodiment, the hardware password card is mainly used to store and manage keys, perform encryption operations, and provide hardware acceleration of the national secret algorithm. It is worth mentioning that the hardware password card is a physical device independent of the operating system, with an independent encryption engine and key storage space, and includes a security module that supports the national secret algorithm to realize data encryption operations and key management. Among them, the hardware password card is physically connected to the Xinchuang operating system through interfaces such as PCI-E (PCI-Express, i.e. Peripheral Component Interconnect Express), USB (Universal Serial Bus, i.e. Universal Serial Bus), and the Xinchuang operating system communicates with the hardware password card through a device driver to ensure the security and integrity of the data during transmission. Among them, the national secret algorithm includes but is not limited to SM2 (i.e. a public key cryptographic algorithm standard), SM3 (i.e. SM3 cryptographic hash function), and SM4 (i.e. SM4 block cipher algorithm).

[0053] In this embodiment, the process of integrating the hardware password card is as follows: First, the operating system needs to load the device driver corresponding to the hardware password card when it is started or running, where the driver is responsible for identifying the hardware password card, initializing the device and connecting to the security module in the kernel. It is worth mentioning that the driver of the hardware password card supports the national secret algorithm interface, thereby ensuring that the hardware password card can be directly used to encrypt and decrypt data when calling within the system.

[0054] Furthermore, the Xinchuang operating system interacts with the hardware password card through the API (Application Programming Interface) interface to use the hardware password card for standardized encryption, decryption, signing and signature verification operations. The above API interface can also be called by kernel modules, applications and custom plug-ins, and supports dynamic registration and deregistration of hardware password cards using the API interface.

[0055] It is worth mentioning that the embodiment of the present application supports multiple hardware password cards running at the same time, and schedules and assigns tasks through a unified password card management module. Among them, different hardware password cards can undertake different security operations. In a specific implementation, a password card can be dedicated to key storage, while another password card can be used for high-intensity encryption operations, so that the embodiment of the present application can dynamically adjust the workload of each password card according to security policies and load conditions, and realize parallel collaboration of multiple password cards. Furthermore, the embodiment of the present application can achieve high-security key generation, storage, distribution and destruction through the key management mechanism of the hardware password card.

[0056] In this embodiment, there is a hardware-level random number generator supporting the national secret algorithm inside the hardware password card, which is used to generate high-strength keys to ensure that the key generation process is completely completed in the hardware password card, and the key will not be exposed to the operating system or the external environment, thereby avoiding the risk of key leakage. Specifically, recording the index value corresponding to the target key generated by the target hardware password card can include: loading a preset device driver to use the preset device driver to identify the initial hardware password card, and initializing the initial hardware password card to obtain the target hardware password card; the target hardware password card is integrated and connected with the Xinchuang operating system through a preset physical interface; recording the index value corresponding to the target key generated by the target hardware password card using the national secret algorithm, and storing the target key and the corresponding index value to the target hardware password card, so as to use the target key determined based on the index value to perform encryption and decryption operations on the data; the types of target keys include symmetric keys and asymmetric keys.

[0057] Furthermore, after the target key is generated, the embodiment of the present application needs to store the target key in the hardware password card. That is, the generated target key is securely stored inside the hardware password card and does not appear in plain text in the operating system. Among them, the system can generate multiple keys according to business needs, and the types of keys can include symmetric keys (such as SM4 keys) and asymmetric keys (such as SM2 keys). In addition, the key storage uses the secure storage space of the hardware password card and is accessed using key indexes.

[0058] In this embodiment, when the operating system or application needs to perform encryption operations, the system can call the hardware password card to perform encryption and decryption operations through the corresponding API interface instead of directly accessing the key. The encryption operation is completed inside the hardware password card, and the encryption result is returned to the operating system to ensure that the key is always under the security protection of the hardware password card during the entire encryption process. It is worth mentioning that the hardware password card is also responsible for managing the entire life cycle of the key, including the creation, update, expiration and destruction of the key. When the key expires or is no longer used, the hardware password card will automatically delete the key to ensure that the key is not abused. The system also supports the regular rotation function of the key, which improves the overall security by dynamically updating the key.

[0059] In this embodiment, in order to ensure the traceability and security of the system, the embodiment of the present application introduces a hardware password card operation log recording mechanism. When the operating system calls the hardware password card to perform encryption and decryption, key generation or access control operations on encrypted files, the system will record the operations performed in the operation log, where the content of the operation log includes the operation time, operation type and caller identity, providing basic data support for subsequent security audits and risk analysis, so that administrators can timely discover and deal with potential security issues through the log content.

[0060] Furthermore, the embodiment of the present application needs to add extended attributes to the file to be encrypted, wherein the extended attributes not only include the basic permission information corresponding to the file, but also include the allowed access time and special permissions of the file to meet more detailed access control requirements. In a specific implementation, the embodiment of the present application can divide the attributes into basic permission attributes, time control attributes and special permission attributes, so that the system can respond to different access control requirements more accurately. Specifically, the corresponding extended attributes to be encrypted are generated based on the file to be expanded, and the extended attributes to be encrypted are encrypted in the target hardware password card using the index value to obtain the encrypted extended attributes, which can include: using a preset attribute generation tool and generating the corresponding extended attributes to be encrypted based on the file to be expanded; the extended attributes to be encrypted include the basic permission attributes that describe the access rights of the file, the time control attributes that describe the access rights of a specific time period, and the special permission attributes that describe the access rights of a specific user to the file; the structures corresponding to the basic permission attributes, the time control attributes and the special permission attributes are the same.

[0061] It is worth mentioning that the embodiments of the present application can manage multiple extended attributes at the same time, providing more diverse options for file access control. That is, a file can have multiple attributes such as access time restrictions and special user permissions at the same time, realizing more complex access control strategies to meet the needs of different scenarios. In addition, the embodiments of the present application can dynamically modify the extended attributes corresponding to the file during the life cycle of the file without stopping or reconfiguring the system. This flexibility allows administrators to adjust the access control strategy in real time according to business needs to adapt to dynamically changing security requirements.

[0062] Furthermore, the embodiments of the present application support the inheritance and overwriting mechanism of attributes, so that administrators can manage the access control of files and directories. In a specific implementation, the embodiments of the present application can set an attribute at the directory level so that all files in the directory inherit the above attribute, and for a specific file, the file attribute can also be overwritten and inherited to achieve more refined control.

[0063] It is worth mentioning that extended attributes are additional information of files, which can store various attributes related to access control. The extended attribute structure of each file includes but is not limited to: basic permission information, access time restrictions and special permissions. Basic permission information describes the access rights of the file, such as read, write and execute permissions. Access time restrictions define access rights within a specific time period to enhance the protection of sensitive data. Special permissions include but are not limited to administrator permissions and audit permissions to allow specific users or roles to access files. The structure of extended attributes in the system is a unified metadata format to support flexible attribute addition and modification.

[0064] In this embodiment, after the corresponding extended attributes are generated based on the file to be encrypted, the embodiment of the present application needs to encrypt the extended attributes, wherein the encryption process of the extended attributes includes the definition, encryption processing, storage and decryption of the attributes. The specific steps are as follows: First, add extended attributes to the file through the command line tool or API interface provided by the system, including basic permissions, access time, and special permissions. Subsequently, an encryption algorithm is selected, and for different types of extended attributes, a suitable national secret algorithm is selected to encrypt the extended attributes. In a specific implementation, the SM4 algorithm is used to symmetric encrypt the basic permissions and access time restrictions, and the SM2 algorithm is used to perform key exchange or digital signature on the special permissions. Specifically, using the index value to encrypt the extended attributes to be encrypted in the target hardware password card to obtain the encrypted extended attributes can include: using the index value to determine the corresponding target key in the target hardware password card, so as to encrypt the extended attributes to be encrypted using the target key in the target hardware password card to obtain the encrypted extended attributes.

[0065] Furthermore, after obtaining the extended attribute to be encrypted, the embodiment of the present application can generate a corresponding extended attribute copy based on the extended attribute to be encrypted, and perform operations on the extended attribute copy. Specifically, after generating the corresponding extended attribute to be encrypted based on the file to be expanded, it can also include: generating an extended attribute copy corresponding to the first extended attribute corresponding to the file to be expanded, and performing a preset operation on the extended attribute copy corresponding to the file to be expanded based on the developer's needs to obtain a second extended attribute; the preset operation includes an add operation, a delete operation, and a modify operation; performing an encryption operation on the second extended attribute to obtain a new encrypted extended attribute, and storing the new encrypted extended attribute in the file to be expanded.

[0066] Step S12: storing the encrypted extended attribute in the file to be extended to obtain the file to be encrypted, and encrypting the file to be encrypted in the target hardware password card based on the index value to obtain the encrypted file.

[0067] In this embodiment, the encrypted extended attribute data needs to be stored in the metadata of the file to be extended and associated with the file to be extended. In the process of storing the encrypted extended attribute data in the metadata of the file to be extended, the system needs to ensure that the encrypted data does not exist in plain text, thereby enhancing security.

[0068] Step S13, using a preset access mechanism to generate an access center, so as to use the access center to determine whether the identity information in the file access request meets the preset attribute access condition. If so, the target hardware password card is called to decrypt the encrypted extended attribute to obtain extended attribute information, and then the encrypted file is accessed based on the extended attribute information.

[0069] In this embodiment, after the user issues a file access instruction, the embodiment of the present application will use the national secret algorithm to verify the user's identity information to ensure that only authorized users can access the extended attributes corresponding to the file. If the user has been authorized, the system needs to call the national secret algorithm to decrypt the extended attributes, and return the decrypted user's required permission information and related attributes to the user end. Specifically, the access center is generated using the preset access mechanism, and the access center is used to determine whether the identity information in the file access request meets the preset attribute access conditions. If it does, the target hardware password card is called to decrypt the encrypted extended attributes. It can include: using the preset access mechanism to generate several access centers; each access center can share information and corresponds to a different execution order; calling the corresponding access center in the execution order so that the access center calls the preset hook, and then using the preset hook to determine whether the identity information in the file access request meets the preset security conditions. If the identity information meets the preset security conditions, it is determined whether the identity information has attribute access rights; if the identity information has attribute access rights, the target hardware password card is called to decrypt the encrypted extended attributes.

[0070] It is worth mentioning that for each modification of the extended attributes, the embodiment of the present application will generate a new version based on the modification operation to ensure the traceability of historical data and facilitate relevant administrators to query and restore the extended attributes of a historical version as needed.

[0071] In this embodiment, the LSM Hook mechanism (Linux Security Modules Hook Mechanism) based on the Linux (i.e., an operating system) kernel is used to realize dynamic control of file access. That is, a security module is generated through the LSM Hook mechanism, and the security module is used to monitor and adjust the access control policy in real time. Among them, each security module can coordinate and share information. That is, each security module can share important access control information between modules using the inter-module communication mechanism. For example, a module may need to obtain the status information of other modules to decide whether to perform a certain operation.

[0072] In addition, in order to improve the flexibility of the system, the embodiment of the present application supports dynamic registration and deregistration of security modules to allow administrators to adjust access control policies as needed during runtime without restarting the system. The specific implementation process is as follows: First, the embodiment of the present application needs to dynamically register a new LSM module through a system command or API interface. The registration process includes defining the functions of the module, the Hook (hook, a special callback function) point and its execution order. Subsequently, when the system calls a specific Hook point, the corresponding security check logic is triggered, and the security check logic is used to execute the access control policy defined by the administrator. The embodiment of the present application can use a configuration file or a graphical interface to define a security policy. The above security policy includes multiple parameters such as access rights, time limits, and user identity authentication, and each security module is allocated according to a predefined policy to ensure that it complies with the set security requirements during execution.

[0073] Furthermore, each module will be assigned a unique identifier when registered, so that the system can distinguish different modules when executing. In addition, the embodiment of the present application can cancel the LSM module that is no longer needed at any time according to security requirements. After cancellation, the module will no longer participate in subsequent access control checks, and the system will automatically switch to other valid LSM modules for logical operations.

[0074] It is worth mentioning that the embodiment of the present application can customize the access control logic according to specific business needs. Among them, the implementation process of the access control logic is as follows: First, different access control logics are integrated using a preset plug-in mechanism. That is, the embodiment of the present application can develop different plug-ins as needed to implement diversified strategies such as time-based access control and role-based access control. Among them, interoperability needs to be considered between plug-ins to ensure that each plug-in will not conflict or cause security vulnerabilities during execution. Secondly, the embodiment of the present application can set the accessible time period of the file. The system will check whether the current time is within the allowed time range each time it is accessed. If the current time is not within the allowed time range, the access request will be rejected. Subsequently, the embodiment of the present application needs to verify the user identity in combination with the national secret algorithm. That is, only users who have passed the verification can perform specific operations.

[0075] It is worth mentioning that the embodiments of the present application support the collaborative work of multiple LSM modules to implement more complex security policies, that is, each security module can share access control information so that multiple security policies can work together. For example, a module can further restrict file access based on other modules to form multi-level protection.

[0076] In this embodiment, the embodiment of the present application sets an execution priority for each LSM module. That is, when multiple modules check the same request at the same time, the system will decide which module's corresponding execution result will be set as the final inspection result according to the priority order of each module. Specifically, using a preset hook to determine whether the identity information in a file access request meets the preset security conditions may include: determining the priorities corresponding to each access center based on developer needs; using preset hooks corresponding to several access centers to judge whether the identity information meets the preset security conditions to obtain corresponding judgment results; if each judgment result indicates that the identity information meets the preset security conditions, then the identity information in the file access request is determined to meet the preset security conditions; if the characterization results corresponding to each judgment result are different, then the target judgment result corresponding to the access center with the highest priority is determined from each judgment result. If the target judgment result indicates that the identity information meets the preset security conditions, then the identity information in the file access request is determined to meet the preset security conditions, otherwise, the identity information in the file access request is determined to not meet the preset security conditions.

[0077] In this embodiment, in order to further enhance the security of the system, the embodiment of the present application introduces a security event trigger mechanism, that is, real-time monitoring of the system's operation process, so that potential security events, such as illegal access attempts and permission violations, can be monitored in a timely manner. Once a security event is detected, the corresponding response measures, such as alarms and log records, will be triggered. It is worth mentioning that the embodiment of the present application can configure different response strategies to take different processing methods according to the type of security event. In addition, in order to strengthen the supervision and audit of access control, the embodiment of the present application logs all access requests and the execution of control logic, that is, records the detailed information corresponding to each file access operation, including access time, user identity, and request results, to provide a basis for subsequent audits and analysis. Specifically, after generating several access centers using the preset access mechanism, it can also include: using the preset access mechanism and registering several plug-ins based on user needs to expand the functions corresponding to the access center using the plug-in; each plug-in has an information sharing function; recording the operation information corresponding to each access center to the preset operation log, so as to perform security assessment operations based on the preset operation log; the operation information includes the execution time, execution result, and the user identity of the execution operation. Among them, the embodiment of the present application can also analyze the access history by auditing the log information, so as to timely discover potential security risks. In addition, the embodiment of the present application also supports exporting audit reports to conduct compliance inspections and security assessments on the system.

[0078] It can be seen that the embodiment of the present application first records the index value corresponding to the target key generated by the target hardware password card, and then generates the corresponding extended attribute to be encrypted based on the file to be expanded, so as to encrypt the extended attribute to be encrypted in the target hardware password card using the index value to obtain the encrypted extended attribute; then, the encrypted extended attribute is stored in the file to be expanded to obtain the file to be encrypted, and the file to be encrypted is encrypted in the target hardware password card based on the index value to obtain the encrypted file; finally, the access center is generated using the preset access mechanism, so as to use the access center to determine whether the identity information in the file access request meets the preset attribute access condition, and if it does, the target hardware password card is called to decrypt the encrypted extended attribute to obtain the extended attribute information, and then the encrypted file is accessed based on the extended attribute information. In this way, the security, flexibility and adaptability of file access to the national encryption standard are improved when accessing the encrypted file.

[0079] Accordingly, see Figure 2 As shown, the present application also provides an encrypted file access device, which is applied to a trusted operating system integrated with a hardware password card, including:

[0080] The extended attribute generation module 11 is used to record the index value corresponding to the target key generated by the target hardware password card, and then generate the corresponding extended attribute to be encrypted based on the file to be extended, so as to encrypt the extended attribute to be encrypted in the target hardware password card by using the index value to obtain the encrypted extended attribute; the target hardware password card includes a national secret algorithm;

[0081] The encrypted file determination module 12 is used to store the encrypted extended attribute in the file to be extended to obtain the file to be encrypted, and encrypt the file to be encrypted in the target hardware password card based on the index value to obtain the encrypted file;

[0082] The file access module 13 is used to generate an access center using a preset access mechanism, so as to use the access center to determine whether the identity information in the file access request meets the preset attribute access condition. If so, the target hardware password card is called to decrypt the encrypted extended attribute to obtain the extended attribute information, and then the encrypted file is accessed based on the extended attribute information.

[0083] As can be seen from the above, before accessing the encrypted file, the embodiment of the present application first needs to record the index value corresponding to the target key generated by the target hardware password card, and then generate the corresponding extended attribute to be encrypted based on the file to be expanded, so as to use the index value to encrypt the extended attribute to be encrypted in the target hardware password card to obtain the encrypted extended attribute; then, the encrypted extended attribute is stored in the file to be expanded to obtain the file to be encrypted, and the file to be encrypted is encrypted in the target hardware password card based on the index value to obtain the encrypted file; finally, the access center is generated using the preset access mechanism, so as to use the access center to determine whether the identity information in the file access request meets the preset attribute access condition, and if it does, the target hardware password card is called to decrypt the encrypted extended attribute to obtain the extended attribute information, and then the encrypted file is accessed based on the extended attribute information. In this way, the security, flexibility and adaptability of file access to the national encryption standard are improved when accessing the encrypted file, thereby improving the user experience.

[0084] In some specific implementations, the extended attribute generation module 11 may specifically include:

[0085] A driver loading unit is used to load a preset device driver, so as to use the preset device driver to identify the initial hardware password card, and to initialize the initial hardware password card to obtain a target hardware password card; the target hardware password card is integrated and connected with the Xinchuang operating system through a preset physical interface;

[0086] An index value generating unit is used to record the index value corresponding to the target key generated by the target hardware password card using the national secret algorithm, and store the target key and the corresponding index value to the target hardware password card, so as to use the target key determined based on the index value to perform encryption and decryption operations on data; the types of the target key include symmetric keys and asymmetric keys.

[0087] In some specific implementations, the extended attribute generation module 11 may specifically include:

[0088] The extended attribute generation subunit is used to generate corresponding extended attributes to be encrypted based on the file to be extended by using a preset attribute generation tool; the extended attributes to be encrypted include a basic permission attribute describing the access rights of the file, a time control attribute describing the access rights of a specific time period, and a special permission attribute describing the access rights of a specific user to the file; the basic permission attribute, the time control attribute, and the special permission attribute have the same corresponding structure;

[0089] The first extended attribute encryption unit is used to determine the corresponding target key in the target hardware password card by using the index value, so as to encrypt the to-be-encrypted extended attribute by using the target key in the target hardware password card to obtain the encrypted extended attribute.

[0090] In some specific implementations, the encrypted file access device may further include:

[0091] An extended attribute operation unit, configured to generate an extended attribute copy corresponding to the first extended attribute corresponding to the file to be extended, and perform a preset operation on the extended attribute copy corresponding to the file to be extended based on the developer's requirements to obtain a second extended attribute; the preset operation includes an add operation, a delete operation, and a modify operation;

[0092] The second extended attribute encryption unit is used to perform an encryption operation on the second extended attribute to obtain a new encrypted extended attribute, and store the new encrypted extended attribute in the to-be-extended file.

[0093] In some specific implementations, the file access module 13 may specifically include:

[0094] An access center generating unit, used to generate a plurality of access centers using a preset access mechanism; each of the access centers can share information and corresponds to a different execution order;

[0095] An access center calling unit, used to call the corresponding access center in the execution order so that the access center calls a preset hook, and then uses the preset hook to determine whether the identity information in the file access request meets the preset security condition, and if the identity information meets the preset security condition, then determine whether the identity information has attribute access rights;

[0096] The extended attribute decryption unit is used to call the target hardware password card to decrypt the encrypted extended attribute if the identity information has the attribute access authority.

[0097] In some specific implementations, the file access module 13 may specifically include:

[0098] A priority determination unit, used to determine the priorities corresponding to the access centers based on the developer's needs;

[0099] A first identity information judgment unit, configured to judge whether the identity information meets the preset security condition by using the preset hooks respectively corresponding to the plurality of access centers, so as to obtain respectively corresponding judgment results;

[0100] A second identity information judgment unit, configured to judge that the identity information in the file access request satisfies the preset security condition if each of the judgment results indicates that the identity information satisfies the preset security condition;

[0101] The third identity information judgment unit is used to determine the target judgment result corresponding to the access center with the highest priority from the judgment results if the characterization results corresponding to the judgment results are different; if the target judgment result represents that the identity information satisfies the preset security condition, then it is determined that the identity information in the file access request satisfies the preset security condition; otherwise, it is determined that the identity information in the file access request does not satisfy the preset security condition.

[0102] In some specific implementations, the encrypted file access device may further include:

[0103] A function extension unit, used to register several plug-ins based on user needs using a preset access mechanism, so as to use the plug-ins to extend the functions corresponding to the access center; each of the plug-ins has an information sharing function;

[0104] An operation information recording unit is used to record the operation information corresponding to each of the access centers into a preset operation log, so as to perform a security assessment operation based on the preset operation log; the operation information includes the execution time, the execution result and the identity of the user who performs the operation.

[0105] Furthermore, the present application also discloses an electronic device. Figure 3 This is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content in the figure cannot be regarded as any limitation on the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the encrypted file access method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0106] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0107] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0108] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, and can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the encrypted file access method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0109] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed encrypted file access method. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0110] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0111] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0112] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0113] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0114] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for accessing an encrypted file, characterized in that: Applicable to the trusted operating system with integrated hardware password card, including: Recording the index value corresponding to the target key generated by the target hardware password card, and then generating the corresponding extended attribute to be encrypted based on the file to be extended, so as to encrypt the extended attribute to be encrypted in the target hardware password card by using the index value to obtain the encrypted extended attribute; the target hardware password card includes a national secret algorithm; The encrypted extended attribute is stored in the file to be extended to obtain the file to be encrypted, and the file to be encrypted is encrypted in the target hardware password card based on the index value to obtain the encrypted file; An access center is generated by using a preset access mechanism, so as to use the access center to determine whether the identity information in the file access request meets the preset attribute access condition, and if so, the target hardware password card is called to decrypt the encrypted extended attribute to obtain extended attribute information, and then the encrypted file is accessed based on the extended attribute information; The step of generating a corresponding extended attribute to be encrypted based on the file to be expanded, and encrypting the extended attribute to be encrypted in the target hardware password card by using the index value to obtain the encrypted extended attribute, includes: Generate corresponding extended attributes to be encrypted based on the file to be extended by using a preset attribute generation tool; the extended attributes to be encrypted include a basic permission attribute describing the access rights of the file, a time control attribute describing the access rights of a specific time period, and a special permission attribute describing the access rights of a specific user to the file; the basic permission attribute, the time control attribute, and the special permission attribute have the same corresponding structure; The index value is used to determine a corresponding target key in the target hardware password card, so as to encrypt the extended attribute to be encrypted in the target hardware password card using the target key to obtain the encrypted extended attribute.

2. The encrypted file access method according to claim 1, characterized in that: The index value corresponding to the target key generated by the target hardware password card is recorded, including: Loading a preset device driver to use the preset device driver to identify the initial hardware password card, and initializing the initial hardware password card to obtain a target hardware password card; the target hardware password card is integrated and connected with the Xinchuang operating system through a preset physical interface; Record the index value corresponding to the target key generated by the target hardware password card using the national secret algorithm, and store the target key and the corresponding index value to the target hardware password card, so as to use the target key determined based on the index value to perform encryption and decryption operations on data; the types of the target key include symmetric keys and asymmetric keys.

3. The encrypted file access method according to claim 1, characterized in that: After the corresponding extended attribute to be encrypted is generated based on the file to be extended, the method further includes: Generate an extended attribute copy corresponding to the first extended attribute corresponding to the file to be extended, and perform a preset operation on the extended attribute copy corresponding to the file to be extended based on the developer's requirements to obtain a second extended attribute; the preset operation includes an add operation, a delete operation, and a modify operation; An encryption operation is performed on the second extended attribute to obtain a new encrypted extended attribute, and the new encrypted extended attribute is stored in the file to be expanded.

4. The encrypted file access method according to any one of claims 1 to 3, characterized in that: The method of generating an access center by using a preset access mechanism, and using the access center to determine whether the identity information in the file access request meets the preset attribute access condition, and if so, calling the target hardware password card to decrypt the encrypted extended attribute, includes: A plurality of access centers are generated by using a preset access mechanism; each of the access centers can share information and corresponds to a different execution order; Calling the corresponding access center in the execution order so that the access center calls a preset hook, and then using the preset hook to determine whether the identity information in the file access request meets the preset security condition, and if the identity information meets the preset security condition, determining whether the identity information has attribute access rights; If the identity information has the attribute access permission, the target hardware password card is called to decrypt the encrypted extended attribute.

5. The encrypted file access method according to claim 4, characterized in that: The using the preset hook to determine whether the identity information in the file access request meets the preset security condition includes: Determine the priorities of the access centers based on the developer's needs; Using the preset hooks respectively corresponding to the plurality of access centers to judge whether the identity information meets the preset security condition, so as to obtain respectively corresponding judgment results; If each of the judgment results indicates that the identity information satisfies the preset security condition, then determining that the identity information in the file access request satisfies the preset security condition; If the characterization results corresponding to each of the judgment results are different, then the target judgment result corresponding to the access center with the highest priority is determined from each of the judgment results; if the target judgment result represents that the identity information satisfies the preset security conditions, then it is determined that the identity information in the file access request satisfies the preset security conditions; otherwise, it is determined that the identity information in the file access request does not satisfy the preset security conditions.

6. The encrypted file access method according to claim 5, characterized in that: After the plurality of access centers are generated by using the preset access mechanism, the method further includes: Using a preset access mechanism and registering several plug-ins based on user needs, so as to use the plug-ins to expand the corresponding functions of the access center; each of the plug-ins has an information sharing function; The operation information corresponding to each of the access centers is recorded in a preset operation log, so as to perform a security assessment operation based on the preset operation log; the operation information includes the execution time, the execution result and the identity of the user who performs the operation.

7. An encrypted file access device, characterized in that: Applicable to the trusted operating system with integrated hardware password card, including: The extended attribute generation module is used to record the index value corresponding to the target key generated by the target hardware password card, and then generate the corresponding extended attribute to be encrypted based on the file to be extended, so as to encrypt the extended attribute to be encrypted in the target hardware password card by using the index value to obtain the encrypted extended attribute; the target hardware password card includes a national secret algorithm; An encrypted file determination module is used to store the encrypted extended attribute in the file to be extended to obtain the file to be encrypted, and encrypt the file to be encrypted in the target hardware password card based on the index value to obtain the encrypted file; A file access module, used to generate an access center using a preset access mechanism, so as to use the access center to determine whether the identity information in the file access request meets the preset attribute access condition, and if so, to call the target hardware password card to decrypt the encrypted extended attribute to obtain extended attribute information, and then access the encrypted file based on the extended attribute information; The extended attribute generation module is specifically used to generate corresponding extended attributes to be encrypted based on the file to be extended by using a preset attribute generation tool; the extended attributes to be encrypted include a basic permission attribute describing the access rights of the file, a time control attribute describing the access rights of a specific time period, and a special permission attribute describing the access rights of a specific user to the file; the basic permission attribute, the time control attribute, and the special permission attribute have the same corresponding structure; The index value is used to determine a corresponding target key in the target hardware password card, so as to encrypt the extended attribute to be encrypted in the target hardware password card using the target key to obtain the encrypted extended attribute.

8. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the steps of the encrypted file access method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the steps of the encrypted file access method according to any one of claims 1 to 6 are implemented.

Images