Remote secure storage method, system and device and storage medium

Abstract

The invention belongs to the technical field of information security, and discloses a remote secure storage method, system and device and a storage medium. The method comprises the following steps: symmetrically encrypting a file to be securely transmitted corresponding to a file list to be encrypted by using a generated symmetric key to obtain a plurality of file ciphertexts; respectively encrypting the symmetric key by using the digital certificate of the producer and the digital certificate of the accessor in the accessed Ukey equipment to obtain a digital envelope; integrating the plurality of file ciphertexts, the digital envelopes and the metadata; signing the integrated data by using a signature certificate of a producer to obtain a signature value; the signature value is added to the tail of the file to be securely transmitted to obtain a secure file allowed to be transmitted, the secure file is sent to a server for remote storage, an accessible object of the file can be set, a digital certificate of the file is used, the file is encrypted and packaged, and the file is sent to the remote security server for storage. And the file storage security is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a remote secure storage method, system, device and storage medium. Background Art

[0002] In today's developed network environment, there are many network hard disks and peripheral products on the Internet to meet users' needs for remote file storage. The current network hard disk only serves the function of file transfer, storing data in plain text on the server, and the file permission management is often relatively simple. It can only open or close the entire file directory to everyone, without controlling the permission of a single file, and cannot achieve safe storage of file data without leakage.

[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of the present invention is to provide a remote secure storage method, system, device and storage medium, aiming to solve the technical problem that file data cannot be stored securely without leakage.

[0005] To achieve the above object, the present invention provides a remote secure storage method, which comprises the following steps:

[0006] Generate a symmetric key, and use the symmetric key to symmetrically encrypt the files to be securely transmitted corresponding to the list of files to be encrypted, to obtain a number of file ciphertexts;

[0007] Obtain the producer's digital certificate and signature certificate from the connected Ukey device, and simultaneously obtain the accessible person's digital certificate, and use the producer's digital certificate and the accessible person's digital certificate to encrypt the symmetric key respectively to obtain a digital envelope. The producer is the producer of the file to be securely transmitted, and the accessible person is the person allowed to access the file to be securely transmitted;

[0008] Integrate the ciphertexts of the plurality of files with the digital envelope and the metadata;

[0009] Signing the integrated data using the producer's signature certificate to obtain a signature value;

[0010] The signature value is appended to the end of the file to be securely transmitted to obtain a secure file that is allowed to be transmitted, and the secure file is sent to a server for remote storage.

[0011] In some embodiments, the metadata includes at least: the file format version number of the file to be securely transmitted and file list data, the file list data containing the hash value of the file ciphertext corresponding to the file name and the file security attributes, wherein the hash value of the file ciphertext corresponding to the file name and the file security attributes are stored in the form of a key-value pair, the key is the file name, the value is the hash value corresponding to the file ciphertext, the key is the attribute name, and the value is the attribute value.

[0012] In some embodiments, the method further comprises:

[0013] Use the SM3 digest algorithm to hash the ciphertexts of several files to obtain the hash value;

[0014] The hash value and the file name of the ciphertext file are stored as a key-value pair;

[0015] An input file security attribute is received, and an attribute name and an attribute value of the file security attribute are stored as a key-value pair.

[0016] In some embodiments, sending the security file to a server for remote storage includes:

[0017] The server receives the sent security file, parses the security file, and obtains the signature certificate of the producer and the signature value at the end of the security file;

[0018] The server uses the SM3 algorithm to obtain the hash value of the signature value and the hash value of other data except the signature value;

[0019] The server compares the hash value of the signature value with the hash value of other data to verify the signature value;

[0020] After the signature value is verified, the server stores the received secure file.

[0021] In some embodiments, the method further comprises:

[0022] receiving secure file download requests;

[0023] querying a server in response to the secure file download request to download a secure file;

[0024] Parse the security file to obtain the signature certificate of the producer and the signature value at the end of the security file;

[0025] Perform verification based on the signature value;

[0026] After verification, the digital certificate of the accessible user is extracted from the connected UKey device;

[0027] Calling the digital certificate to decrypt the digital envelope of the security document to obtain a symmetric key;

[0028] The symmetric key is used to decrypt the file ciphertext of the security file to obtain a plaintext file, and the producer information of the security file is displayed based on the signature certificate.

[0029] In some embodiments, the method further comprises:

[0030] Determining whether the corresponding user is an accessible user based on the secure file download request;

[0031] If the user is accessible, the step of querying the server in response to the secure file download request to download the secure file is performed.

[0032] In some embodiments, the verifying based on the signature value includes:

[0033] Using the SM3 algorithm to obtain the hash value of the signature value and the hash value of other data except the signature value;

[0034] Compare the hash value of the signature value with the hash value of other data to verify the signature value;

[0035] After the signature value is verified, the SM3 algorithm is used to obtain the hash value of each file ciphertext and the hash value corresponding to the file list data, and the hash value of each file ciphertext is compared with the hash value corresponding to the file list data to perform ciphertext verification;

[0036] After the ciphertext verification is passed, the process returns to the step of extracting the digital certificate of the accessible person from the connected UKey device.

[0037] In addition, to achieve the above-mentioned purpose, the present invention also proposes a remote secure storage system, the remote secure storage system comprising:

[0038] The client is used to generate a symmetric key, and use the symmetric key to symmetrically encrypt the files to be securely transmitted corresponding to the list of files to be encrypted, to obtain a number of file ciphertexts;

[0039] The client is used to obtain the digital certificate and signature certificate of the producer from the connected Ukey device, and simultaneously obtain the digital certificate of the accessible person, and use the digital certificate of the producer and the digital certificate of the accessible person to encrypt the symmetric key respectively to obtain a digital envelope. The producer is the producer of the file to be securely transmitted, and the accessible person is the allowed access to the file to be securely transmitted;

[0040] The client is used to integrate the ciphertexts of the plurality of files with the digital envelope and metadata;

[0041] The client is used to sign the integrated data using the signature certificate of the producer to obtain a signature value;

[0042] The client is used to append the signature value to the end of the file to be securely transmitted to obtain a secure file that is allowed to be transmitted, and send the secure file to the server;

[0043] The server is used to receive the security file sent by the client and store the security file.

[0044] In addition, to achieve the above-mentioned purpose, the present invention also proposes a remote secure storage device, which includes: a memory, a processor, and a remote secure storage program stored on the memory and executable on the processor, and the remote secure storage program is configured to implement the steps of the remote secure storage method described above.

[0045] In addition, to achieve the above-mentioned purpose, the present invention also proposes a storage medium, on which a remote secure storage program is stored, and when the remote secure storage program is executed by a processor, the steps of the remote secure storage method described above are implemented.

[0046] The present invention uses a generated symmetric key to symmetrically encrypt the files to be securely transmitted corresponding to the list of files to be encrypted, so as to obtain several file ciphertexts; uses the digital certificate of the producer and the digital certificate of the accessee in the connected Ukey device to encrypt the symmetric key respectively, so as to obtain a digital envelope; integrates several file ciphertexts, the digital envelope and metadata; uses the signature certificate of the producer to sign the integrated data, so as to obtain a signature value; appends the signature value to the end of the file to be securely transmitted, so as to obtain a secure file that is allowed to be transmitted, and sends the secure file to a server for remote storage, and can set the accessible object of the file, use its digital certificate, encrypt and encapsulate the file, and send it to a remote secure server for storage, thereby improving the security of file storage. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a flowchart of the first embodiment of the remote secure storage method of the present invention;

[0048] Figure 2 It is a schematic diagram of the overall system architecture in the remote secure storage method of the present invention;

[0049] Figure 3 A schematic diagram of user authority control in the remote secure storage method of the present invention;

[0050] Figure 4 This is a structural block diagram of the first embodiment of the remote secure storage system of the present invention.

[0051] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0052] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0053] The embodiment of the present invention provides a remote secure storage method, referring to Figure 1 , Figure 1 It is a flowchart of a first embodiment of a remote secure storage method of the present invention.

[0054] In this embodiment, the remote secure storage method includes the following steps:

[0055] Step S10: Generate a symmetric key, and use the symmetric key to symmetrically encrypt the files to be securely transmitted corresponding to the list of files to be encrypted, to obtain a number of file ciphertexts.

[0056] In this embodiment, the execution subject of this embodiment is a remote secure storage device, wherein the remote secure storage device has functions such as data processing, data communication and program running. The remote secure storage device can be a computer terminal device or other network device, and of course it can also be other devices with similar functions, and this embodiment does not limit this.

[0057] It should be noted that the current network hard disk only serves the function of file transfer, storing data in plain text on the server, and the file permission management is often relatively simple. It can only open or close the entire file directory to everyone, and there is no permission control for a single file, making it impossible to achieve secure and leak-proof storage of file data.

[0058] In order to solve the above technical problems, this embodiment uses the generated symmetric key to symmetrically encrypt the files to be securely transmitted corresponding to the list of encrypted files to obtain several file ciphertexts; uses the digital certificate of the producer and the digital certificate of the accessor in the connected Ukey device to encrypt the symmetric key respectively to obtain a digital envelope; integrates several file ciphertexts, digital envelopes and metadata; uses the producer's signature certificate to sign the integrated data to obtain a signature value; appends the signature value to the end of the file to be securely transmitted to obtain a secure file allowed for transmission, and sends the secure file to the server for remote storage. It is possible to set the accessible object of the file, use its digital certificate, encrypt and encapsulate the file, and send it to a remote secure server for storage, thereby improving the security of file storage. Specifically, it can be implemented as follows.

[0059] In the specific implementation, this embodiment first combines Figure 2 The overall system architecture of this solution is described in detail. Figure 2 As shown, the remote secure storage system in this embodiment is mainly composed of a client and a storage server. The storage process also includes UKey devices, digital certificates, and secure files. The functions of the client include 1. Identity authentication: through local identity authentication, non-certificate users are restricted from using client functions. 2. Make secure files: users must first make secure files as required before exchanging shared files with other users. 3. Send / receive secure files: users can upload secure files under the restrictions of their own permissions; users can also receive secure files in the secure server. 4. Secure file query: query the secure files stored in the server, and you can query the secure files made by yourself or the secure files sent to you by others. 5. Secure file management: obtain the list of secure files in real time and provide a management mode of custom grouping. 6. Secure file reminder: provide a reminder function for the arrival of new secure files. 7. Contact management: provide information of trusted users and their certificate management. The functions of the secure storage server are as follows: 1. User permission setting and query: restrict users without permission from downloading secure files. 2. Secure storage files: store files in the server. 3. Secure file query: query the list of secure files accessible to the current user. 4. Message notification: When receiving a secure file, notify the accessible user. 5. Contact information management: Provide information of trusted users and their certificate management.

[0060] When the user needs to create a secure file, he can open the client and then select the file to be securely transmitted as the data file. This process is repeated until the user has selected all the files, thereby obtaining a list of files to be encrypted. A symmetric key can be generated using a random number generator, and the symmetric key can be used to symmetrically encrypt the file to be securely transmitted corresponding to the list of files to be encrypted to obtain several file ciphertexts.

[0061] Step S20: Obtain the producer's digital certificate and signature certificate from the connected Ukey device, and simultaneously obtain the accessible person's digital certificate, and use the producer's digital certificate and the accessible person's digital certificate to encrypt the symmetric key respectively to obtain a digital envelope.

[0062] It should be noted that a private key is stored in the Ukey device. When the user queries and reads the encrypted file, he needs to first connect to the Ukey device for decryption. When encrypting, he needs to first obtain the corresponding private key from the Ukey device to encrypt the file. Specifically, the producer's digital certificate and signature certificate can be obtained from the connected Ukey device, and the digital certificate of the accessible person can be obtained at the same time. The digital certificate is the private key. The symmetric keys are encrypted separately through the above digital certificates, so that a digital envelope can be obtained, in which the producer is the producer of the file to be securely transmitted, and the accessible person is the allowed access to the file to be securely transmitted.

[0063] Step S30: Integrate the ciphertexts of the plurality of files, the digital envelope and the metadata.

[0064] In this embodiment, the metadata at least includes: the file format version number of the file to be securely transmitted and the file list data, the file list data includes the Hash value of the file ciphertext corresponding to the file name and the file security attribute, wherein the Hash value of the file ciphertext corresponding to the file name and the file security attribute are stored in the form of a key-value pair, the key is the file name, the value is the Hash value corresponding to the file ciphertext, the key is the attribute name, and the value is the attribute value. The process of obtaining the file list data is to use the SM3 digest algorithm to hash several file ciphertexts to obtain a Hash value; store the Hash value and the file name of the file ciphertext as a key-value pair; receive the input file security attribute, and store the attribute name and attribute value of the file security attribute as a key-value pair.

[0065] It should be noted that the SM3 digest algorithm is a standard password hash algorithm with the main features of an output length of 256 bits, a block size of 512 bits, and a message processing method of Structure and included message expansion and compression functions: based on 32-bit word size.

[0066] In addition, metadata may also include a signature certificate of the secure document producer and a number of digital certificates of the accessor.

[0067] Step S40: Sign the integrated data using the producer's signature certificate to obtain a signature value.

[0068] It should be noted that the producer's digital certificate obtained above is used for symmetric key encryption, and the producer's signature certificate can be used to sign the integrated data. The specific hash algorithm used for the signature is not limited in this embodiment and can be selected according to actual needs.

[0069] Step S50: append the signature value to the end of the file to be securely transmitted to obtain a secure file that is allowed to be transmitted, and send the secure file to a server for remote storage.

[0070] In the specific implementation, after receiving the security file sent by the client, the server parses the security file to obtain the producer's signature certificate and the signature value at the end of the security file; the server uses the SM3 algorithm to obtain the hash value of the signature value and the hash value of other data except the signature value; the server compares the hash value of the signature value with the hash value of other data to verify the signature value; after the signature value verification is passed, the server stores the received security file, and the signature value verification before storage can further improve the security of file storage.

[0071] In this embodiment, the secure file format integrates multiple data blocks: using the TLV data encoding format, T represents the type, L represents the data length, and V represents binary data of length L. The data format is shown in Table 1 below.

[0072] Table 1:

[0073]

[0074] The metadata includes the version number, the signature certificate of the secure file producer, several digital certificates of the accessible user, and manifest data (file list data). The version number is used to record the version number of the current secure file format, and the type of this data block is 1. The type of the data block of the signature certificate of the secure file producer is 2. The type of the data block of the digital certificate of the accessible user is 3. The manifest data (file list data) exists in the form of JSON, and the type of this data block is 4. It mainly stores the hash value of the file ciphertext corresponding to the file name and the file security attributes: The hash value of the file ciphertext corresponding to the file name: multiple Key-Value key-value pairs, the key is the file name, and the value is the hash value corresponding to the file ciphertext. File security attributes: multiple Key-Value key-value pairs, the key is the attribute name, and the value is the attribute value. The ciphertext data includes the file name and several file ciphertexts obtained after symmetric encryption. The types of these two types of data blocks are 5 and 6 respectively. The key digital envelope is the digital envelope data made for the symmetric encryption key, and the type of this data block is 7. The secure file signature value is to digitally sign the above data block using the signature certificate of the secure file producer, and the type of this data block is 8.

[0075] Furthermore, when the user needs to download the stored file, the client receives the secure file download request sent by the user, and then first determines whether the user is accessible based on the secure file download request. If the user is accessible, the client downloads the corresponding secure file from the server based on the secure file download request. For details, please refer to Figure 3 As shown, user A generates a security file and sets the accessible users to "B, C". Users B, C, and D download the file respectively and try to decrypt it, but only users B and C are accessible. Finally, user D has no access to the file and the decryption fails. Users B and C decrypt successfully and obtain the plaintext of the file.

[0076] After downloading the security file, in this embodiment, the signature certificate of the producer and the signature value at the end of the security file can be obtained by parsing the security file, and verification is performed based on the signature value. After the verification passes, the digital certificate of the accessible person is extracted from the connected UKey device; the digital certificate is called to decrypt the digital envelope of the security file to obtain a symmetric key; the file ciphertext of the security file is decrypted using the symmetric key to obtain a plaintext file, and the producer information of the security file is displayed based on the signature certificate.

[0077] Among them, the verification process specifically uses the SM3 algorithm to obtain the Hash value of the signature value and the Hash value of other data except the signature value; compares the Hash value of the signature value with the Hash value of other data to verify the signature value; after the signature value verification is passed, uses the SM3 algorithm to obtain the Hash value of each file ciphertext and the Hash value corresponding to the file list data, and compares the Hash value of each file ciphertext with the Hash value corresponding to the file list data to perform ciphertext verification. If the ciphertext verification is passed, the verification is completed. The above comparisons are all consistency comparisons.

[0078] This embodiment uses the generated symmetric key to symmetrically encrypt the files to be securely transmitted corresponding to the list of encrypted files to obtain several file ciphertexts; uses the digital certificate of the producer and the digital certificate of the accessee in the connected Ukey device to encrypt the symmetric key respectively to obtain a digital envelope; integrates the several file ciphertexts, the digital envelope and the metadata; uses the producer's signature certificate to sign the integrated data to obtain a signature value; appends the signature value to the end of the file to be securely transmitted to obtain a secure file that is allowed to be transmitted, and sends the secure file to the server for remote storage. It is possible to set the accessible object of the file, use its digital certificate to encrypt and package the file, and send it to a remote secure server for storage, thereby improving the security of file storage.

[0079] In addition, an embodiment of the present invention further provides a storage medium, on which a remote secure storage program is stored. When the remote secure storage program is executed by a processor, the steps of the remote secure storage method described above are implemented.

[0080] Reference Figure 4 , Figure 4 This is a structural block diagram of the first embodiment of the remote secure storage system of the present invention.

[0081] like Figure 4 As shown, the remote secure storage system proposed in the embodiment of the present invention includes:

[0082] The client 10 is used to generate a symmetric key, and use the symmetric key to symmetrically encrypt the files to be securely transmitted corresponding to the list of files to be encrypted, to obtain a number of file ciphertexts;

[0083] The client 10 is used to obtain the digital certificate and signature certificate of the producer from the connected Ukey device, and simultaneously obtain the digital certificate of the accessible person, and use the digital certificate of the producer and the digital certificate of the accessible person to encrypt the symmetric key respectively to obtain a digital envelope. The producer is the producer of the file to be securely transmitted, and the accessible person is the allowed access to the file to be securely transmitted;

[0084] The client 10 is used to integrate the ciphertexts of the plurality of files with the digital envelope and metadata;

[0085] The client 10 is used to sign the integrated data using the signature certificate of the producer to obtain a signature value;

[0086] The client 10 is used to append the signature value to the end of the file to be securely transmitted to obtain a secure file that is allowed to be transmitted, and send the secure file to the server;

[0087] The server 20 is used to receive the security file sent by the client and store the security file.

[0088] This embodiment uses the generated symmetric key to symmetrically encrypt the files to be securely transmitted corresponding to the list of encrypted files to obtain several file ciphertexts; uses the digital certificate of the producer and the digital certificate of the accessee in the connected Ukey device to encrypt the symmetric key respectively to obtain a digital envelope; integrates the several file ciphertexts, the digital envelope and the metadata; uses the producer's signature certificate to sign the integrated data to obtain a signature value; appends the signature value to the end of the file to be securely transmitted to obtain a secure file that is allowed to be transmitted, and sends the secure file to the server for remote storage. It is possible to set the accessible object of the file, use its digital certificate to encrypt and package the file, and send it to a remote secure server for storage, thereby improving the security of file storage.

[0089] In some embodiments,

[0090] An embodiment of the present application also provides a remote secure storage device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus, and the memory is used to store a remote secure storage program; the processor is used to implement the above-mentioned remote secure storage method when executing the program stored in the memory.

[0091] The communication bus mentioned in the above remote secure storage device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0092] The communication interface is used for communication between the above remote secure storage device and other devices.

[0093] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0094] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, and discrete hardware components.

[0095] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0096] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0097] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0098] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

[0099] It should be understood that the above is only an example and does not constitute any limitation on the technical solution of the present invention. In specific applications, technicians in this field can make settings as needed, and the present invention does not limit this.

[0100] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of them according to actual needs to achieve the purpose of the present embodiment, and no limitation is made here.

[0101] In addition, for technical details not fully described in this embodiment, reference can be made to the remote secure storage method provided in any embodiment of the present invention, and will not be repeated here.

[0102] In addition, it should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0103] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0104] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory (ROM) / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0105] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0106] It is understandable that the system provided by the embodiment of the present invention corresponds to the method provided by the embodiment of the present invention, and the explanation, examples and beneficial effects of the relevant contents can refer to the corresponding parts in the above method.

Claims

1. A remote secure storage method, characterized in that: The remote secure storage method comprises: Generate a symmetric key, and use the symmetric key to symmetrically encrypt the files to be securely transmitted corresponding to the list of files to be encrypted, to obtain a number of file ciphertexts; Obtain the producer's digital certificate and signature certificate from the connected Ukey device, and simultaneously obtain the accessible person's digital certificate, and use the producer's digital certificate and the accessible person's digital certificate to encrypt the symmetric key respectively to obtain a digital envelope. The producer is the producer of the file to be securely transmitted, and the accessible person is the person allowed to access the file to be securely transmitted; Integrate the ciphertexts of the plurality of files with the digital envelope and the metadata; Signing the integrated data using the producer's signature certificate to obtain a signature value; The signature value is appended to the end of the file to be securely transmitted to obtain a secure file that is allowed to be transmitted, and the secure file is sent to a server for remote storage.

2. The remote secure storage method according to claim 1, characterized in that: The metadata includes at least: the file format version number of the file to be securely transmitted and file list data, the file list data contains the hash value of the file ciphertext corresponding to the file name and the file security attributes, wherein the hash value of the file ciphertext corresponding to the file name and the file security attributes are stored in the form of a key-value pair, the key is the file name, the value is the hash value corresponding to the file ciphertext, the key is the attribute name, and the value is the attribute value.

3. The remote secure storage method according to claim 2, characterized in that: The method further comprises: Use the SM3 digest algorithm to hash the ciphertexts of several files to obtain the hash value; The hash value and the file name of the ciphertext file are stored as a key-value pair; An input file security attribute is received, and an attribute name and an attribute value of the file security attribute are stored as a key-value pair.

4. The remote secure storage method according to claim 1, characterized in that: The sending of the security file to the server for remote storage comprises: The server receives the sent security file, parses the security file, and obtains the signature certificate of the producer and the signature value at the end of the security file; The server uses the SM3 algorithm to obtain the hash value of the signature value and the hash value of other data except the signature value; The server compares the hash value of the signature value with the hash value of other data to verify the signature value; After the signature value is verified, the server stores the received secure file.

5. The remote secure storage method according to claim 1, characterized in that: The method further comprises: receiving secure file download requests; querying a server in response to the secure file download request to download a secure file; Parse the security file to obtain the signature certificate of the producer and the signature value at the end of the security file; Perform verification based on the signature value; After verification, the digital certificate of the accessible user is extracted from the connected UKey device; Calling the digital certificate to decrypt the digital envelope of the security document to obtain a symmetric key; The symmetric key is used to decrypt the file ciphertext of the security file to obtain a plaintext file, and the producer information of the security file is displayed based on the signature certificate.

6. The remote secure storage method according to claim 5, characterized in that: The method further comprises: Determining whether the corresponding user is an accessible user based on the secure file download request; If the user is accessible, the step of querying the server in response to the secure file download request to download the secure file is performed.

7. The remote secure storage method according to claim 5, characterized in that: The verifying based on the signature value includes: Using the SM3 algorithm to obtain the hash value of the signature value and the hash value of other data except the signature value; Compare the hash value of the signature value with the hash value of other data to verify the signature value; After the signature value is verified, the SM3 algorithm is used to obtain the hash value of each file ciphertext and the hash value corresponding to the file list data, and the hash value of each file ciphertext is compared with the hash value corresponding to the file list data to perform ciphertext verification; After the ciphertext verification is passed, the process returns to the step of extracting the digital certificate of the accessible person from the connected UKey device.

8. A remote secure storage system, characterized in that: The remote secure storage system comprises: The client is used to generate a symmetric key, and use the symmetric key to symmetrically encrypt the files to be securely transmitted corresponding to the list of files to be encrypted, to obtain a number of file ciphertexts; The client is used to obtain the digital certificate and signature certificate of the producer from the connected Ukey device, and simultaneously obtain the digital certificate of the accessible person, and use the digital certificate of the producer and the digital certificate of the accessible person to encrypt the symmetric key respectively to obtain a digital envelope. The producer is the producer of the file to be securely transmitted, and the accessible person is the allowed access to the file to be securely transmitted; The client is used to integrate the ciphertexts of the plurality of files with the digital envelope and metadata; The client is used to sign the integrated data using the signature certificate of the producer to obtain a signature value; The client is used to append the signature value to the end of the file to be securely transmitted to obtain a secure file that is allowed to be transmitted, and send the secure file to the server; The server is used to receive the security file sent by the client and store the security file.

9. A remote secure storage device, characterized in that: The remote secure storage device comprises: a memory, a processor, and a remote secure storage program stored in the memory and executable on the processor, wherein the remote secure storage program is configured to implement the steps of the remote secure storage method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a remote secure storage program, and when the remote secure storage program is executed by the processor, the steps of the remote secure storage method according to any one of claims 1 to 7 are implemented.

Images