File encryption and decryption hierarchical management method and device, electronic equipment and medium

Abstract

The embodiment of the invention provides a file encryption and decryption hierarchical management method and device, electronic equipment and a medium. The method comprises the steps that a first secret key of a first department to which a user terminal belongs is acquired; obtaining an encrypted file, wherein the encrypted file comprises a random symmetric key ciphertext and encrypted file content; determining whether the first department has the permission to view the encrypted file; if the first department has the permission to view the encrypted file, obtaining a salt value of a second department; calculating a second secret key of the second department according to the first secret key and the salt value of the second department; decrypting the random symmetric key ciphertext through a second key to obtain a random symmetric key; and decrypting the encrypted file content through the random symmetric key to obtain a file plaintext. According to the embodiment of the invention, the second secret key is quickly obtained according to the secret key of the first department and the salt value of the department where the encrypted file is located so as to decrypt the encrypted file, and the performance of the file management system is improved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a file encryption and decryption hierarchical management method, device, electronic equipment and medium. Background Art

[0002] As data security awareness gradually increases, key encryption technology has developed rapidly, and file management systems based on key encryption have been widely used in many fields.

[0003] In the related art, the file management system assigns an independent file key to each file and stores these file keys in a key storage database. When a user needs to view a file, the file management system determines that the user has the right to view the file based on the user's job role, and then sends the corresponding file key to the user, thereby achieving file management.

[0004] As the number of files increases dramatically, there are too many file keys in the key storage database, which causes the file management system to take a long time to query file keys and poor system performance. Summary of the invention

[0005] In view of the above problems, a file encryption and decryption hierarchical management method, device, electronic device and medium are proposed to overcome the above problems or at least partially solve the above problems.

[0006] On the one hand, a file encryption and decryption hierarchical management method is provided, comprising:

[0007] Obtaining a first key of a first department to which the user terminal belongs;

[0008] Obtaining an encrypted file, the encrypted file comprising a random symmetric key ciphertext and encrypted file content; wherein the random symmetric key ciphertext is obtained by encrypting the random symmetric key using the second key of the second department to which the encrypted file belongs; and the encrypted file content is obtained by encrypting the file plaintext using the random symmetric key;

[0009] Determining whether the first department has permission to view the encrypted file;

[0010] If the first department has the authority to view the encrypted file, obtaining the salt value of the second department;

[0011] Obtaining the second key of the second department by calculation according to the first key and the salt value of the second department;

[0012] Decrypting the random symmetric key ciphertext using the second key to obtain the random symmetric key;

[0013] The encrypted file content is decrypted using the random symmetric key to obtain the file plaintext.

[0014] Optionally, the encrypted file is generated by the following method:

[0015] Generate the random symmetric key, and encrypt the file plaintext using the random symmetric key to obtain the encrypted file content;

[0016] Obtaining a second key of a second department to which the encrypted file belongs, and encrypting the random symmetric key by using the second key to obtain the random symmetric key ciphertext;

[0017] The encrypted file content and the random symmetric key ciphertext are combined to obtain the encrypted file.

[0018] Optionally, determining whether the first department has permission to view the encrypted file includes:

[0019] Determining the subordinate relationship between the first department and the second department;

[0020] If the first department and the second department are the same department, the first department has the authority to view the encrypted file;

[0021] Alternatively, if the first department is a superior department of the second department, the first department has the authority to view the encrypted file.

[0022] Optionally, the encrypted file includes a second serial number of the second department to which it belongs;

[0023] The determining the subordinate relationship between the first department and the second department includes:

[0024] Obtaining a first number of the first department and a second number of the second department; the first number and the second number both include information about the superior department and the department to which they belong;

[0025] comparing a first number of the first department and a second number of the second department;

[0026] If the department information in the first number of the first department is consistent with the department information in the second number of the second department, it is determined that the first department and the second department are the same department;

[0027] If the department information in the first number of the first department is consistent with the superior department information in the second number of the second department, the first department is determined to be the superior department of the second department.

[0028] Optionally, if the first department has permission to view the encrypted file, obtaining the salt value of the second department includes:

[0029] Obtaining the salt value of the subordinate departments of the first department;

[0030] If the first department has the authority to view the encrypted file, determining that the salt value of the subordinate departments of the first department includes the salt value of the second department;

[0031] The salt value of the second department is obtained by searching the salt value of the subordinate department of the first department.

[0032] Optionally, the method further comprises:

[0033] If the subordinate relationship between the second department and other departments is adjusted, updating the second number of the second department according to the new subordinate relationship;

[0034] The second number in the encrypted file is updated accordingly.

[0035] Optionally, the method further comprises:

[0036] Starting from the time when the second key is obtained, storing the second key within a threshold time;

[0037] When the storage time of the second key reaches a threshold time, the second key is deleted.

[0038] On the other hand, a file encryption and decryption hierarchical management device is provided, comprising:

[0039] A first key acquisition module, used to acquire a first key of a first department to which the user terminal belongs;

[0040] A file acquisition module is used to acquire an encrypted file, wherein the encrypted file includes a random symmetric key ciphertext and encrypted file content; wherein the random symmetric key ciphertext is obtained by encrypting the random symmetric key with the second key of the second department to which the encrypted file belongs; and the encrypted file content is obtained by encrypting the file plaintext with the random symmetric key;

[0041] An authority determination module, used to determine whether the first department has the authority to view the encrypted file;

[0042] a salt value acquisition module, configured to acquire the salt value of the second department if the first department has permission to view the encrypted file;

[0043] A second key acquisition module, configured to calculate the second key of the second department according to the first key and the salt value of the second department;

[0044] A third key acquisition module, used to decrypt the random symmetric key ciphertext using the second key to obtain the random symmetric key;

[0045] The file decryption module is used to decrypt the encrypted file content using the random symmetric key to obtain the accompanying file plaintext.

[0046] On the other hand, an electronic device is provided, comprising: a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of the above-mentioned file encryption and decryption hierarchical management method are implemented.

[0047] On the other hand, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned file encryption and decryption hierarchical management method are implemented.

[0048] The embodiments of the present invention include the following advantages:

[0049] After the user terminal obtains the encrypted file, it first determines whether the first department to which the user terminal belongs has the authority to view the encrypted file. If it is determined that the first department has the authority to view the encrypted file, the second key of the second department is calculated by obtaining the first key of the first department and the salt value of the second department, and the encrypted file is decrypted by the second key to obtain the plain text of the file. After the method determines that the first department has the authority to view the encrypted file, it can quickly calculate the second key to decrypt the encrypted file based on the key of the first department and the salt value of the department where the encrypted file is located, without querying the key database, thereby improving the performance of the file management system and reducing the risk of key leakage.

[0050] Among them, the encrypted file includes a random symmetric key ciphertext and encrypted file content, so that when decrypting the encrypted file belonging to the second department, it is necessary to first obtain the second key, decrypt the random symmetric key ciphertext according to the second key to obtain the random symmetric key, and then decrypt the encrypted file content with the random symmetric key to obtain the file plaintext. Through two encryption operations, the security of the file is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor.

[0052] Figure 1It is a flowchart of the steps of a hierarchical management method for file encryption and decryption provided by an embodiment of the present invention;

[0053] Figure 2 This is an application scenario diagram of a file encryption and decryption hierarchical management method provided by an embodiment of the present invention;

[0054] Figure 3 is a flowchart of a file encryption method provided by an embodiment of the present invention;

[0055] Figure 4 It is a structural block diagram of a file encryption and decryption hierarchical management device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0056] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0057] In the related art, the file management system stores each file key in a key storage database. When a user needs to view a file, the file management system determines that the user has the right to view the file based on the user's job role, and then sends the corresponding file key to the user, thereby achieving file management. As the number of files increases massively, there are too many file keys in the key storage database, resulting in a long time for the file management system to query the file key, resulting in poor system performance.

[0058] After obtaining the encrypted file in the embodiment of the present invention, it is determined whether the first department to which the user terminal belongs has the authority to view the encrypted file. If it is determined that the first department has the authority to view the encrypted file, the second key of the second department is calculated by obtaining the first key of the first department and the salt value of the second department, and the encrypted file is decrypted by the second key to obtain the file plaintext. This method can quickly calculate the second key to decrypt the encrypted file, thereby improving the performance of the file management system.

[0059] Figure 1 The present invention provides a flowchart of the steps of a hierarchical management method for file encryption and decryption.

[0060] like Figure 1 As shown, the file encryption and decryption hierarchical management method may specifically include the following steps:

[0061] Step 101, obtaining a first key of a first department to which a user terminal belongs;

[0062] The user terminal can be a mobile phone, a tablet computer, an augmented reality (AR) / virtual reality (VR) device, a laptop computer, a personal digital assistant (PDA) or other electronic device, and the present invention does not limit this. An encryption client is installed on the user terminal for running the file encryption and decryption hierarchical management method.

[0063] Figure 2 This is an application scenario diagram of a file encryption and decryption hierarchical management method provided by an embodiment of the present invention.

[0064] In an enterprise or team, the file viewing permission is usually related to the user's role level. The higher the level of the user, the greater the file viewing permission. By assigning different permission levels to different users, users can be quickly granted appropriate access and operation permissions, thereby effectively preventing unauthorized users from obtaining important data and protecting data security.

[0065] like Figure 2 As shown, the authority level is divided according to the department level. An organizational structure includes multiple departments, which are divided into first-level departments, second-level departments, third-level departments, etc. Among them, the second-level department is the subordinate department of the first-level department, the third-level department is the subordinate department of the second-level department, and so on. Each department includes at least one employee of the department, and each employee uses the user terminal to perform authority judgment and file access operations.

[0066] In the hierarchical management method for file encryption and decryption, each department has its unique department number and department key, wherein the department number is used to determine the subordinate relationship between each department and other departments, and the department key is used to decrypt the encrypted files belonging to the department.

[0067] Each department has its own encrypted files. The user terminal needs to obtain the department key of the department to which the encrypted files belong before viewing the encrypted files.

[0068] After the encryption client is installed on the user terminal, it can obtain the department number and department key of the department to which the user terminal belongs, which is used to determine the authority and perform subsequent file decryption operations.

[0069] Step 102, obtaining an encrypted file, wherein the encrypted file includes a random symmetric key ciphertext and encrypted file content;

[0070] The random symmetric key ciphertext is obtained by encrypting the random symmetric key with the second key of the second department to which the encrypted file belongs; the encrypted file content is obtained by encrypting the file plaintext with the random symmetric key;

[0071] The encryption client of the user terminal will obtain the file encryption and decryption policy issued by the management system, and encrypt or decrypt the file according to the file encryption and decryption policy.

[0072] The file encryption and decryption policy is the condition for file encryption and decryption configured by the administrator.

[0073] As an example, the file encryption and decryption strategy may be: scan the file stored in the user terminal, and if the file type is a word document or a pdf document, encrypt the file; if the file size is less than 100MB, encrypt the file, etc. In other embodiments, the file encryption and decryption strategy may be other conditions, and the present invention does not impose any limitation on the specific conditions in the file encryption and decryption strategy.

[0074] Figure 3 The present invention provides a flowchart of a method for encrypting a file.

[0075] like Figure 3 As shown, in some embodiments, the encrypted file can be generated by the following method:

[0076] Step 201, generating the random symmetric key, and encrypting the file plaintext by the random symmetric key to obtain the encrypted file content;

[0077] When the encryption client of the user terminal finds a file that meets the encryption policy, it encrypts the file.

[0078] First, a random symmetric key is generated, and the file plaintext is encrypted using the random symmetric key and encryption algorithm to obtain the encrypted file content.

[0079] Since the random symmetric key is randomly generated, each time the plaintext file is encrypted, different encrypted file content will be obtained. This randomness increases the complexity and unpredictability of the encrypted file content, thereby improving data security.

[0080] Step 202, obtaining a second key of a second department to which the encrypted file belongs, and encrypting the random symmetric key using the second key to obtain the random symmetric key ciphertext;

[0081] The encryption client of the user terminal stores the department key of the department, that is, the second key of the second department to which the encrypted file belongs in step 202. The second key is directly obtained, and the random symmetric key generated in step 201 is encrypted by the second key to obtain the random symmetric key ciphertext.

[0082] Step 203: Combine the encrypted file content and the random symmetric key ciphertext to obtain the encrypted file.

[0083] The encrypted file consists of a random symmetric key ciphertext and encrypted file content. This structure makes it necessary to first obtain the second key when decrypting the encrypted file belonging to the second department, decrypt the random symmetric key ciphertext according to the second key to obtain the random symmetric key, and then decrypt the encrypted file content with the random symmetric key to obtain the file plaintext, thereby improving the security of the file.

[0084] In some embodiments, the encrypted file also includes an encrypted information header and department ID information.

[0085] The encryption information header may include the symmetric encryption algorithm type, version, status, file plaintext summary, extended information, etc. Other user terminals that obtain the encrypted file can identify the basic information of the encrypted file based on the encryption information header, and determine the algorithm used to decrypt the encrypted file.

[0086] The department ID information is used to indicate the department to which the encrypted file belongs. Other user terminals that obtain the encrypted file can determine whether they have the authority to view the encrypted file based on the department ID information.

[0087] In some embodiments, the extended information portion in the encrypted information header is encoded in TLV format to achieve dynamic extension.

[0088] Step 103, determining whether the first department has the authority to view the encrypted file;

[0089] The user terminal determines that the department to which it belongs has the authority to view the encrypted file, so as to continue the subsequent operation of decrypting the encrypted file.

[0090] In some embodiments, step 103 includes:

[0091] Determining the subordinate relationship between the first department and the second department;

[0092] If the first department and the second department are the same department, the first department has the authority to view the encrypted file;

[0093] Alternatively, if the first department is a superior department of the second department, the first department has the authority to view the encrypted file.

[0094] In this method, the user terminal of the superior department has the right to view the encrypted files of its subordinate department, and the user terminal of the same department has the right to view the encrypted files of the department.

[0095] When it is determined that the department to which the user terminal belongs is the same as the department to which the encrypted file belongs, the encrypted file can be decrypted directly according to the department key stored in the user terminal.

[0096] In some embodiments, the encrypted file includes a second number of the second department to which it belongs;

[0097] The determining the subordinate relationship between the first department and the second department includes:

[0098] Obtaining a first number of the first department and a second number of the second department; the first number and the second number both include information about the superior department and the department to which they belong;

[0099] As an example, the department number consists of multiple digits, and each two digits represent a department. The first digits of the department number are the information of the superior department, and the last two digits are the information of the department to which it belongs. For example, the first-level departments include: Department 01, Department 02, Department 03, etc.; the second-level departments under the first-level department 01 include: Department 0101, Department 0102, Department 0103, etc.; the third-level departments under the second-level department 0101 include: Department 010101, Department 010102, Department 010103, etc.

[0100] comparing a first number of the first department and a second number of the second department;

[0101] If the department information in the first number of the first department is consistent with the department information in the second number of the second department, it is determined that the first department and the second department are the same department;

[0102] If the department information in the first number of the first department is consistent with the superior department information in the second number of the second department, the first department is determined to be the superior department of the second department.

[0103] As an example, Figure 2 As shown, if the first number of the first department is 0101 and the second number of the second department is 0101, then by comparing the first number and the second number, the department information of the first number is consistent with the department information of the second number, both are "0101", then it is determined that the first department and the second department are the same department.

[0104] like Figure 2 As shown, if the first number of the first department is 0102 and the second number of the second department is 010201, then by comparing the first number and the second number, the department information of the first number is consistent with the superior department information in the second number, both of which are "0102". It can be seen that the first department is the superior department of the second department.

[0105] like Figure 2As shown, if the first number of the first department is 01 and the second number of the second department is 010201, then by comparing the first number and the second number, the first two digits of the department information of the first number and the superior department information in the second number are consistent, both are "01", which means that the first department is the superior department of the second department.

[0106] Combination Figure 2 It can be understood that when the first two digits of the first-level department number "01" and the first-level department number "01..." are equal, the first-level department is the superior department of the N-level department. That is, a department can be the superior department of multiple departments at different levels.

[0107] It is worth noting that the above numbering method is only used as an example. In other embodiments, other numbering methods can be used to number each department, and the present invention is not limited to this.

[0108] In some embodiments, the method further comprises:

[0109] If the subordinate relationship between the second department and other departments is adjusted, updating the second number of the second department according to the new subordinate relationship;

[0110] The second number in the encrypted file is updated accordingly.

[0111] In a file management system, organizational structure adjustments may occur. In this case, the department number needs to be updated according to the new department affiliation to ensure the security of file viewing permissions.

[0112] For example, if the second department is a second-level department with department number 0102, and it is adjusted to be a sub-department of the second-level department with department number 0101, the department number of the second department is updated to 0101XX after the adjustment, that is, the second number is updated to 0101XX.

[0113] After the second number of the second section is updated, the second number in the encrypted file in the second section is updated accordingly.

[0114] In some embodiments, the encrypted file is composed of four parts: an encrypted information header, department ID information, a random symmetric key ciphertext, and encrypted file content, and the department ID information includes the department number of the department described in the encrypted file.

[0115] After the second number of the second department is updated, new department ID information is generated according to the new second number, and then the encrypted file is reassembled with the encrypted information header, the random symmetric key ciphertext and the encrypted file content.

[0116] In some embodiments, after the department affiliation is adjusted, a new random symmetric key is regenerated, and then the encrypted file is regenerated according to steps 201-203 of the above-mentioned file encryption method.

[0117] In some embodiments, if the subordinate relationship between the second department and other departments is adjusted, the salt value and the department key will also be regenerated for the second department and the subordinate departments of the second department.

[0118] If the original superior department of the second department is no longer the superior department of the second department after the subordinate relationship is adjusted, this operation can ensure that the original superior department of the second department no longer has the authority to view the encrypted files of the second department.

[0119] Step 104, if the first department has the authority to view the encrypted file, obtaining the salt value of the second department;

[0120] Salt values ​​are usually randomly generated by the system and assigned to each department. Each department has a unique salt value. Salt values ​​can include random uppercase and lowercase letters, numbers, characters, etc., and their length and complexity can be configured according to security requirements.

[0121] Combination Figure 2 To illustrate, in the hierarchical management method for file encryption and decryption provided in an embodiment of the present invention, there is a master key. The department key of the first-level department is calculated by the master key and the salt value of the first-level department. The department key of the second-level department is calculated by the department key of the first-level department to which it belongs and the salt value of the second-level department. The department key of the third-level department is calculated by the department key of the second-level department to which it belongs and the salt value of the third-level department... and so on.

[0122] The master key is generated by hashing a random seed, and the random number seed is generated and stored offline to avoid touching the Internet and improve the security of the system. In addition, a random mnemonic can be used to generate a random number seed for easy memorization.

[0123] The lower-level department salt value is stored in the encryption client of the user terminal. When the first department is determined to be the upper-level department of the second department, it is determined that the lower-level department salt value in the user terminal includes the salt value of the second department.

[0124] In some embodiments, step 104 includes:

[0125] Obtaining the salt value of the subordinate departments of the first department;

[0126] If the first department has the authority to view the encrypted file, determining that the salt value of the subordinate departments of the first department includes the salt value of the second department;

[0127] The salt value of the second department is obtained by searching the salt value of the subordinate department of the first department.

[0128] It is worth noting that when the first department is not the direct superior department of the second department, it is also necessary to search for the salt values ​​of the intermediate-level departments between the first department and the second department step by step.

[0129] As an example, combining Figure 2 For example, when the first department is the first-level department 01 and the second department is the third-level department 010201, it is necessary to find the salt value of the second-level department 0102 and the salt value of the third-level department 010201.

[0130] When the first department is the first-level department 01, and the second department is the N-level department 01010101..., it is necessary to find the salt value of the second-level department 0101, the salt value of the third-level department 010101, the salt value of the fourth-level department 010101... and so on, as well as the salt values ​​of the N-level departments 01010101...

[0131] After determining the viewing authority of the encrypted file, the salt value of the second part is obtained by searching, so that the second key of the second part can be obtained according to the salt value of the second part.

[0132] In this process, there is no need to transmit the second key of the second department, thereby reducing the risk of leakage caused by key transmission.

[0133] Step 105, calculating the second key of the second department according to the first key and the salt value of the second department;

[0134] Specifically, when the first department is the direct superior department of the second department, the second key of the second department is obtained by performing a hash operation on the first key of the first department and the salt value of the second department.

[0135] When performing a hash operation, the first key and the second salt value are combined as input and calculated through a hash function (such as SHA-256, etc.). The design of the hash function ensures that the output second key is highly random and irreversible, that is, the original first key and salt value cannot be deduced from the second key. This greatly enhances the diversity and security of the key, making it difficult for attackers to attack through known key information, providing a solid guarantee for data security.

[0136] When the first department is not the direct superior department of the second department, it is necessary to determine the department key of each level of department step by step according to the first key of the first department and the salt values ​​of its subordinate departments at different levels, and finally obtain the second key of the second department.

[0137] When the first department is a first-level department and the second department is an N-level department under the first department, it is necessary to determine the department key B of the second-level department based on the department key A of the first-level department and the salt value of the second-level department; determine the department key C of the third-level department based on the department key B of the second-level department and the salt value of the third-level department... and so on; determine the department key E of the N-level department based on the department key D of the N-1 level department and the salt value of the N-level department.

[0138] As an example, combining Figure 2 To illustrate, when the first department is the first-level department 01 and the second department is the third-level department 010201, it is necessary to first calculate the department key of the second-level department 0102 based on the department key of the first-level department 01 and the salt value of the second-level department 0102, and then calculate based on the department key of the second-level department 0102 and the salt value of the third-level department 010201, and finally obtain the department key of the third-level department 010201.

[0139] In this way, the user terminal only needs to store the department key of the department, and then determine the department keys of all subordinate departments step by step according to the salt value of the subordinate department, so as to decrypt the encrypted file. This greatly reduces the storage requirements of department keys and improves system performance.

[0140] It is worth noting that the "first department" and "second department" are only used to distinguish the department where the user viewing the encrypted file is located from the department to which the encrypted file belongs, and do not represent the hierarchical relationship between departments.

[0141] In some embodiments, the method further comprises:

[0142] The second key is stored within a threshold time starting from when the second key is obtained; when the storage time of the second key reaches the threshold time, the second key is deleted.

[0143] Specifically, after the user terminal calculates the second key, it can use the second key to decrypt multiple encrypted files in the department to which the second key belongs. In order to reduce repeated calculations, the second key is temporarily and securely stored in the user terminal, which can improve the decryption efficiency of encrypted files and thus improve the user experience.

[0144] At the same time, the encryption client sets a threshold time for storing the second key. From the moment the user terminal obtains the second key, the encryption client will calculate the storage time of the second key stored in the user terminal. When the storage time reaches the set threshold time, the second key stored in the user terminal is automatically deleted. While considering the user experience, data security is guaranteed.

[0145] As an example, the threshold time is set to 5 minutes. In other embodiments, the threshold time can be set to other specific time according to actual needs, and the present invention is not limited to this.

[0146] Step 106, decrypting the random symmetric key ciphertext using the second key to obtain the random symmetric key;

[0147] Decrypting the random symmetric key ciphertext with the second key to obtain the random symmetric key depends on the correctness of the second key and the security of the decryption algorithm. The decryption algorithm here should be the reverse operation of the encryption algorithm used in step 202 of the file encryption method.

[0148] Step 107: decrypt the encrypted file content using the random symmetric key to obtain the file plaintext.

[0149] In actual applications, the process of decrypting the encrypted file content using a random symmetric key to obtain the file plaintext involves a series of complex mathematical operations and algorithmic logic. The design of these operations and algorithms ensures the accuracy and efficiency of the decryption process while ensuring the security of the data.

[0150] In addition, the security of the decryption process depends not only on the confidentiality of the key, but also on the selection and implementation of the encryption algorithm. Therefore, when selecting an encryption algorithm and key management scheme, you can consider factors such as the security of the algorithm, the complexity of the key, and the convenience and reliability of key management.

[0151] In some embodiments, when a user terminal is moved out of the department to which the user terminal originally belonged, the encryption client will clear the file encryption and decryption policies, department numbers, department keys and other information stored in the user terminal, causing the user terminal to lose the right to view the encrypted files of the original department and the encrypted files of the subordinate departments of the original department.

[0152] In an embodiment of the present invention, after the user terminal obtains the encrypted file, it first determines whether the first department to which the user terminal belongs has the authority to view the encrypted file. If it is determined that the first department has the authority to view the encrypted file, the second key of the second department is calculated by obtaining the first key of the first department and the salt value of the second department, and the encrypted file is decrypted by the second key to obtain the plain text of the file. After the method determines that the first department has the authority to view the encrypted file, it can quickly calculate the second key to decrypt the encrypted file based on the key of the first department and the salt value of the department where the encrypted file is located, without querying the key database, thereby improving the performance of the file management system and reducing the risk of key leakage.

[0153] Among them, the encrypted file includes a random symmetric key ciphertext and encrypted file content, so that when decrypting the encrypted file belonging to the second department, it is necessary to first obtain the second key, decrypt the random symmetric key ciphertext according to the second key to obtain the random symmetric key, and then decrypt the encrypted file content with the random symmetric key to obtain the file plaintext. The security of the file is improved through two encryption operations.

[0154] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0155] Figure 4 It is a structural block diagram of a file encryption and decryption hierarchical management device provided by an embodiment of the present invention.

[0156] like Figure 4 As shown, a file encryption and decryption hierarchical management device provided by an embodiment of the present invention may specifically include the following modules:

[0157] A key acquisition module 301, configured to acquire a first key of a first department to which a user terminal belongs;

[0158] The encryption client of the user terminal can obtain the first key of the first department to which the user terminal belongs, for subsequent file decryption operations.

[0159] The file acquisition module 302 is used to acquire an encrypted file, wherein the encrypted file includes a random symmetric key ciphertext and encrypted file content; wherein the random symmetric key ciphertext is obtained by encrypting the random symmetric key with the second key of the second department to which the encrypted file belongs; and the encrypted file content is obtained by encrypting the file plaintext with the random symmetric key;

[0160] The encryption client of the user terminal will obtain the file encryption and decryption policy issued by the management system, and encrypt or decrypt the file according to the file encryption and decryption policy. The file encryption and decryption policy is the condition for file encryption and decryption configured by the administrator.

[0161] A first authority determination module 303, used to determine whether the first department has the authority to view the encrypted file;

[0162] The user terminal determines that the department to which it belongs has the authority to view the encrypted file, so as to continue the subsequent operation of decrypting the encrypted file.

[0163] A first salt value acquisition module 304, configured to acquire the salt value of the second department if the first department has the authority to view the encrypted file;

[0164] The lower-level department salt value is stored in the encryption client of the user terminal. When the first department is determined to be the upper-level department of the second department, it is determined that the lower-level department salt value in the user terminal includes the salt value of the second department.

[0165] A second key acquisition module 305, configured to calculate the second key of the second department according to the first key and the salt value of the second department;

[0166] The second key of the second part is obtained by performing a hash operation on the first key of the first part and the salt value of the second part.

[0167] When performing a hash operation, the first key and the second salt value are combined as input and calculated through a hash function (such as SHA-256, etc.). The design of the hash function ensures that the output second key is highly random and irreversible, that is, the original first key and salt value cannot be deduced from the second key. This greatly enhances the diversity and security of the key, making it difficult for attackers to attack through known key information, providing a solid guarantee for data security.

[0168] A third key acquisition module 306, configured to decrypt the random symmetric key ciphertext using the second key to obtain the random symmetric key;

[0169] Decrypting the random symmetric key ciphertext with the second key to obtain the random symmetric key depends on the correctness of the second key and the security of the decryption algorithm. The decryption algorithm here should be the inverse operation of the encryption algorithm used by the second key to encrypt the random symmetric key.

[0170] The file decryption module 307 is used to decrypt the encrypted file content using the random symmetric key to obtain the file plaintext.

[0171] The encrypted file content is decrypted using a random symmetric key to obtain the file plaintext so that the user terminal can view the file.

[0172] In some embodiments, a file encryption device provided by an embodiment of the present invention may specifically include the following modules:

[0173] A key generation module, used to generate the random symmetric key, and encrypt the file plaintext by the random symmetric key to obtain the encrypted file content;

[0174] When the encryption client of the user terminal finds a file that meets the encryption policy, it encrypts the file by generating a random symmetric key and then encrypting the file plaintext according to the random symmetric key and encryption algorithm to obtain the encrypted file content.

[0175] A key encryption module, used for obtaining a second key of a second department to which the encrypted file belongs, and encrypting the random symmetric key by using the second key to obtain the random symmetric key ciphertext;

[0176] The encryption client of the user terminal stores the department key of the department, that is, the second key of the second department to which the encrypted file belongs. The second key is directly obtained, and the random symmetric key generated above is encrypted by the second key to obtain the random symmetric key ciphertext.

[0177] The file encryption module is used to combine the encrypted file content with the random symmetric key ciphertext to obtain the encrypted file.

[0178] The encrypted file consists of a random symmetric key ciphertext and encrypted file content. This structure makes it necessary to first obtain the second key when decrypting the encrypted file belonging to the second department, decrypt the random symmetric key ciphertext according to the second key to obtain the random symmetric key, and then decrypt the encrypted file content with the random symmetric key to obtain the file plaintext, thereby improving the security of the file.

[0179] In some embodiments, the authority determination module 303 includes:

[0180] A second authority determination module, used to determine the subordinate relationship between the first department and the second department;

[0181] If the first department and the second department are the same department, the first department has the authority to view the encrypted file;

[0182] Alternatively, if the first department is a superior department of the second department, the first department has the authority to view the encrypted file.

[0183] In this method, the user terminal of the superior department has the right to view the encrypted files of its subordinate department, and the user terminal of the same department has the right to view the encrypted files of the department.

[0184] In some embodiments, the encrypted file includes a second number of the second department to which it belongs;

[0185] In some embodiments, the relationship determination module includes:

[0186] A number acquisition module, used to acquire a first number of the first department and a second number of the second department; the first number and the second number both include information about the superior department and the department to which they belong;

[0187] A number comparison module, used for comparing a first number of the first department with a second number of the second department;

[0188] If the department information in the first number of the first department is consistent with the department information in the second number of the second department, it is determined that the first department and the second department are the same department;

[0189] If the department information in the first number of the first department is consistent with the superior department information in the second number of the second department, the first department is determined to be the superior department of the second department.

[0190] As an example, the department number consists of multiple digits, and each two digits represent a department. The first two digits of the department number are the superior department information, and the last two digits are the department information.

[0191] For example, the first-level departments include: Department No. 01, Department No. 02, Department No. 03, etc.; the second-level departments under the first-level department No. 01 include: Department No. 0101, Department No. 0102, Department No. 0103, etc.; the third-level departments under the second-level department No. 0101 include: Department No. 010101, Department No. 010102, Department No. 010103, etc.

[0192] If the first number of the first department is 0101 and the second number of the second department is 0101, then by comparing the first number and the second number, if the department information of the first number is consistent with the department information of the second number, both of which are "0101", it is determined that the first department and the second department are the same department.

[0193] If the first number of the first department is 0102 and the second number of the second department is 010201, then by comparing the first number and the second number, the department information of the first number is consistent with the superior department information in the second number, both of which are "0102", it can be known that the first department is the superior department of the second department.

[0194] It is worth noting that the above numbering method is only used as an example. In other embodiments, other numbering methods can be used to number each department, and the present invention is not limited to this.

[0195] In some embodiments, the salt value acquisition module 304 includes:

[0196] a second salt value acquisition module, configured to acquire the salt value of the subordinate departments of the first department; if the first department has the authority to view the encrypted file, determining that the salt value of the subordinate departments of the first department includes the salt value of the second department;

[0197] The third salt value acquisition module is used to search for the salt value of the second department in the salt values ​​of the subordinate departments of the first department to obtain the salt value of the second department.

[0198] The lower-level department salt value is stored in the encryption client of the user terminal. When the first department is determined to be the upper-level department of the second department, it is determined that the lower-level department salt value in the user terminal includes the salt value of the second department.

[0199] After determining the viewing authority of the encrypted file, the salt value of the second part is obtained by searching, and then the second key of the second part is obtained according to the salt value of the second part. In this process, the second key of the second part does not need to be transmitted, reducing the risk of leakage caused by key transmission.

[0200] In some embodiments, the apparatus further comprises:

[0201] The number updating module is used to update the second number of the second department according to the new subordinate relationship if the subordinate relationship between the second department and other departments is adjusted; and correspondingly update the second number in the encrypted file.

[0202] In the file management system, there may be organizational structure adjustments, and the department number needs to be updated according to the new department affiliation. After the second number of the second department is updated, the second number in the encrypted file in the second department is updated accordingly, thereby ensuring the security of file viewing permissions.

[0203] In some embodiments, the apparatus further comprises:

[0204] The key deletion module is used to store the second key within a threshold time starting from when the second key is obtained; when the storage time of the second key reaches the threshold time, delete the second key.

[0205] Specifically, after the user terminal calculates the second key, it can use the second key to decrypt multiple encrypted files in the department to which the second key belongs. In order to reduce repeated calculations, the second key is temporarily and securely stored in the user terminal, which can improve the decryption efficiency of encrypted files and thus improve the user experience.

[0206] At the same time, the encryption client sets a threshold time for storing the second key. From the moment the user terminal obtains the second key, the encryption client will calculate the storage time of the second key stored in the user terminal. When the storage time reaches the set threshold time, the second key stored in the user terminal is automatically deleted. While considering the user experience, data security is guaranteed.

[0207] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0208] An embodiment of the present invention further provides an electronic device, including:

[0209] It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned file encryption and decryption hierarchical management method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0210] An embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned file encryption and decryption hierarchical management method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0211] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0212] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0213] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0214] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0215] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable terminal device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0216] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0217] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0218] The above is a detailed introduction to a file encryption and decryption hierarchical management method, device, electronic device and computer-readable storage medium provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for a general technician in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A hierarchical management method for file encryption and decryption, characterized in that: include: Obtaining a first key of a first department to which the user terminal belongs; Obtaining an encrypted file, the encrypted file comprising a random symmetric key ciphertext and encrypted file content; wherein the random symmetric key ciphertext is obtained by encrypting the random symmetric key using the second key of the second department to which the encrypted file belongs; and the encrypted file content is obtained by encrypting the file plaintext using the random symmetric key; Determining whether the first department has permission to view the encrypted file; If the first department has the authority to view the encrypted file, obtaining the salt value of the second department; Obtaining the second key of the second department by calculation according to the first key and the salt value of the second department; Decrypting the random symmetric key ciphertext using the second key to obtain the random symmetric key; The encrypted file content is decrypted using the random symmetric key to obtain the file plaintext.

2. The method according to claim 1, characterized in that The encrypted file is generated by the following method: Generate the random symmetric key, and encrypt the file plaintext using the random symmetric key to obtain the encrypted file content; Obtaining a second key of a second department to which the encrypted file belongs, and encrypting the random symmetric key by using the second key to obtain the random symmetric key ciphertext; The encrypted file content and the random symmetric key ciphertext are combined to obtain the encrypted file.

3. The method according to claim 1, characterized in that The determining whether the first department has the authority to view the encrypted file includes: Determining the subordinate relationship between the first department and the second department; If the first department and the second department are the same department, the first department has the authority to view the encrypted file; Alternatively, if the first department is a superior department of the second department, the first department has the authority to view the encrypted file.

4. The method according to claim 3, characterized in that The encrypted file includes the second serial number of the second department to which it belongs; The determining the subordinate relationship between the first department and the second department includes: Obtaining a first number of the first department and a second number of the second department; the first number and the second number both include information about the superior department and the department to which they belong; comparing a first number of the first department and a second number of the second department; If the department information in the first number of the first department is consistent with the department information in the second number of the second department, it is determined that the first department and the second department are the same department; If the department information in the first number of the first department is consistent with the superior department information in the second number of the second department, the first department is determined to be the superior department of the second department.

5. The method according to claim 1, characterized in that If the first department has the authority to view the encrypted file, obtaining the salt value of the second department includes: Obtaining the salt value of the subordinate departments of the first department; If the first department has the authority to view the encrypted file, determining that the salt value of the subordinate departments of the first department includes the salt value of the second department; The salt value of the second department is obtained by searching the salt value of the subordinate department of the first department.

6. The method according to claim 4, characterized in that The method further comprises: If the subordinate relationship between the second department and other departments is adjusted, updating the second number of the second department according to the new subordinate relationship; The second number in the encrypted file is updated accordingly.

7. The method according to claim 1, characterized in that The method further comprises: Starting from the time when the second key is obtained, storing the second key within a threshold time; When the storage time of the second key reaches a threshold time, the second key is deleted.

8. A file encryption and decryption hierarchical management device, characterized in that: include: A first key acquisition module, used to acquire a first key of a first department to which the user terminal belongs; A file acquisition module is used to acquire an encrypted file, wherein the encrypted file includes a random symmetric key ciphertext and encrypted file content; wherein the random symmetric key ciphertext is obtained by encrypting the random symmetric key with the second key of the second department to which the encrypted file belongs; and the encrypted file content is obtained by encrypting the file plaintext with the random symmetric key; A first authority determination module, used to determine whether the first department has the authority to view the encrypted file; a first salt value acquisition module, configured to acquire the salt value of the second department if the first department has permission to view the encrypted file; A second key acquisition module, configured to calculate the second key of the second department according to the first key and the salt value of the second department; A third key acquisition module, used to decrypt the random symmetric key ciphertext using the second key to obtain the random symmetric key; The file decryption module is used to decrypt the encrypted file content using the random symmetric key to obtain the accompanying file plaintext.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of the file encryption and decryption hierarchical management method as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the file encryption and decryption hierarchical management method according to any one of claims 1 to 7 are implemented.

Images