Document operation method and device based on trusted computing and storage medium
By setting up a document trusted collaboration module in the device and leveraging the encryption, integrity measurement and collaboration policy management capabilities of the trusted root, the problem of single and insufficient security in the existing document protection method is solved, and efficient security guarantees for documents during transmission and collaboration are achieved.
Patent Information
- Application Number
- CN202411949183.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-27
- Publication Date
- 2025-04-29
AI Technical Summary
The existing document protection method is single and there are problems with insufficient security and integrity protection, especially during document transmission and collaboration, which can easily lead to password leakage or document tampering.
Using a document operation method based on trusted computing, a document trusted collaboration module is set up in the device, and the encryption, integrity measurement and collaboration policy management capabilities of the trusted root are used to provide three protection methods: document encryption, integrity verification and collaboration policy.
Effectively ensure the security and integrity of documents during transmission and collaboration, prevent password leakage and document tampering, and ensure the credibility and security of documents.
Smart Images
Figure CN119903549A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of document protection technology, and in particular to a document operation method, device and storage medium based on trusted computing. Background Art
[0002] At present, paperless office has become increasingly mature. Most of the work records and information exchanges in the process of collaboration and communication are completed using documents, but the current document protection methods are relatively simple. Among them, some documents are protected by encryption methods of office software or encryption methods when compressing folders, and some are protected by restricted editing methods of office software. However, encryption or restricted editing methods may not be able to fully guarantee the security of documents. First, the encryption mechanism of office software or compression software has the risk of password cracking. In addition, during the process of human interaction with document passwords, passwords may be accidentally leaked or maliciously stolen during the interaction process. Secondly, restricted editing of documents will also bring problems. For example, document recipients or people who steal documents by illegal means can modify documents at will due to lax restrictions on editing, resulting in tampering of document content. This situation may cause losses to the relevant parties and may even lead to more serious consequences.
[0003] Therefore, how to ensure the security and integrity of documents is a problem that those skilled in the art need to solve. Summary of the invention
[0004] The present application provides a document operation method, device and storage medium based on trusted computing to ensure the security and integrity of the document.
[0005] In a first aspect, the present application provides a document operation method based on trusted computing, which is applied to a document trusted collaboration module of a sending device, and the document operation method includes:
[0006] Get the target document to be processed;
[0007] Receiving a document operation instruction for the target document; the document operation instruction comprises: at least one of an encryption instruction, an integrity value generation instruction, and a collaboration strategy generation instruction;
[0008] According to the document operation instruction, calling the trusted root of the sending device to perform the corresponding document operation on the target document to generate an operation result; the operation result includes the target document;
[0009] The operation result is sent to a receiving device so that the receiving device can verify the operation result using a document trusted collaboration module and a trusted root.
[0010] Optionally, calling the trusted root of the sending device to perform a corresponding document operation on the target document to generate an operation result according to the document operation instruction includes:
[0011] If the document operation instruction is an encryption instruction, an encryption operation is performed on the target document through the trusted root of the sending device, and the encrypted target document is used as the operation result.
[0012] Optionally, calling the trusted root of the sending device to perform a corresponding document operation on the target document to generate an operation result according to the document operation instruction includes:
[0013] If the document operation instruction is an integrity value generation instruction, the integrity of the target document is measured through the trusted root of the sending device to generate an integrity value, and an operation result is generated according to the target document and the integrity value.
[0014] Optionally, calling the trusted root of the sending device to perform a corresponding document operation on the target document to generate an operation result according to the document operation instruction includes:
[0015] If the document operation instruction is a collaboration policy generation instruction, the collaboration policy is generated through the trusted root of the sending device, and the operation result is generated according to the target document and the collaboration policy; wherein the collaboration policy includes: at least one of subject information, object information, operation information and environment information.
[0016] In a second aspect, the present application provides a document operation method based on trusted computing, which is applied to a document trusted collaboration module of a receiving device, and the document operation method includes:
[0017] Receiving an operation result sent by a sending device; wherein the operation result is generated by the above-mentioned document operation method;
[0018] Invoking a trusted root of a receiving device to verify the operation result;
[0019] If the verification is successful, the target document in the operation result is allowed to be opened.
[0020] Optionally, the calling of the trusted root of the receiving device verifies the operation result, and if the verification is successful, allows the target document in the operation result to be opened, including:
[0021] If the operation result includes an encrypted target document, after receiving the target document opening instruction, calling the trusted root of the receiving device to perform a decryption operation on the encrypted target document;
[0022] If the decryption is successful, the target document is allowed to be opened; wherein, the trusted root of the receiving device and the trusted root of the sending device perform encryption and decryption operations through the same password management system.
[0023] Optionally, the calling of the trusted root of the receiving device verifies the operation result, and if the verification is successful, allows the target document in the operation result to be opened, including:
[0024] If the operation result includes the target document and the integrity value, calling the trusted root of the receiving device and storing the integrity value in the reference library;
[0025] If a target document opening instruction is received, the trusted root of the receiving device is called to perform integrity measurement on the target document to generate a measurement value, and it is determined whether the measurement value of the target document is the same as the integrity value of the benchmark library. If they are the same, the target document is allowed to be opened.
[0026] Optionally, the calling of the trusted root of the receiving device verifies the operation result, and if the verification is successful, allows the target document in the operation result to be opened, including:
[0027] If the operation result includes the target document and the collaboration policy, calling the trusted root storage collaboration policy of the receiving device;
[0028] If a target document opening instruction is received, the information to be verified is obtained, and the trusted root of the receiving device is called to determine whether the information to be verified complies with the collaboration policy; if it complies, the target document is allowed to be opened.
[0029] In a third aspect, the present application provides an electronic device, including:
[0030] A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of the document operation method described above in the present application through the computer program.
[0031] In a fourth aspect, the present application further provides a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the steps of the above-mentioned document operation method of the present application.
[0032] The above technical solution provided by the embodiment of the present application has the following advantages over the prior art: the present application discloses a document operation scheme based on trusted computing, the scheme is applied to the document trusted collaboration module of the sending device, the scheme obtains the target document to be processed, and the document operation instruction for the target document, the document operation instruction includes: at least one of the encryption instruction, the integrity value generation instruction and the collaboration strategy generation instruction; according to the document operation instruction, the trusted root of the sending device is called to perform the corresponding document operation on the target document to generate an operation result; the operation result includes the target document; the operation result is sent to the receiving device so that the receiving device verifies the operation result using the document trusted collaboration module and the trusted root. It can be seen that the present solution provides three document protection methods, namely document encryption, document integrity and document collaboration strategy, by setting up a document trusted collaboration module in the device and utilizing the encryption capability, integrity measurement capability and flexibly definable trusted strategy of the trusted computing and trusted root. The user can use one or more security methods according to the degree of document security and the document interaction object to verify the integrity of the collaborative document, formulate a collaboration strategy and encrypt the document to ensure the security of the document during transmission and collaboration. BRIEF DESCRIPTION OF THE DRAWINGS
[0033] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.
[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.
[0035] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.
[0036] Figure 1 A flowchart of a document operation method based on trusted computing provided in an embodiment of the present application;
[0037] Figure 2 An architecture diagram of a trusted collaboration method based on document trusted collaboration software provided in an embodiment of the present application;
[0038] Figure 3 An architecture diagram of a trusted collaboration method based on a document trusted collaboration plug-in provided in an embodiment of the present application;
[0039] Figure 4 An encryption flow chart of the document trusted collaboration software provided in the embodiment of the present application;
[0040] Figure 5 A decryption flow chart of the document trusted collaboration software provided in the embodiment of the present application;
[0041] Figure 6 A flow chart for generating integrity of document trusted collaboration software provided in an embodiment of the present application;
[0042] Figure 7 A schematic diagram of the integrity value storage process provided in an embodiment of the present application;
[0043] Figure 8 The integrity verification flow chart provided for the embodiment of the present application;
[0044] Fig. 9 A schematic diagram of a document collaboration strategy generation process provided in an embodiment of the present application;
[0045] Fig.10 A schematic diagram of the structure of a document operation device based on trusted computing provided in an embodiment of the present application;
[0046] Fig.11 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0047] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.
[0048] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.
[0049] The embodiments of the present application disclose a document operation method, device and storage medium based on trusted computing to ensure the security and integrity of the document.
[0050] See also Figure 1, is a flowchart of a document operation method based on trusted computing provided in an embodiment of the present application, the method is applied to a document trusted collaboration module of a sending device, and the document operation method includes the following steps:
[0051] S101, obtaining a target document to be processed;
[0052] In the present application, the document trusted collaboration module may specifically be document trusted collaboration software deployed in the device operating system, or a document trusted collaboration plug-in integrated into office software, which is not specifically limited here.
[0053] See also Figure 2 , which is a diagram of the architecture of the trusted collaboration method based on document trusted collaboration software provided in the embodiment of the present application, see Figure 3 , is an architecture diagram of a trusted collaboration method based on a document trusted collaboration plug-in provided in an embodiment of the present application, the functions implemented by the document trusted collaboration software and the document trusted collaboration plug-in are the same; through Figure 2 and Figure 3 It can be seen that the document trusted collaboration module includes: document encryption and decryption, document integrity generation, document integrity verification, document collaboration policy generation, document collaboration policy verification, office software control interface and other modules. The trusted root of the device includes: trusted cryptographic module, encryption and decryption functions, integrity measurement and trusted policy management.
[0054] In this application, the document trusted collaboration module provides a document import interface to the document editors. When the document import is completed, the document trusted collaboration module can obtain the document to be processed. This application refers to the document that needs to perform the security operation as the target document.
[0055] S102, receiving a document operation instruction for a target document; the document operation instruction includes: at least one of an encryption instruction, an integrity value generation instruction, and a collaboration strategy generation instruction;
[0056] In the present application, after the document trusted collaboration module obtains the target document, it will provide the document editor with security options, which include: document encryption option, document integrity option and document collaboration strategy option. The document editor can use one or more security methods according to the document security level and the document interaction object. After the document editor selects the corresponding security option, the corresponding document operation instruction will be generated, which includes: one or more of encryption instructions, integrity value generation instructions and collaboration strategy generation instructions; for example: the user selects the document encryption option and the document integrity option, then the generated document operation instructions include: encryption instructions and integrity value generation instructions.
[0057] S103, according to the document operation instruction, calling the trusted root of the sending device to perform the corresponding document operation on the target document to generate an operation result; the operation result includes the target document;
[0058] In the present application, different document operations need to be performed for different document operation instructions. For example, for encryption instructions, the document operation to be performed is an encryption operation; for integrity value generation instructions, the document operation to be performed is a document integrity measurement operation; for collaboration strategy generation instructions, the document operation to be performed is a collaboration strategy generation operation.
[0059] Moreover, this solution not only requires setting up a document trusted collaboration module in the device, but also requires implanting a hardware trusted root in the device. When performing document operations, it is necessary to call the trusted root of the sending device to perform corresponding document operations on the target document to generate operation results; and no matter which type of document operation is performed, the operation result includes the target document.
[0060] S104. Send the operation result to the receiving device so that the receiving device can verify the operation result using the document trusted collaboration module and the trusted root.
[0061] After this application performs a document operation on the target document and generates an operation result, the operation result needs to be sent to a receiving device. The receiving device is also equipped with a document trusted collaboration module and a trusted root. Therefore, after the receiving device receives the operation result, it needs to verify the operation result through the document trusted collaboration module and the trusted root in the receiving device. The target document can be opened only after the verification is passed.
[0062] From the above, it can be seen that in this application, if the document editor sets the security method for the document in the office software or the system's document trusted collaboration software, three methods can be provided to the document editor: document encryption, document integrity, and document collaboration strategy. The document editor selects one or more appropriate security methods based on the importance of the document and the collaboration object. The document trusted collaboration software / plug-in calls the trusted root capability, generates a security mechanism for the document according to the selected method, and finally completes the generation of the trusted collaboration document. When the recipient receives the trusted collaboration document, when opening the document, the device's document trusted collaboration software or the document trusted collaboration plug-in in the office software uses its own mechanism to call its own hardware trusted root to perform corresponding verification on the document. The verification allows the recipient's office software to open the file, and determines the document opening method as restricted editing or open editing through the document collaboration strategy, thereby ensuring the security of the document during transmission and collaboration.
[0063] In another embodiment of the present application, according to different types of document operation instructions, it is necessary to call the trusted root to perform different document operations on the target document, which are described separately here:
[0064] 1. If the document operation instruction is an encryption instruction, the encryption operation is performed on the target document through the trusted root of the sending device, and the encrypted target document is used as the operation result;
[0065] Correspondingly, after the receiving device receives the operation result, if the operation result includes an encrypted target document, after receiving the target document opening instruction, the trusted root of the receiving device is called to perform a decryption operation on the encrypted target document; if the decryption is successful, the target document is allowed to be opened; wherein, the trusted root of the receiving device and the trusted root of the sending device perform encryption and decryption operations through the same password management system.
[0066] It should be noted that regardless of whether the document trusted collaboration module is a document trusted collaboration software embedded in the device operating system or a document trusted collaboration plug-in embedded in the office software, the document operation process performed in this application is the same. In this example, only the method of embedding the document trusted collaboration software in the operating system is described as an example.
[0067] See also Figure 4 , is an encryption flow chart of the document trusted collaboration software provided in the embodiment of the present application. The document trusted collaboration software provides a document import interface to the document editor. After the document import is completed, the document trusted collaboration software provides the document editor with a security mode option. After the document editor selects the document encryption option, the document trusted collaboration software calls the encryption and decryption function of the trusted root, and the trusted root calls the trusted cryptographic module to encrypt the document. After encryption, the encrypted document is returned. The encrypted document is the operation result. The document editor sends the operation result to the collaborator's receiving terminal through the sending terminal.
[0068] See also Figure 5 , which is a decryption flow chart of the document trusted collaboration software provided in the embodiment of the present application. The collaborating personnel obtain the encrypted document in the operation result through the receiving terminal. When opening the document, the office software sends a decryption command to the document trusted collaboration software, requesting the document trusted collaboration software to decrypt the encrypted document. The document trusted collaboration software sends a decryption command to the trusted root, and the trusted root obtains the encrypted document according to the decryption command. The trusted root calls the trusted cryptographic module through the encryption and decryption function to decrypt the encrypted document. If the decryption is successful, the document is confirmed to be a trusted document. The document trusted collaboration software returns the decrypted document to the office software, allowing the document to be opened; if the decryption fails, the document is considered to be an untrusted document, and the information that it cannot be decrypted is returned. The document trusted collaboration software returns an error message to the office software. At this time, the document cannot be opened, and an alarm message is generated to prompt the collaborating personnel.
[0069] 2. If the document operation instruction is an integrity value generation instruction, the integrity of the target document is measured through the trusted root of the sending device to generate an integrity value, and the operation result is generated according to the target document and the integrity value.
[0070] Correspondingly, after the receiving device receives the operation result, if the operation result includes the target document and the integrity value, the trusted root of the receiving device is called to store the integrity value in the benchmark library; if the target document opening instruction is received, the trusted root of the receiving device is called to perform integrity measurement on the target document to generate a measurement value, and determine whether the measurement value of the target document is the same as the integrity value of the benchmark library. If they are the same, the target document is allowed to be opened.
[0071] See also Figure 6 , which is a flow chart of integrity generation of the document trusted collaboration software provided in the embodiment of the present application. The document trusted collaboration software provides a document import interface to the document editor. After the document import is completed, the document trusted collaboration software provides the document editor with a protection mode option. After the document editor selects document integrity verification, the document trusted collaboration software sends a document integrity generation command and a document address to the trusted root. The trusted root obtains the document according to the document address, and generates an integrity value for the document through the computing power provided by the trusted cryptographic module, and returns it to the document trusted collaboration software. The document trusted collaboration software obtains the returned document integrity value and packages it with the document. The document editor exports a compressed package containing the document and the integrity value, and sends the compressed package to the receiving terminal of the collaborator through the sending terminal.
[0072] See also Figure 7 , is a schematic diagram of the integrity value storage process provided by the embodiment of the present application. After receiving the document compression package through the receiving terminal, the collaborative personnel decompress it. The document trusted collaboration software recognizes the decompression action and sends the decompressed integrity value file to the trusted root. After the trusted root parses the integrity value file, it stores the parsed integrity value in the document reference library. Figure 8 , is the integrity verification flow chart provided in the embodiment of the present application. When a collaborator opens a document, the office software sends a verification command to the document trusted collaboration software, requesting the document trusted collaboration software to verify the integrity of the file. The document trusted collaboration software obtains the document address and document information and sends them to the trusted root. The trusted root receives the integrity verification command, obtains the corresponding document according to the document address and document information, and measures the document through the integrity function to generate a measurement value; the trusted root queries the document reference value in the reference library according to the document unique value, and the document reference value is the integrity value stored in the reference library; compares the document reference value with the measurement value to see if they are the same. If the comparison is successful, the document is confirmed to be a trusted document, and feedback is given to the document trusted collaboration software to allow the office software to open it; if the comparison is unsuccessful, the document is considered to be an untrusted document, and feedback is given to the document trusted collaboration software, and the office software is not allowed to open the document, and an alarm message is generated to prompt the collaborator.
[0073] 3. If the document operation instruction is a collaboration policy generation instruction, the collaboration policy is generated through the trusted root of the sending device, and the operation result is generated according to the target document and the collaboration policy; wherein the collaboration policy includes: at least one of subject information, object information, operation information and environment information.
[0074] Correspondingly, after the receiving device receives the operation result, if the operation result includes the target document and the collaboration policy, the trusted root of the receiving device is called to store the collaboration policy; if an instruction to open the target document is received, the information to be verified is obtained, and the trusted root of the receiving device is called to determine whether the information to be verified complies with the collaboration policy; if it complies, the target document is allowed to be opened.
[0075] See also Fig. 9 , is a schematic diagram of the document collaboration strategy generation process provided in the embodiment of the present application. The document trusted collaboration software in the present application provides the document editor with the ability to write collaboration strategies, which is mainly based on the trusted strategy implementation of the trusted root, and provides a set of simple collaboration strategy writing methods based on the trusted strategy quadruple for the document. After uploading the document to the document trusted collaboration software, the document editor selects the collaboration strategy guarantee method to start the collaboration strategy editor in the document trusted collaboration software. The collaboration strategy editor provides the document editor with four document definition methods: subject, object, operation, and environment. The document editor can define the basic information of the document through the subject, define the information of the document collaborator through the object, define the operation of the collaborator on the document through the operation, such as read-only opening, editable opening, not allowed opening, etc., and define the requirements of the current device of the collaborator through the environment, such as the current device ip (Internet Protocol Address), the current device user name, etc. After the collaboration strategy is written, the trusted root encrypts the policy file and returns it to the document trusted collaboration software, and finally sends it to the collaborator after being packaged with the document.
[0076] The following is an example of a document collaboration policy after being parsed by a trusted root: Subject information includes: Document 1's unique ID (Identity document, unique code) is 996540, and its type is .docx; Object information includes: Collaborators are required to have device admin privileges and be named test1 or test2 or test3; Operation information includes: Collaboration policy verification is performed when the document is opened in editable form; Environment information includes: The current environment requires the device IP to be 1.1.1.1 or 1.1.1.2 or 1.1.1.3 or 1.1.1.4; When the collaborator name is test1 or test3, the document is allowed to be opened in read-only mode; When the collaborator name is test2, the document is allowed to be opened in editable mode; Other collaborators are prohibited from opening the document; When the device IP does not meet the requirements, the document is not allowed to be opened.
[0077] After the collaborator receives the document compression package through the receiving device, the document trusted collaboration software obtains the policy file in the compression package and passes it to the trusted root. The trusted root decrypts and parses and stores the policy. When the collaborator opens the document, the document trusted collaboration software determines whether the information to be verified complies with the collaboration policy. The information to be verified includes: device information, collaborator account information, etc. If the trusted root determines that the information to be verified complies with the collaboration policy, the collaborator is allowed to open the document through the corresponding opening method. If it does not comply with the policy, the person is prohibited from opening the document.
[0078] From the above, it can be seen that this application utilizes the trusted root encryption capability of trusted computing to encrypt documents through the cryptographic resources in the hardware. The document recipient can only decrypt the document through the trusted root under the same password management system to prevent the document from being maliciously stolen and opened. This application also utilizes the integrity measurement verification capability of trusted computing technology to generate the integrity value of the document. The document recipient can verify the integrity of the document when the document is opened and confirm whether the document has been tampered with through the trusted computing capability of the receiving device. This application can also utilize the policy formulation capability of trusted computing technology to add appropriate collaboration strategies to the document, carry the collaboration strategy during the document transmission process, obtain the recipient information when the document recipient opens the document, verify the recipient's document operation authority through the collaboration strategy, match the recipient with appropriate document operations, and prevent the document from being maliciously tampered with.
[0079] In another embodiment of the present application, a document operation method based on trusted computing is disclosed, which is applied to a document trusted collaboration module of a receiving device, including:
[0080] Receive the operation result sent by the sending device; call the trusted root of the receiving device to verify the operation result; if the verification is successful, allow the target document in the operation result to be opened.
[0081] Among them, the operation result is generated by the document operation method described in the above method embodiment; for example: the document trusted collaboration module of the sending device obtains the target document to be processed, and receives a document operation instruction for the target document; the document operation instruction includes: at least one of an encryption instruction, an integrity value generation instruction and a collaboration strategy generation instruction; according to the document operation instruction, the trusted root of the sending device is called to perform a corresponding document operation on the target document to generate an operation result; the operation result includes the target document.
[0082] In another embodiment of the present application, the trusted root of the calling receiving device verifies the operation result, and if the verification is successful, allows the target document in the operation result to be opened, including:
[0083] If the operation result includes an encrypted target document, after receiving the target document opening instruction, calling the trusted root of the receiving device to perform a decryption operation on the encrypted target document;
[0084] If the decryption is successful, the target document is allowed to be opened; wherein, the trusted root of the receiving device and the trusted root of the sending device perform encryption and decryption operations through the same password management system.
[0085] In another embodiment of the present application, the trusted root of the calling receiving device verifies the operation result, and if the verification is successful, allows the target document in the operation result to be opened, including:
[0086] If the operation result includes the target document and the integrity value, calling the trusted root of the receiving device and storing the integrity value in the reference library;
[0087] If a target document opening instruction is received, the trusted root of the receiving device is called to perform integrity measurement on the target document to generate a measurement value, and it is determined whether the measurement value of the target document is the same as the integrity value of the benchmark library. If they are the same, the target document is allowed to be opened.
[0088] In another embodiment of the present application, the trusted root of the calling receiving device verifies the operation result, and if the verification is successful, allows the target document in the operation result to be opened, including:
[0089] If the operation result includes the target document and the collaboration policy, calling the trusted root storage collaboration policy of the receiving device;
[0090] If a target document opening instruction is received, the information to be verified is obtained, and the trusted root of the receiving device is called to determine whether the information to be verified complies with the collaboration policy; if it complies, the target document is allowed to be opened.
[0091] It should be noted that the specific execution process of the document operation method described in this embodiment can refer to the document operation method described in the above embodiment and will not be repeated here.
[0092] See also Fig.10 , Fig.10 A schematic diagram of the structure of a document operation device based on trusted computing provided in an embodiment of the present application, the device is applied to a document trusted collaboration module of a sending device, and the device specifically includes:
[0093] An acquisition module 11 is used to acquire a target document to be processed;
[0094] A first receiving module 12 is used to receive a document operation instruction for the target document; the document operation instruction includes: at least one of an encryption instruction, an integrity value generation instruction, and a collaboration strategy generation instruction;
[0095] An operation module 13 is used to call the trusted root of the sending device to perform a corresponding document operation on the target document according to the document operation instruction to generate an operation result; the operation result includes the target document;
[0096] The sending module 14 is used to send the operation result to the receiving device so that the receiving device can verify the operation result by using the document trusted collaboration module and the trusted root.
[0097] As an optional embodiment, the operated modules include:
[0098] The first operating unit is used to perform an encryption operation on the target document through the trusted root of the sending device if the document operation instruction is an encryption instruction, and use the encrypted target document as the operation result.
[0099] As an optional embodiment, the operated modules include:
[0100] The second operating unit is used to measure the integrity of the target document through the trusted root of the sending device to generate an integrity value if the document operation instruction is an integrity value generation instruction, and generate an operation result according to the target document and the integrity value.
[0101] As an optional embodiment, the operated modules include:
[0102] The third operation unit is used to generate a collaboration policy through the trusted root of the sending device if the document operation instruction is a collaboration policy generation instruction, and generate an operation result according to the target document and the collaboration policy; wherein the collaboration policy includes: at least one of subject information, object information, operation information and environment information.
[0103] In another embodiment of the present application, a document operation device based on trusted computing is disclosed, and the device is applied to a document trusted collaboration module of a receiving device, including:
[0104] A second receiving module is used to receive an operation result sent by a sending device; wherein the operation result is generated by the document operation method applied to the sending device;
[0105] The verification module is used to call the trusted root of the receiving device to verify the operation result. If the verification is successful, the target document in the operation result is allowed to be opened.
[0106] As an optional embodiment, the verification module includes:
[0107] The first verification unit is used to call the trusted root of the receiving device to perform a decryption operation on the encrypted target document after receiving the target document opening instruction if the operation result includes an encrypted target document; if the decryption is successful, the target document is allowed to be opened; wherein the trusted root of the receiving device and the trusted root of the sending device perform encryption and decryption operations through the same password management system.
[0108] As an optional embodiment, the verification module includes:
[0109] The second verification unit is used to call the trusted root of the receiving device to store the integrity value in the benchmark library if the operation result includes the target document and the integrity value; if a target document opening instruction is received, call the trusted root of the receiving device to perform integrity measurement on the target document to generate a measurement value, and determine whether the measurement value of the target document is the same as the integrity value of the benchmark library. If they are the same, the target document is allowed to be opened.
[0110] As an optional embodiment, the verification module includes:
[0111] The third verification unit is used to call the trusted root of the receiving device to store the collaboration policy if the operation result includes the target document and the collaboration policy; if a target document opening instruction is received, obtain the information to be verified and call the trusted root of the receiving device to determine whether the information to be verified complies with the collaboration policy; if it complies, allow the target document to be opened.
[0112] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.
[0113] See also Fig.11 , Fig.11 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, the electronic device specifically includes:
[0114] The processor 21, the memory 22 and the computer program stored in the memory 22 and executable on the processor 21, the processor 21 executes the steps of the document operation method described in any of the above method embodiments through the computer program.
[0115] Among them, if the electronic device is a sending device, the steps of the document operation method applied to the sending device in the above embodiment are executed; if the electronic device is a receiving device, the steps of the document operation method applied to the receiving device in the above embodiment are executed.
[0116] The processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.
[0117] The memory 22 may include one or more computer-readable storage media, which may be non-transitory. The memory 22 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 22 is at least used to store the following computer program 221, wherein, after the computer program is loaded and executed by the processor 21, it can implement the relevant steps in the document operation method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 22 may also include an operating system 222 and data 223, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 222 may include Windows, Unix, Linux, etc.
[0118] In some embodiments, the electronic device may further include a display screen 23 , an input / output interface 24 , a communication interface 25 , a sensor 26 , a power source 27 , and a communication bus 28 .
[0119] certainly, Fig.11 The structure of the electronic device shown does not constitute a limitation on the electronic device in the embodiments of the present application. In actual applications, the electronic device may include Fig.11 More or fewer components than shown, or combinations of certain components.
[0120] In another exemplary embodiment, a computer storage medium is also provided, and when the program instructions are executed by a processor, the steps of the document operation method described in any of the above method embodiments are implemented. The storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.
[0121] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, and this embodiment will not be described in detail here.
[0122] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.
[0123] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.
Claims
1. A document operation method based on trusted computing, characterized in that: A document trusted collaboration module applied to a sending device, wherein the document operation method comprises: Get the target document to be processed; Receiving a document operation instruction for the target document; the document operation instruction comprises: at least one of an encryption instruction, an integrity value generation instruction, and a collaboration strategy generation instruction; According to the document operation instruction, calling the trusted root of the sending device to perform the corresponding document operation on the target document to generate an operation result; the operation result includes the target document; The operation result is sent to a receiving device so that the receiving device can verify the operation result using a document trusted collaboration module and a trusted root.
2. The document operation method according to claim 1, characterized in that: The step of calling the trusted root of the sending device to perform a corresponding document operation on the target document to generate an operation result according to the document operation instruction includes: If the document operation instruction is an encryption instruction, an encryption operation is performed on the target document through the trusted root of the sending device, and the encrypted target document is used as the operation result.
3. The document operation method according to claim 1, characterized in that: The step of calling the trusted root of the sending device to perform a corresponding document operation on the target document to generate an operation result according to the document operation instruction includes: If the document operation instruction is an integrity value generation instruction, the integrity of the target document is measured through the trusted root of the sending device to generate an integrity value, and an operation result is generated according to the target document and the integrity value.
4. The document operation method according to claim 1, characterized in that: The step of calling the trusted root of the sending device to perform a corresponding document operation on the target document to generate an operation result according to the document operation instruction includes: If the document operation instruction is a collaboration policy generation instruction, a collaboration policy is generated through the trusted root of the sending device, and an operation result is generated according to the target document and the collaboration policy; wherein the collaboration policy includes: at least one of subject information, object information, operation information and environment information.
5. A document operation method based on trusted computing, characterized in that: A document trusted collaboration module applied to a receiving device, wherein the document operation method comprises: Receiving an operation result sent by a sending device; wherein the operation result is generated by the document operation method of any one of claims 1 to 4 above; Invoking a trusted root of a receiving device to verify the operation result; If the verification is successful, the target document in the operation result is allowed to be opened.
6. The document operation method according to claim 5, characterized in that: The calling receiving device's trusted root verifies the operation result, and if the verification is successful, allows the target document in the operation result to be opened, including: If the operation result includes an encrypted target document, after receiving the target document opening instruction, calling the trusted root of the receiving device to perform a decryption operation on the encrypted target document; If the decryption is successful, the target document is allowed to be opened; wherein, the trusted root of the receiving device and the trusted root of the sending device perform encryption and decryption operations through the same password management system.
7. The document operation method according to claim 5, characterized in that: The calling receiving device's trusted root verifies the operation result, and if the verification is successful, allows the target document in the operation result to be opened, including: If the operation result includes the target document and the integrity value, calling the trusted root of the receiving device and storing the integrity value in the reference library; If a target document opening instruction is received, the trusted root of the receiving device is called to perform integrity measurement on the target document to generate a measurement value, and it is determined whether the measurement value of the target document is the same as the integrity value of the benchmark library. If they are the same, the target document is allowed to be opened.
8. The document operation method according to claim 5, characterized in that: The calling receiving device's trusted root verifies the operation result, and if the verification is successful, allows the target document in the operation result to be opened, including: If the operation result includes the target document and the collaboration policy, calling the trusted root storage collaboration policy of the receiving device; If a target document opening instruction is received, the information to be verified is obtained, and the trusted root of the receiving device is called to determine whether the information to be verified complies with the collaboration policy; if it complies, the target document is allowed to be opened.
9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of the document operation method described in any one of claims 1 to 7 of the present application through the computer program.
10. A computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the steps of the document operation method described in any one of claims 1 to 7 of the present application.