Safety management system and method for electronic archives

Abstract

The invention relates to the technical field of archive security management, and discloses a security management system and method for electronic archives, and the system comprises an electronic archive encryption unit, an electronic archive storage library, a user database, an access authority management unit, a Hash operation unit, a Hash database, and a data verification unit. Electronic archives are classified according to important level characteristics, and asymmetric encryption and XOR encryption algorithms are respectively adopted, so that archive information can be protected in a targeted manner, and sensitive contents are prevented from being leaked; in the aspect of access authority management, by means of a user database and an authority management unit, the authorities of reading, writing, downloading and the like of different users on confidential files and common files are accurately controlled, and illegal access and tampering are avoided; and on the aspect of data integrity guarantee, the Hash operation unit and the data verification unit are utilized to compare Hash values during storage and access, so that whether the data are tampered or not can be timely perceived and recovered as required, and the integrity and accuracy of the archive data are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of file security management, and particularly relates to a security management system and method for electronic files. Background Art

[0002] In today's digital age, all industries are increasingly relying on electronic files. However, while this digital storage and dissemination method brings convenience, it also raises many serious security issues.

[0003] On the one hand, electronic files are extremely vulnerable to illegal access and theft. In an open network environment, hacking techniques are becoming increasingly rampant. They use various advanced tools and means to try to break through the information protection barriers of enterprises and institutions to obtain high-value electronic file information, such as trade secrets, customer privacy data, classified government documents, etc. Once leaked, it will cause huge economic losses, reputation damage to relevant units, and even may endanger national security. For example, in recent years, frequent enterprise data leakage incidents have led to the sale of a large amount of user information on the dark web, which not only makes enterprises face huge fines but also seriously affects users' trust in enterprises.

[0004] On the other hand, there is a risk of electronic files being tampered with. Due to the easy modifiability of electronic data, malicious or accidental operational mistakes by internal personnel, and deliberate modification of file content by external attackers to achieve purposes such as misleading decision-making and disrupting business processes, the authenticity and integrity of electronic files may be threatened. In some key business scenarios, such as scientific research experiment data and legal contract documents, minor changes to file data may lead to catastrophic consequences, resulting in invalid scientific research results, legal disputes, and other problems.

[0005] In summary, in the face of increasingly complex information security threats and many drawbacks of the existing electronic file management mode, there is an urgent need for a new and comprehensive electronic file security management system and method that can effectively ensure the secure storage, access, and use of electronic files from multiple aspects such as encryption protection, precise access permission control, and data integrity verification. Summary of the Invention

[0006] The purpose of the present invention is to provide a security management system and method for electronic files, which solves the technical problems proposed in the background art.

[0007] The purpose of the present invention can be achieved by the following technical solutions:

[0008] A security management system for electronic files, comprising:

[0009] An electronic file encryption unit, used to encrypt electronic files and then store the electronic files in an electronic file repository;

[0010] An electronic file repository for storing all encrypted electronic files;

[0011] A user database for storing pre-entered user information, which includes the login username and password of the corresponding user, as well as the access permissions corresponding to the relevant user;

[0012] An access permission management unit for identifying the user when the user accesses the electronic file, then obtaining the user information, and determining the user's access permission according to the user information;

[0013] A hash operation unit for calculating the hash value of each electronic file through the SHA-256 hash algorithm when the encrypted electronic file is stored, obtaining the hash value of each electronic file, and then storing the hash value of each electronic file in the hash database;

[0014] A hash database for storing the hash values of each encrypted electronic file;

[0015] A data verification unit for calculating the hash value of the accessed electronic file through the hash operation unit when the relevant user accesses the electronic file, obtaining the hash value of the accessed electronic file, then comparing the hash value of the accessed electronic file with the hash value of the corresponding electronic file in the hash database, and determining whether the data of the accessed electronic file has been tampered with according to the comparison result. If the electronic file data has been tampered with, a tampering alarm message will be sent to the relevant administrator.

[0016] As a further solution of the present invention: The encryption processing method is as follows:

[0017] The first step, data acquisition:

[0018] Obtain the electronic file data to be processed from the electronic file repository;

[0019] The second step, data classification:

[0020] Classify the electronic files according to the pre-obtained importance level features to divide the electronic files into confidential files and ordinary files;

[0021] The third step, key generation:

[0022] For confidential files:

[0023] Generate a public key and a private key using an asymmetric encryption algorithm;

[0024] Among them, the public key generation method is:

[0025] Select two prime numbers and label them as p and q for calculation;

[0026] Subsequently, an integer e that is relatively prime to (p - 1)×(q - 1) is selected as the public key exponent;

[0027] Among them, the value range of the integer e is within [2, (p - 1)×(q - 1) - 1];

[0028] Then, through n = p×q, calculate the product of p and q;

[0029] Subsequently, form the public key P = (e, n) through n and e;

[0030] Next, through d×e ≡ 1 [mod (p - 1)×(q - 1)]

[0031] Among them, ≡ represents the symbol of congruence;

[0032] Subsequently, form the private key S = (d, n) through n and d;

[0033] For ordinary files:

[0034] Generate an XOR encryption key through a pre - set random number generator;

[0035] Among them, the random number generator uses the RAND_bytes function in the OpenSSL library, and the key length is 128 bits;

[0036] Fourth step, data encryption:

[0037] StepK1. For confidential files, encrypt them using the public key;

[0038] Extract the original data corresponding to the confidential file and mark it as M1;

[0039] Subsequently, through E1 i = M1 e (mod n), calculate the encrypted confidential file E1 i ;

[0040] StepK2. For ordinary files, encrypt them using the XOR encryption algorithm;

[0041] Take the XOR encryption key as K;

[0042] Extract the original data corresponding to the ordinary file and mark it as M2;

[0043] Subsequently, through E2 i = M2 ⊕ K, calculate the encrypted ordinary file E2 i , where ⊕ represents the XOR operation.

[0044] As a further solution of the present invention: Among them, the important level features include:

[0045] Sensitivity level of file content: It reflects the sensitive situation corresponding to the confidentiality and privacy of the information contained in the electronic file, and is marked as Z1, and its value range is from 0 to 10; among them, the higher the value, the more sensitive the electronic file;

[0046] When the value of Z1 is between 0 and 3, it is a low sensitivity level; when the value of Z1 is between 4 and 7, it is a medium sensitivity level; when the value of Z1 is between 8 and 10, it is a high sensitivity level;

[0047] The value of the sensitivity level of file content is a predetermined value;

[0048] Business relevance: It reflects the degree of closeness of the association between the file and the core business process, and is marked as Z2, and its value range is from 0 to 10; among them, the higher the value, the closer the association;

[0049] When the value of Z2 is between 0 and 3, it is a low business relevance; when the value of Z2 is between 4 and 7, it is a medium business relevance; when the value of Z2 is between 8 and 10, it is a high business relevance;

[0050] Usage frequency: It counts the number of times the file is accessed and used within a certain time period, and is marked as Z3, and its value range is from 0 to 10;

[0051] When the value of Z3 is between 0 and 3, it is a low usage frequency; when the value of Z3 is between 4 and 7, it is a medium usage frequency; when the value of Z3 is between 8 and 10, it is a high usage frequency;

[0052] Among them, Z1, Z2, and Z3 are all preset values;

[0053] As a further solution of the present invention: The method for obtaining the important level feature is as follows:

[0054] Z0 = (Z1 + Z2 + Z3) / 3;

[0055] In the formula, Z0 represents the important level feature value of the electronic file;

[0056] As a further solution of the present invention: The category division method is as follows:

[0057] At the same time, each electronic file in the electronic file data is marked as E i , i = 1, 2,... m, where m represents the number of electronic files;

[0058] Obtain the important level feature value of the corresponding electronic file Ei, and denote it as Z0 i , and then compare it with the preset level feature threshold ZY:

[0059] If Z0 i > ZY, then the corresponding electronic file is classified as a confidential document;

[0060] If Z0 i ≤ZY, the corresponding electronic file is classified as a general file.

[0061] As a further solution of the present invention: Among them, different users have different access rights. The access rights refer to the execution operations of relevant users on electronic documents. The execution operations include the reading right, writing right, and downloading right of confidential files, which are respectively marked as: D01, X01, Z01, and the reading right, writing right, and downloading right of general files, which are respectively marked as: D02, X02, Z02;

[0062] When allowing relevant users to read confidential files, D01 = 1;

[0063] When not allowing relevant users to read confidential files, D01 = 0;

[0064] When allowing relevant users to rewrite confidential files, X01 = 1;

[0065] When not allowing relevant users to rewrite confidential files, X01 = 0;

[0066] When allowing relevant users to download confidential files, Z01 = 1;

[0067] When not allowing relevant users to download confidential files, Z01 = 0;

[0068] When allowing relevant users to read general files, D02 = 1;

[0069] When not allowing relevant users to read general files, D02 = 0;

[0070] When allowing relevant users to rewrite general files, X02 = 1;

[0071] When not allowing relevant users to rewrite general files, X02 = 0;

[0072] When allowing relevant users to download general files, Z02 = 1;

[0073] When not allowing relevant users to download general files, Z02 = 0.

[0074] As a further solution of the present invention: The specific method of the access right management unit is as follows:

[0075] StepQ1. User identity identification:

[0076] When relevant users access electronic files, the relevant users input the user name and password;

[0077] The input username and password are then compared with the login username and login password of the user information stored in the user database in advance:

[0078] The comparison method is as follows:

[0079] Traverse all user information in the user database;

[0080] When the username and password entered by the relevant user are the same as the login username and login password of a user information in the user database, it is determined that the user identity recognition is successful, and then the access permission of the user is extracted from the user information;

[0081] When the username and password entered by the relevant user are different from the login username and login password of a user information in the user database, it is determined that the user identity recognition fails, and then a deny access signal is generated, and at the same time, the corresponding access permission cannot be extracted from the user information;

[0082] StepQ2, Permission verification:

[0083] When the user identity recognition is successful, the access permission of the user is extracted from the user information, and according to the D01 value and D02 value in the access permission, the encrypted electronic files that meet the requirements are screened out from the electronic file repository;

[0084] As a further solution of the present invention: Among them:

[0085] When in the access permission of the relevant user: D01 = 1, D02 = 1, it means that all encrypted electronic files in the electronic file repository meet the requirements;

[0086] When in the access permission of the relevant user: D01 = 0, D02 = 1, it means that the encrypted confidential files in the electronic file repository do not meet the requirements, and the encrypted ordinary files meet the requirements;

[0087] When in the access permission of the relevant user: D01 = 0, D02 = 0, it means that all encrypted electronic files in the electronic file repository do not meet the requirements;

[0088] At the same time, according to the X01 value and X02 value in the access permission, for the screened encrypted electronic files, determine whether the write function of the relevant encrypted electronic files is enabled;

[0089] When in the access permission of the relevant user: X01 = 1, X02 = 1, it means that the user can rewrite all encrypted electronic files in the electronic file repository;

[0090] When in the access rights of the relevant user: X01 = 0, X02 = 1, it means that the user cannot rewrite the encrypted confidential files in the electronic file repository, and the user cannot rewrite the encrypted ordinary files in the electronic file repository;

[0091] When in the access rights of the relevant user: X01 = 0, X02 = 0, it means that the user cannot rewrite all the encrypted electronic files in the electronic file repository;

[0092] At the same time, according to the Z01 value and Z02 value in the access rights, for the filtered encrypted electronic files, determine whether the download function of the relevant encrypted electronic files is enabled;

[0093] When in the access rights of the relevant user: Z01 = 1, Z02 = 1, it means that the user can download all the encrypted electronic files in the electronic file repository;

[0094] When in the access rights of the relevant user: Z01 = 0, Z02 = 1, it means that the user cannot download the encrypted confidential files in the electronic file repository, and the user cannot download the encrypted ordinary files in the electronic file repository;

[0095] When in the access rights of the relevant user: Z01 = 0, Z02 = 0, it means that the user cannot download all the encrypted electronic files in the electronic file repository.

[0096] As a further solution of the present invention: The comparison method in the data verification unit is as follows:

[0097] If H1 = H0, it means that the accessed electronic file data has not been tampered with;

[0098] If H1 ≠ H0, it means that the electronic file data has been tampered with and the data integrity has been damaged;

[0099] Among them, H1 represents the hash value of the accessed electronic file, and H0 represents the hash value of the corresponding electronic file in the hash database.

[0100] A security management method for electronic files, which is implemented by the security management system for electronic files described above. The method includes the following steps:

[0101] Step 1. Electronic file encryption:

[0102] Perform encryption processing on the electronic files, and then store the electronic files in the electronic file repository;

[0103] Step 2. Access rights management:

[0104] When a user accesses an electronic file, the user's identity is verified, and then user information is obtained from the user database. Based on the user information, the user's access rights are determined.

[0105] Step 3: Access data verification:

[0106] When a relevant user accesses an electronic file, a hash value of the accessed electronic file is calculated, and the hash value of the accessed electronic file is obtained. Then, the hash value of the accessed electronic file is compared with the hash value of the corresponding electronic file stored in the hash database, and based on the comparison result, it is determined whether the data of the accessed electronic file has been tampered with.

[0107] Advantages of the present invention:

[0108] In terms of data confidentiality of the present invention:

[0109] The present invention divides electronic files into confidential files and ordinary files according to the important level characteristics of the electronic files through an electronic file encryption unit, and respectively performs encryption processing using an asymmetric encryption algorithm and an exclusive-or encryption algorithm. This classification and encryption method can match corresponding encryption means according to the importance of the files, effectively protecting sensitive information in electronic files, such as commercial secrets, personal privacy, etc., greatly enhancing the confidentiality of electronic file data, and preventing data from being illegally obtained and interpreted by unauthorized third parties.

[0110] In terms of access right control of the present invention:

[0111] The present invention stores user information, including user names, passwords, and corresponding access rights, in a user database, and performs identity verification and access right verification through an access right management unit when a user accesses an electronic file. Different users are given different access rights, covering operation rights such as reading, writing, and downloading of confidential files and ordinary files, realizing refined control of user access behaviors, ensuring that only legitimate users with corresponding rights can perform specific operations, further guaranteeing the security of electronic file data, and avoiding improper access, tampering, or leakage of confidential information, especially applicable to complex usage scenarios with multiple users and multiple roles in enterprises, institutions, etc.

[0112] In terms of ensuring data integrity of the present invention:

[0113] The present invention calculates the hash value of an encrypted electronic file during storage and stores it in a hash database using a hash operation unit. When a relevant user accesses the electronic file, the data verification unit recalculates the hash value of the accessed electronic file and compares it with the stored hash value. In this way, it is possible to detect in a timely and accurate manner whether the electronic file data has been tampered with. Once it is found that the data integrity has been damaged and there is a backup, data recovery can be performed, effectively ensuring the integrity and accuracy of the electronic file data throughout the process from storage to access, and enhancing the reliability and credibility of the entire electronic file management system.

[0114] At the overall system level of the present invention:

[0115] The present invention integrates multiple functional modules such as electronic file encryption, access right management, and data verification, forming a relatively complete electronic file security management system. Each module cooperates with each other and works in coordination, which can not only comprehensively ensure the security of electronic files in all aspects such as storage, access, and use, but also improve the overall efficiency and standardization of electronic file management, meet the requirements of various application scenarios with high security requirements for electronic files, and help enterprises, organizations, etc. better manage and utilize electronic file resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0116] The present invention will be further described below with reference to the accompanying drawings.

[0117] Figure 1 is a system block diagram of a security management system for an electronic file according to the present invention.

[0118] Figure 2 is a schematic diagram of the module process of an electronic file encryption unit in a security management system for an electronic file according to the present invention.

[0119] Figure 3 is a schematic diagram of the module process of an access right management unit in a security management system for an electronic file according to the present invention.

[0120] Figure 4 is a schematic diagram of the process of a security management method for an electronic file according to the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0121] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0122] Embodiment 1

[0123] Please refer toFigure 1 , Figure 2 and Figure 3 As shown in ,

[0124] , the present invention is a security management system for electronic files, including:

[0124] An electronic file encryption unit, which is used to encrypt electronic files and then store the electronic files in an electronic file repository;

[0125] The encryption processing method is as follows:

[0126] The first step, data acquisition:

[0127] Obtain the electronic file data to be processed from the electronic file repository;

[0128] The second step, data classification:

[0129] Classify the electronic files according to the pre-obtained importance level characteristics, so as to divide the electronic files into confidential files and ordinary files;

[0130] Among them, the importance level characteristics include:

[0131] Sensitivity of file content: It reflects the sensitive situation corresponding to the confidentiality and privacy of the information contained in the electronic file, and marks it as Z1, and its value range is from 0 to 10; among them, the higher the value, the more sensitive the electronic file;

[0132] The value of the sensitivity of file content is a pre-determined value;

[0133] For example, files containing trade secrets and personal privacy data will have a higher value, while general public notice files will have a lower value;

[0134] Business relevance: It reflects the degree of closeness of the association between the file and the core business process, and marks it as Z2, and its value range is from 0 to 10; among them, the higher the value, the closer the association;

[0135] For example, files directly related to the company's core business decisions and key project executions have a high score in this item, while files related to some marginal and auxiliary affairs have a low score;

[0136] Usage frequency: Count the number of times the file is accessed and used within a certain time period, and mark it as Z3, and its value range is from 0 to 10;

[0137] For example, files that are frequently accessed and called by many people have a high usage frequency score, while files that are rarely used have a low score;

[0138] Among them, Z1, Z2, and Z3 are all preset values;

[0139] The method for obtaining the importance level characteristics is as follows:

[0140] Z0 = (Z1 + Z2 + Z3) / 3;

[0141] Wherein, Z0 represents the importance level characteristic value of the electronic file;

[0142] The classification method is as follows:

[0143] At the same time, each electronic file in the electronic file data is marked as E i , i = 1, 2,..., m, where m represents the number of electronic files;

[0144] Obtain the importance level characteristic value of the corresponding electronic file Ei and denote it as Z0 i , and then compare it with the preset level characteristic threshold ZY:

[0145] If Z0 i > ZY, then the corresponding electronic file is classified as a confidential document;

[0146] If Z0 i ≤ ZY, then the corresponding electronic file is classified as an ordinary document;

[0147] Step 3: Key generation:

[0148] For confidential documents:

[0149] An asymmetric encryption algorithm is used to generate a public key and a private key;

[0150] Among them, the public key generation method is:

[0151] Select two prime numbers and mark them as p and q for calculation;

[0152] Then select an integer e that is relatively prime to (p - 1)×(q - 1) as the public key exponent, where the value range of the integer e is within [2, (p - 1)×(q - 1) - 1];

[0153] Then calculate the product of p and q through n = p×q;

[0154] Then form the public key P = (e, n) through n and e;

[0155] Then through d×e ≡ 1[mod(p - 1)×(q - 1)]

[0156] Among them, ≡ represents the symbol of congruence;

[0157] Then form the private key S = (d, n) through n and d;

[0158] For ordinary documents:

[0159] Generate an XOR encryption key through a pre-set random number generator; among them, the random number generator uses the RAND_bytes function in the OpenSSL library to ensure that the generated random numbers have high-strength randomness, and the key length is 128 bits;

[0160] Step 4, Data Encryption:

[0161] StepK1, For confidential files, encrypt them using the public key;

[0162] Extract the original data corresponding to the confidential file and mark it as M1;

[0163] Then through E1 i = M1 e (mod n), calculate the encrypted confidential file E1 i ;

[0164] StepK2, For ordinary files, encrypt them using the XOR encryption algorithm;

[0165] Use the XOR encryption key as K;

[0166] Extract the original data corresponding to the ordinary file and mark it as M2;

[0167] Then through E2 i = M2 ⊕ K, calculate the encrypted ordinary file E2 i , where ⊕ represents the XOR operation;

[0168] In this embodiment, both the XOR encryption algorithm and the random number generator are prior arts, so no further elaboration will be made;

[0169] An electronic file repository for storing all encrypted electronic files.

[0170] In this embodiment, the electronic file encryption unit performs classified encryption processing on electronic files, distinguishes confidential files and ordinary files according to the important level characteristics of the files, and uses different encryption algorithms. Asymmetric encryption algorithm is used for confidential files, and XOR encryption algorithm is used for ordinary files, which can effectively guarantee the data security of electronic files with different importance levels, prevent unauthorized access to file contents, and protect sensitive information such as business secrets and personal privacy contained in the files; classify according to the important level characteristics of the files, and adopt different encryption methods for different categories, avoiding resource waste caused by uniformly adopting high-cost encryption methods for all files, making the encryption process more targeted and efficient, and helping to improve the operation efficiency of the entire electronic file management system.

[0171] Embodiment 2

[0172] Please refer to Figure 1 , Figure 2and Figure 3 As shown in Figure 3 , as the second embodiment of the present invention, in the specific implementation of the present application, compared with the first embodiment, the difference between the technical solution of this embodiment and that of the first embodiment is only that in this embodiment, it further includes:

[0173] A user database for storing pre-entered user information, where the user information includes the login username and password of the corresponding user, as well as the access permissions corresponding to the relevant user;

[0174] Among them, different users have different access permissions. The access permission refers to the execution operations of the relevant user on the electronic document. The execution operations include the read permission, write permission, and download permission for confidential files, which are respectively marked as: D01, X01, Z01, and the read permission, write permission, and download permission for ordinary files, which are respectively marked as: D02, X02, Z02;

[0175] When allowing the relevant user to read the confidential file, the value of the read permission D01 is recorded as 1 in the user information, that is, D01 = 1;

[0176] When not allowing the relevant user to read the confidential file, the value of the read permission D01 is recorded as 0 in the user information, that is, D01 = 0;

[0177] When allowing the relevant user to rewrite the confidential file, the value of the read permission X01 is recorded as 1 in the user information, that is, X01 = 1;

[0178] When not allowing the relevant user to rewrite the confidential file, the value of the read permission X01 is recorded as 0 in the user information, that is, X01 = 0;

[0179] When allowing the relevant user to download the confidential file, the value of the read permission Z01 is recorded as 1 in the user information, that is, Z01 = 1;

[0180] When not allowing the relevant user to download the confidential file, the value of the read permission Z01 is recorded as 0 in the user information, that is, Z01 = 0;

[0181] When allowing the relevant user to read the ordinary file, the value of the read permission D01 is recorded as 1 in the user information, that is, D02 = 1;

[0182] When not allowing the relevant user to read the ordinary file, the value of the read permission D01 is recorded as 0 in the user information, that is, D02 = 0;

[0183] When allowing the relevant user to rewrite the ordinary file, the value of the read permission X01 is recorded as 1 in the user information, that is, X02 = 1;

[0184] When not allowing the relevant user to rewrite the ordinary file, the value of the read permission X01 is recorded as 0 in the user information, that is, X02 = 0;

[0185] When allowing relevant users to download ordinary files, the value of the read permission Z01 is recorded as 1 in the user information, i.e., Z02 = 1;

[0186] When not allowing relevant users to download ordinary files, the value of the read permission Z01 is recorded as 0 in the user information, i.e., Z02 = 0.

[0187] An access permission management unit is used to identify the user's identity when the user accesses the electronic file, then obtain the user information, and determine the user's access permission according to the user information;

[0188] StepQ1. User identity identification:

[0189] When a relevant user accesses the electronic file, the relevant user inputs a username and a password;

[0190] Then, the input username and password are respectively compared with the login username and login password of the user information pre-stored in the user database:

[0191] The comparison method is as follows:

[0192] Traverse all user information in the user database;

[0193] When the username and password input by the relevant user are consistent with the login username and login password of a user information in the user database, it is determined that the user identity identification is successful, and then the access permission of the user is extracted from the user information;

[0194] When the username and password input by the relevant user are inconsistent with the login username and login password of a user information in the user database, it is determined that the user identity identification fails, then a reject access signal is generated, and at the same time, the corresponding access permission cannot be extracted from the user information;

[0195] StepQ2. Permission verification:

[0196] When the user identity identification is successful, then the access permission of the user is extracted from the user information, and according to the D01 value and D02 value in the access permission, encrypted electronic files that meet the requirements are screened out from the electronic file repository;

[0197] Among them:

[0198] When in the access permission of the relevant user: D01 = 1, D02 = 1, it means that all encrypted electronic files in the electronic file repository meet the requirements;

[0199] When in the access permission of the relevant user: D01 = 0, D02 = 1, it means that the encrypted confidential files in the electronic file repository do not meet the requirements, and the encrypted ordinary files meet the requirements;

[0200] In actual situations, in the access rights of relevant users, when a user can read confidential files, by default, the user can also read ordinary files;

[0201] When in the access rights of relevant users: D01 = 0 and D02 = 0, it means that all encrypted electronic files in the electronic file repository do not meet the requirements;

[0202] In actual situations, when all encrypted electronic files in the electronic file repository do not meet the requirements, it means that the user is a new user and has not yet been granted the right to read relevant electronic files;

[0203] At the same time, based on the X01 value and X02 value in the access rights, for the selected encrypted electronic files, determine whether the write function of the relevant encrypted electronic files is enabled;

[0204] When in the access rights of relevant users: X01 = 1 and X02 = 1, it means that the user can rewrite all encrypted electronic files in the electronic file repository;

[0205] When in the access rights of relevant users: X01 = 0 and X02 = 1, it means that the user cannot rewrite the encrypted confidential files in the electronic file repository, and the user cannot rewrite the encrypted ordinary files in the electronic file repository;

[0206] When in the access rights of relevant users: X01 = 0 and X02 = 0, it means that the user cannot rewrite all encrypted electronic files in the electronic file repository;

[0207] At the same time, based on the Z01 value and Z02 value in the access rights, for the selected encrypted electronic files, determine whether the download function of the relevant encrypted electronic files is enabled;

[0208] When in the access rights of relevant users: Z01 = 1 and Z02 = 1, it means that the user can download all encrypted electronic files in the electronic file repository;

[0209] When in the access rights of relevant users: Z01 = 0 and Z02 = 1, it means that the user cannot download the encrypted confidential files in the electronic file repository, and the user cannot download the encrypted ordinary files in the electronic file repository;

[0210] When in the access rights of relevant users: Z01 = 0 and Z02 = 0, it means that the user cannot download all encrypted electronic files in the electronic file repository;

[0211] In this embodiment, a user database and an access right management unit are added. It can strictly control operations on accessing electronic files, such as reading, writing, and downloading, according to the access rights preset for different users, ensuring that only users with corresponding permissions can perform corresponding operations, further enhancing the security of electronic file data and preventing confidential information from being improperly obtained or tampered with; it can flexibly allocate access rights according to the roles and needs of different users in the business process, meeting diverse usage scenarios within an enterprise or organization, and improving the applicability and practicality of the electronic file management system under a complex organizational structure.

[0212] Embodiment Three

[0213] Please refer to Figure 1 、 Figure 2 and Figure 3 As shown in, as Embodiment Three of the present invention, when this application is specifically implemented, compared with Embodiment One and Embodiment Two, the technical solution of this embodiment lies in combining and implementing the solutions of the above Embodiment One and Embodiment Two. The difference between the technical solution of this embodiment and Embodiment One and Embodiment Two is only that in this embodiment, it further includes:

[0214] A hash operation unit, used for calculating the hash value of each encrypted electronic file through the SHA-256 hash algorithm when the encrypted electronic file is stored, and obtaining the hash value of each electronic file, and then storing the hash value of each electronic file in the hash database;

[0215] A hash database, used for storing the hash values of each encrypted electronic file;

[0216] A data verification unit, used for calculating the hash value of the accessed electronic file through the hash operation unit when a relevant user accesses the electronic file, and obtaining the hash value of the accessed electronic file, and then comparing the hash value of the accessed electronic file with the hash value of the corresponding electronic file in the hash database:

[0217] If H1 = H0, it indicates that the data of the accessed electronic file has not been tampered with and the data integrity is guaranteed;

[0218] If H1 ≠ H0, it indicates that the electronic file data has been tampered with and the data integrity has been damaged, and then a tampering alarm message is sent to the relevant administrator;

[0219] Wherein, H1 represents the hash value of the accessed electronic file, and H0 represents the hash value of the corresponding electronic file in the hash database.

[0220] In this embodiment, a new hash operation unit and a hash database are added, and in cooperation with the data verification unit, hash value calculation and comparison are performed during the storage and access of electronic files, enabling timely detection of whether the file data has been tampered with. In the case where the data integrity is damaged and there is a backup, recovery can be carried out, effectively ensuring the integrity and accuracy of the data throughout the process from the storage to the access of the electronic files; it provides an additional data verification mechanism for the electronic file management system, enabling the system to quickly respond and take corresponding measures when facing possible data anomalies, enhancing the reliability of the entire system in terms of data security, and allowing users to use the electronic file system with more confidence.

[0221] Embodiment 4

[0222] Please refer to Figure 1 、 Figure 2 and Figure 3 As shown in, as Embodiment 4 of the present invention, in the specific implementation of this application, compared with Embodiment 1, Embodiment 2, and Embodiment 3, the technical solution of this embodiment is to combine and implement the solutions of the above-mentioned Embodiment 1, Embodiment 2, Embodiment 3, and Embodiment 4.

[0223] This embodiment combines and implements the solutions of the previous Embodiment 1, Embodiment 2, and Embodiment 3, integrating multiple security measures such as file encryption, access permission management, and data integrity verification, and constructing a relatively comprehensive and multi-level electronic file security management system to comprehensively guarantee the security, integrity, and compliance of electronic files in various links such as storage, access, and use, and can better meet the requirements of various application scenarios with high security requirements for electronic files.

[0224] Please refer to Figure 4 As shown in, the present invention also proposes a security management method for electronic files. This method is implemented through a security management system for electronic files, and this method includes the following steps:

[0225] Step 1: Electronic file encryption:

[0226] Perform encryption processing on the electronic file, and then store the electronic file in the electronic file repository;

[0227] Step 2: Access permission management:

[0228] When a user accesses an electronic file, identify the user's identity, then obtain the user information from the user database, and determine the user's access permission according to the user information;

[0229] Step 3: Access data verification:

[0230] When a relevant user accesses an electronic file, a hash value calculation is performed on the accessed electronic file to obtain the hash value of the accessed electronic file. Subsequently, the hash value of the accessed electronic file is compared with the hash value of the corresponding electronic file stored in the hash database. Based on the comparison result, it is determined whether the data of the accessed electronic file has been tampered with. If the electronic file data has been tampered with, a tampering alert message is sent to the relevant administrator.

[0231] All the above formulas are dimensionless and take their numerical calculations. The formula is obtained by collecting a large amount of data for software simulation to get a formula closest to the actual situation. The preset parameters and threshold selection in the formula are set by those skilled in the art according to the actual situation.

[0232] The above is only the specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present application can easily think of changes or substitutions, which should all be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claimed rights.

Claims

1. A security management system for electronic archives, characterized in that: include: An electronic file encryption unit, used to encrypt the electronic file and then store the electronic file in an electronic file storage library; Electronic archive repository, used to store all encrypted electronic archives; The user database is used to store pre-entered user information, which includes the corresponding user's login username, login password, and the corresponding access rights of the relevant user; The access rights management unit is used to identify the user when the user accesses the electronic archive, obtain the user information, and determine the user's access rights based on the user information; A hash operation unit, used for calculating the hash value of each electronic file by using the hash algorithm SHA-256 when the encrypted electronic file is stored, and obtaining the hash value of each electronic file, and then storing the hash value of each electronic file in the hash database; A hash database, used to store the hash value of each encrypted electronic file; The data verification unit is used to calculate the hash value of the accessed electronic file through the hash operation unit when the relevant user accesses the electronic file, and obtain the hash value of the accessed electronic file, then compare the hash value of the accessed electronic file with the hash value of the corresponding electronic file in the hash database, and determine whether the data of the accessed electronic file has been tampered with based on the comparison result.

2. The electronic archive security management system according to claim 1, characterized in that: The encryption process is as follows: Step 1: Data acquisition: Obtaining electronic archive data to be processed from the electronic archive repository; Step 2: Data classification: Classify the electronic files according to the important level characteristics obtained in advance, so as to classify the electronic files into confidential files and ordinary files; Step 3: Key generation: For confidential documents: Use asymmetric encryption algorithm to generate public and private keys; The public key is generated as follows: Choose two prime numbers and label them as p and q. Then choose an integer e that is relatively prime to (p-1)×(q-1) as the public key exponent; Then, by n = p × q, the product of p and q is calculated; Then, the public key P = (e, n) is formed by n and e; Then, through d×e≡1[mod(p-1)×(q-1)] Among them, ≡ represents the symbol of congruence; Then, the private key S = (d, n) is formed by n and d; For normal files: Generate an XOR encryption key through a preset random number generator; Step 4: Data encryption: StepK1. For confidential files, use the public key to encrypt; Extract the original data corresponding to the confidential file and mark it as M1; Then through E1 i =M1 e (mod n), calculate the encrypted confidential file E1 i ; StepK2, for ordinary files, use XOR encryption algorithm to encrypt; XOR the encryption key to K; Extract the original data corresponding to the common file and mark it as M2; Then through E2 i =M2⊕K, calculate the encrypted common file E2 i , where ⊕ represents the XOR operation.

3. The electronic archive security management system according to claim 2, characterized in that: in, Important grade features include: The sensitivity of the electronic archives’ content, business relevance, and frequency of use are marked as Z1, Z2, and Z3, respectively. Z1, Z2, and Z3 are preset values, and their value ranges are all from 0 to 10; The important level features are derived as follows: Z0=(Z1+Z2+Z3) / 3; In the formula, Z0 represents the important level characteristic value of the electronic archive.

4. The electronic archive security management system according to claim 3, characterized in that: The categories are divided as follows: At the same time, each electronic file in the electronic file data is marked as E i , i = 1, 2, ... m, m represents the number of electronic files; Get the important level characteristic value of the corresponding electronic archive Ei and record it as Z0 i , and then compare it with the preset level feature threshold ZY: If Z0 i >ZY, then the corresponding electronic files will be classified as confidential files; If Z0 i ≤ZY, the corresponding electronic files will be classified as ordinary files.

5. The electronic archive security management system according to claim 1, characterized in that: in, Different users have different access rights. Access rights refer to the operations that relevant users can perform on electronic documents. The operations include read permission, write permission, and download permission for confidential files, which are marked as D01, X01, and Z01, respectively, and read permission, write permission, and download permission for ordinary files, which are marked as D02, X02, and Z02, respectively. When the relevant user is allowed to read confidential files, D01 = 1; When the relevant user is not allowed to read confidential files, D01 = 0; When the relevant user is allowed to rewrite the confidential file, X01 = 1; When the relevant user is not allowed to rewrite the confidential file, X01 = 0; When the relevant user is allowed to download confidential files, Z01 = 1; When the relevant user is not allowed to download confidential files, Z01 = 0; When the relevant user is allowed to read ordinary files, D02 = 1; When the relevant user is not allowed to read ordinary files, D02 = 0; When the relevant user is allowed to rewrite the ordinary file, X02 = 1; When the relevant user is not allowed to rewrite ordinary files, X02 = 0; When the relevant user is allowed to download ordinary files, Z02 = 1; When the relevant user is not allowed to download ordinary files, Z02=0.

6. The electronic archive security management system according to claim 5, characterized in that: The specific method of the access permission management unit is as follows: StepQ1, User Identification: When the relevant user accesses the electronic archive, the relevant user enters the user name and password; Then the entered username and password are compared with the login username and login password of the user information pre-stored in the user database: The comparison is as follows: Traverse all user information in the user database; When the username and password entered by the relevant user are consistent with the login username and password of a user information in the user database, the user identity is determined to be successfully identified, and the user's access rights are then extracted from the user information; When the username and password entered by the relevant user are inconsistent with the login username and password of a user information in the user database, it is determined that the user identity recognition has failed, and then an access denial signal is generated, and the corresponding access rights cannot be extracted from the user information; StepQ2, Permission verification: When the user's identity is successfully identified, the user's access rights are extracted from the user information, and based on the D01 value and D02 value in the access rights, the encrypted electronic archives that meet the requirements are screened out from the electronic archive repository.

7. The electronic archive security management system according to claim 6, characterized in that: During the authority verification, the X01 value and the X02 value in the access permission are used to determine whether the write function of the relevant encrypted electronic files is enabled for the selected encrypted electronic files; At the same time, based on the Z01 value and Z02 value in the access permission, determine whether the download function of the selected encrypted electronic files is enabled.

8. The electronic archive security management system according to claim 7, characterized in that: in: When D01=1、D02=1 in the access rights of the relevant user, it means that all encrypted electronic archives in the electronic archive repository meet the requirements; When D01=0, D02=1 in the access rights of the relevant user, it means that the encrypted confidential files in the electronic archive repository do not meet the requirements, but the encrypted common files meet the requirements; When D01=0, D02=0 in the access rights of the relevant user, it means that all encrypted electronic archives in the electronic archive repository do not meet the requirements; When the access rights of the relevant user are: X01 = 1, X02 = 1, it means that the user can rewrite all encrypted electronic files in the electronic file repository; When the access rights of the relevant user are: X01 = 0, X02 = 1, it means that the user cannot rewrite the encrypted confidential files in the electronic archive repository, and the user cannot rewrite the encrypted common files in the electronic archive repository; When the access rights of the relevant user are: X01 = 0, X02 = 0, it means that the user cannot rewrite all encrypted electronic files in the electronic file repository; When the access rights of the relevant user are: Z01 = 1, Z02 = 1, it means that the user can download all encrypted electronic files in the electronic file repository; When the access rights of the relevant user are: Z01 = 0, Z02 = 1, it means that the user cannot download the encrypted confidential files in the electronic archive repository, and the user cannot download the encrypted common files in the electronic archive repository; When the access rights of the relevant user are: Z01=0, Z02=0, it means that the user cannot download all encrypted electronic files in the electronic file repository.

9. The electronic archive security management system according to claim 1, characterized in that: The comparison method in the data verification unit is as follows: If H1 = H0, it means that the accessed electronic archive data has not been tampered with; If H1≠H0, it means that the electronic file data has been tampered with; Among them, H1 represents the hash value of the accessed electronic file, and H0 represents the hash value of the corresponding electronic file in the hash database.

10. A method for the safe management of electronic files, characterized in that: The method is implemented by a security management system for electronic archives as described in any one of claims 1 to 9, and the method comprises the following steps: Step 1: Encrypt electronic files: Encrypting the electronic file and then storing the electronic file in the electronic file repository; Step 2: Access Rights Management: When a user accesses an electronic file, the user's identity is identified, and then the user information is obtained from the user database, and the user's access rights are determined based on the user information; Step 3: Access data verification: When the relevant user accesses the electronic file, the hash value of the accessed electronic file is calculated and the hash value of the accessed electronic file is obtained. The hash value of the accessed electronic file is then compared with the hash value of the corresponding electronic file stored in the hash database, and based on the comparison result, it is determined whether the data of the accessed electronic file has been tampered with.

Images