Data confidentiality method, device and medium based on permission sharing operation of encrypted PSSD

Abstract

The present invention discloses a data confidentiality method, device and medium based on the permission sharing operation of encrypted PSSD, which includes the following steps: 1) partitioning the PSSD into permission zones; 2) setting the characteristic attributes of the encryption zones; and setting an attribute structure L for each encryption zone. ij , within this structure, specify the user groups that can access the encryption zone and the corresponding minimum user permissions; 3) assign unlocking permissions to each user group; 3) upon receiving a user request to access the encryption zone, verify the user's access permissions; 4) if the user identity permission level currently performing the unlocking operation is greater than the encrypted disk partition permissions and the accessible user group matches, automatically unlock the disk space with matching permissions; otherwise, a verification failure message is sent and an error count is recorded for each verification failure. This method enables tiered data sharing and management between groups, enabling inter-group data reading and writing based on user permissions, and more flexible management of disk encryption space.

Description

Technical Field

[0001] The present invention relates to data security technology, and in particular to a data confidentiality method, device and medium based on a permission sharing operation of an encrypted PSSD. Background Art

[0002] In the portable solid state drive (PSSD) market, data hard drives currently on the market typically have only two partitions: a data area and a CD ROM area. The CD ROM area is a fixed-size, read-only area used to store manufacturer software and manuals. The data area can be used to store user data and can be partitioned by the operating system into multiple system drive letters. Users can categorize their data and store it in different logical partitions based on their preferences.

[0003] In order to prevent the risk of data leakage, R&D personnel of mobile PSSD manufacturers will add various physical unlocking verifications to the original SSD. For example, they can complete authentication and unlock disk space through fingerprints, digital passwords, NFC, Bluetooth, etc., or they can encrypt the transmitted data through full algorithm encryption such as AES-256 data encryption, SM4 algorithm encryption, etc. Some manufacturers will combine the two to make it more secure, and even introduce hardware encryption to make the overall encrypted PSSD more secure.

[0004] A PSSD encrypted with the above security solution can effectively protect the data on the disk. Without key authentication, it cannot be read even after a hardware replacement. However, a PSSD encrypted in this way is often not suitable for multiple people or team use. The reason is that once the key is obtained, all data on this type of encrypted mobile hard drive can be read, regardless of whether the unlocking person has permission to operate the relevant content.

[0005] Therefore, if a team shares a single encrypted PSSD, there is a risk that sensitive data could be leaked by unauthorized individuals. If multiple encrypted PSSDs are used, the shared data, due to the large number of people responsible for authentication and decryption, could affect the efficiency of the entire system. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to provide a data confidentiality method, device and medium based on the permission sharing operation of encrypted PSSD in response to the defects in the existing technology.

[0007] The technical solution adopted by the present invention to solve the technical problem is: a data confidentiality method based on the permission sharing operation of encrypted PSSD, comprising the following steps:

[0008] 1) Partition the PSSD into permission zones, including a CD ROM zone, a shared non-encrypted zone, and multiple encrypted zones;

[0009] The permissions for each partition are as follows: For the CD ROM area and the shared non-encrypted area, every user can directly access it, while the encrypted area requires verification of permissions. The CD ROM area is set to read-only, the shared non-encrypted area is set to read and write, and the encrypted area is set to read and write after the user passes the verification.

[0010] 2) Set the characteristic attributes of the encrypted area;

[0011] For each encryption area, there is an attribute structure L ij , the user groups that can access the specified encryption area within the structure and the corresponding minimum user permissions;

[0012] 3) Assign unlocking permissions to each preset user group and set the authentication key permission level for each user. The authentication key permission level includes the user's group number, the user's member group number and the permission value;

[0013] 3) When receiving a user's request to access the encrypted area, verify the user's access rights;

[0014] 4) If the current user identity authorization level performing the unlocking is greater than the access permission of the encrypted area and the accessible user group matches, the disk space with matching permissions will be automatically unlocked, thereby enabling data to be read and written. Otherwise, a verification failure message will be sent and an error count will be recorded for each verification failure.

[0015] According to the above scheme, in step 2), L ij = (c,d), where:

[0016] c represents the user's group number;

[0017] d is composed of group c and the lowest read and write permission m in the group;

[0018] d = Encrypt( c||m)

[0019] Among them, || represents string concatenation; Encrypt represents the encryption function.

[0020] According to the above solution, when the current unlocking user's identity authority level is greater than the encrypted disk partition authority and the accessible user group matches, that is, Acess(G ij ,L ij )=1, indicating that the permission match is successful. The verification conditions are as follows:

[0021] 1) Group matching is successful: c = floor(a / 8), where floor is a floor function.

[0022] 2) Permission level check passed: j ≥ m, that is, Decrypt(b) ≥ Decrypt(d), where Decrypt is the decryption function corresponding to Encrypt.

[0023] According to the above solution, the authentication key permission level of each user is set in step 3), as follows:

[0024] The authentication key authority level assigned to each user is G ij ;

[0025] G ij = (a, b);

[0026] Among them, a represents the user's member number,

[0027] a = g*8+i; where g is the user's group ID and i is the member's ID within the group;

[0028] b is the permission value, which is generated based on the combination member number i and the assigned permission level j:

[0029] b=Encrypt( i||j||k);

[0030] Where k is a system key, || represents string concatenation, and Encrypt represents an encryption function.

[0031] According to the above scheme, each user in step 3) will be assigned a digital certificate or token T ij , T ij Contains the user's permission information and signature;

[0032] T ij = Sign ( G ij , v );

[0033] Among them, v is a multi-value field, which contains one or more verification information; the verification information includes: key, fingerprint ID, one-time password.

[0034] According to the above scheme, in step 2), d is composed of group c, the lowest read and write permission m in the group, and the combined verification identifier n;

[0035] d = Encrypt( c||m||n)

[0036] Among them, || represents string concatenation; Encrypt represents the encryption algorithm; n is a combination verification identifier, which is an 8-bit binary data used to mark whether the disk is in combination unlock mode and is used to communicate with the digital certificate or token T ij When n is marked as non-zero, the disk verification will match the token marked by n to see if it is verified. Only when all tokens pass can the disk be unlocked.

[0037] According to the above scheme, Access(G ij ,L ij )=1 indicates that the permission match is successful. The verification conditions are as follows:

[0038] 1) Group matching is successful: c = floor(a / 8), where floor is a floor function.

[0039] 2) Permission level check passed: j ≥ m, that is, Decrypt(b) ≥ Decrypt(d), where Decrypt is the decryption function corresponding to Encrypt;

[0040] 3) Token T corresponding to bit(n) ij Verification passed, bit is a binary bit 1 sequential function.

[0041] According to the above solution, in step 4), the error count of the current level verification authority is greater than the verification quantity threshold corresponding to the set authority level, and the L corresponding to the disk ij The level unlocking permission needs to be raised by 1 level, that is, the lowest read and write unlocking permission m=m+1, until the highest level permission;

[0042] When the number of verification errors for the highest level of permission exceeds the set threshold, all data on the disk will be automatically destroyed.

[0043] The present invention further provides an electronic device, comprising:

[0044] one or more processors;

[0045] as well as

[0046] a storage device for storing one or more programs,

[0047] When the one or more programs are executed by the one or more processors, the one or more processors execute the method described in any one of the above solutions.

[0048] The present invention also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method described in any one of the above solutions is implemented.

[0049] The beneficial effects produced by the present invention are:

[0050] 1. The present invention provides a method for sharing encrypted data among multiple members according to their permission levels, which can achieve step-by-step data sharing and management among groups, realize reading and writing of data among groups according to user permissions, and manage disk encryption space more flexibly;

[0051] 2. The present invention provides a disk unlocking method with combined verification, which makes the usage scenario more flexible and the verification method more secure. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The present invention will be further described below with reference to the accompanying drawings and embodiments, in which:

[0053] Figure 1 is a flow chart of a method according to an embodiment of the present invention;

[0054] Figure 2 is a flow chart of a permission matching method according to an embodiment of the present invention;

[0055] Figure 3 is a schematic diagram of token verification according to an embodiment of the present invention;

[0056] Figure 4 2 is a schematic diagram of the permission verification result of an embodiment of the present invention. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0058] Example 1:

[0059] like Figure 1 As shown, a data confidentiality method for permission sharing operation based on encrypted PSSD includes the following steps

[0060] 1) Partition the PSSD into permission zones, including a CD ROM zone, a shared non-encrypted zone, and multiple encrypted zones;

[0061] The permissions for each partition are as follows: For the CD ROM area and the shared non-encrypted area, every user can directly access it, while the encrypted area requires verification of permissions. The CD ROM area is set to read-only, the shared non-encrypted area is set to read and write, and the encrypted area is set to read and write after the user passes the verification.

[0062] 2) Set the characteristic attributes of the encrypted area;

[0063] For each encryption area, there is an attribute structure L ij, the user groups that can access the specified encryption area within the structure and the corresponding minimum user permissions;

[0064] L ij = (c,d), where:

[0065] c represents the user's group number;

[0066] d is composed of group c and the lowest read and write permission m in the group;

[0067] d = Encrypt( c||m)

[0068] Among them, || represents string concatenation; Encrypt represents encryption function;

[0069] 3) Assign unlocking permissions to each user group and enter identification information; each user group consists of multiple members grouped according to work needs;

[0070] Identification information includes the authentication key assigned to each user with a permission level of G ij ; and each user's identity authentication information, such as fingerprint information;

[0071] G ij =(a,b);

[0072] Where a represents the user's member number,

[0073] a = g*8+i; where g is the user's group ID and i is the member's ID within the group;

[0074] b is the permission value, which is generated by combining the member number i and the permission level j:

[0075] b=Encrypt( i||j||k);

[0076] Where k is a system key, || represents string concatenation, and Encrypt represents an encryption function.

[0077] 3) When receiving a user's request to access the encrypted area, verify the user's access rights;

[0078] Before authorization verification, user identity information verification can be performed first, such as fingerprint verification;

[0079] 4) If the current unlocking user's identity authority level is greater than the encrypted disk partition authority and the accessible user group matches, that is, Acess(G ij ,L ij )=1, automatically unlock the disk space with matching permissions, so that data can be read and written. Otherwise, a verification failure message will be sent and an error count will be recorded for each verification failure.

[0080] Access(G ij ,L ij )=1 indicates that the permission match is successful. The verification conditions are as follows:

[0081] 4.1) Group matching is successful: c = floor(a / 8), where floor is a floor function.

[0082] 4.2) Permission level check passed: j ≥ m, that is, Decrypt(b) ≥ Decrypt(d), where Decrypt is the decryption function corresponding to Encrypt.

[0083] The error count of the current level verification permission is greater than the verification threshold of the corresponding set permission level. The L corresponding to the disk ij The level of unlocking permissions needs to be raised by 1 level, that is, the lowest read and write unlocking permission m=m+1, until the highest level permission;

[0084] When the number of verification errors for the highest level of permission exceeds the set threshold, all data on the disk will be automatically destroyed.

[0085] Example 2:

[0086] like Figure 1 As shown, a data confidentiality method for permission sharing operation based on encrypted PSSD includes the following steps

[0087] 1) Partition the PSSD into permission zones, including a CD ROM zone, a shared non-encrypted zone, and multiple encrypted zones;

[0088] The permissions for each partition are as follows: For the CD ROM area and the shared non-encrypted area, every user can directly access it, while the encrypted area requires verification of permissions. The CD ROM area is set to read-only, the shared non-encrypted area is set to read and write, and the encrypted area is set to read and write after the user passes the verification.

[0089] 2) Set the characteristic attributes of the encrypted area;

[0090] For each encryption area, there is an attribute structure L ij , the user groups that can access the specified encryption area within the structure and the corresponding minimum user permissions;

[0091] L ij = (c,d), where:

[0092] c represents the user's group number;

[0093] d is composed of group c, the lowest read and write permission m in the group, and the combined verification identifier n;

[0094] d = Encrypt( c||m||n)

[0095] Among them, || represents string concatenation; Encrypt represents the encryption algorithm; n is a combination verification identifier, which is an 8-bit binary data used to mark whether the disk is in combination unlock mode and is used to communicate with the digital certificate or token T ij When n is marked as non-zero, the disk verification will match the token marked by n to see if it is verified. Only when all tokens pass can the disk be unlocked.

[0096] 3) Assign unlocking permissions to each group of users and enter identification information;

[0097] Identification information includes the authentication key assigned to each user with a permission level of G ij ; and each user's identity authentication information, such as fingerprint information;

[0098] G ij =(a,b);

[0099] Where a represents the user's member number,

[0100] a = g*8+i; where g is the user's group ID and i is the member's ID within the group;

[0101] b is the permission value, which is generated by combining the member number i and the permission level j:

[0102] b=Encrypt( i||j||k);

[0103] Where k is a system key, || represents string concatenation, and Encrypt represents an encryption function.

[0104] In this embodiment, each user is also assigned a digital certificate or token T before each access. ij , T ij Contains the user's permission information and signature;

[0105] T ij = Sign ( G ij , v );

[0106] Among them, v is a multi-valued field containing one or more verification information; the verification information includes: one or more of: key, fingerprint ID, and one-time password.

[0107] 4) When receiving a user's request to access the encrypted area, verify the user's access rights;

[0108] Before authorization verification, user identity information verification can be performed first, such as fingerprint verification;

[0109] 5) If the current unlocking user's identity authority level is greater than the encrypted disk partition authority and the accessible user group matches, that is, Acess(G ij ,L ij )=1, automatically unlock the disk space with matching permissions, so that data can be read and written. Otherwise, a verification failure message will be sent and an error count will be recorded for each verification failure.

[0110] like Figure 2 ,Acess(G ij ,L ij )=1 indicates that the permission match is successful. The verification conditions are as follows:

[0111] 1) Group matching is successful: c = floor(a / 8), where floor is a floor function.

[0112] 2) Permission level check passed: j ≥ m, that is, Decrypt(b) ≥ Decrypt(d), where Decrypt is the decryption function corresponding to Encrypt;

[0113] 3) Token T corresponding to bit(n) ij Verification passed, bit is a binary bit 1 sequence function;

[0114] When n is marked as non-zero, the disk verification will match the token marked by n to see if it is verified. Only when all tokens pass can the disk be unlocked, such as Figure 3 shown.

[0115] Access(G ij ,L ij )=0 means permission matching fails and access is not possible, such as Figure 4 As shown;

[0116] The error count of the current level verification permission is greater than the verification threshold of the corresponding set permission level. The L corresponding to the disk ij The level unlocking permission needs to be raised by 1 level, that is, the lowest read and write unlocking permission m=m+1, until the highest level permission;

[0117] For error technology and permission adjustment mechanism, each time the verification fails, the error count Ne of the corresponding encryption area is increased, and the threshold is set to s. When Ne>s, G is recalculated. ij ', then b'=Encrypt(i||(m+1)||k).

[0118] When the number of verification errors for the highest level of permission exceeds the set threshold, all data on the disk will be automatically destroyed.

[0119] For operators with the highest authority, the threshold M can be set separately. top , when the error count Ne top >M top When the disk data destruction mechanism is triggered, all partition information settings and verification methods on the disk will be cleared from the bottom layer.

[0120] It should be understood that those skilled in the art can make improvements or changes based on the above description, and all such improvements and changes should fall within the scope of protection of the appended claims of the present invention.

Claims

1. A data confidentiality method for permission sharing operations based on encrypted PSSD, characterized in that: The following steps are involved: 1) Partition the PSSD into permission zones, including a CD ROM zone, a shared non-encrypted zone, and multiple encrypted zones; The permissions for each partition are as follows: For the CD ROM area and the shared non-encrypted area, every user can directly access it, while the encrypted area requires verification of permissions. The CD ROM area is set to read-only, the shared non-encrypted area is set to read and write, and the encrypted area is set to read and write after the user passes the verification. 2) Set the characteristic attributes of the encrypted area; For each encryption area, there is an attribute structure L ij , the user groups that can access the specified encryption area within the structure and the corresponding minimum user permissions; In step 2), L ij = (c,d), where: c represents the user's group number; d is composed of group c, the lowest read and write permission m in the group, and the combined verification identifier n; d = Encrypt( c||m||n); Among them, || represents string concatenation; Encrypt represents the encryption algorithm; n is a combination verification identifier, which is an 8-bit binary data used to mark whether the disk is in combination unlock mode and is used to communicate with the digital certificate or token T ij When n is marked as non-zero, the disk verification will match the token marked by n to see if it is verified. Only when all tokens pass can the disk be unlocked. 3) Assign unlocking permissions to each preset user group and set the authentication key permission level for each user. The authentication key permission level includes the user's group number, the user's member group number and the permission value; When receiving a user's request to access the encryption area, verify the user's access rights; Among them, the unlocking permissions assigned to each preset group of users are: Each user will be assigned a digital certificate or token T ij , T ij Contains the user's permission information and signature; T ij =Sign(G ij ,v); Wherein, v is a multi-valued field containing one or more verification information; the verification information includes: key, fingerprint ID, one-time password; G ij The authentication key permission level assigned to each user personnel; 4) If the current user identity authorization level performing the unlocking is greater than the access permission of the encrypted area and the accessible user group matches, the disk space with matching permissions will be unlocked, thereby enabling data to be read and written. Otherwise, a verification failure message will be sent and an error count will be recorded for each verification failure.

2. The data confidentiality method for rights sharing operation based on encrypted PSSD according to claim 1, characterized in that: In step 3), the authentication key permission level for each user is set as follows: The authentication key authority level assigned to each user is G ij ; G ij =(a,b); Among them, a represents the user's member number, a = g*8+i; where g is the user's group ID and i is the member's ID within the group; b is the permission value, which is generated based on the combination member number i and the assigned permission level j: b=Encrypt( i||j||k); Where k is a system key, || represents string concatenation, and Encrypt represents an encryption function.

3. The data confidentiality method for rights sharing operation based on encrypted PSSD according to claim 2, characterized in that: In step 4), when the current unlocking user's identity authority level is greater than the encrypted disk partition authority and the accessible user group matches, that is, Acess(G ij ,L ij )=1, indicating that the permission match is successful. The verification conditions are as follows: 1) Group matching is successful: c = floor(a / 8), where floor is a floor function. 2) Permission level check passed: j ≥ m, that is, Decrypt(b) ≥ Decrypt(d), where Decrypt is the decryption function corresponding to Encrypt; 3) Token T corresponding to bit(n) ij Verification passed, bit is a binary bit 1 sequential function.

4. The data confidentiality method for rights sharing operation based on encrypted PSSD according to claim 1, characterized in that: In step 4), the error count of the current level verification authority is greater than the verification quantity threshold corresponding to the set authority level, and the L corresponding to the disk ij The level unlocking permission needs to be raised by 1 level, that is, the lowest read and write unlocking permission m=m+1, until the highest level permission; When the number of verification errors for the highest level of permission exceeds the set threshold, all data on the disk will be automatically destroyed.

5. An electronic device, characterized in that: include: one or more processors; as well as a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to perform the method according to any one of claims 1 to 4.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images