Encryption and decryption system, method and equipment of target file, medium and program product

Abstract

The invention relates to the technical field of file security, and discloses a target file encryption and decryption system, method and device, a medium and a program product, and the target file encryption and decryption system comprises a login and authentication module which is used for verifying the identity of a target user and obtaining a user identity token; the access control and authority configuration module is used for acquiring a target key according to the access authority of the target file of the target user; the encryption and decryption module is used for decrypting the file content of the encrypted target file by utilizing a symmetric decryption strategy and a public key according to a decryption instruction of a target user, and decrypting the file encryption header of the encrypted target file by utilizing an asymmetric decryption strategy and a target key; and the encryption and decryption module is used for reading the decrypted target file according to the decrypted file content and the decrypted file encryption header. According to the method, the target file is continuously encrypted and decrypted by constructing the encryption and decryption system of the target file, so that the dynamic security protection of the target file is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of file security, and particularly to an encryption and decryption system, method, device, medium, and program product for target files. Background Art

[0002] Android files refer to various types of data files stored and used in the Android operating system, including but not limited to application files, user data files (such as documents, pictures, videos, audio, etc.), system configuration files, etc.

[0003] In order to protect user privacy and ensure the security of Android files, it is usually necessary to perform encryption and decryption operations on Android files. In related technologies, most of the methods for encrypting and decrypting Android files are based on the API Hook (Application Programming Interface Hook) technology at the Linux system bottom layer or file filtering drivers to encrypt the core file data.

[0004] Among them, the API Hook technology intercepts the calls of application programs to file-related APIs during the program running process. When an application program attempts to read or write a file, it first performs encryption or decryption operations, and then passes the processed data to the application program to achieve transparent encryption and decryption of the core file data. The file filtering driver monitors the read and write operations of the file system and encrypts or decrypts each read and write operation to encrypt and protect the core file data during the read and write process.

[0005] However, in the methods for encrypting and decrypting Android files in related technologies, to determine whether a user has permission to access a file, it mainly relies on the rules and permission information preset locally on the device. These rules and permission information are fixed locally on the device and take effect in the local environment of the device once set, lacking the ability to interact with the outside in real time and adjust dynamically, resulting in low flexibility. Summary of the Invention

[0006] In view of this, the present invention provides an encryption and decryption system, method, device, medium, and program product for target files to solve the problem of low flexibility in the methods for encrypting and decrypting Android files in related technologies.

[0007] In a first aspect, the present invention provides a system for encrypting and decrypting target files, comprising: a login and authentication module, an access control and permission configuration module, a communication and policy control module, a basic key management module, and an encryption and decryption module; the login and authentication module is configured to verify the identity of a target user according to the account password information sent by the target user, and obtain a user identity token according to the account password information; the access control and permission configuration module is configured to determine whether the target user has access rights to the target file according to the user identity token and the target file identifier sent by the target user, and obtain a target key corresponding to the target file according to the target user having access rights to the target file; the communication and policy control module is configured to obtain the encrypted target file from the server according to the target file acquisition instruction and the target file identifier; the basic key management module is configured to provide a public key and an encryption and decryption policy for the encryption and decryption module; the encryption and decryption module is configured to decrypt the file content of the encrypted target file by using the symmetric decryption policy in the encryption and decryption policy provided by the basic key management module and the public key, and decrypt the file encryption header of the encrypted target file by using the asymmetric decryption policy in the encryption and decryption policy provided by the basic key management module and the target key; the encryption and decryption module is configured to obtain the decrypted target file according to the decrypted file content and the decrypted file encryption header.

[0008] The encryption and decryption system for target files of the present invention, a login and authentication module, is used to verify the identity of the target user according to the account password information sent by the target user, and obtain a user identity token according to the account password information, effectively preventing access by illegal users. Only the target user who has passed the identity verification can enter the subsequent operation process of the encryption and decryption system for target files, greatly reducing the risk of malicious intrusion into the encryption and decryption system for target files, and ensuring the security of target files when accessed at the source. An access control and permission configuration module is used to determine whether the target user has the access permission to the target file according to the user identity token and the target file identifier sent by the target user, and is used to obtain the target key corresponding to the target file according to the fact that the target user has the access permission to the target file. The access control and permission configuration module of the present invention accurately controls the access level of specific target files according to the identities, roles and other attributes of different target users, avoids abuse of permissions, and ensures that the target file is only accessed and operated by the authorized target user. By obtaining the target key corresponding to the target file, since the process of obtaining the target key does not send the target key to the target user and the target key is dynamically generated, further strengthening the security of obtaining the target file and preventing the target user from accessing the target key, protecting the confidentiality and security of the target file from the perspective of key use. The communication and policy control module of the present invention is used to obtain the encrypted target file from the server according to the target file acquisition instruction and the target file identifier; the basic key management module is used to provide the public key and the encryption and decryption policy for the encryption and decryption module. The basic key management module specifically provides the public key and the encryption and decryption policy, centrally manages the information related to the public key and the encryption and decryption policy, and avoids potential security risks caused by the leakage of the encryption and decryption policy. The encryption and decryption module of the present invention is used to decrypt the file content of the encrypted target file by using the symmetric decryption policy in the encryption and decryption policy provided by the basic key management module and the public key according to the decryption instruction of the target user, and decrypt the file encryption header of the encrypted target file by using the asymmetric decryption policy in the encryption and decryption policy provided by the basic key management module and the target key; the encryption and decryption module is used to obtain the decrypted target file according to the decrypted file content and the decrypted file encryption header. The encryption and decryption module of the present invention uses a hierarchical encryption and decryption mechanism, decrypts the file content by using the symmetric decryption policy combined with the public key, and decrypts the file encryption header by using the asymmetric decryption policy combined with the target key. This hierarchical and combined encryption and decryption method with different algorithms makes the encryption and decryption system more complex and robust, increases the cracking difficulty, and protects the file content and key encryption information from being easily stolen or tampered with.Compared with related technologies, the present invention continuously encrypts and decrypts the target file by constructing an encryption and decryption system for the target file, dynamically adapts to permission management, adjusts permissions according to the needs of the target user, and determines the access permission in real time based on the user identity token. All keys and encryption and decryption policies during the encryption and decryption process are dynamically provided without the need for configuration and confirmation by the target user, improving the flexibility of the encryption and decryption process of the target file and comprehensively ensuring the security of the target file.

[0009] In an optional implementation manner, the encryption and decryption module is further configured to encrypt the file content of the target file using the symmetric encryption policy and the public key in the encryption and decryption policy provided by the basic key management module according to the encryption instruction of the target user, and encrypt the file encryption header of the target file using the asymmetric encryption policy and the target key in the encryption and decryption policy provided by the basic key management module; the encryption and decryption module is further configured to generate an encrypted target file based on the encrypted file content and the encrypted file encryption header; the communication and policy control module is configured to send the encrypted target file to the server.

[0010] In an optional implementation manner, the login and authentication module includes: a user configuration unit configured to configure user groups, account password information according to the control instruction of the target user.

[0011] The user configuration unit of the present invention is configured to configure user groups, account password information according to the control instruction of the target user, meet diverse usage scenarios, adapt to different organizational structures and business processes, and enhance the adaptability of the system to various user environments.

[0012] In an optional implementation manner, the access control and permission configuration module includes: a file list determination unit configured to obtain permission information according to the user identity token, query multiple files with access permissions corresponding to the user identity token according to the permission information to obtain a user application permission table; an access permission determination unit configured to match the target file identifier with the user application permission table. If the target file identifier exists in the user application permission table, it is determined that the target user has access permission to the target file; if the target file identifier does not exist in the user application permission table, it is determined that the target user does not have access permission to the target file.

[0013] In an optional implementation manner, the access control and permission configuration module includes: a permission configuration unit configured to modify the permission information corresponding to the user identity token according to the control instruction of the target user.

[0014] The permission configuration unit of the present invention is configured to modify the permission information corresponding to the user identity token according to the control instruction of the target user, timely adjust the permissions corresponding to its own identity token, greatly improve the timeliness of permission adjustment, and flexibly adapt to different working scenarios.

[0015] In an alternative embodiment, the encryption and decryption module includes: a plaintext buffer channel generation unit, configured to store the decrypted target file through the plaintext buffer channel in response to a read operation of the decrypted target file; and a ciphertext buffer channel generation unit, configured to store the encrypted target file through the ciphertext buffer channel in response to a write operation of the encrypted target file.

[0016] The plaintext buffer channel generation unit of the present invention is configured to store the decrypted target file through the plaintext buffer channel in response to a read operation of the decrypted target file; and the ciphertext buffer channel generation unit is configured to store the encrypted target file through the ciphertext buffer channel in response to a write operation of the encrypted target file. When the target file needs to be obtained again later, the target file can be directly obtained through the buffer channel according to authorization or not, improving the transmission efficiency of the target file.

[0017] In a second aspect, the present invention provides a method for encrypting and decrypting a target file, including: verifying the identity of a target user according to the account password information sent by the target user, and obtaining a user identity token according to the account password information; determining whether the target user has access rights to the target file according to the user identity token and the target file identifier sent by the target user, and obtaining a target key corresponding to the target file according to the target user having access rights to the target file; obtaining the encrypted target file from a server according to the target file acquisition instruction and the target file identifier; decrypting the file content of the encrypted target file by using the symmetric decryption strategy in the encryption and decryption policy provided by the basic key management module and the public key according to the decryption instruction of the target user, and decrypting the file encryption header of the encrypted target file by using the asymmetric decryption strategy and the target key in the encryption and decryption policy provided by the basic key management module; and obtaining the decrypted target file according to the decrypted file content and the decrypted file encryption header.

[0018] In a third aspect, the present invention provides a computer device, including: a memory and a processor, which are communicatively connected to each other. The memory stores computer instructions, and the processor executes the computer instructions to execute the method for encrypting and decrypting a target file in the second aspect described above.

[0019] In a fourth aspect, the present invention provides a computer-readable storage medium, on which computer instructions are stored, and the computer instructions are used to cause a computer to execute the method for encrypting and decrypting a target file in the second aspect described above.

[0020] In a fifth aspect, the present invention provides a computer program product, including computer instructions, and the computer instructions are used to cause a computer to execute the method for encrypting and decrypting a target file in the second aspect described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in related technologies, the following will briefly introduce the drawings required for use in the description of the specific embodiments or related technologies. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0022] Figure 1 It is a schematic framework diagram of an encryption and decryption system for target files according to an embodiment of the present invention.

[0023] Figure 2 It is a schematic framework diagram of an encryption and decryption system for another target file according to an embodiment of the present invention.

[0024] Figure 3 It is a schematic workflow diagram of an encryption and decryption system for target files according to an embodiment of the present invention.

[0025] Figure 4 It is a schematic diagram of the transparent encryption and decryption process of a double-buffer channel file according to an embodiment of the present invention.

[0026] Figure 5 It is a schematic flowchart of a method for encrypting and decrypting target files according to an embodiment of the present invention.

[0027] Figure 6 It is a schematic hardware structure diagram of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0028] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of the present invention.

[0029] Traditional network security models usually rely on "Perimeter Security", that is, by means of firewalls, VPNs (Virtual Private Networks), intrusion detection, etc., to isolate the enterprise's internal network from external threats. However, when traditional network security models determine whether a user has permission to access a file, they mainly rely on the rules and permission information pre-set locally on the device. These rules and permission information are fixed locally on the device and take effect in the local device environment once set, lacking the ability to interact with the outside in real time and adjust dynamically, resulting in low flexibility.

[0030] However, with the rapid development of cloud computing and 5G (fifth-generation mobile communication) technologies, modern enterprise networks are no longer single and internally closed systems. The widespread application of cloud computing, remote work, and mobile devices has blurred the "inside and outside" boundaries, making the network boundaries lose clarity. The perimeter security measures of traditional network security models cannot effectively cover new risks. Moreover, not only external attackers pose threats, but internal users may also become sources of attacks. Therefore, traditional network security models can no longer meet people's security needs.

[0031] The embodiments of the present invention provide a target file encryption and decryption system, which continuously encrypts and decrypts the target file by constructing the target file encryption and decryption system, so as to achieve the effect of enhancing the dynamic security protection of the target file.

[0032] Zero Trust is a network security concept and framework, whose core idea is to no longer trust any user or device by default, even if they are located within the enterprise's internal network. The goal of Zero Trust is to address the evolving security threats in the modern network environment, especially in the context of the widespread application of remote work, cloud computing, and mobile devices. The core principles of Zero Trust include: Never Trust, Always Verify, Least Privilege Access, Continuous Monitoring and Validation, etc. The principle of Never Trust represents that Zero Trust needs to provide the principle of continuous verification and dynamic authorization, which requires that even if a user or device has obtained access rights, their behavior needs to be continuously monitored to ensure that their activities meet expectations and the risks are evaluated at any time. When the behavior is abnormal, measures can be taken in a timely manner.

[0033] With the popularization of remote work, enterprise data flows between employees' BYOD (Bring Your Own Device) and office terminals. There is a large amount of internal and external data interaction and transfer among different positions, roles, and applications. In particular, the demand of enterprise employees for reading and modifying intranet files on mobile devices is becoming increasingly common, which requires the use of a zero-trust architecture. Common zero-trust encryption technologies include: encryption in transit, static data encryption, and end-to-end encryption. Encryption technologies ensure that data cannot be interpreted even if obtained by attackers; Data access control (Access Control) is one of the key mechanisms in the zero-trust architecture, ensuring that only authenticated and authorized users or devices can access specific data. Common data access control technologies include: Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), and risk-based dynamic access control. The main difference among the three lies in which attributes are used to grant access permissions.

[0034] Transparent File Encryption / Decryption (TFE) is a file encryption / decryption mechanism that does not affect the user experience. It aims to provide security protection for files while not interfering with the normal process of users using files. Transparent file encryption / decryption technology achieves "transparency" by automatically performing encryption and decryption operations at the operating system or file system level, that is, users do not need to manually operate to encrypt or decrypt files, and all operations are automatically completed in the background. It includes file-level encryption / decryption, key-based encryption / decryption, and file encryption / decryption driver. Among them, the file encryption / decryption driver ensures the transparency of encryption / decryption and can be implemented by the file encryption / decryption driver (File System Filter Driver) or kernel module in the operating system. These drivers intervene in the read and write operations of the file system and automatically decrypt when an application or user accesses the file, and automatically encrypt when saving or writing the file. The current mainstream file encryption driver technologies include transparent encryption technology based on API Hook technology and transparent encryption technology based on file filter drivers.

[0035] In addition, the encryption and decryption of important files also involve the encryption and decryption algorithms used. Encryption and decryption algorithms can be mainly divided into two categories, including symmetric encryption and decryption, and asymmetric encryption and decryption. Symmetric encryption and decryption technologies use the same key for encryption and decryption, while asymmetric encryption and decryption technologies require two sets of keys for encryption and decryption. Symmetric encryption and decryption algorithms have high encryption and decryption efficiency and low resource consumption, but the security is average; Asymmetric encryption and decryption algorithms are more complex, have better encryption security, and consume more resources.

[0036] Since the underlying layer of Android is the Linux system, files can only be quickly read and written after they are opened, and the Linux system needs to use VFS (Virtual File System) to map read and write operations to the file system. Therefore, in the file system page buffer lookup process, in order to improve the read and write speed, it is necessary to use the buffer page cache to write data, and then write the buffer page to the specific file using VFS when it is idle. The Linux system often uses AddressSpace Operations to manage the mapping relationship between the buffer page and the file system. Since all file operations must use address space operations to implement the underlying functions, this mechanism can be used to implement file encryption and decryption functions.

[0037] According to an embodiment of the present invention, an embodiment of an encryption and decryption system for a target file is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than here.

[0038] In this embodiment, an encryption and decryption system for a target file is provided, which can be used in a computer device. Specifically, it can be used in a computer device corresponding to a client. Figure 1 is a schematic framework diagram of an encryption and decryption system for a target file according to an embodiment of the present invention, as Figure 1 shown, the system includes: a login and authentication module 101, an access control and permission configuration module 102, a communication and policy control module 103, a basic key management module 104, and an encryption and decryption module 105.

[0039] The login and authentication module 101 is used to verify the identity of the target user according to the account password information sent by the target user, and obtain a user identity token according to the account password information.

[0040] Among them, the account password information includes the account and password input by the target user. By judging the correctness of the account and password input by the target user, the identity of the target user is verified, which is equivalent to the target user logging in to the encryption and decryption system of the target file according to the account password in the embodiment of the present invention.

[0041] In some optional embodiments, obtaining a user identity token according to the account password information includes: pulling a randomly generated user identity token encrypted using the Base64 method (a coding method for representing binary data based on 64 printable characters) and containing some user personal information from a public platform according to the account password information.

[0042] In some alternative embodiments, multi-factor authentication (MFA) can also be configured to ensure the security of authentication. Exemplarily, authentication sources for third-party verification such as email verification codes and SMS verification codes can also be added as authentication methods.

[0043] The access control and permission configuration module 102 is used to determine whether the target user has access rights to the target file based on the user identity token and the target file identifier sent by the target user, and is used to obtain the target key corresponding to the target file based on the fact that the target user has access rights to the target file.

[0044] Among them, the target file identifier is one or a set of specific information used to uniquely identify the target file.

[0045] In some alternative embodiments, the user identity token corresponds to multiple files to which the target user has access rights. Query and match are performed based on the target file identifier and the multiple files to which the target user corresponding to the user identity token has access rights. If the match is successful, it is determined that the target user has access rights to the target file. If the match fails, it is determined that the target user does not have access rights to the target file.

[0046] In some alternative embodiments, when it is determined that the target user has access rights to the target file, the target key corresponding to the target file is dynamically generated and obtained according to the basic key management module 104.

[0047] In some alternative embodiments, when it is determined that the target user has access rights to the target file, the target key corresponding to the target file identifier is obtained in the target key correspondence table, and the target key correspondence table stores the target keys corresponding to each pre-set file.

[0048] In some alternative embodiments, a user database is configured in the access control and permission configuration module 102. The user database stores a target key table, a user application permission table, a user identification information data table, a user application permission table, an application permission and corresponding file information mapping table, etc. Since file permissions are dynamically controlled, the remote server can manage whether the target user has read and write permissions for the target file, etc. The permission management does not depend on the local device, ensuring the effectiveness of authorization and the security of documents.

[0049] The communication and policy control module 103 is used to obtain the encrypted target file from the server according to the target file acquisition instruction and the target file identifier.

[0050] Among them, due to the continuous verification and dynamic authorization of users in the zero-trust architecture, the permissions of authenticated users for each file need to be updated in real time. The communication and policy control module 103 is used for the communication between the client and the server and the dynamic verification of file permissions. The communication and policy control module 103 is used to create application-level threads, and send the encrypted target file to the server or obtain the encrypted target file from the server.

[0051] In some optional embodiments, the communication and policy control module 103 is further configured to update the permissions and encryption / decryption policies for the target user to access the target file in real time. If the access permission of the target user to the target file changes, it notifies the basic key management module 104 to update the permission information, and at the same time aborts the relevant processes for operating on the target file.

[0052] The basic key management module 104 is used to provide the public key and encryption / decryption policies for the encryption / decryption module 105.

[0053] Among them, the public key is the key used in the asymmetric encryption / decryption algorithm. In the embodiments of the present invention, the basic key management module 104 is used to randomly generate the public key.

[0054] In some optional embodiments, the encryption / decryption policies include symmetric encryption / decryption algorithms and asymmetric encryption / decryption algorithms. The symmetric encryption / decryption technology uses the same key for encryption and decryption, which is the public key, while the asymmetric encryption / decryption technology requires two sets of keys for encryption and decryption, one public key and one private key, and the private key is the above-mentioned target key.

[0055] In some optional embodiments, the basic key management module 104 includes the mapping relationship between the permission file and the local file address, the mapping relationship between the file encryption / decryption policy and the local file, and the mapping relationship between the file key and the local file. The basic key management module 104 is responsible for managing keys and encryption / decryption policies, including the generation, distribution, integrity verification, and update of keys and encryption policies.

[0056] The encryption / decryption module 105 is used to decrypt the file content of the encrypted target file using the symmetric decryption policy and the public key in the encryption / decryption policy provided by the basic key management module 104 according to the decryption instruction of the target user, and decrypt the file encryption header of the encrypted target file using the asymmetric decryption policy and the target key in the encryption / decryption policy provided by the basic key management module 104.

[0057] Among them, the symmetric encryption policy is mainly used for encrypting the file content, the symmetric decryption policy is mainly used for decrypting the file content, the asymmetric encryption policy is mainly used for encrypting the file header, file name, and file key, and the asymmetric decryption policy is mainly used for decrypting the file encryption header, file name, and file key.

[0058] In some alternative embodiments, the file content is the information that the target file truly contains, such as the text in a text file, the pixel data in a picture file, etc. The file encryption header contains meta-information related to the target file, such as the encryption algorithm, key information, file format, etc.

[0059] The encryption / decryption module 105 is configured to obtain the decrypted target file based on the decrypted file content and the decrypted file encryption header.

[0060] In some alternative embodiments, the encryption / decryption module 105 is configured to splice the decrypted file content and the decrypted file encryption header to obtain the decrypted target file.

[0061] Among them, the decrypted file content and the decrypted file encryption header are separated by themselves. The meta-information in the file encryption header is necessary for correctly parsing and reading the file content. For example, the file format information can tell the reading program how to interpret the file content. Only by splicing the decrypted file content and the decrypted file encryption header can a complete target file that can be recognized by the reading program be restored.

[0062] In some alternative embodiments, the encryption / decryption module 105 is further configured to, according to the encryption instruction of the target user, use the symmetric encryption policy in the encryption / decryption policy provided by the basic key management module and the public key to encrypt the file content of the target file, and use the asymmetric encryption policy in the encryption / decryption policy provided by the basic key management module and the target key to encrypt the file encryption header of the target file.

[0063] The encryption / decryption module 105 is further configured to generate the encrypted target file based on the encrypted file content and the encrypted file encryption header.

[0064] The communication and policy control module 103 is configured to send the encrypted target file to the server.

[0065] The encryption and decryption system for target files provided in this embodiment includes a login and authentication module, which is used to verify the identity of the target user according to the account password information sent by the target user, and obtain the user identity token according to the account password information, effectively preventing the access of illegal users. Only the target user who passes the identity verification can enter the subsequent operation process of the encryption and decryption system for target files, greatly reducing the risk of malicious intrusion into the encryption and decryption system for target files and ensuring the security of the target files when accessed at the source. The access control and permission configuration module is used to judge whether the target user has the access permission to the target file according to the user identity token and the target file identifier sent by the target user, and obtain the target key corresponding to the target file according to the fact that the target user has the access permission to the target file. The access control and permission configuration module of the present invention accurately controls the access level of specific target files according to the identities, roles and other attributes of different target users, avoids the abuse of permissions, ensures that the target files are only accessed and operated by authorized target users, and obtains the target key corresponding to the target file. Since the process of obtaining the target key does not send the target key to the target user and the target key is dynamically generated, the security of obtaining the target file is further strengthened, preventing the target user from accessing the target key and ensuring the confidentiality and security of the target file from the level of key use. The communication and policy control module of the present invention is used to obtain the encrypted target file from the server according to the target file acquisition instruction and the target file identifier; the basic key management module is used to provide the public key and the encryption and decryption policy for the encryption and decryption module. The basic key management module specifically provides the public key and the encryption and decryption policy, centrally manages the information related to the public key and the encryption and decryption policy, and avoids the security risks brought by the leakage of the encryption and decryption policy. The encryption and decryption module of the present invention is used to decrypt the file content of the encrypted target file by using the symmetric decryption policy and the public key in the encryption and decryption policy provided by the basic key management module according to the decryption instruction of the target user, and decrypt the file encryption header of the encrypted target file by using the asymmetric decryption policy and the target key in the encryption and decryption policy provided by the basic key management module; the encryption and decryption module is used to obtain the decrypted target file according to the decrypted file content and the decrypted file encryption header. The encryption and decryption module of the present invention uses a hierarchical encryption and decryption mechanism, decrypts the file content by using the symmetric decryption policy combined with the public key, and decrypts the file encryption header by using the asymmetric decryption policy combined with the target key. This hierarchical and different algorithm combined encryption and decryption method makes the encryption and decryption system more complex and robust, improves the cracking difficulty, and protects the file content and key encryption information from being easily stolen or tampered with.Compared with related technologies, the present invention constructs an encryption and decryption system for target files, continuously encrypts and decrypts the target files, dynamically adapts to permission management, adjusts permissions according to the needs of target users, and determines access permissions in real time based on user identity tokens. All keys and encryption and decryption policies during the encryption and decryption process are dynamically provided and do not require configuration and confirmation by the target user, improving the flexibility of the target file encryption and decryption process and comprehensively ensuring the security of the target files.

[0066] In this embodiment, an encryption and decryption system for target files is provided, which can be used in computer devices. Specifically, it can be used in computer devices corresponding to clients. Figure 2 It is a framework schematic diagram of another encryption and decryption system for target files according to an embodiment of the present invention. As Figure 2 shown, the system includes: a login and authentication module 201, an access control and permission configuration module 202, a communication and policy control module 203, a basic key management module 204, and an encryption and decryption module 205.

[0067] The login and authentication module 201 is used to verify the identity of the target user according to the account password information sent by the target user, and obtain a user identity token according to the account password information.

[0068] The access control and permission configuration module 202 is used to determine whether the target user has access permission to the target file according to the user identity token and the target file identifier sent by the target user, and is used to obtain the target key corresponding to the target file according to the target user having access permission to the target file.

[0069] The communication and policy control module 203 is used to obtain the encrypted target file from the server according to the target file acquisition instruction and the target file identifier.

[0070] The basic key management module 204 is used to provide a public key and an encryption and decryption policy for the encryption and decryption module 205.

[0071] The encryption and decryption module 205 is used to decrypt the file content of the encrypted target file using the symmetric decryption policy in the encryption and decryption policy provided by the basic key management module 204 and the public key, and decrypt the file encryption header of the encrypted target file using the asymmetric decryption policy and the target key in the encryption and decryption policy provided by the basic key management module 204 according to the decryption instruction of the target user.

[0072] The encryption and decryption module 205 is used to obtain the decrypted target file according to the decrypted file content and the decrypted file encryption header.

[0073] In some optional embodiments, the login and authentication module 201 includes:

[0074] The authentication unit 2011 is used to authenticate the identity of the target user according to the account password information sent by the target user. For details, please refer to Figure 1 the login and authentication module 101 in the illustrated embodiment, which will not be elaborated here.

[0075] The identity token acquisition unit 2012 is used to acquire the user identity token according to the account password information. For details, please refer to Figure 1 the login and authentication module 101 in the illustrated embodiment, which will not be elaborated here.

[0076] The user configuration unit 2013 is used to configure the user group and account password information according to the control instruction of the target user.

[0077] Among them, the configuration instruction can be a modification instruction, a deletion instruction, an addition instruction, etc., and the user group is a set of users with the same characteristics or requirements.

[0078] The user configuration unit 2013 in the embodiment of the present invention is used to configure the user group and account password information according to the control instruction of the target user, meet diverse usage scenarios, adapt to different organizational structures and business processes, and enhance the adaptability of the system to various user environments.

[0079] In some optional implementation manners, the access control and permission configuration module 202 includes:

[0080] The file list determination unit 2021 is used to acquire the permission information according to the user identity token, query a plurality of files with access permissions corresponding to the user identity token according to the permission information, and obtain the user application permission table.

[0081] The access permission determination unit 2022 is used to match the target file identifier with the user application permission table. If the target file identifier exists in the user application permission table, it is determined that the target user has the access permission to the target file; if the target file identifier does not exist in the user application permission table, it is determined that the target user does not have the access permission to the target file.

[0082] The key acquisition unit 2023 is used to acquire the target key corresponding to the target file according to the fact that the target user has the access permission to the target file. For details, please refer to Figure 1 the access control and permission configuration module 102 in the illustrated embodiment, which will not be elaborated here.

[0083] The permission configuration unit 2024 is used to modify the permission information corresponding to the user identity token according to the control instruction of the target user.

[0084] Among them, the control instruction can be to modify, delete, add, etc. the permission information. Exemplarily, the permission information corresponding to the user identity token includes that the target user has the read permission for the target file, and if the target user needs to write to the target file, the permission information can be modified to have the read and write permissions for the target file, so that the target user can write to the target file.

[0085] The permission configuration unit of the embodiment of the present invention is used to modify the permission information corresponding to the user identity token according to the control instruction of the target user, and timely adjust the permissions corresponding to its own identity token, greatly improving the timeliness of permission adjustment and flexibly adapting to different working scenarios.

[0086] In some alternative embodiments, the communication and policy control module 203 includes:

[0087] The target file acquisition unit 2031 is used to acquire the encrypted target file from the server according to the target file acquisition instruction and the target file identifier. For details, please refer to Figure 1 the communication and policy control module 103 of the embodiment shown, which will not be elaborated here.

[0088] The target file sending unit 2032 is used to send the encrypted target file to the server. For details, please refer to Figure 1 the communication and policy control module 103 of the embodiment shown, which will not be elaborated here.

[0089] In some alternative embodiments, the encryption and decryption module 205 includes:

[0090] The decryption unit 2051 is used to decrypt the file content of the encrypted target file using the symmetric decryption policy in the encryption and decryption policy provided by the basic key management module according to the decryption instruction of the target user, and decrypt the file encryption header of the encrypted target file using the asymmetric decryption policy and the target key in the encryption and decryption policy provided by the basic key management module. For details, please refer to Figure 1 the encryption and decryption module 105 of the embodiment shown, which will not be elaborated here.

[0091] The file reading unit 2052 is used to acquire the decrypted target file according to the decrypted file content and the decrypted file encryption header. For details, please refer to Figure 1 the encryption and decryption module 105 of the embodiment shown, which will not be elaborated here.

[0092] The plaintext buffer channel generation unit 2053 is used to store the decrypted target file through the plaintext buffer channel in response to the read operation of the decrypted target file.

[0093] Among them, a file filtering driver is used to intercept relevant read operations of Linux system call Address Space Operations and obtain the target file. When the target file is viewed, the filtering driver intercepts the read operation and decrypts the intercepted target file, and transmits the plaintext of the target file to the memory space through the plaintext buffer channel for storage.

[0094] An encryption unit 2054, configured to encrypt the file content of the target file by using a symmetric encryption policy and a public key in the encryption and decryption policies provided by the basic key management module according to the encryption instructions of the target user, and encrypt the file encryption header of the target file by using an asymmetric encryption policy and a target key in the encryption and decryption policies provided by the basic key management module. For details, please refer to Figure 1 the encryption and decryption module 105 in the illustrated embodiment, which will not be elaborated here.

[0095] An encrypted file generation unit 2055, configured to generate an encrypted target file according to the encrypted file content and the encrypted file encryption header. For details, please refer to Figure 1 the encryption and decryption module 105 in the illustrated embodiment, which will not be elaborated here.

[0096] A ciphertext buffer channel generation unit 2056, configured to store the encrypted target file through the ciphertext buffer channel in response to a write operation of the encrypted target file.

[0097] Among them, when the target file is written, the filtering driver intercepts the write operation and stores the encrypted target file through the ciphertext buffer channel.

[0098] In an embodiment of the present invention, a plaintext buffer channel generation unit is configured to store the decrypted target file through the plaintext buffer channel in response to a read operation of the decrypted target file; a ciphertext buffer channel generation unit is configured to store the encrypted target file through the ciphertext buffer channel in response to a write operation of the encrypted target file. When the target file needs to be obtained again later, the target file can be directly obtained through the buffer channel according to authorization or not, improving the transmission efficiency of the target file.

[0099] In this embodiment, a target file encryption and decryption system is provided, which can be used in a computer device. Specifically, it can be used in a computer device corresponding to a client. Figure 3 It is a schematic diagram of the working process of the target file encryption and decryption system according to an embodiment of the present invention, as Figure 3 shown, including: a login and authentication module 301, an access control and permission configuration module 302, a communication and policy control module 303, a basic key management module 304, an encryption and decryption module 305, and a double buffer channel read and write module 306.

[0100] Login and Authentication Module 301: This module mainly manages the visitor identity authentication and recognition function, which is used to verify the correctness of the user account password and generate a general identity token. It can also configure the application of multi-factor authentication (MFA) to ensure the security of identity authentication. For details, please refer to Figure 1 the login and authentication module 101 of the illustrated embodiment, which will not be elaborated here.

[0101] Access Control and Permission Configuration Module 302: It is used for user identification access information management and the configuration of file key and permission mapping policies. The access control and permission configuration module 302 is mainly used to manage the user identity token and user identification information, including the addition, deletion, update, and query of relevant information; the access control and permission configuration module 302 is also used to determine whether the target user has access rights to the target file according to the user identity token and the target file identifier sent by the target user, and to obtain the target key corresponding to the target file according to the target user having access rights to the target file. For details, please refer to Figure 1 the access control and permission configuration module 102 of the illustrated embodiment, which will not be elaborated here.

[0102] Communication and Policy Control Module 303: Since continuous verification and dynamic authorization of users are carried out in the zero-trust architecture, the permissions of authenticated users for each file need to be updated in real time. This module is used for the communication between the client and the server and the dynamic verification of file permissions. The communication and policy control module 303 is used to create an application-level thread within the application program to send the encrypted target file to the server or obtain the encrypted target file from the server. For details, please refer to Figure 1 the communication and policy control module 103 of the illustrated embodiment, which will not be elaborated here.

[0103] Basic Key Management Module 304: It is mainly responsible for providing keys and encryption / decryption policies for other modules, including the mapping relationship between permission files and local file addresses, the mapping relationship between file encryption / decryption policies and local files, and the mapping relationship between file keys and local files. The basic key management module 304 is used to manage file keys and encryption policies, including the generation, distribution, integrity verification, and update of keys and encryption policies. For details, please refer to Figure 1 the basic key management module 104 of the illustrated embodiment, which will not be elaborated here.

[0104] Encryption / Decryption Module 305: This module mainly provides an encryption / decryption solution based on dynamic encryption / decryption policies for encrypting and decrypting target files. The technologies mainly involved are symmetric encryption algorithms and asymmetric encryption algorithms. This module uses the file ID (Identification, identifier) as the unique identifier and calls the encryption / decryption policies provided by the basic key management module 304 to perform encryption / decryption processing on the target file. For details, please refer to Figure 1The encryption and decryption module 105 of the illustrated embodiment will not be elaborated here.

[0105] Dual-buffer channel read-write module 306: This module mainly realizes the fast reading and writing of the target file at the system kernel layer. It uses a file filter driver to intercept the relevant read and write operations of the Linux system call Address Space Operations and obtain the encrypted and decrypted target file. When the target file is viewed, the filter driver intercepts the system's read operation and decrypts the intercepted target file to obtain the plaintext of the file, and transmits the plaintext of the file to the system memory space through the plaintext buffer channel; when the file is written, the filter driver intercepts the system's write operation and encrypts the target file to obtain the ciphertext of the file, and writes the ciphertext of the file to the storage device through the ciphertext buffer channel.

[0106] Exemplarily, as Figure 4 shown, it is a schematic diagram of the transparent encryption and decryption process of a dual-buffer channel file. The dual-buffer channel includes a plaintext buffer channel and a ciphertext buffer channel. When the target user is in an authorized process, the plaintext data is directly obtained through the plaintext buffer channel. When the target user is in an unauthorized process, the ciphertext data is obtained through the ciphertext buffer channel.

[0107] Among them, as Figure 4 shown, the judgment process for the authorized process and the unauthorized process is as follows: When the target user accesses the file, first perform authentication information verification based on the user identification information (account password information) (that is, verify the identity of the target user according to the account password information sent by the target user). When the verification fails, it is directly judged as an unauthorized process; when the verification is successful, perform authorization information verification based on the file authorization information (that is, judge whether the target user has the access right to the target file according to the user identity token and the target file identifier sent by the target user). When the verification fails, it is directly judged as an unauthorized process. When the verification is successful, perform encryption and decryption processing on the target file according to the file data mapping table (the mapping table of file name and file content), the encryption policy mapping table (the mapping table of encryption and decryption policies and file components), and the file key mapping table (the mapping table of keys and file components) (that is, according to the encryption and decryption instructions of the target user, use the symmetric encryption and decryption policy in the encryption and decryption policy provided by the basic key management module, the public key to encrypt and decrypt the file content, use the asymmetric encryption and decryption policy in the encryption and decryption policy provided by the basic key management module, the target key to encrypt and decrypt the file encryption header; according to the encrypted and decrypted file content and the encrypted and decrypted file encryption header, perform encryption and decryption processing on the target file), and judge it as an authorized process.

[0108] The dual-buffer channel in the embodiment of the present invention supports the authorized process and the unauthorized process to achieve fast file reading. By judging whether the target file is authorized, if it is an authorized process, the plaintext data is directly read from the plaintext buffer channel, and the file reading and writing functions are implemented through the encryption and decryption module; if it is an unauthorized process, only the function of reading the ciphertext data from the ciphertext buffer channel is provided to protect the target file.

[0109] In this embodiment, a method for encrypting and decrypting a target file is provided, which can be used in a computer device. Figure 5 It is a flowchart of the method for encrypting and decrypting a target file according to the embodiment of the present invention, as Figure 5 shown, and the process includes the following steps:

[0110] Step S501: Verify the identity of the target user according to the account password information sent by the target user, and obtain the user identity token according to the account password information.

[0111] Step S502: Judge whether the target user has the access right to the target file according to the user identity token and the target file identifier sent by the target user, and obtain the target key corresponding to the target file according to the fact that the target user has the access right to the target file.

[0112] Step S503: Obtain the encrypted target file from the server according to the target file acquisition instruction and the target file identifier.

[0113] Step S504: According to the decryption instruction of the target user, use the symmetric decryption strategy in the encryption and decryption strategy provided by the basic key management module and the public key to decrypt the file content of the encrypted target file, and use the asymmetric decryption strategy and the target key in the encryption and decryption strategy provided by the basic key management module to decrypt the file encryption header of the encrypted target file.

[0114] Step S505: Obtain the decrypted target file according to the decrypted file content and the decrypted file encryption header.

[0115] In some optional embodiments, the method for encrypting and decrypting a target file further includes: encrypting the file content of the target file using the symmetric encryption strategy and the public key in the encryption and decryption strategy provided by the basic key management module according to the encryption instruction of the target user, and encrypting the file encryption header of the target file using the asymmetric encryption strategy and the target key in the encryption and decryption strategy provided by the basic key management module; generating the encrypted target file according to the encrypted file content and the encrypted file encryption header; and sending the encrypted target file to the server.

[0116] In some alternative embodiments, the method for encrypting and decrypting the target file further includes: configuring the user group and account password information according to the control instruction of the target user.

[0117] In some alternative embodiments, determining whether the target user has access rights to the target file according to the user identity token and the target file identifier sent by the target user includes: obtaining permission information according to the user identity token, querying multiple files with access rights corresponding to the user identity token according to the permission information to obtain a user application permission table; matching the target file identifier with the user application permission table, if the target file identifier exists in the user application permission table, it is determined that the target user has access rights to the target file; if the target file identifier does not exist in the user application permission table, it is determined that the target user does not have access rights to the target file.

[0118] In some alternative embodiments, the method for encrypting and decrypting the target file further includes: modifying the permission information corresponding to the user identity token according to the control instruction of the target user.

[0119] In some alternative embodiments, the method for encrypting and decrypting the target file further includes: in response to the read operation of the decrypted target file, storing the decrypted target file through a plaintext buffer channel; in response to the write operation of the encrypted target file, storing the encrypted target file through a ciphertext buffer channel.

[0120] An embodiment of the present invention further provides a computer device for executing the method for encrypting and decrypting the target file as described above Figure 5 shown.

[0121] Please refer to Figure 6 , Figure 6 which is a schematic structural diagram of a computer device provided by an alternative embodiment of the present invention. As Figure 6 shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including a high-speed interface and a low-speed interface. Each component communicates with each other using different buses and can be installed on a common motherboard or installed in other ways as needed. The processor can process instructions executed within the computer device, including instructions stored in the memory or on the memory to display graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some alternative embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a set of blade servers, or a multi-processor system). Figure 6 One processor 10 is taken as an example in

[0122] The processor 10 may be a central processing unit, a network processor, or a combination thereof. Among them, the processor 10 may further include a hardware chip. The above-mentioned hardware chip may be an application-specific integrated circuit, a programmable logic device, or a combination thereof. The above-mentioned programmable logic device may be a complex programmable logic device, a field-programmable gate array, a generic array logic, or any combination thereof.

[0123] Among them, the memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiments.

[0124] The memory 20 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may further include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state storage devices. In some alternative embodiments, the memory 20 may optionally include a memory remotely set relative to the processor 10, and these remote memories may be connected to the computer device through a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an enterprise intranet, a local area network, a mobile communication network, and combinations thereof.

[0125] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk, or a solid-state drive; the memory 20 may further include a combination of the above types of memories.

[0126] The computer device further includes a communication interface 30 for the computer device to communicate with other devices or communication networks.

[0127] Embodiments of the present invention also provide a computer-readable storage medium. The method according to the embodiments of the present invention can be implemented in hardware, firmware, or be implemented as computer code that can be recorded on a storage medium, or be implemented as computer code that is originally stored in a remote storage medium or a non-transitory machine-readable storage medium and downloaded through a network and will be stored in a local storage medium, so that the method described herein can be stored as such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk, or a solid-state drive, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by the computer, the processor, or the hardware, the method shown in the above embodiments is implemented.

[0128] A part of the present invention can be applied as a computer program product, for example, computer program instructions. When executed by a computer, through the operation of the computer, the method and / or technical solution according to the present invention can be called or provided. Those skilled in the art should be able to understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Herein, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible by the computer.

[0129] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. An encryption and decryption system for target files, characterized in that, The system includes: a login and authentication module, an access control and permission configuration module, a communication and policy control module, a basic key management module, and an encryption and decryption module; The login and authentication module is used to verify the identity of the target user according to the account password information sent by the target user, and obtain a user identity token according to the account password information; The access control and permission configuration module is used to determine whether the target user has access permission to the target file according to the user identity token and the target file identifier sent by the target user, and is used to obtain the target key corresponding to the target file according to the fact that the target user has access permission to the target file; The communication and policy control module is used to obtain the encrypted target file from the server according to the target file acquisition instruction and the target file identifier; The basic key management module is used to provide a public key and an encryption and decryption policy for the encryption and decryption module; The encryption and decryption module is used to decrypt the file content of the encrypted target file according to the decryption instruction of the target user, using the symmetric decryption policy in the encryption and decryption policy provided by the basic key management module and the public key, and decrypt the file encryption header of the encrypted target file using the asymmetric decryption policy in the encryption and decryption policy provided by the basic key management module and the target key; The encryption and decryption module is used to obtain the decrypted target file according to the decrypted file content and the decrypted file encryption header.

2. The system according to claim 1, wherein, The encryption and decryption module is further used to encrypt the file content of the target file according to the encryption instruction of the target user, using the symmetric encryption policy in the encryption and decryption policy provided by the basic key management module and the public key, and encrypt the file encryption header of the target file using the asymmetric encryption policy in the encryption and decryption policy provided by the basic key management module and the target key; The encryption and decryption module is further used to generate the encrypted target file according to the encrypted file content and the encrypted file encryption header; The communication and policy control module is used to send the encrypted target file to the server.

3. The system according to claim 1 or 2, characterized in that, The login and authentication module includes: A user configuration unit, which is used to configure the user group and the account password information according to the control instruction of the target user.

4. The system according to claim 1 or 2, characterized in that, The access control and permission configuration module includes: A file list determination unit, which is used to obtain permission information according to the user identity token, query multiple files with access permission corresponding to the user identity token according to the permission information, and obtain a user application permission table; An access permission determination unit, which is used to match the target file identifier with the user application permission table. If the target file identifier exists in the user application permission table, it is determined that the target user has access permission to the target file; if the target file identifier does not exist in the user application permission table, it is determined that the target user does not have access permission to the target file.

5. The system according to claim 1 or 2, characterized in that, The access control and permission configuration module includes: A permission configuration unit for modifying the permission information corresponding to the user identity token according to the control instruction of the target user.

6. The system according to claim 2, wherein The encryption and decryption module includes: A plaintext buffer channel generation unit for storing the decrypted target file through a plaintext buffer channel in response to a read operation of the decrypted target file. A ciphertext buffer channel generation unit for storing the encrypted target file through a ciphertext buffer channel in response to a write operation of the encrypted target file.

7. A method for encrypting and decrypting a target file, characterized in that, The method includes: Verifying the identity of the target user according to the account password information sent by the target user, and obtaining a user identity token according to the account password information. Judging whether the target user has access rights to the target file according to the user identity token and the target file identifier sent by the target user, and obtaining the target key corresponding to the target file according to the fact that the target user has access rights to the target file. Obtaining the encrypted target file from the server according to a target file acquisition instruction and the target file identifier. Decrypting the file content of the encrypted target file by using the symmetric decryption strategy in the encryption and decryption policy provided by the basic key management module and the asymmetric decryption strategy in the encryption and decryption policy provided by the basic key management module and the target key according to the decryption instruction of the target user. Obtaining the decrypted target file according to the decrypted file content and the decrypted file encryption header.

8. A computer device, characterized in that, It includes: A memory and a processor, which are communicatively connected to each other. Computer instructions are stored in the memory, and the processor executes the computer instructions to execute the encryption and decryption method of the target file according to claim 7.

9. A computer-readable storage medium, characterized in that, Computer instructions are stored on the computer-readable storage medium, and the computer instructions are used to cause a computer to execute the encryption and decryption method of the target file according to claim 7.

10. A computer program product, characterized in that, It includes computer instructions, and the computer instructions are used to cause a computer to execute the encryption and decryption method of the target file according to claim 7.

Images