Document set security protection method and system and computer readable storage medium

Abstract

The invention belongs to the field of network security, particularly relates to a document set security protection method and system and a computer readable storage medium, and aims to solve the problem that a key and an encrypted document are easy to leak in a document transmission process. The method comprises the steps that a first server encrypts a document set, generates an encrypted document set and an original password table, stores the encrypted document set in a file stream mode to form continuous encrypted document blocks, encrypts the original password table to generate a primary encrypted password table, mixes the primary encrypted password table with a machine feature code of an authorized server, and sends the mixed primary encrypted password table to the authorized server; generating a mixed password table, wherein the mixed password table and the encrypted document blocks form an encrypted data set; the second server obtains the encrypted data set and then obtains the document set through cleaning and multiple decryption, and therefore safety protection of the document set transmission process and the whole life cycle is achieved.

Description

Background Art

[0002] Existing document encryption methods only ensure confidentiality through encryption, with a single protection mechanism, lacking collaborative protection for document integrity and availability. There are problems such as easy key leakage during transmission, and difficulty in detecting key leakage or document tampering. At the same time, there is a lack of usage control after document encryption, and it can be copied and used on any device at will, increasing the risk of encrypted document leakage, making document encryption ineffective and difficult to ensure the security of the entire data life cycle. Summary of the Invention

[0003] To solve the above problems in the prior art, that is, the problems of easy leakage of keys and encrypted documents during document transmission, the present application provides a method for secure protection of a document set, and the method includes: The first server encrypts the document set to generate an encrypted document set and an original password table, and the original password table contains the keys used for encrypting the document set; The first server stores the encrypted document set in the form of a file stream to form continuous encrypted document blocks; The first server encrypts the original password table to generate a primary encrypted password table; The first server mixes the primary encrypted password table with the machine feature code of the authorization server to generate a mixed password table. The mixed password table corresponds to the continuous encrypted document blocks, and the mixed password table and the corresponding encrypted document blocks form an encrypted data set; The second server obtains the encrypted data set; The second server cleans the mixed password table in the encrypted data set according to its own machine feature code and a preset rule. If the cleaning is successful, the primary encrypted password table is obtained; The second server extracts the encrypted document set according to the encrypted document blocks; The second server decrypts the primary encrypted password table to obtain the original password table; The second server decrypts the encrypted document set based on the original password table to obtain the document set.

[0004] Optionally, the method for secure protection of the document set further includes: The first server stores the metadata information corresponding to the encrypted document blocks in a distributed storage system; The second server obtains the metadata information and verifies the encrypted document blocks according to the metadata information. If the verification passes, the encrypted document set is extracted according to the encrypted document blocks.

[0005] Optionally, the encrypted data set further includes the mixing rule of the primary encrypted password table and the machine feature code of the authorization server.

[0006] Optionally, in the document set security protection method, the generation of the first encrypted password table by encrypting the original password table includes: The first server encrypts the original password table using a block symmetric cryptography algorithm to generate the first encrypted password table; The second server decrypts the first encrypted password table according to the decryption algorithm corresponding to the first encrypted password table.

[0007] Optionally, the document set security protection method further includes: The first server sets the usage permissions of the document set and generates a permission password table, where the permission password table corresponds to the document set; The first server encrypts the document set and the permission password table to generate an encrypted document set, an encrypted permission password table, and an original password table.

[0008] Optionally, the hybrid password table, the corresponding encrypted document block, and the encrypted permission password table form an encrypted data set; The second server decrypts the encrypted document set and the encrypted permission password table based on the original password table to obtain the document set and the permission password table, and performs operations on the document set according to the permission password table.

[0009] Optionally, in the document set security protection method, the first server stores the encrypted permission password table in a distributed storage system; The second server obtains the encrypted permission password table, decrypts the encrypted document set and the encrypted permission password table based on the original password table to obtain the document set and the permission password table, and performs operations on the document set according to the permission password table.

[0010] On the other hand, the present application proposes a document set security protection system, including: A first server, where the first server includes: An encryption module, configured to encrypt the document set to generate an encrypted document set and an original password table, where the original password table contains the key used to encrypt the document set; A file stream module, configured to store the encrypted document set in a file stream manner to form continuous encrypted document blocks; A multi-layer encryption module, configured to encrypt the original password table to generate a first encrypted password table; A hybrid module, configured to hybridize the first encrypted password table with the machine feature code of the authorization server to generate a hybrid password table, where the hybrid password table corresponds to the continuous encrypted document blocks, The hybrid cipher table and the corresponding encrypted document block form an encrypted data set; A second server, the second server includes: A data acquisition module for acquiring the encrypted data set; A cleaning module for cleaning the hybrid cipher table in the encrypted data set according to its own machine feature code and a preset rule, and if the cleaning is successful, obtaining the first-encrypted cipher table; An extraction module for extracting the encrypted document set according to the encrypted document block; A first decryption module for decrypting the first-encrypted cipher table to obtain the original cipher table; A second decryption module for decrypting the encrypted document set based on the original cipher table to obtain the document set.

[0011] Optionally, in the document set security protection system, the first server further includes: A document set permission setting module for setting the usage permission of the document set and generating a permission cipher table, where the permission cipher table corresponds to the document set; The encryption module of the first server for encrypting the document set and the permission cipher table to generate an encrypted document set, an encrypted permission cipher table, and an original cipher table; The second decryption module of the second server for decrypting the encrypted document set and the encrypted permission cipher table based on the original cipher table to obtain the document set and the permission cipher table.

[0012] Optionally, the data acquisition module of the second server is used to acquire the encrypted data set and the encrypted permission cipher table.

[0013] Optionally, the second server further includes a permission execution module for performing operations on the document set according to the permission cipher table.

[0014] Optionally, the hybrid module of the first server is used to form an encrypted data set according to the hybrid cipher table, the encrypted document block, and the corresponding encrypted permission cipher table; the data acquisition module of the second server is used to acquire the encrypted data set.

[0015] Optionally, the file stream module of the first server is further used to store the metadata information corresponding to the encrypted document block in a distributed storage system; the extraction module of the second server is used to acquire the metadata information and verify the encrypted document block in the encrypted data set according to the metadata information, and if the verification passes, extract the encrypted document set according to the encrypted document block.

[0016] In the third aspect of the present application, a computer device cluster is proposed, including: At least two processors; and A memory communicatively connected to the at least two processors; wherein The memory stores instructions executable by the processors, and the instructions are used to be executed by the processors to perform the above-mentioned document set security protection method.

[0017] Optionally, one of the at least two processors serves as the processor of the first server, and the other serves as the processor of the second server.

[0018] In a fourth aspect of the present application, a computer-readable storage medium is proposed. The computer-readable storage medium stores computer instructions, and the computer instructions are used to be executed by the computer to implement the above-mentioned document set security protection method.

[0019] The present application encrypts a document set and stores it in the form of a continuous encrypted document block in a file stream manner, and re-encrypts the original password table of the encrypted document set to obtain a primary encrypted password table. Then, the primary encrypted password table is mixed with the authorized machine feature code to generate a mixed password table, and the generated mixed password table and the encrypted document block together form an encrypted data set for deliverable transmission. After obtaining the encrypted data set, the document user extracts and aggregates the encrypted document block to obtain the encrypted document set, and cleans or unmixes the mixed password table based on its own robot feature code. Only when its own robot feature code is consistent with the authorized machine feature code, it is possible to successfully clean and obtain the primary encrypted password table, and then perform two decryptions. First, decrypt the primary encrypted password table to obtain the original password table, and then decrypt the encrypted document set according to the original password table to obtain the original document set. In this process, the document set is stored in a file stream manner, and double encryption protection is achieved by re-encrypting the original password table, thereby effectively preventing the leakage of keys and data during document transmission. Moreover, by introducing the mixing of the authorized machine feature code and the password table after secondary encryption, the security of document transmission is further enhanced, and the usage rights of the document are controlled, meeting the commercial requirements of the document while improving the security of the document and realizing the security of the entire data life cycle. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] By reading the detailed description of the non-limiting embodiments with reference to the following drawings, other features, objects, and advantages of the present application will become more apparent: Figure 1 is a flowchart of an implementation manner of the document set security protection method of the present application; Figure 2 is a flowchart of another implementation manner of the document set security protection method of the present application; Figure 3 is a flowchart of yet another implementation manner of the document set security protection method of the present application; Figure 4It is a schematic structural diagram of an implementation manner of the document set security protection system of the present application; Figure 5 It is a schematic structural diagram of another implementation manner of the document set security protection system of the present application; Figure 6 It is a schematic structural diagram of the computer system of the server for implementing the method, system, and device embodiments of the present application. Specific implementation manner

[0021] The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the related invention and are not intended to limit the invention. Additionally, it should be noted that for the sake of description, only the parts related to the relevant invention are shown in the drawings.

[0022] It should be noted that, without conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The present application will be described in detail below with reference to the drawings and embodiments.

[0023] The present application provides a document set security protection method, which is applied to interactive computer devices. One of them is called the first server, and the other party interacting with it is called the second server. The first server and the second server can be respectively the sender and receiver of the document, or respectively the server and the client, or respectively different nodes in the network, or respectively the central server and the node in the network, etc. "The first server" and "the second server" are only used to distinguish the two parties of the interaction and do not limit the computer devices. At least one document is included in the document set, and the document can be a layout document or a non-layout document.

[0024] The document set security protection method, as Figure 1 shown, includes: Step S1011, the first server encrypts the document set to generate an encrypted document set and an original password table, and the original password table contains the key used for encrypting the document set; Step S1012, the first server stores the encrypted document set in the form of a file stream to form continuous encrypted document blocks; Step S1013, the first server encrypts the original password table to generate a first-level encrypted password table; Step S1014, the first server mixes the first-level encrypted password table with the machine feature code of the authorization server to generate a mixed password table. The mixed password table corresponds to the continuous encrypted document blocks, and the mixed password table and the corresponding encrypted document blocks form an encrypted data set; Step S1021, the second server obtains the encrypted data set; Step S1022: The second server cleans the mixed password table in the encrypted dataset according to its own machine signature and preset rules. If the cleaning is successful, the first-level encrypted password table is obtained. Step S1023: The second server extracts the encrypted document set from the encrypted document blocks. Step S1024: The second server decrypts the first-level encrypted password table to obtain the original password table. Step S1025: The second server decrypts the encrypted document set based on the original password table to obtain the document set.

[0025] Among them, steps S1011 - S1014 are executed by the first server. In step S1011, the document set is encrypted. Specifically, a symmetric encryption algorithm can be used to encrypt the document set, and through encryption, an encrypted document set and an original password table are generated. The original password table contains the key used for encryption.

[0026] After encrypting the document set, in step S1012, the encrypted document set is written to the target storage medium in the form of a file stream for storage. The target storage medium can be the local of the first server or a distributed storage system, etc. During the writing process, the encrypted document set can be divided into blocks according to a preset size to form continuous encrypted document blocks. In one implementation, the first server can also store the metadata information corresponding to the encrypted document blocks locally on the first server or in a distributed storage system for subsequent acquisition and use by the second server.

[0027] Meanwhile, in step S1013, the original password table is further encrypted. Specifically, a block symmetric cipher algorithm can be used to encrypt the original password table to generate a first-level encrypted password table, effectively preventing the leakage of the key of the original password table.

[0028] Furthermore, in step S1014, the first-level encrypted password table is mixed with the machine signature of the authorization server to generate a mixed password table. Specifically, an existing confusion algorithm can be used to mix the first-level encrypted password table with the machine signature, or the first-level encrypted password table and the machine signature are superimposed and then perturbation data is added to complete the mixing. Among them, the machine signature can be the MAC address, motherboard information, or MD5 check code, etc., of the authorization server, and the authorization server is a computer device that has obtained the usage permission of the document set. Through the mixing process, not only can the use of the second server be controlled through the machine signature, but also the generated mixed encrypted password table is difficult to restore the real information even if it is intercepted, further preventing the leakage of the encryption key of the document set, thereby ensuring the security of the document set. The generated mixed password table corresponds to the continuous encrypted document blocks formed in step S1012, and forms a deliverable and transmissible encrypted dataset with the corresponding continuous encrypted document blocks and is stored in the same place.

[0029] The second server executes step S1021 when needed to obtain the encrypted dataset from the storage of the encrypted dataset, so as to obtain the mixed password table and the corresponding consecutive encrypted document blocks. Then, step S1022 cleans, that is, unmixes, the mixed password table. Specifically, step S1022 obtains the corresponding unmixing rule, that is, the preset rule, according to the mixing rule, and cleans the mixed password table based on the unmixing rule and the machine signature of the second server itself, and separates the primary encrypted password table. In one implementation, the machine signature is a conditional factor in the unmixing rule. If the machine signature of the second server itself is the same as (or the same as one of the machine signatures of multiple authorization servers) the machine signature of the authorization server, the unmixing rule can be executed, so as to successfully clean the mixed password table and separate the primary encrypted password table; if they are not the same, the cleaning fails, and the second server cannot separate the primary encrypted password table and cannot further use the document set. In another implementation, the machine signature is a conditional factor for obtaining the mixing rule. If the machine signature of the second server itself is different from the machine signature of the authorization server, the mixing rule cannot be obtained, nor can the mixed password table be cleaned. This ensures that only authorized servers can obtain the usage rights of the document set, thereby preventing document leakage and ensuring document security. Among them, in one implementation, the mixing rule, that is, the rule for generating the mixed password table, is also written into the mixed password table; in another implementation, the mixing rule can also be saved in other files and form an encrypted dataset together with the mixed password table and the encrypted document blocks.

[0030] Step S1023 then extracts the encrypted document set according to the encrypted document blocks in the encrypted dataset according to the file stream rule. Step S1023 and step S1022 can be executed simultaneously or successively. After obtaining the primary encrypted password table, step S1024 decrypts the primary encrypted password table to obtain the original password table. Among them, the extraction of the encrypted document set and the decryption of the primary encrypted password table can be implemented according to the existing technology. Step S1025 then obtains the key based on the original password table to decrypt the encrypted document set to obtain the document set.

[0031] The document set security protection method provided by this application not only encrypts the document set, but also re-encrypts the original password table of the encrypted document set to prevent the leakage of the original key. After the encrypted original password table is mixed with the authorized machine feature code, it is transmitted together with the encrypted document blocks processed in the file stream manner, which multiple guarantees the security of the document and the key during the transmission process. By combining security with permission control, even if the transmitted encrypted data set is intercepted, it cannot be recognized and there is no permission to separate the key, nor is there any permission to use the document set. Only computer devices with the authorized machine feature code can obtain the document set by extraction and decryption. Compared with the prior art, this application can achieve the security protection of the entire life cycle of the document set. Even if the data is intercepted or copied, it cannot be used, and it has more stringent security and stability.

[0032] In another implementation, as Figure 2 shown, the document set security protection method provided by this application includes: Step S2011, the first server sets the usage permission of the document set and generates a permission password table, and the permission password table corresponds to the document set; Step S2012, the first server encrypts the document set and the permission password table to generate an encrypted document set, an encrypted permission password table, and an original password table. The original password table contains the keys used to encrypt the document set and the permission password table; Step S2013, the first server stores the encrypted document set in the file stream manner to form continuous encrypted document blocks; Step S2014, the first server encrypts the original password table to generate a once-encrypted password table; Step S2015, the first server mixes the once-encrypted password table with the machine feature code of the authorized server to generate a mixed password table. The mixed password table corresponds to the continuous encrypted document blocks, and the mixed password table, the corresponding encrypted document blocks, and the encrypted permission password table form an encrypted data set; Step S2021, the second server obtains the encrypted data set; Step S2022, the second server cleans the mixed password table in the encrypted data set according to its own machine feature code and preset rules. If the cleaning is successful, the once-encrypted password table is obtained; Step S2023, the second server extracts the encrypted document set according to the encrypted document blocks; Step S2024, the second server decrypts the once-encrypted password table to obtain the original password table; Step S2025: The second server decrypts the encrypted document set and the encrypted permission information based on the original password table to obtain the document set and the permission password table, and performs operations on the document set according to the permission password table.

[0033] In this embodiment, the first server also sets the usage permissions of the document set and generates a permission password table. The permission password table corresponds to the document set. Only by obtaining the permission password in the permission password table can operations with corresponding permissions be performed on the document set. For example, when setting the open permission password for the document set, only by obtaining the permission password can the open operation of the document set be executed. The first server encrypts the document set and the permission password table at the same time to generate an encrypted permission password table. In one embodiment, the encrypted permission password table is also included in the encrypted data set for transmission. After the second server separates and decrypts to obtain the original password table, it decrypts the encrypted document set and the encrypted permission password table based on the original password table to obtain the document set and the permission password table, and performs operations on the document set according to the permission password table. By setting the permission password, the permission management of the document set can be more convenient. In another embodiment, the encrypted permission password table is not included in the encrypted data set, but is separately stored by the first server in another distributed storage system, and a location index of the encrypted permission password table is set in the encrypted document set. When needed, the second server obtains the encrypted data set, obtains the encrypted permission password table according to the location index of the encrypted permission password table, and then decrypts the encrypted permission password table based on the original password table to obtain the permission password table. This embodiment stores the encrypted permission password table separately from the encrypted document set, which can further enhance the security of document usage.

[0034] In still another embodiment, as Figure 3 shown, the document set security protection method provided by the present application includes: Step S3011: The first server sets the usage permissions of the document set and generates a permission password table, and the permission password table corresponds to the document set; Step S3012: The first server encrypts the document set and the permission password table to generate an encrypted document set, an encrypted permission password table, and an original password table. The original password table contains the keys used to encrypt the document set and the permission password table; Step S3013: The first server stores the encrypted document set in the form of a file stream to form continuous encrypted document blocks; Step S3014: Store the metadata information corresponding to the encrypted document blocks in a distributed storage system; Step S3015: The first server encrypts the original password table to generate a once-encrypted password table; Step S3016, the first server mixes the one-time encrypted password table with the machine fingerprint of the authorization server to generate a mixed password table, which corresponds to the consecutive encrypted document blocks. The mixed password table and the corresponding encrypted document blocks form an encrypted data set; Step S3021, the second server obtains the encrypted data set and the encrypted permission password table; Step S3022, the second server cleans the mixed password table in the encrypted data set according to its own machine fingerprint and a preset rule. If the cleaning is successful, the one-time encrypted password table is obtained; Step S3023, the second server obtains the metadata information and verifies the encrypted document blocks in the encrypted data set according to the metadata information; Step S3024, if the verification passes, the second server extracts the encrypted document set from the encrypted document blocks; Step S3025, the second server decrypts the one-time encrypted password table to obtain the original password table; Step S3026, the second server decrypts the encrypted document set and the encrypted permission information based on the original password table to obtain the document set and the permission password table, and performs operations on the document set according to the permission password table.

[0035] In this embodiment, the first server also stores the metadata information corresponding to the encrypted document blocks in other distributed storage systems. After the second server obtains the encrypted document blocks in the encrypted data set, it obtains the metadata information from the distributed storage system according to the association information in the encrypted document blocks or the association information in the document set usage information previously obtained by the second server, and verifies the encrypted document blocks according to the metadata information. If the verification passes, the encrypted document set is extracted from the encrypted document blocks. If the verification fails, the encrypted document blocks cannot be correctly extracted, and the second server can display an error message. This can further ensure the integrity and transmission security of the document set. In addition, in this embodiment, the encrypted permission password table is not included in the encrypted data set, but is separately stored by the first server in other distributed storage systems. The second server obtains the encrypted data set and the encrypted permission password table when needed, and then decrypts the encrypted permission password table based on the original password table to obtain the permission password table. This embodiment stores the encrypted permission password table and the encrypted document set separately, which can further improve document permission control and the security of the entire document life cycle.

[0036] In the above embodiments, although the various steps are described in the above order, those skilled in the art can understand that in order to achieve the effects of this embodiment, different steps do not have to be executed in such an order, and they can be executed simultaneously (in parallel) or in a reversed order, and these simple changes are all within the protection scope of the present invention.

[0037] On the other hand, the present application proposes a document set security protection system, and the system includes a first server and a second server. In one implementation, as Figure 3 shown, the first server includes: An encryption module, configured to encrypt the document set to generate an encrypted document set and an original password table, where the original password table contains the key used for encrypting the document set; A file stream module, configured to store the encrypted document set in a file stream manner to form continuous encrypted document blocks; A multi-layer encryption module, configured to encrypt the original password table to generate a primary encrypted password table; A mixing module, configured to mix the primary encrypted password table with the machine feature code of the authorization server to generate a mixed password table, where the mixed password table corresponds to the continuous encrypted document blocks, and the mixed password table and the corresponding encrypted document blocks form an encrypted data set; The second server includes: A data acquisition module, configured to acquire the encrypted data set; A cleaning module, configured to clean the mixed password table in the encrypted data set according to its own machine feature code and a preset rule. If the cleaning is successful, the primary encrypted password table is obtained; An extraction module, configured to extract the encrypted document set according to the encrypted document blocks; A first decryption module, configured to decrypt the primary encrypted password table to obtain the original password table; A second decryption module, configured to decrypt the encrypted document set based on the original password table to obtain the document set.

[0038] Among them, the encrypted data set can be stored in the first server, and the second server acquires the encrypted data set from the first server. The encrypted data set can also be stored in whole or in part elsewhere, such as other distributed storage systems, and the second server acquires the encrypted data set from the storage location of the encrypted data set.

[0039] In another implementation of the document set security protection system, as Figure 4 shown, the first server further includes: A document set permission setting module, configured to set the usage permissions of the document set and generate a permission password table, where the permission password table corresponds to the document set; An encryption module for encrypting the document set and the permission password table to generate an encrypted document set, an encrypted permission password table, and an original password table; A file stream module for storing the encrypted document set in a file stream manner to form continuous encrypted document blocks; A multi-layer encryption module for encrypting the original password table to generate a first encrypted password table; A mixing module for mixing the first encrypted password table with the machine feature code of the authorization server to generate a mixed password table, where the mixed password table corresponds to the continuous encrypted document blocks, and the mixed password table and the corresponding encrypted document blocks form an encrypted data set; The second server includes: A data acquisition module for acquiring the encrypted data set and the encrypted permission password table; A cleaning module for cleaning the mixed password table in the encrypted data set according to its own machine feature code and preset rules. If the cleaning is successful, the first encrypted password table is obtained; An extraction module for extracting the encrypted document set according to the encrypted document blocks; A first decryption module for decrypting the first encrypted password table to obtain the original password table; A second decryption module for decrypting the encrypted document set and the encrypted permission password table based on the original password table to obtain the document set and the permission password table; A permission execution module for performing operations on the document set according to the permission password table.

[0040] In one implementation, the mixing module of the first server can form an encrypted data set according to the mixed password table, the corresponding encrypted document blocks, and the encrypted permission password table. The data acquisition module of the second server is used to acquire the encrypted data set and does not need to acquire the encrypted permission password table separately.

[0041] In one implementation, the file stream module of the first server is further used to store the metadata information corresponding to the encrypted document blocks in a distributed storage system; the extraction module of the second server is used to acquire the metadata information and verify the encrypted document blocks in the encrypted data set according to the metadata information. If the verification passes, the encrypted document set is extracted according to the encrypted document blocks.

[0042] The document set security protection system provided by this application re - encrypts the original password table of the encrypted document set to prevent the leakage of the original key, and then mixes the encrypted original password table with the authorized machine feature code and transmits it with the encrypted document blocks processed in the file stream manner, multiple - guaranteeing the security of the documents and keys during the transmission process. Combined with permission control, the transmitted data cannot be recognized even if intercepted, and there is no permission to separate the key, nor any permission to use the document set, thus realizing more rigorous security protection for the entire life cycle of the document set.

[0043] Those skilled in the art can clearly understand that for the convenience and conciseness of description, the specific working process and related explanations of the above - described system can refer to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0044] It should be noted that the document set security protection system provided in the above - mentioned embodiments is only illustrated by the division of the above - mentioned functional modules. In actual applications, the above - mentioned functions can be allocated to different functional modules according to needs, that is, the modules or steps in the embodiments of the present invention can be further decomposed or combined. For example, the modules in the above - mentioned embodiments can be combined into one module, or further split into multiple sub - modules to complete all or part of the functions described above. For the names of the modules and steps involved in the embodiments of the present invention, they are only used to distinguish each module or step, and are not regarded as an improper limitation of the present invention.

[0045] In the third aspect of this application, a computer device cluster is proposed, including: At least two processors; and A memory communicatively connected to at least two of the processors; wherein, The memory stores instructions executable by the processors, and the instructions are used to be executed by the processors to perform the above - mentioned document set security protection method.

[0046] In one implementation, one of the at least two processors serves as the processor of the first server, and the other serves as the processor of the second server.

[0047] In the fourth aspect of this application, a computer - readable storage medium is proposed. The computer - readable storage medium stores computer instructions, and the computer instructions are used to be executed by the computer to implement the above - mentioned document set security protection method.

[0048] Those skilled in the art can clearly understand that for the convenience and conciseness of description, the specific working process and related explanations of the above - described storage device and processing device can refer to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0049] Those skilled in the art should be able to realize that the modules and method steps of each example described in combination with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. The programs corresponding to the software modules and method steps can be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the technical field. To clearly illustrate the interchangeability of electronic hardware and software, the composition and steps of each example have been generally described according to functions in the above description. Whether these functions are executed in the form of electronic hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0050] Reference is made below to Figure 6 , which shows a schematic structural diagram of a computer system of a server for implementing the method, system, and device embodiments of the present application. Figure 6 The server shown is only an example and should not impose any limitations on the functions and scope of use of the embodiments of the present application.

[0051] As Figure 6 shown, the computer system includes a central processing unit (CPU, Central Processing Unit) 601, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM, Read Only Memory) 602 or the program loaded from the storage section 608 into the random access memory (RAM, Random Access Memory) 603. In the RAM 603, various programs and data required for system operation are also stored. The CPU 601, ROM 602, and RAM 603 are connected to each other through a bus 604. The input / output (I / O, Input / Output) interface 605 is also connected to the bus 604.

[0052] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc. and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is mounted on the drive 610 as needed so that a computer program read therefrom is installed into the storage section 608 as needed.

[0053] In particular, according to embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product that includes a computer program carried on a computer-readable medium, and the computer program includes program code for performing the methods shown in the flowcharts. In such an embodiment, the computer program can be downloaded and installed from a network through the communication section 609 and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-described functions defined in the methods of the present application are performed. It should be noted that the computer-readable medium described above in the present application can be a computer-readable signal medium, a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples of the computer-readable storage medium can include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present application, a computer-readable signal medium can include a data signal propagated in a baseband or as part of a carrier wave, which carries the computer-readable program code. Such a propagated data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer-readable signal medium can also be any computer-readable medium other than the computer-readable storage medium, which can send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted by any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0054] Computer program code for performing the operations of this application can be written in one or more programming languages or combinations thereof. The above-mentioned programming languages include object-oriented programming languages such as Java, Smalltalk, C++, and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, executed as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (for example, by using an Internet service provider to connect through the Internet).

[0055] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in the flowchart or block diagram can represent a module, a program segment, or a part of the code that contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks can occur in a different order than that marked in the accompanying drawings. For example, two consecutive blocks shown can actually be executed substantially in parallel, and they can sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system for performing the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0056] The terms "first", "second", etc. are used to distinguish similar objects, rather than to describe or represent a specific order or sequence.

[0057] The term "comprising" or any other similar term is intended to cover non-exclusive inclusion, such that a process, method, article, or device / equipment that comprises a series of elements includes not only those elements but also other elements not expressly listed, or also includes elements inherent in these processes, methods, articles, or devices / equipment.

[0058] So far, the technical solution of the present invention has been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easily understood by those skilled in the art that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will all fall within the protection scope of the present invention.

Claims

1. A method for protecting the security of a document set, characterized in that, Including: The first server encrypts the document set to generate an encrypted document set and an original password table, where the original password table contains the key used for encrypting the document set; The first server stores the encrypted document set in a file stream manner to form continuous encrypted document blocks; The first server encrypts the original password table to generate a first-level encrypted password table; The first server mixes the first-level encrypted password table with the machine feature code of the authorization server to generate a mixed password table, where the mixed password table corresponds to the continuous encrypted document blocks, and the mixed password table and the corresponding encrypted document blocks form an encrypted data set; The second server obtains the encrypted data set; The second server cleans the mixed password table in the encrypted data set according to its own machine feature code and a preset rule. If the cleaning is successful, the first-level encrypted password table is obtained; The second server extracts the encrypted document set according to the encrypted document blocks; The second server decrypts the first-level encrypted password table to obtain the original password table; The second server decrypts the encrypted document set based on the original password table to obtain the document set.

2. The document set security protection method according to claim 1, wherein It also includes: The first server stores the metadata information corresponding to the encrypted document blocks in a distributed storage system; The second server obtains the metadata information and verifies the encrypted document blocks according to the metadata information. If the verification passes, the encrypted document set is extracted according to the encrypted document blocks.

3. The method for protecting the security of a document set according to claim 1, wherein The encrypted data set also includes the mixing rule of the first-level encrypted password table and the machine feature code of the authorization server.

4. The method for protecting the security of a document set according to any one of claims 1-3, characterized in that, The method also includes: The first server sets the usage permission of the document set and generates a permission password table, where the permission password table corresponds to the document set; The first server encrypts the document set and the permission password table to generate an encrypted document set, an encrypted permission password table, and an original password table.

5. The method for protecting the security of a document set according to claim 4, wherein, The mixed password table and the corresponding encrypted document blocks, as well as the encrypted permission password table, form an encrypted data set; The second server decrypts the encrypted document set and the encrypted permission password table based on the original password table to obtain the document set and the permission password table, and performs operations on the document set according to the permission password table.

6. The method for protecting the security of a document set according to claim 4, wherein, The first server stores the encrypted permission password table in a distributed storage system; The second server obtains the encrypted permission password table. The second server decrypts the encrypted document set and the encrypted permission password table based on the original password table to obtain the document set and the permission password table, and performs operations on the document set according to the permission password table.

7. A document set security protection system, characterized in that, Including: A first server, where the first server includes: An encryption module for encrypting the document set to generate an encrypted document set and an original password table, where the original password table contains the key used for encrypting the document set; A file stream module for storing the encrypted document set in a file stream manner to form continuous encrypted document blocks; A multi-level encryption module for encrypting the original password table to generate a first-level encrypted password table; A mixing module, configured to mix the primary encrypted password table with the machine signature of the authorization server to generate a mixed password table, where the mixed password table corresponds to the consecutive encrypted document blocks, and the mixed password table and the corresponding encrypted document blocks form an encrypted data set; A second server, where the second server includes: A data acquisition module, configured to acquire the encrypted data set; A cleaning module, configured to clean the mixed password table in the encrypted data set according to its own machine signature and a preset rule. If the cleaning is successful, the primary encrypted password table is obtained; An extraction module, configured to extract the encrypted document set according to the encrypted document blocks; A first decryption module, configured to decrypt the primary encrypted password table to obtain the original password table; A second decryption module, configured to decrypt the encrypted document set based on the original password table to obtain the document set.

8. The document set security protection system according to claim 7, characterized in that The first server further includes: A document set permission setting module, configured to set the usage permissions of the document set and generate a permission password table, where the permission password table corresponds to the document set; The encryption module of the first server, configured to encrypt the document set and the permission password table to generate an encrypted document set, an encrypted permission password table, and an original password table; The data acquisition module of the second server, configured to acquire the encrypted data set and the encrypted permission password table; The second decryption module of the second server, configured to decrypt the encrypted document set and the encrypted permission password table based on the original password table to obtain the document set and the permission password table.

9. A computer device cluster, characterized in that, including: At least two processors; and A memory communicatively connected to the at least two processors; wherein, The memory stores instructions executable by the processors, and the instructions are used to be executed by the processors to implement the document set security protection method according to any one of claims 1-6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions, and the computer instructions are used to be executed by the computer to implement the document set security protection method according to any one of claims 1-6.

Images