Electronic file circulation security protection method and system

Abstract

The invention discloses an electronic file circulation security protection method and system, which ensure file content security through file encryption and decryption services. Through the signature generation service, the file digital signature generation, the combination of the signature verification service and the integrity verification of the file, the file and the operation log can be effectively prevented from being illegally tampered by depending on the non-tampering characteristic of the block chain, and the authenticity and integrity of the file in the storage and circulation process are ensured. Even if the file is attacked in the storage or transmission process, the change of the file can be found in time, and the reliability of the file content is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of network data security technology, and in particular to a method and system for protecting the security of electronic file circulation. Background Art

[0002] With the prevalence of digital office work, electronic documents are gradually replacing paper documents as the media carrier. However, compared with paper documents, electronic documents are more susceptible to tampering and forgery, making it difficult to ensure the authenticity, integrity, and effective traceability of documents during circulation. Specific shortcomings are as follows:

[0003] 1. Currently, the integrity protection of electronic files only targets the file content, and does not protect other file information (such as file name, creation time, file type, author information, etc.). This leads to problems such as tampering, forgery or theft of electronic files during circulation, causing the authenticity and integrity of the files to be destroyed.

[0004] 2. During the circulation of electronic files, especially in disconnected networks, it is difficult to determine key information such as the file status, operator, and operation time due to network inaccessibility and lack of reliable operation records. This may lead to the operator denying his or her own operation behavior, resulting in difficulties in responsibility identification and responsibility tracing. Summary of the Invention

[0005] In view of the deficiencies in the prior art, the present invention aims to provide a method and system for protecting the security of electronic file circulation.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] An electronic document circulation security protection method includes four parts: generating a digital signature, verifying the digital signature, encrypting the document, and decrypting the document;

[0008] (1) The process of generating a digital signature is as follows:

[0009] 1.1) Users input or upload electronic files to the electronic file security circulation system;

[0010] 1.2) The electronic document security circulation system uses a data parser to parse and extract the electronic document, including the file name, file content, and file meta-information; the extracted content serves as input to the hash operator;

[0011] 1.3) The electronic document security circulation system uses a hash operator to hash the contents extracted by the data analyzer separately or in combination, to obtain hash values ​​of the file name, file content and file meta-information separately or in combination;

[0012] 1.4) The electronic document security circulation system uses an encryption operator to encrypt the hash value obtained in step 1.3) using the user's private key, a random number, and a timestamp to generate a digital signature for the electronic document;

[0013] (2) The specific process of digital signature verification is as follows:

[0014] 2.1) Input or upload electronic files to the electronic file security circulation system;

[0015] 2.2) The electronic document security circulation system uses a data parser to parse and extract the electronic document. The extracted content includes the file name, file content and file meta-information. The extracted content serves as the input of the hash operator.

[0016] 2.3) The electronic document security circulation system uses a hash operator to hash the contents extracted by the data analyzer separately or in combination, and obtains the hash values ​​of the file name, file content and file meta-information separately or in combination;

[0017] 2.4) The electronic document security circulation system obtains the digital signature of the electronic document. The electronic document security circulation system uses a decryption operator to decrypt the digital signature of the electronic document using the user's public key to obtain a random number, a timestamp, and a hash value;

[0018] 2.5) The electronic document secure circulation system analyzes and compares the hash value obtained by the hash operator in step 2.3) with the hash value decrypted by the decryption operator in step 2.4) to obtain a verification result. If they are consistent, the verification is successful; otherwise, the verification fails.

[0019] (3) The specific process of file encryption is as follows:

[0020] 3.1) The user inputs or uploads the electronic file to be encrypted into the electronic file security circulation system;

[0021] 3.2) The electronic document security circulation system uses a data parser to parse and extract the electronic document. The extracted content is the file name, file content and file meta-information. The extracted content is used as the input of the hash operator 1;

[0022] 3.3) The electronic document security circulation system uses a hash operator to hash the contents extracted by the data parser separately or in combination, and obtains hash values ​​of the file name, file content and file meta-information separately or in combination;

[0023] 3.4) The electronic document security circulation system uses hash operator 2 to perform a single hash on the user's public key and the hash value obtained by hash operator 1 to obtain the key for the electronic document;

[0024] 3.5) The electronic file security circulation system uses the electronic file key to encrypt the electronic file, obtain the encrypted electronic file and return it to the user;

[0025] (IV) The specific process of file decryption is as follows:

[0026] 4.1) The electronic document security circulation system obtains the digital signature of the electronic document;

[0027] 4.2) The electronic document security circulation system uses a decryption operator to decrypt the digital signature of the electronic document using the user's public key to obtain a random number, a timestamp, and a hash value;

[0028] 4.3) The electronic document security circulation system uses the user's public key and hash value as input to the hash operator 2 to obtain the key of the electronic document;

[0029] 4.4) The electronic file security circulation system uses the electronic file's key to decrypt the encrypted file, obtain the plaintext electronic file, and return it to the user.

[0030] Furthermore, the electronic document security circulation system supports networking mode;

[0031] In the networking mode, the network of the file owner and the file user is connected. The file owner logs in to the electronic file security circulation system and uploads the plaintext electronic file to the electronic file security circulation system. The electronic file security circulation system uses the file owner's private key to encrypt the electronic file; the file owner sends or shares the encrypted electronic file to others through the electronic file security circulation system; after the file user logs in to the electronic file security circulation system, he views the received file list or the shared file list. The electronic file security circulation system calls the file owner's public key from the public key infrastructure to decrypt the electronic file that the file user wants to view, and the file user views the decrypted electronic file through the electronic file security circulation system; the electronic file security circulation system calls the file encryption, file decryption, and file transfer or file sharing chain methods in the smart contract, and saves the file encryption operation and file decryption operation logs in the blockchain for subsequent audits.

[0032] Furthermore, the electronic document security circulation system supports offline mode;

[0033] In offline mode, the network of the file owner and the file user is not connected. The file owner logs in to the electronic file security circulation system and uploads the plaintext electronic file to the electronic file security circulation system. The electronic file security circulation system uses the file owner's private key to encrypt the electronic file; the file owner or other users download the encrypted electronic file from the electronic file security circulation system and pass it to the file user offline; the file user downloads the file viewer client offline from the electronic file security process system; the file user opens the file viewer client, fills in the application information, and uploads the electronic file to be viewed; the file viewer client generates a file viewing application code; the file user uploads the file viewing application code to the electronic file security circulation system offline and obtains the file viewing authorization code from the electronic file security circulation system; the file user enters the file viewing authorization code into the file viewer client to view the content of the electronic file; the electronic file security circulation system calls the file encryption, file download, application information and file decryption application chain methods in the smart contract, and saves the relevant operation log records in the blockchain for subsequent audits.

[0034] Furthermore, the specific process of the file owner or other user downloading the electronic file from the electronic file security circulation system as a file downloader is: the file downloader views the file list and submits a download request, the electronic file security circulation system obtains the file downloader information, the electronic file and the digital signature of the electronic file, records the file downloader information in the download additional information, and then uses the file downloader's private key to encrypt and compress the electronic file, the digital signature of the electronic file and the download additional information to obtain an encrypted compressed file and return it to the file downloader.

[0035] Furthermore, in offline mode, after the file downloader passes the downloaded encrypted compressed file to the file user offline, the file user uploads the encrypted compressed file obtained from the file downloader to the file viewer client when viewing the electronic file through the file viewer client; the file viewer client automatically obtains the file user's computer unique identification code or MAC address, and combines the application information, the information of the encrypted compressed file and the computer unique identification code or MAC address, and encodes and generates a file viewing application code; after the file user submits the file viewing application code offline to the electronic file security circulation system, the electronic file security circulation system parses the file viewing application code, obtains the application information and Encrypt the information of the compressed file; the electronic file security circulation system obtains the public keys of the file owner and the file downloader from the public key infrastructure and generates a file viewing authorization code, sets an expiration date, and then transmits the file viewing authorization code to the file user offline; after the file user imports the obtained file viewing authorization code into the application list of the file viewer client, the file viewer client verifies the file viewing authorization code, obtains the public keys of the file owner and the file downloader, and then uses the public key of the file downloader to decrypt the encrypted compressed file, obtain the electronic file, the digital signature of the electronic file and the downloaded additional information, and then uses the public key of the file owner to decrypt the electronic file to obtain the decrypted electronic file for the file user to view.

[0036] Furthermore, before logging into the electronic document security circulation system, new users must first register their user identity. The specific process is as follows:

[0037] The user fills in the registered user information on the registration page provided by the electronic document security circulation system, including the unit name, department, user name, user ID number and login password; the electronic document security circulation system verifies the user information and applies for a certificate from the public key infrastructure. The public key infrastructure generates the user's public and private key pair and returns it to the electronic document security circulation system; the electronic document security circulation system calls the user registration chain method in the smart contract, and saves the user information and registration log in the blockchain for subsequent auditing; the user registration is completed and the private key information is saved.

[0038] Furthermore, after the electronic document security circulation system generates a digital signature and completes the encryption of the electronic document, it returns the encrypted electronic document and the digital signature of the electronic document to the user, and calls the method of encrypting and uploading the document digital signature to the chain in the smart contract file, and saves the relevant operation logs in the blockchain for subsequent auditing.

[0039] Furthermore, in the networked mode, when a file user views a file, he first checks the received file list or the shared file list and selects the electronic file to be viewed. The electronic file security circulation system parses the electronic file, obtains the file name, file metadata and the digital signature of the electronic file, and obtains the public key of the file owner of the electronic file from the public infrastructure, and verifies the digital signature of the electronic file. If the verification is successful, the electronic file security circulation system calls the file decryption service to decrypt the electronic file and returns the decryption result to the file user; the electronic file security circulation system calls the chain method of the file verification, viewing and decryption operations in the smart contract, and saves the relevant operation logs in the blockchain for subsequent audits.

[0040] Furthermore, during the audit, the auditor initiates the review of the log records of file encryption and decryption, file download and file decryption applications through the electronic document security circulation system; the electronic document security circulation system calls the log viewing chain method in the smart contract, saves the log query operation record in the blockchain for subsequent audits, and calls the relevant query service in the smart contract to obtain the log record details for the auditor to view; during tracing the source, the auditor uploads the electronic file to the electronic document security circulation system, the electronic document security circulation system obtains the digital signature of the electronic file, calls the query method of file encryption, download and file decryption application in the smart contract, obtains the relevant log information, and calls the traceability service to obtain the files related to the electronic file that needs to be traced, and then returns the operation log and related files to the auditor.

[0041] The present invention discloses an electronic document security circulation system for realizing the above method, comprising an application layer, a service layer, a data layer, a support layer and an operating environment;

[0042] The operating environment is composed of a domestic CPU, a domestic operating system, domestic middleware, a domestic database and a blockchain, and is used to provide a domestic operating environment;

[0043] The support layer is a public key infrastructure, which is used to uniformly manage keys and certificates and provide trusted user identities;

[0044] The data layer consists of a relational database and a blockchain, and is used to store data;

[0045] The service layer is used to provide digital signature generation services, digital signature verification services, file encryption services, file decryption services, file sending services, file sharing services, file receiving services, file tracing services and smart contract services in the blockchain;

[0046] The application layer consists of file management, system management, log auditing and file viewer clients, and is user-oriented, providing users with file encryption and decryption, file transfer, file sharing, user management, permission management and file traceability functions.

[0047] The beneficial effects of the present invention are:

[0048] 1. Ensure file confidentiality, authenticity, and integrity: This invention ensures the security of file content through file encryption and decryption services. It generates digital signatures through signature generation services and performs integrity verification on files in conjunction with signature verification services. Leveraging the blockchain's immutable nature, this technology effectively prevents illegal tampering of files and operation logs, ensuring the authenticity and integrity of files during storage and transfer. Even if a file is attacked during storage or transmission, changes can be detected promptly, ensuring the reliability of the file content.

[0049] 2. Achieve operator non-repudiation: Digital signature technology ensures that every file operation is clearly attributed to a responsible individual, making it impossible for the operator to deny their actions. Because digital signatures are generated using the operator's private key, which is held solely by the operator and whose security is strictly protected. Furthermore, detailed operation logs are recorded in the blockchain, further enhancing the credibility and traceability of these records. This allows for quick and accurate identification of the operator and clear accountability in the event of a dispute, effectively avoiding disputes arising from unclear accountability.

[0050] 3. Enhanced Data Credibility and Compliance: Blockchain permanently stores key file information within the network, providing an immutable historical record of files and operation logs, ensuring high credibility. Whether in internal audits, legal disputes, or business tracing, blockchain-stored evidence enables comprehensive and accurate tracing of the entire file lifecycle, providing strong data support for decision-making within organizations and businesses. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 This is a schematic diagram of the principle of generating a digital signature in Example 1 of the present invention;

[0052] Figure 2 Schematic diagram of the principle of digital signature verification in Example 1 of the present invention;

[0053] Figure 3 This is a schematic diagram of the principle of file encryption in Example 1 of the present invention;

[0054] Figure 4 This is a schematic diagram of the principle of file decryption in Example 1 of the present invention;

[0055] Figure 5This is a schematic diagram of the system architecture in Example 2 of the present invention;

[0056] Figure 6 This is a flowchart of the use of the electronic document security circulation system in the network mode in Example 1 of the present invention;

[0057] Figure 7 This is a flowchart of the use of the electronic file secure circulation system in offline mode in Example 1 of the present invention;

[0058] Figure 8 This is a flowchart of user identity registration in Example 1 of the present invention;

[0059] Figure 9 This is a flowchart of the electronic file security transfer system encryption file in Example 1 of the present invention;

[0060] Figure 10 This is a flow chart of sending / sharing files in networking mode in Example 1 of the present invention;

[0061] Figure 11 This is a flowchart of viewing files in the networking mode in Example 1 of the present invention;

[0062] Figure 12 This is a flowchart of downloading files in offline mode in Example 1 of the present invention;

[0063] Figure 13 This is a flowchart of viewing files in offline mode in Example 1 of the present invention;

[0064] Figure 14 This is the audit flow chart in Example 1 of the present invention;

[0065] Figure 15 This is a traceability flow chart in Example 1 of the present invention. DETAILED DESCRIPTION

[0066] The present invention will be further described below in conjunction with the accompanying drawings. It should be noted that this embodiment is based on the technical solution and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to this embodiment.

[0067] Example 1

[0068] This embodiment provides a method for protecting the security of electronic file transfer, including four parts: generating a digital signature, verifying the digital signature, encrypting the file, and decrypting the file;

[0069] (1) If Figure 1 As shown, the process of generating a digital signature is as follows:

[0070] 1.1) Users input or upload electronic files to the electronic file security circulation system;

[0071] 1.2) The electronic document secure circulation system uses a data parser to parse and extract the electronic document. The extracted content includes file name, file content, and file meta-information. The file meta-information is arranged according to creation time, file type (png, docx, pdf, ofd, etc.), file creator (user digital certificate), file classification level (confidential, secret, internal, public), file size (in bytes), and file permissions. The extracted content serves as input to the hash operator.

[0072] 1.3) The electronic document security circulation system uses a hash operator to hash the contents extracted by the data analyzer separately or in combination, to obtain hash values ​​of the file name, file content and file meta-information separately or in combination;

[0073] 1.4) The electronic document security circulation system uses an encryption operator, the user's private key, combined with a random number and a timestamp to encrypt the hash value obtained in step 1.3) to generate a digital signature for the electronic document.

[0074] In this embodiment, the hash operator supports hash algorithms such as domestic SM3 and SHA-256. The encryption operator supports various asymmetric encryption algorithms such as domestic SM2 and RSA. Random numbers are generated using a physical noise source generator, providing a high-quality random number source.

[0075] Digital signature generation ensures the authenticity, validity and integrity of electronic documents and operation information, and is used for signature verification services and non-repudiation services.

[0076] (2) If Figure 2 As shown, the specific process of digital signature verification is as follows:

[0077] 2.1) Input or upload electronic files to the electronic file security circulation system;

[0078] 2.2) The electronic document security circulation system uses a data parser to parse and extract electronic documents. The extracted content includes file name, file content, and file meta-information. The file meta-information is arranged according to creation time, file type (png, docx, pdf, ofd, etc.), file creator (user digital certificate), file classification level (confidential, secret, internal, public), file size (in bytes), and file permissions. The extracted content serves as input to the hash operator.

[0079] 2.3) The electronic document security circulation system uses a hash operator to hash the contents extracted by the data analyzer separately or in combination, and obtains the hash values ​​of the file name, file content and file meta-information separately or in combination;

[0080] 2.4) The electronic document security circulation system obtains the digital signature of the electronic document. The electronic document security circulation system uses a decryption operator to decrypt the digital signature of the electronic document using the user's public key to obtain a random number, a timestamp, and a hash value;

[0081] 2.5) The electronic document security circulation system analyzes and compares the hash value obtained by the hash operator in step 2.3) and the hash value decrypted by the decryption operator in step 2.4) to obtain a verification result. If they are consistent, the verification is successful; otherwise, the verification fails.

[0082] (3) If Figure 3 As shown in the figure, the specific process of file encryption is as follows:

[0083] 3.1) The user inputs or uploads the electronic file to be encrypted into the electronic file security circulation system;

[0084] 3.2) The electronic document security circulation system uses a data parser to parse and extract electronic documents. The extracted content includes file name, file content, and file meta-information. The file meta-information is arranged according to creation time, file type (png, docx, pdf, ofd, etc.), file creator (user digital certificate), file classification level (confidential, secret, internal, public), file size (in bytes), and file permissions. The extracted content serves as input to hash operator 1.

[0085] 3.3) The electronic document security circulation system uses a hash operator to hash the contents extracted by the data parser separately or in combination, and obtains hash values ​​of the file name, file content and file meta-information separately or in combination;

[0086] 3.4) The electronic document security circulation system uses hash operator 2 to perform a single hash on the user's public key and the hash value obtained by hash operator 1 to obtain the key for the electronic document;

[0087] 3.5) The electronic file security circulation system uses the electronic file's key to encrypt the electronic file, obtain the encrypted electronic file and return it to the user.

[0088] (4) If Figure 4 As shown in the figure, the specific process of file decryption is as follows:

[0089] 4.1) The electronic document security circulation system obtains the digital signature of the electronic document;

[0090] 4.2) The electronic document security circulation system uses a decryption operator to decrypt the digital signature of the electronic document using the user's public key to obtain a random number, a timestamp, and a hash value;

[0091] 4.3) The electronic document security circulation system uses the user's public key and hash value as input to the hash operator 2 to obtain the key of the electronic document;

[0092] 4.4) The electronic file security circulation system uses the electronic file's key to decrypt the encrypted file, obtain the plaintext electronic file, and return it to the user.

[0093] In this embodiment, the electronic document secure circulation system supports both online mode and offline mode.

[0094] In the networking mode, the file owner and the file user are connected via the network, such as Figure 6 As shown, a file owner logs into the secure electronic file circulation system and uploads a plaintext electronic file to the system. The secure electronic file circulation system then encrypts the electronic file using the file owner's private key. The file owner then sends or shares the encrypted electronic file with others through the secure electronic file circulation system. After logging into the secure electronic file circulation system and viewing a list of received or shared files, the secure electronic file circulation system uses the file owner's public key from the public key infrastructure to decrypt the electronic file the file user wants to view. The file user then views the decrypted electronic file through the secure electronic file circulation system. The secure electronic file circulation system then invokes the file encryption and decryption methods in the smart contract to store the file encryption and decryption operation logs on the blockchain for subsequent auditing.

[0095] In offline mode, the file owner and the file user are not connected to each other. Figure 7 As shown, the file owner logs into the electronic file security circulation system and uploads a plaintext electronic file to the electronic file security circulation system. The electronic file security circulation system encrypts the electronic file using the file owner's private key. The file owner or other user downloads the encrypted electronic file from the electronic file security circulation system and transmits it to the file user offline. The file user downloads the file viewer client offline from the electronic file security process system. The file user opens the file viewer client, fills in the application information (including file user information), and uploads the electronic file to be viewed. The file viewer client generates a file viewing application code. The file user uploads the file viewing application code to the electronic file security circulation system offline and obtains a file viewing authorization code from the electronic file security circulation system. The file user enters the file viewing authorization code into the file viewer client to view the content of the electronic file. The electronic file security circulation system calls the on-chain methods for file encryption, file download, application information, and file decryption application in the smart contract, and saves the relevant operation log records on the blockchain for subsequent auditing.

[0096] Furthermore, if Figure 12As shown, in this embodiment, the specific process of the file owner or other user downloading the electronic file from the electronic file security circulation system as a file downloader is: the file downloader views the file list and submits a download request, the electronic file security circulation system obtains the file downloader information, the electronic file and the digital signature of the electronic file, records the file downloader information in the download additional information, and then uses the file downloader's private key to encrypt and compress the electronic file, the digital signature of the electronic file and the download additional information to obtain an encrypted compressed file and return it to the file downloader.

[0097] Furthermore, if Figure 13 As shown, in this embodiment, in offline mode, after the file downloader transmits the downloaded encrypted compressed file offline to the file user, the file user uploads the encrypted compressed file obtained from the file downloader to the file viewer client when viewing the electronic file through the file viewer client; the file viewer client automatically obtains the file user's computer unique identification code or MAC address, and combines the application information, the information of the encrypted compressed file (including the name of the encrypted compressed file, the unique identification code) and the computer unique identification code or MAC address, and encodes and generates a file viewing application code; after the file user submits the file viewing application code offline to the electronic file security circulation system, the electronic file security circulation system parses the file viewing application code. Application code, obtain application information and encrypted compressed file information; the electronic file security circulation system obtains the public keys of the file owner and file downloader from the public key infrastructure and generates a file viewing authorization code, sets an expiration date, and then transmits the file viewing authorization code to the file user offline; after the file user imports the obtained file viewing authorization code into the application list of the file viewer client, the file viewer client verifies the file viewing authorization code, obtains the public keys of the file owner and file downloader, and then uses the public key of the file downloader to decrypt the encrypted compressed file, obtain the electronic file, the digital signature of the electronic file and the downloaded additional information, and then uses the public key of the file owner to decrypt the electronic file to obtain the decrypted electronic file for the file user to view.

[0098] Furthermore, the electronic document security circulation system and the document viewer client have tracking watermarks, which prevent leakage and trace the source by displaying the current operator's name, unique identification code and other information.

[0099] In this embodiment, before a new user logs into the electronic document security circulation system, he / she must first register his / her user identity. Figure 8 As shown, the specific process is:

[0100] The user completes the registration information on the registration page provided by the electronic document security circulation system, including information such as company name, department, user name, ID number, and login password. The electronic document security circulation system verifies the user information and requests a certificate from the public key infrastructure. The public key infrastructure generates the user's public and private key pair and returns it to the electronic document security circulation system. The electronic document security circulation system calls the user registration on-chain method in the smart contract and saves the user information, registration log, and other information on the blockchain for subsequent auditing. User registration is completed, and the private key information is saved.

[0101] In this embodiment, if Figure 9 As shown, after the electronic document security circulation system generates a digital signature and completes the encryption of the electronic document, it returns the encrypted electronic document and the digital signature of the electronic document to the user, and calls the encryption and file digital signature on-chain methods in the smart contract file, and saves the relevant operation logs in the blockchain for subsequent auditing.

[0102] In this embodiment, if Figure 10 As shown, in the networked mode, the electronic file security circulation system sends or shares the encrypted electronic file and the digital signature of the electronic file specified by the file owner through the file transfer service or file sharing service. The electronic file security circulation system returns the file transfer result to the file owner, and calls the smart contract file transfer or file sharing chain method, and saves the relevant operation logs in the blockchain for subsequent auditing.

[0103] like Figure 11 As shown, in networked mode, when a file user views a file, they first check the received file list or shared file list and select the electronic file they want to view. The electronic file security circulation system parses the electronic file, obtains the file name, file metadata, and the electronic file's digital signature, and obtains the public key of the file owner from the public infrastructure. It verifies the digital signature of the electronic file. If the verification is successful, the electronic file security circulation system calls the file decryption service to decrypt the electronic file and returns the decryption result to the file user. The electronic file security circulation system calls the on-chain methods for file verification, viewing, and decryption operations in the smart contract, and saves the relevant operation logs on the blockchain for subsequent auditing.

[0104] In this embodiment, if Figure 14As shown, during the audit, the auditor initiates the review of log records such as file encryption and decryption, file download, and file decryption application through the electronic file security circulation system; the electronic file security circulation system calls the log viewing chain method in the smart contract, saves the log query operation record in the blockchain for subsequent audits, and calls the relevant query services in the smart contract, such as file encryption query, file decryption query, file download query, file decryption application view, etc., to obtain log record details for the auditor to view. Figure 15 As shown, during tracing, the auditor uploads the electronic file to the electronic file security circulation system. The electronic file security circulation system obtains the digital signature of the electronic file, calls the query method of file encryption, download, and file decryption application in the smart contract, obtains relevant log information, and calls the tracing service to obtain files related to the electronic file that needs to be traced, and then returns the operation log and related files to the auditor.

[0105] Example 2

[0106] This embodiment provides an electronic file security circulation system that implements the method described in Example 1. Figure 5 As shown, it includes application layer, service layer, data layer, support layer and operating environment;

[0107] The operating environment is composed of a domestic CPU, a domestic operating system, a domestic middleware, a domestic database and a blockchain, and is used to provide a domestic operating environment.

[0108] The supporting layer is a public key infrastructure, which is used to uniformly manage keys and certificates and provide trusted user identities.

[0109] The data layer consists of a relational database and a blockchain, and is used to store system data and key information.

[0110] The service layer is used to provide digital signature generation services, digital signature verification services, file encryption services, file decryption services, file sending services, file sharing services, file receiving services, file tracing services and smart contract services in the blockchain. Figure 6 As shown, it can also provide more services such as log management service, system authorization management service, file watermark service and file online editing service.

[0111] The application layer consists of file management, system management, log auditing and file viewer client, which is used to provide users with functions such as file encryption and decryption, file transfer, file sharing, user management, permission management, and file tracing.

[0112] Those skilled in the art can make various corresponding changes and modifications based on the above technical solutions and concepts, and all of these changes and modifications should be included in the scope of protection of the claims of the present invention.

Claims

1. A method for protecting the circulation of electronic documents, characterized by comprising four steps: generating a digital signature, verifying the digital signature, encrypting the document, and decrypting the document; (1) The process of generating a digital signature is as follows: 1.1) Users input or upload electronic files to the electronic file security circulation system; 1.2) The electronic document security circulation system uses a data parser to parse and extract the electronic document, including the file name, file content, and file meta-information; the extracted content serves as input to the hash operator; 1.3) The electronic document security circulation system uses a hash operator to hash the contents extracted by the data analyzer separately or in combination, to obtain hash values ​​of the file name, file content and file meta-information separately or in combination; 1.4) The electronic document security circulation system uses an encryption operator to encrypt the hash value obtained in step 1.3) using the user's private key, a random number, and a timestamp to generate a digital signature for the electronic document; (2) The specific process of digital signature verification is as follows: 2.1) Input or upload electronic files to the electronic file security circulation system; 2.2) The electronic document security circulation system uses a data parser to parse and extract the electronic document. The extracted content includes the file name, file content and file meta-information. The extracted content serves as the input of the hash operator. 2.3) The electronic document security circulation system uses a hash operator to hash the contents extracted by the data analyzer separately or in combination, and obtains the hash values ​​of the file name, file content and file meta-information separately or in combination; 2.4) The electronic document security circulation system obtains the digital signature of the electronic document. The electronic document security circulation system uses a decryption operator to decrypt the digital signature of the electronic document using the user's public key to obtain a random number, a timestamp, and a hash value; 2.5) The electronic document secure circulation system analyzes and compares the hash value obtained by the hash operator in step 2.3) with the hash value decrypted by the decryption operator in step 2.4) to obtain a verification result. If they are consistent, the verification is successful; otherwise, the verification fails. (3) The specific process of file encryption is as follows: 3.1) The user inputs or uploads the electronic file to be encrypted into the electronic file security circulation system; 3.2) The electronic document security circulation system uses a data parser to parse and extract the electronic document. The extracted content is the file name, file content and file meta-information. The extracted content is used as the input of the hash operator 1; 3.3) The electronic document security circulation system uses a hash operator to hash the contents extracted by the data parser separately or in combination, and obtains hash values ​​of the file name, file content and file meta-information separately or in combination; 3.4) The electronic document security circulation system uses hash operator 2 to perform a single hash on the user's public key and the hash value obtained by hash operator 1 to obtain the key for the electronic document; 3.5) The electronic file security circulation system uses the electronic file key to encrypt the electronic file, obtain the encrypted electronic file and return it to the user; (IV) The specific process of file decryption is as follows: 4.1) The electronic document security circulation system obtains the digital signature of the electronic document; 4.2) The electronic document security circulation system uses a decryption operator to decrypt the digital signature of the electronic document using the user's public key to obtain a random number, a timestamp, and a hash value; 4.3) The electronic document security circulation system uses the user's public key and hash value as input to the hash operator 2 to obtain the key of the electronic document; 4.4) The electronic file security circulation system uses the electronic file's key to decrypt the encrypted file, obtain the plaintext electronic file, and return it to the user.

2. The method according to claim 1, characterized in that The electronic document security circulation system supports networking mode; In the networked mode, the file owner and the file user are connected to each other through the network. The file owner logs into the electronic file security circulation system and uploads the plaintext electronic file to the electronic file security circulation system. The electronic file security circulation system uses the file owner's private key to encrypt the electronic file. The file owner then sends or shares the encrypted electronic file to others through the electronic file security circulation system. After the file user logs in to the electronic file security circulation system, he or she can view the received file list or the shared file list. The electronic file security circulation system calls the file owner's public key from the public key infrastructure to decrypt the electronic file that the file user wants to view. The file user can then view the decrypted electronic file through the electronic file security circulation system. The electronic document security circulation system calls the file encryption, file decryption, and file transfer or file sharing chain methods in the smart contract, and saves the file encryption and file decryption operation logs in the blockchain for subsequent auditing.

3. The method according to claim 1, characterized in that The electronic document security circulation system supports offline mode; In offline mode, the file owner and the file user are disconnected from the network. The file owner logs in to the electronic file security circulation system and uploads the plaintext electronic file to the electronic file security circulation system. The electronic file security circulation system encrypts the electronic file using the file owner's private key. The file owner or other users download the encrypted electronic file from the electronic file security circulation system and pass it to the file user offline. The file user downloads the file viewer client from the electronic file security process system offline. The file user opens the file viewer client, fills in the application information, and uploads the electronic file to be viewed. The file viewer client generates a file viewing application code; The file user uploads the file viewing application code to the electronic file security circulation system offline and obtains the file viewing authorization code from the electronic file security circulation system. The file user enters the file viewing authorization code into the file viewer client to view the content of the electronic file. The electronic document security circulation system calls the chain-up methods of file encryption, file download, application information and file decryption application in the smart contract, and saves the relevant operation log records in the blockchain for subsequent audits.

4. The method according to claim 3, characterized in that The specific process of a file owner or other user downloading an electronic file from the electronic file security circulation system as a file downloader is as follows: the file downloader views the file list and submits a download request. The electronic file security circulation system obtains the file downloader information, the electronic file, and the digital signature of the electronic file, records the file downloader information in the download additional information, and then uses the file downloader's private key to encrypt and compress the electronic file, the digital signature of the electronic file, and the download additional information to obtain an encrypted compressed file and return it to the file downloader.

5. The method according to claim 4, characterized in that In offline mode, after the file downloader passes the downloaded encrypted compressed file to the file user offline, the file user uploads the encrypted compressed file obtained from the file downloader to the file viewer client when viewing the electronic file through the file viewer client; the file viewer client automatically obtains the file user's computer unique identification code or MAC address, and combines the application information, the information of the encrypted compressed file, and the computer unique identification code or MAC address, and encodes and generates a file viewing application code; after the file user submits the file viewing application code offline to the electronic file security circulation system, the electronic file security circulation system parses the file viewing application code and obtains the application information and the information of the encrypted compressed file; The electronic file security circulation system obtains the public keys of the file owner and the file downloader from the public key infrastructure and generates a file viewing authorization code, sets an validity period, and then transmits the file viewing authorization code to the file user offline; after the file user imports the obtained file viewing authorization code into the application list of the file viewer client, the file viewer client verifies the file viewing authorization code, obtains the public keys of the file owner and the file downloader, and then uses the public key of the file downloader to decrypt the encrypted compressed file, obtain the electronic file, the digital signature of the electronic file and the downloaded additional information, and then uses the public key of the file owner to decrypt the electronic file to obtain the decrypted electronic file for the file user to view.

6. The method according to claim 1, characterized in that Before logging into the electronic document security circulation system, new users must first register their user identity. The specific process is as follows: The user fills in the registration user information on the registration page provided by the electronic document security circulation system, including the name of the unit, department, user name, user ID number and login password; The electronic document security circulation system verifies the user information and applies for a certificate from the public key infrastructure. The public key infrastructure generates the user's public and private key pair and returns it to the electronic document security circulation system. The electronic document security circulation system calls the on-chain method of user registration in the smart contract, saves user information and registration logs in the blockchain for subsequent audits; user registration is completed and private key information is saved.

7. The method according to claim 1, characterized in that After the electronic document security circulation system generates a digital signature and completes the encryption of the electronic document, it returns the encrypted electronic document and the digital signature of the electronic document to the user, and calls the encryption and file digital signature on-chain methods in the smart contract file, and saves the relevant operation logs in the blockchain for subsequent audits.

8. The method according to claim 2, characterized in that In the network mode, when a file user views a file, he or she first checks the received file list or shared file list and selects the electronic file to be viewed. The electronic file security circulation system parses the electronic file, obtains the file name, file meta-information and the digital signature of the electronic file, obtains the public key of the file owner of the electronic file from the public infrastructure, verifies the digital signature of the electronic file, and if the verification is successful, the electronic file security circulation system calls the file decryption service to decrypt the electronic file and returns the decryption result to the file user. The electronic document security circulation system calls the on-chain methods of file verification, viewing, and decryption operations in the smart contract, and saves the relevant operation logs in the blockchain for subsequent audits.

9. The method according to claim 2, 3, 6 or 7, characterized in that During the audit, the auditor initiates the review of the log records of file encryption and decryption, file download and file decryption applications through the electronic document security circulation system; the electronic document security circulation system calls the log viewing chain method in the smart contract, saves the log query operation record in the blockchain for subsequent audits, and calls the relevant query service in the smart contract to obtain the log record details for the auditor to view; during tracing the source, the auditor uploads the electronic file to the electronic document security circulation system, the electronic document security circulation system obtains the digital signature of the electronic file, calls the query method of file encryption, download and file decryption application in the smart contract, obtains the relevant log information, and calls the traceability service to obtain the files related to the electronic file that needs to be traced, and then returns the operation log and related files to the auditor.

10. A system for secure electronic document circulation that implements the method according to any one of claims 1 to 9, characterized in that: Includes application layer, service layer, data layer, support layer and operating environment; The operating environment is composed of a domestic CPU, a domestic operating system, domestic middleware, a domestic database and a blockchain, and is used to provide a domestic operating environment; The support layer is a public key infrastructure, which is used to uniformly manage keys and certificates and provide trusted user identities; The data layer consists of a relational database and a blockchain, and is used to store data; The service layer is used to provide digital signature generation services, digital signature verification services, file encryption services, file decryption services, file sending services, file sharing services, file receiving services, file tracing services and smart contract services in the blockchain; The application layer consists of file management, system management, log auditing and file viewer clients, and is user-oriented, providing users with file encryption and decryption, file transfer, file sharing, user management, permission management and file traceability functions.

Images