Encrypted file cloud access method and device and related components

Abstract

The invention discloses an encrypted file cloud access method, an encrypted file cloud access device and related components, and aims to construct a universal data protection and access framework to realize full-terminal coverage of a PC (Personal Computer), a Web, a Mobile and the like and compatibility of mainstream operating systems of Windows, Linux, Android and the like. The method comprises the following steps: receiving a configuration file of an encrypted file system and a user password uploaded by a user; verifying the configuration file and the user password and generating a file system key; extracting an encrypted file name on the webpage, and calling a decryption algorithm module and a file system key to decrypt the encrypted file name; intercepting the file downloading request, extracting an encrypted file, and calling a decryption algorithm module and a file system key to decrypt the content of the encrypted file; and rendering the decrypted encrypted file name and the content of the encrypted file to a webpage interface. By means of the method, an enterprise can be helped to efficiently and regularly upload sensitive data to the cloud end, and a user can conveniently access and use encrypted data in cloud storage.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for accessing encrypted files in the cloud, and related components. Background Art

[0002] Currently, enterprises generally adopt local encrypted storage, that is, the data is processed locally through encryption algorithms and then saved to the server or terminal media (such as hard disk, USB flash drive, etc.) to reduce the risk of data leakage and illegal access.

[0003] However, with the rapid development of cloud computing technology, enterprises are seeing a significant increase in demand for flexible data scalability, convenient remote access, and centralized management. Cloud computing, with its high availability, low cost, and cross-regional accessibility, has gradually become the preferred solution for enterprise data storage. However, uploading sensitive data directly to the cloud can present challenges: cloud storage is vulnerable to cyberattacks and privilege abuse, leading to data leakage or tampering.

[0004] To balance compliance and cloud migration requirements, enterprises typically adopt a "local encryption + cloud synchronization" model, where data is encrypted locally before being uploaded to cloud storage services. However, this model has significant drawbacks in practical applications:

[0005] Encryption and synchronization rely on manual operations or multiple independent tools, resulting in fragmented processes that are prone to data processing errors or compliance vulnerabilities due to human error.

[0006] Users need to download encrypted data from the cloud and then process it using local decryption tools. This is cumbersome and lacks automation support, making it difficult to meet high-frequency, cross-platform data access needs.

[0007] Traditional encryption methods usually rely on the encrypted file system of a specific operating system, but lack support in scenarios such as mobile terminals and lightweight operating systems, resulting in users being unable to seamlessly access encrypted data.

[0008] Furthermore, existing encrypted file systems often require users to possess certain technical skills during the decryption process, and some solutions lack support for non-native operating systems, further exacerbating cross-platform access difficulties. For example, some encryption tools cannot directly read encrypted files generated by Windows on Android or iOS devices, forcing users to use intermediate conversion tools or additional configuration to decrypt data, significantly reducing user experience and flexibility. Summary of the Invention

[0009] The purpose of the present invention is to provide a method, device and related components for accessing encrypted files in the cloud, aiming to solve the problems of low efficiency in uploading data to the cloud and inconvenient access in local encrypted storage methods.

[0010] In a first aspect, an embodiment of the present invention provides a method for accessing encrypted files in the cloud, comprising:

[0011] Receive the encrypted file system configuration file and user password uploaded by the user through the user interaction module;

[0012] Verify the configuration file and user password through a decryption algorithm module;

[0013] If the verification is successful, a file system key is generated and stored in the storage module;

[0014] When a user visits a web page, the encrypted file name on the web page is extracted by the file name processing module, and the decryption algorithm module and the file system key are called to decrypt the encrypted file name;

[0015] Intercept file download requests and extract download links through the file download module;

[0016] Extracting the encrypted file through the download link, and calling the decryption algorithm module and the file system key to decrypt the content of the encrypted file;

[0017] Render the decrypted encrypted file name and the contents of the encrypted file to the web page interface.

[0018] In a second aspect, an embodiment of the present invention provides an encrypted file cloud access device, comprising:

[0019] The user interaction module is used to receive the configuration file of the encrypted file system and the user password uploaded by the user;

[0020] A decryption algorithm module, used to verify the configuration file and user password;

[0021] A storage module, configured to generate a file system key and store the file system key if the verification is successful;

[0022] The file name processing module is used to extract the encrypted file name on the web page when the user visits the web page, and call the decryption algorithm module and the file system key to decrypt the encrypted file name;

[0023] File download module, used to intercept file download requests and extract download links;

[0024] The decryption algorithm module is further used to extract the encrypted file through the download link and call the file system key to decrypt the content of the encrypted file;

[0025] The rendering module is used to render the decrypted encrypted file name and the content of the encrypted file to the web page interface.

[0026] In a third aspect, an embodiment of the present invention further provides a computer device, which includes a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the encrypted file cloud access method described in the first aspect is implemented.

[0027] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the encrypted file cloud access method described in the first aspect above is implemented.

[0028] The present invention discloses a cloud-based access method, device, and related components for encrypted files. The method comprises: receiving a configuration file and a user password of an encrypted file system uploaded by a user through a user interaction module; verifying the configuration file and user password through a decryption algorithm module; if the verification is successful, generating a file system key and storing the file system key through a storage module; when a user accesses a webpage, extracting the encrypted file name on the webpage through a file name processing module, and calling the decryption algorithm module and the file system key to decrypt the encrypted file name; intercepting a file download request and extracting a download link through a file download module; extracting the encrypted file through the download link, and calling the decryption algorithm module and the file system key to decrypt the content of the encrypted file; and rendering the decrypted encrypted file name and the content of the encrypted file to a webpage interface. The present invention realizes automatic encryption and synchronization of local data to the cloud by integrating an encrypted file system, eliminating manual operation links; decrypting the file name in real time by dynamically parsing webpage elements and rendering it as a plaintext list, while intercepting download requests, completing file content decryption, and directly outputting the plaintext file. This fully automates the entire encrypted data process, from uploading to access, significantly improving the efficiency and user experience of accessing encrypted cloud data. It also overcomes cross-platform limitations, enabling instant decryption on any device. Furthermore, it maintains enterprise-level data compliance, with keys always stored locally and independent of third-party decryption environments, ensuring both security and convenience. The present invention also provides an encrypted file cloud access device, a computer-readable storage medium, and a computer device, all of which exhibit the aforementioned benefits and are not further elaborated upon here. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0030] Figure 1A flow chart for users to upload data to the cloud and retrieve data from the cloud;

[0031] Figure 2 This is a schematic diagram of the browser plug-in's operation process;

[0032] Figure 3 This is a diagram of the workflow of each module in the browser plug-in;

[0033] Figure 4 A flowchart of a method for accessing encrypted files in the cloud;

[0034] Figure 5 A schematic block diagram of an encrypted file cloud access device. DETAILED DESCRIPTION

[0035] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0036] It will be understood that when used in this specification and the appended claims, the terms “comprises” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0037] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the present invention. As used in the specification and appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0038] It should be further understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0039] See also Figure 1 The complete process for users to upload and retrieve data from the cloud includes: During the data upload phase, users first organize and categorize locally stored data to ensure accuracy and standardization. Then, using a secure and stable network connection and specialized data transmission tools, the data is transferred to the cloud service provider's servers. Upon receiving the data, the cloud service provider will perform strict encryption and storage optimization to ensure data security and efficient access.

[0040] When retrieving data from cloud storage, users must first verify their identity through an authentication system to ensure that only authorized users can access the data. Afterward, users can enter specific query criteria based on their needs on the cloud service interface. The system will quickly filter out the matching data from the massive amount of stored data, decrypt it, and transmit it back to the user via the network in a high-speed and stable manner.

[0041] In response to increasingly stringent data compliance requirements, users usually need to encrypt data before synchronizing it to cloud storage. However, traditional encryption methods are cumbersome to operate, have a poor user experience, and are difficult to meet the actual needs of automation and high availability. To solve the above problems, this embodiment introduces an encrypted file system (such as securefs, gocryptfs, Cryptomator, CryFS, VeraCrypt, etc.) during the data cloud stage to build a transparent encryption mechanism: users can create an encrypted mount directory locally, and all file operations (such as creation, editing, deletion, etc.) performed in the encrypted mount directory will be automatically encrypted, and users can still access files in plain text without perception. This method does not require manual encryption and decryption operations, and will not interfere with the user's usage behavior.

[0042] Furthermore, users can set the ciphertext data directory corresponding to the encrypted mount directory as a synchronization folder on the cloud storage client. This allows the encrypted file system to handle encryption tasks, while the cloud storage client detects data changes and synchronizes the ciphertext to the cloud, thus achieving an integrated cloud solution of "compliant encryption + automatic synchronization." This approach simultaneously balances compliance, security, and ease of use, effectively resolving the inefficiency and operational complexity of traditional encryption methods.

[0043] In the data access process, users need to obtain and decrypt encrypted data from the cloud. Traditional methods usually rely on installing an encrypted file system locally to complete the decryption operation, which not only requires users to have certain technical capabilities, but also faces limitations in platform compatibility. Some encrypted file systems lack support on certain specific operating systems (such as mobile terminals, Linux lightweight environments, etc.), which seriously affects the flexibility of access and cross-platform capabilities. To solve the above problems, this embodiment proposes an auxiliary decryption mechanism based on browser plug-ins. When users access cloud storage through the Web, they can use pre-installed browser plug-ins to automatically complete the decryption operation and directly obtain the plaintext version of the required file without downloading a dedicated client or relying on a local mounting environment. Given that modern browsers are widely supported on mainstream operating systems, this browser plug-in solution has excellent cross-platform compatibility and usability, which greatly improves the efficiency and experience of users accessing encrypted cloud data.

[0044] Web access is the primary form of cloud storage services. Most mainstream cloud storage platforms (such as OneDrive and Dropbox) provide web-based access interfaces, but only some operating systems and devices are equipped with dedicated PC clients or mobile applications. Many users are reluctant to install these clients on their local devices to avoid additional storage usage, CPU load, and memory consumption. In contrast, web browsers are available on almost all devices, making them a more universal access method. Especially on cloud operating systems and devices (such as ChromeOS and Chromebooks), web browsers are often the only way to interact.

[0045] This embodiment designs and implements a browser plug-in based on the browser plug-in mechanism to provide seamless Web-side decryption function. Figure 2 As shown, the plug-in allows users to access decrypted files directly from the cloud storage web client without having to install a local encrypted file system, significantly improving usability. Furthermore, the browser plug-in is cross-platform compatible and can run in different operating system environments, providing users with a more flexible and efficient way to access encrypted files.

[0046] Suppose a user needs to access encrypted files in cloud storage on a public computer that does not have an encrypted file system installed. Under traditional methods, users usually need to install the corresponding software (such as FUSE) first and manually configure the encrypted file system. The whole process is cumbersome and time-consuming, and in some restricted environments (such as computers in companies or schools), it may not be possible to install additional software. In contrast, using the browser plug-in of this embodiment, users can download and decrypt files directly on the cloud storage Web terminal without relying on a local encrypted file system or additional software installation. Since web browsers are available for almost all operating systems, the plug-in can achieve cross-platform compatibility, significantly improving the access convenience and efficiency of encrypted files.

[0047] See also Figure 3In this embodiment, the Encrypted File System Browser Plug-in (CFS Browser Plug-in) consists of three parts: a user interface layer, a logic processing layer, and a storage layer. This layer implements efficient encrypted file decryption and downloading. The user interface layer is responsible for user interaction, providing an intuitive interface that allows users to upload configuration files and enter passwords. The input data is then passed to the configuration management module for processing. The user interface layer also includes a file name processing module, which extracts encrypted file names from web pages and sends them to the decryption algorithm module for decryption. The decrypted file names are then rendered back to the web page, allowing users to browse a list of plaintext files. The logic processing layer is the core component of the plug-in, responsible for data processing and flow. The configuration management module parses user-uploaded configuration files, extracts configuration information, and interacts with other modules. The decryption algorithm module is the core component of the browser plug-in, using a key to decrypt encrypted file names and file contents. Furthermore, the file download module intercepts file download requests from the web client and decrypts encrypted files, ensuring that users receive ready-to-use plaintext files. The storage layer provides data storage services, primarily storing necessary data such as user configuration information and decryption keys, and providing access support for upper-layer modules. The specific implementation method of the browser plug-in is described in detail below through specific embodiments.

[0048] See also Figure 4 This embodiment provides a method for accessing encrypted files in the cloud, including:

[0049] S101: receiving, through a user interaction module, a configuration file of an encrypted file system and a user password uploaded by a user;

[0050] Specifically, the user interaction module implements the configuration file and password reception function through the browser plug-in's pop-up interface: when the user clicks the plug-in icon, a pop-up operation window pops up, with a file selector and password input box embedded in the window. After the user selects the encrypted file system's JSON configuration file (such as securefs.json) and enters the key in the password box, clicking the Submit button triggers the handleSubmit() function. This function reads the configuration file contents using the FileReader API and obtains the plaintext password. It then calls chrome.runtime.sendMessage to send the configuration data and password to the configuration management module.

[0051] The main function of the user interaction module is to provide a user interface for entering the encrypted file system configuration file and user password to complete identity authentication and obtain the file system key for decryption. This module is implemented in the Popup component of the Chrome browser plug-in and communicates with other plug-in components through the Chrome API. The Popup component serves as the plug-in's front-end interactive interface, allowing the user to pop up an operation window after clicking the plug-in icon. The user interaction module's workflow is as follows: the user uploads the configuration file and enters the user password through the user interaction module. The module then passes the relevant information to the configuration management module for parsing and verification, and obtains the verification result. If the verification is successful, a prompt will pop up to indicate the successful operation; if the verification fails, an error message will be fed back to the user to ensure that the user can adjust the input information in a timely manner.

[0052] In this embodiment, the encrypted file system includes at least one of SecureFS, gocryptfs, EncFS, or Cryptomator.

[0053] SecureFS is a secure file system software designed to provide users with encrypted protection for files and folders, helping ensure the security and privacy of information when storing and transmitting data. By using SecureFS, users can create encrypted containers and place sensitive files within them. These files can only be accessed with the correct access credentials (such as a password), effectively preventing data from being viewed, tampered with, or stolen without authorization. It is commonly used in scenarios such as personal privacy protection and corporate confidential file management.

[0054] gocryptfs is an open source encrypted file system written in Go. It allows users to create an encryption layer on top of an existing file system, transparently encrypting and decrypting files and folders in a specified directory.

[0055] EncFS is an open-source tool for creating encrypted file systems. It creates an encryption layer on top of existing file systems, allowing users to store ordinary files on disk in encrypted form. When users access these encrypted files, EncFS decrypts them in memory, allowing users to read and write them like ordinary files. However, the encrypted content is actually stored on disk, enhancing data security and privacy. It is commonly used in Linux, macOS, and other systems and supports a variety of encryption algorithms.

[0056] Cryptomator is open-source client-side encryption software. It allows users to encrypt local and cloud-based files to protect data privacy and security. Without affecting existing storage services, users can create encrypted vaults and store sensitive data on cloud storage platforms like Dropbox, Google Drive, and OneDrive, or on local hard drives and external storage devices. Encrypted files can only be decrypted and accessed using the correct key.

[0057] It should be noted that the encrypted file system of this embodiment can use the securefs simple mode, the cloud storage service can be based on OneDrive, and the browser environment can use Chrome for development and testing.

[0058] S102: Verify the configuration file and user password using a decryption algorithm module;

[0059] Specifically, the verification of configuration files and user passwords through the decryption algorithm module includes:

[0060] Extract salt value, number of iterations, computation cost parameters, configure initialization vector, configure message authentication code and encryption key from the configuration file;

[0061] Use the Argon2id password derivation function to generate a derived key based on the user password, salt value, number of iterations, and computational cost parameters;

[0062] Decrypting the encryption key using the AES-GCM algorithm based on the configuration initialization vector, the configuration message authentication code, and the derived key;

[0063] If the decryption is successful, the verification is considered successful and the file system key is generated;

[0064] If the decryption is successful, the verification is considered to have failed and an error message is returned.

[0065] The Argon2id cryptographic derivation function dynamically generates keys. This algorithm uses salt values ​​to defend against pre-computation attacks and dynamically adjusts memory consumption and CPU load based on the number of iterations and computational cost parameters, significantly increasing the threshold for brute force attacks. The encryption key is processed using the AES-GCM authenticated encryption algorithm, which achieves semantic security through the configuration of initialization vectors and provides integrity verification using message authentication codes, effectively preventing the risk of ciphertext tampering.

[0066] Among them, the core function of the decryption algorithm module is to implement configuration file verification, file name decryption, and file content decryption, and provide decryption services for other plug-in modules. The decryption algorithm module is implemented in the Background component of the Chrome browser plug-in and communicates with other plug-in components through the Chrome API. Since the Background component runs as a browser service worker, its execution environment is independent of the front-end interface, has higher stability, and can efficiently utilize system resources. Therefore, this component is particularly suitable for performing computationally intensive tasks, such as decryption operations of encrypted files. The workflow of the decryption algorithm module is as follows: When other modules request decryption, the decryption algorithm module will select the corresponding decryption algorithm based on the request type, process the input data, and return the decryption result to the calling module to ensure that the decryption process of the encrypted file system is smooth and error-free.

[0067] In some embodiments, after the user interaction module sends the configuration file and user password to the configuration management module, the configuration management module sends the user-entered configuration file and user password to the decryption algorithm module for verification and obtains the verification result. The configuration management module then returns the verification result to the user interaction module to provide feedback on the verification status to the user. If the verification is successful, the configuration management module sends the file system key to the storage module for secure storage in Chrome's storage system, thereby ensuring that the file system key can be successfully accessed during subsequent decryption.

[0068] After receiving the configuration file and user password, the decryption algorithm module parses the configuration file (e.g., in JSON format) and extracts the salt value (Salt), number of iterations (its), computational cost parameters (m_cost, p), configuration initialization vector (IV), configuration message authentication code (MAC), and encryption key (EncryptedKey). It then calls the Argon2id password derivation function, combining the user-entered password with the salt value, number of iterations, and computational cost parameters to generate a derived key (DerivedKey). Next, the AES-GCM algorithm is used to decrypt the encrypted key using the configuration initialization vector, configuration message authentication code, and derived key from the configuration file as input. If the decryption process passes the ciphertext check (e.g., HMAC-TAG comparison) and key recovery is successful, verification is considered successful, the file system key is generated, and subsequent encryption policy deployment is completed. If decryption fails (e.g., due to a password error resulting in a mismatch in the derived key, or a MAC check failure), the exception handling mechanism is triggered, logging, and returning a "Verification Failed" error message.

[0069] It should be noted that the main function of the configuration management module is to store the file system key in the storage module after successful verification for subsequent decryption operations. The configuration management module is implemented in the Popup component of the Chrome browser plug-in and communicates with other plug-in components through the Chrome API.

[0070] S103: If the verification is successful, a file system key is generated and stored in a storage module;

[0071] When the configuration file is successfully verified, the decryption algorithm module generates a file system key (Kfs). The configuration management module then calls the storage module to persist the key. The storage module saves the Kfs in encrypted form to Chrome's local storage space via the chrome.storage.local.set() method of the Chrome extension API.

[0072] The main function of the storage module is to abstract the storage mechanism provided by Chrome and provide data storage and access support to other modules. The storage module uses Chrome local storage as the storage medium, mainly based on the following considerations: First, Chrome local storage can retain data after the plug-in is closed, avoiding the need for users to re-enter passwords or upload configuration files every time they use the plug-in, thereby improving the user experience. Second, Chrome local storage supports a storage capacity of up to 10MB, which can meet the needs of storing encrypted file metadata. In addition, all data is stored on the local device and will not be uploaded to the cloud, thereby enhancing data security and privacy protection. In addition, the storage module also provides data storage and retrieval interfaces for other modules to call to support the plug-in's encryption key management and persistent management of related metadata.

[0073] S104: When a user accesses a web page, the encrypted file name on the web page is extracted by the file name processing module, and the decryption algorithm module and the file system key are called to decrypt the encrypted file name;

[0074] In this embodiment, extracting the encrypted file name on the web page by the file name processing module includes:

[0075] Detect the URL of the current web page and determine whether the web page is a cloud storage platform based on the URL;

[0076] If the webpage is a cloud storage platform, XPath expressions are used to match HTML elements and extract the encrypted file name displayed on the webpage.

[0077] The entire extraction process is fully automated, requiring no manual user intervention, ensuring the integrity of business logic and the accuracy of data processing. This dynamic matching also significantly reduces cross-platform compatibility development costs, allowing for expansion and support for emerging cloud storage services by simply adding domain name determination branches and corresponding XPath rules.

[0078] In some embodiments, extracting the encrypted file name on the web page through the file name processing module includes: detecting the URL of the current browser tab, and matching the domain name through regular expressions to determine whether it is a cloud storage platform. If the match is successful, call the browser extension API to obtain the DOM tree of the current page, and load the predefined XPath rule library. Subsequently, traverse the DOM nodes, locate the encrypted file name elements through XPath expressions, extract the text content and filter invalid characters. For dynamically loaded encrypted files (such as lists rendered through AJAX), DOM Mutation Observer is used to monitor node changes and capture newly added encrypted file names in real time. If it is detected that the file name meets the encryption characteristics (such as containing a hexadecimal random string and a suffix of .enc or .gpg), the system further ensures the security of the connection through TLS certificate verification, and transmits the extraction results back to the local storage module through an encrypted channel.

[0079] In this embodiment, the file name processing module's primary function is to extract encrypted file names from web pages and send them to the decryption algorithm module for decryption. After decryption, the corresponding encrypted file names are replaced on the web page, allowing users to directly browse the plaintext file list and conveniently select the desired file for decryption and download. The file name processing module is implemented in the Content Script component of the Chrome browser plug-in and communicates with other plug-in components via the Chrome API. The core function of the Content Script component is to interact with web pages, accessing and manipulating the web page's DOM structure, intercepting user input, and modifying web page content, thereby dynamically parsing and replacing encrypted file names. The file name processing module's workflow is as follows: When a user opens a web page, the file name processing module first checks the current web page's URL to determine whether it is from a cloud storage platform such as OneDrive. The module then uses XPath to match HTML elements, extracting the encrypted file names displayed on the web page, and sending each encrypted file name to the decryption algorithm module for decryption. After decryption is complete, the plaintext file names replace the original encrypted file names, presenting a readable file list on the web page interface, enhancing user convenience.

[0080] In this embodiment, calling the decryption algorithm module and the file system key to decrypt the encrypted file name includes:

[0081] Extract the file system key (Kfs) from the storage module;

[0082] Then, the first 32 bytes are intercepted from the file system key as the file name encryption key (Kname);

[0083] Then use the AES-SIV decryption algorithm to decrypt the encrypted file name encName according to the file name encryption key;

[0084] If the decryption is successful, the plaintext file name decName is generated;

[0085] If decryption fails, an error message is returned.

[0086] This embodiment securely extracts the file system master key from the storage module and employs a hierarchical key management strategy. By intercepting the first 32 bytes, a dedicated file name encryption key is generated. This achieves separation of duties for encryption functions, ensuring that even a leak of this key will not compromise the core file system. The decryption process utilizes the AES-Synthetic Initialization Vector (SIV) authenticated encryption algorithm, which is resistant to unintentional ciphertext tampering and effectively protects against file name replay attacks and data tampering.

[0087] The above process is used to decrypt encrypted file names in securefs simple mode to restore plaintext file names.

[0088] S105: intercepting the file download request and extracting the download link through the file download module;

[0089] In this embodiment, extracting the download link includes: intercepting and extracting the download link through a URL interception mechanism.

[0090] Specifically, based on the Electron framework, a network request interceptor is registered in the main process, and filtering rules are set. When the user triggers a web page download operation, the interceptor extracts parameters (such as token) in the download link through regular expressions. For dynamically loaded download links, the file download module captures the final URL after redirection by listening to the did-get-response-details event, and parses the file name in combination with the Content-Disposition response header. To ensure security, the system verifies the legitimacy of the domain name of the callback URL and uses HMAC-SHA256 to verify the integrity of the parameters, thereby preventing CSRF attacks. The extracted download link is encrypted and transmitted to the rendering process via IPC (inter-process communication) for subsequent calls by the file download module.

[0091] In this embodiment, the main function of the file download module is to monitor and intercept file download requests, extract download links, and parse the encrypted file content through the decryption algorithm module, and finally provide the user with a decrypted plaintext file download service. The file download module is implemented in the Background component of the Chrome browser plug-in and communicates with other plug-in components through the Chrome API. Since the Background component runs in the background for a long time and will not be affected by page refreshes, and for security reasons, Chrome limits the API for monitoring network requests to be called only in the Background component, so this module is implemented in this component. The workflow of the file download module is as follows: continuously monitor network requests, and when a file download request sent by OneDrive is detected, the request is intercepted and the download link is extracted. Subsequently, the decryption algorithm module is called to process the encrypted file content. After successful decryption, a download request for the plaintext file is generated, allowing the user to directly download the decrypted file to the local computer. This process does not require the user to install an additional encrypted file system, thereby improving the convenience of accessing encrypted files and cross-platform applicability.

[0092] S106: extracting the encrypted file through the download link, and calling the decryption algorithm module and the file system key to decrypt the content of the encrypted file;

[0093] Specifically, extracting the encrypted file through the download link and calling the decryption algorithm module and the file system key to decrypt the contents of the encrypted file include:

[0094] Extract the file system key (Kfs) from the storage module;

[0095] Extract 32 to 64 bytes from the file system key as the file content encryption key (Kfile);

[0096] Obtain the encrypted file through HTTP request and extract the file unique identifier id from the header of the encrypted file;

[0097] Encrypt the file content encryption key and the file unique identifier using AES-ECB to generate the file content key (Kcontent);

[0098] Initialize the plaintext file content F and traverse each data block ci in the encrypted file;

[0099] Extract the encryption initialization vector IV, encryption message authentication code MAC and encrypted data (data) from the data block;

[0100] Use the AES-GCM algorithm to decrypt the data block based on the generated file content key, encryption initialization vector, encrypted message authentication code and encrypted data;

[0101] If the decryption is successful, the decrypted data block is appended to the plaintext file content F;

[0102] If the decryption fails, an error message is returned. Finally, the complete plaintext file content F is returned.

[0103] This embodiment extracts the file system master key from the storage module and precisely intercepts the 32- to 64-byte interval to generate a unique file content encryption key. This key partitioning mechanism ensures secure isolation between different encryption functions. When retrieving an encrypted file, a standard HTTP request is used to download the data stream, and the file header is intelligently parsed to extract a unique identifier, providing an atomic basis for subsequent key derivation. Simultaneously, the file identifier and content key are encrypted in AES-ECB mode to generate a dynamic file content key, enabling key customization based on file characteristics and effectively preventing batch decryption attacks.

[0104] S107: Rendering the decrypted encrypted file name and the encrypted file content to a web page interface.

[0105] Specifically, the decrypted encrypted file name is dynamically updated to the page title bar through DOM operations, and the atob() function is used to convert the Base64-encoded text content (such as JSON data) into a string, and then rendered to the page in real time through Vue.js responsive data binding. <pre>For encrypted files, the decrypted ArrayBuffer is encapsulated as a temporary URL through the createObjectURL() method and assigned to To enhance the interactive experience, the module further uses Web Workers to perform decryption calculations to avoid blocking the UI thread, and <progress>The tag provides real-time feedback on the decryption progress.

[0106] In this embodiment, with a small amount of modification, the browser plug-in can adapt to different encrypted file systems and cloud storage services, thereby improving its versatility and scalability. If it is necessary to adapt to other encrypted file systems, it is only necessary to adjust the decryption algorithm module and replace the decryption algorithm therein with the encryption method used by the target encrypted file system to ensure correct parsing of the encrypted file name and file content. If it is necessary to adapt to other cloud storage services, the file name processing module and the file download module need to be adjusted accordingly. Specifically, the file name matching rules of the file name processing module need to be modified so that it can correctly identify the encrypted file names on the target cloud storage platform. In addition, the interception rules of the file download module need to be adjusted to adapt to the file download mechanisms of different cloud storage services. Through the above-mentioned adaptability adjustments, the plug-in framework can flexibly adapt to different encrypted file systems and cloud storage platforms, and has strong versatility and scalability.

[0107] Among them, cloud storage adaptation is mainly through URL interception + XPath dynamic positioning, and encrypted file system adaptation is through modular standard interface + unified decryption process. Therefore, only a small number of new rules or modules are needed to quickly support new cloud services and encryption systems.

[0108] Specifically, the cloud storage service adaptation requires three modifications:

[0109] 1. Modify the URL interception rules. Specifically, add the declarativeNetRequest rule to the addBlockRule() function in background.js, define the urlFilter pattern of the target cloud service, and register it in the dynamic rule table to modify the URL interception rules. Each cloud storage service corresponds to a specific set of URL filtering conditions, which can be easily expanded to support new cloud platforms by adding and deleting rules.

[0110] 2. Modify the file name selector. Specifically, add a new condition (such as else if (hostname.includes ("baidu"))) to the domain name detection branch of content.js and configure the corresponding XPath expression (such as / / div[@class='file-name'] / text()) or CSS selector (such as .file-name-text) to modify the file name selector.

[0111] 3. Modify the permission declaration. Specifically, add the new service domain name (such as "https: / / pan.baidu.com / *") to the host_permissions and content_scripts.matches fields in manifest.json to modify the permission declaration.

[0112] Furthermore, the encrypted file system adaptation requires the reconstruction of two modules:

[0113] Interface implementation: Create a new module (such as gocryptfs.js) in the cfs / directory and implement the standard interfaces: decryptConfig(), decFilename(), and downloadDecryptedFile().

[0114] decryptConfig() is used to parse gocryptfs.conf and verify the password;

[0115] decFilename() is used to decrypt the file name using AES-SIV;

[0116] downloadDecryptedFile() is used to decrypt the content using the gocryptfs block algorithm;

[0117] Call routing: Add system type detection to decryptAlgorithmModule and route to the corresponding decryption module based on the configuration file suffix (such as .cryptomator). Adapting to new services / systems only requires incremental addition of rules or modules, without changing the core process.

[0118] In this embodiment, by analyzing the web page structure, extending the matching logic (XPath or CSS selector) and reusing the existing decryption process, it is possible to quickly adapt to the encrypted file name recognition and decryption of different cloud storage platforms.

[0119] The encrypted file name processing mainly involves the following key parts:

[0120] Encrypted file name matching: find the encrypted file name element on the web page through the XPath selector;

[0121] Encrypted file name decryption: Use the decryption algorithm of SecureFS (or other encrypted file systems) to decrypt the encrypted file name into a readable file name;

[0122] Update encrypted file name: Replace the decrypted file name on the web page.

[0123] Among them, the encrypted file name matching rules of the modified file name processing module include:

[0124] Use browser developer tools to analyze the file name element structure on the target cloud storage platform's web page;

[0125] Then modify the matching logic of the encrypted file name in the content.js file:

[0126] Add a function to match elements using CSS selectors.

[0127] In this embodiment, the file download mechanisms of different cloud storage services can be quickly adapted by adding new interception rules, dynamic file name parsing, customized download request processing, and manifest permission extension.

[0128] Specifically, to adapt the file download mechanism to different cloud storage services, the following adjustments need to be made:

[0129] In the addBlockRule function in background.js, add an interception rule for the new cloud storage service:

[0130] Then you also need to make corresponding updates in the removeBlockRule function to ensure that the newly added rule can be removed:

[0131] Then update the code that initializes the check rules to ensure that all rules are checked;

[0132] Subsequently, the file download URL structure of different cloud storage services may be different, so it is necessary to add service-specific URL parsing logic to extract the file name or other information from the URL;

[0133] Some cloud storage services may require special download processing, such as additional header information or authorization;

[0134] Finally, modify manifest.json to add new cloud storage service permissions and content script matching, thereby implementing a file download mechanism that quickly adapts to different cloud storage services.

[0135] This embodiment automatically encrypts local data and synchronizes it to the cloud through an integrated encrypted file system, eliminating manual operations. It dynamically parses web page elements to decrypt file names in real time and renders them as plaintext lists. It also intercepts download requests, decrypts file contents, and directly outputs plaintext files. This fully automates the entire encrypted data process, from upload to access, significantly improving the efficiency and user experience of accessing encrypted cloud data. It also overcomes cross-platform limitations, enabling instant decryption on any device. Furthermore, it maintains enterprise-level data compliance, with keys always stored locally and independent of third-party decryption environments, ensuring both security and convenience.

[0136] See also Figure 5 This embodiment provides an encrypted file cloud access device 500, including:

[0137] The user interaction module 501 is used to receive the configuration file of the encrypted file system and the user password uploaded by the user;

[0138] Decryption algorithm module 502, used to verify the configuration file and user password;

[0139] The storage module 503 is configured to generate a file system key and store the file system key if the verification is successful;

[0140] The file name processing module 504 is used to extract the encrypted file name on the web page when the user visits the web page, and call the decryption algorithm module and the file system key to decrypt the encrypted file name;

[0141] The file download module 505 is used to intercept file download requests and extract download links;

[0142] The decryption algorithm module 502 is further used to extract the encrypted file through the download link and call the file system key to decrypt the content of the encrypted file;

[0143] The rendering module 506 is used to render the decrypted encrypted file name and the content of the encrypted file to the web page interface.

[0144] Furthermore, the decryption algorithm module 502 includes:

[0145] An extraction unit, configured to extract a salt value, a number of iterations, a computation cost parameter, a configuration initialization vector, a configuration message authentication code, and an encryption key from the configuration file;

[0146] A derived key generation unit, configured to generate a derived key using an Argon2id password derivation function according to a user password, a salt value, a number of iterations, and a computational cost parameter;

[0147] a decryption unit, configured to decrypt the encryption key using an AES-GCM algorithm according to the configuration initialization vector, the configuration message authentication code, and the derived key;

[0148] A system key generation unit, configured to determine that the verification is successful and generate a file system key if the decryption is successful;

[0149] The information returning unit is used to determine that the verification has failed and return an error message if the decryption is successful.

[0150] Furthermore, the file name processing module 504 includes:

[0151] A website address detection unit, configured to detect the website address of a current web page and determine whether the web page is a cloud storage platform according to the website address;

[0152] The matching unit is used to match HTML elements using XPath expressions and extract the encrypted file name displayed on the web page if the web page is a cloud storage platform.

[0153] Furthermore, the decryption algorithm module 502 includes:

[0154] A key extraction unit, configured to extract the file system key from the storage module;

[0155] An interception unit, configured to intercept the first 32 bytes from the file system key as a file name encryption key;

[0156] A file name decryption unit, configured to decrypt the encrypted file name using an AES-SIV decryption algorithm according to the file name encryption key;

[0157] A file name generation unit, used to generate a plain text file name if the decryption is successful;

[0158] The error information returning unit is used to return an error message if the decryption fails.

[0159] Furthermore, the decryption algorithm module 502 includes:

[0160] a system key extraction unit, configured to extract the file system key from the storage module;

[0161] A byte interception unit, configured to intercept 32 bytes to 64 bytes from the file system key as a file content encryption key;

[0162] A unique identifier extraction unit, configured to obtain an encrypted file through an HTTP request and extract a file unique identifier from a header of the encrypted file;

[0163] a content key generating unit, configured to encrypt a file content encryption key and a file unique identifier using AES-ECB to generate a file content key;

[0164] A traversal unit, configured to initialize the plaintext file content and traverse each data block in the encrypted file;

[0165] a data extraction unit, configured to extract an encryption initialization vector, an encrypted message authentication code, and encrypted data from the data block;

[0166] A data block decryption unit, configured to decrypt the data block using an AES-GCM algorithm according to the generated file content key, the encryption initialization vector, the encrypted message authentication code, and the encrypted data;

[0167] An appending unit, used to append the decrypted data block to the plaintext file content if the decryption is successful;

[0168] The return unit is used to return an error message if the decryption fails.

[0169] Furthermore, the decryption algorithm module 502 further includes:

[0170] The interception unit is used to intercept and extract the download link through a URL interception mechanism.

[0171] Furthermore, the encrypted file system includes at least one of SecureFS, gocryptfs, EncFS or Cryptomator.

[0172] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the above-mentioned devices and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0173] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed, can implement the methods provided in the above embodiments. The storage medium may include: a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, among other media capable of storing program code.

[0174] The present invention further provides a computer device that may include a memory and a processor. The memory stores a computer program, and the processor, when invoking the computer program in the memory, can implement the method provided in the above embodiment. Of course, the computer device may also include various network interfaces, a power supply, and other components.

[0175] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principle of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the claims of the present invention.

[0176] It should also be noted that, in this specification, relational terms such as first and second, etc., are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "include," "comprising," or any other variations thereof are intended to cover non-exclusive terms.

[0177] "Include" means that a process, method, article, or apparatus comprising a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a..." does not preclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.< / progress> < / pre>

Claims

1. A method for accessing encrypted files in the cloud, characterized in that: include: Receive the encrypted file system configuration file and user password uploaded by the user through the user interaction module; Verify the configuration file and user password through a decryption algorithm module; If the verification is successful, a file system key is generated and stored in the storage module; When a user visits a web page, the encrypted file name on the web page is extracted by the file name processing module, and the decryption algorithm module and the file system key are called to decrypt the encrypted file name; Intercept file download requests and extract download links through the file download module; Extracting the encrypted file through the download link, and calling the decryption algorithm module and the file system key to decrypt the content of the encrypted file; Render the decrypted encrypted file name and the contents of the encrypted file to the web page interface.

2. The encrypted file cloud access method according to claim 1, characterized in that: The verification of the configuration file and the user password by the decryption algorithm module includes: Extracting salt value, number of iterations, computation cost parameter, configuration initialization vector, configuration message authentication code and encryption key from the configuration file; Use the Argon2id password derivation function to generate a derived key based on the user password, salt value, number of iterations, and computational cost parameters; Decrypting the encryption key using the AES-GCM algorithm based on the configuration initialization vector, the configuration message authentication code, and the derived key; If the decryption is successful, the verification is considered successful and the file system key is generated; If the decryption is successful, the verification is considered to have failed and an error message is returned.

3. The encrypted file cloud access method according to claim 1, characterized in that: Extracting the encrypted file name on the web page by the file name processing module includes: Detecting the URL of the current webpage and determining whether the webpage is a cloud storage platform based on the URL; If the webpage is a cloud storage platform, an XPath expression is used to match HTML elements and extract the encrypted file name displayed on the webpage.

4. The encrypted file cloud access method according to claim 1, characterized in that: Calling the decryption algorithm module and the file system key to decrypt the encrypted file name includes: extracting the file system key from the storage module; Extract the first 32 bytes from the file system key as the file name encryption key; Decrypt the encrypted file name using the AES-SIV decryption algorithm according to the file name encryption key; If the decryption is successful, a plaintext file name is generated; If decryption fails, an error message is returned.

5. The encrypted file cloud access method according to claim 1, characterized in that: Extracting the encrypted file through the download link and calling the decryption algorithm module and the file system key to decrypt the content of the encrypted file includes: extracting the file system key from the storage module; Intercepting 32 bytes to 64 bytes from the file system key as a file content encryption key; Obtain an encrypted file through an HTTP request, and extract a unique file identifier from a header of the encrypted file; Encrypt the file content encryption key and the file unique identifier using AES-ECB to generate a file content key; Initialize the plaintext file content and traverse each data block in the encrypted file; extracting an encryption initialization vector, an encryption message authentication code, and encrypted data from the data block; Decrypting the data block using the AES-GCM algorithm based on the generated file content key, the encryption initialization vector, the encrypted message authentication code, and the encrypted data; If the decryption is successful, the decrypted data block is appended to the plaintext file content; If decryption fails, an error message is returned.

6. The encrypted file cloud access method according to claim 1, characterized in that: Extracting the download link includes: intercepting and extracting the download link through a URL interception mechanism.

7. The encrypted file cloud access method according to claim 1, characterized in that: The encrypted file system includes at least one of SecureFS, gocryptfs, EncFS or Cryptomator.

8. A cloud-based access device for encrypted files, characterized in that: include: The user interaction module is used to receive the configuration file of the encrypted file system and the user password uploaded by the user; A decryption algorithm module, used to verify the configuration file and user password; A storage module, configured to generate a file system key and store the file system key if the verification is successful; The file name processing module is used to extract the encrypted file name on the web page when the user visits the web page, and call the decryption algorithm module and the file system key to decrypt the encrypted file name; File download module, used to intercept file download requests and extract download links; The decryption algorithm module is further used to extract the encrypted file through the download link and call the file system key to decrypt the content of the encrypted file; The rendering module is used to render the decrypted encrypted file name and the content of the encrypted file to the web page interface.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the encrypted file cloud access method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, causes the processor to execute the encrypted file cloud access method according to any one of claims 1 to 7.

Images