Secure file storage method and system

Abstract

A method and system for secure file storage, comprising: generating an initial key according to a password input by a user, and then generating a secret code key pair, a signature key pair, and a plaintext file key corresponding to a file, a private key in the two key pairs being encrypted by the initial key and then stored, and a private key in the signature key pair being stored by the plaintext file key corresponding to the file; the plaintext file secret key is stored after being encrypted by a public key in the secret code secret key pair, and the signature secret key pair is used for generating and verifying a signature of a user side. In addition, the file is stored after being encrypted by the plaintext file key. By means of the framework, safe storage service of the files can be provided.

Description

Technical Field

[0001] This invention relates to an information security technology, and more particularly to a method and system for secure file storage. Background Technology

[0002] With the development of information technology, more and more companies are providing file storage services to meet users' file storage and backup needs. Currently, most file storage services on the market require users to first store the file key on an account server before transferring files to a third-party storage space (server). The file is then sent to the third-party server for encryption and storage. When a user needs to access the file, the account server sends the file key back to the user, who then uses this key to send the file to the third-party server for decryption and transmission. Because the account server stores the file key, if the account server is hacked, the file key is at risk of being leaked, allowing hackers to use it to request access to the file data from the third-party server.

[0003] However, to prevent security issues arising from the leakage of keys stored on the account server, how to securely protect file keys on the account server and prevent them from being stolen by hackers has become an important technical problem to be solved. In this invention, the local machine, in conjunction with the interface server and key server, uses multi-key and encryption technology to prevent the leakage of file content stored on third-party servers due to the leakage of keys stored on the account server (interface server and key server), thereby further achieving the goal of secure file storage. Summary of the Invention

[0004] To address the aforementioned problems, this invention provides a method for secure file storage that uses multiple keys and key pairs to protect the content of files.

[0005] The secure file storage method of the present invention is executed by a user terminal, an interface server, a key server, and a file server. The secure file storage method includes: the user terminal receiving a password provided by a user; the user terminal using the password and the interface server to generate an initial key corresponding to the password; the user terminal using a first asymmetric encryption technique to generate a cryptographic public key and a cryptographic private key; encrypting the cryptographic private key using the initial key to generate an encrypted cryptographic private key; the user terminal storing the cryptographic public key and the encrypted cryptographic private key to the key server via the interface server; the user terminal sending a first request to the interface server, instructing the interface server to randomly generate a plaintext file key; encrypting the plaintext file key using the cryptographic public key to generate an ciphertext file key; storing the ciphertext file key to the key server and transmitting it to the user terminal; the user terminal using the cryptographic private key to decrypt the ciphertext file key to obtain the plaintext file key; the user terminal using a secure communication protocol to transmit the plaintext file key and a file to the file server; and the file server encrypting the file according to the plaintext file key to generate an encrypted file, and then storing the encrypted file.

[0006] In one embodiment, the user terminal uses an unintentional pseudo-random function in cooperation with the interface server to generate an initial key.

[0007] In another embodiment, the secure file storage method of the present invention further includes the following steps: the user terminal uses a second asymmetric encryption technology to generate a signature public key and a signature private key, and uses an initial key to encrypt the signature private key to generate an encrypted signature private key; the user terminal stores the signature public key and the encrypted signature private key to a key server through an interface server; and the interface server uses the signature public key to verify the signature in the first request.

[0008] In one embodiment, the interface server generates a plaintext file key only when the signature verification is successful.

[0009] In one embodiment, the user deletes the initial key, the cryptographic private key, and the signing private key after a preset time.

[0010] In one embodiment, the secure file storage method of the present invention further includes the following steps: the user terminal obtains an encrypted password private key and an encrypted signature private key from a key server through an interface server; the user terminal receives a password and cooperates with the interface server to generate an initial key; the user terminal uses the initial key to decrypt the encrypted password private key to obtain the password private key; and the user terminal uses the initial key to decrypt the encrypted signature private key to obtain the signature private key, wherein the initial key, the password private key, and the signature private key are used for subsequent encryption context changes, file uploads, or file downloads.

[0011] In one embodiment, the secure file storage method of the present invention further includes the following steps: a user terminal receives a new password and, in cooperation with an interface server, generates a new initial key corresponding to the new password; the user terminal uses the new initial key to encrypt a password private key to generate a new encrypted password private key; the user terminal uses the new initial key to encrypt a signature private key to generate a new encrypted signature private key; and the user terminal stores the new encrypted password private key and the new encrypted signature private key to a key server through the interface server.

[0012] In another embodiment, when the user terminal transmits the plaintext file key and the file to the file server using a secure communication protocol, it specifies an encryption algorithm so that the file server can use the plaintext file key and the encryption algorithm to encrypt the file to generate an encrypted file.

[0013] In one embodiment, the secure file storage method of the present invention further includes the following steps: a user terminal sends a second request to a file server, wherein the second request includes a plaintext file key and specifies an encryption algorithm; and the file server uses the plaintext file key and the encryption algorithm to decrypt the encrypted file into a file and sends the file to the user terminal.

[0014] The present invention also provides a secure file storage system, comprising a user terminal, an interface server, a key server, and a file server. The user terminal receives a password and collaborates with the interface server to generate an initial key corresponding to the password. The user terminal uses a first asymmetric encryption technique to generate a cryptographic public key and a cryptographic private key, encrypts the cryptographic private key using the initial key to generate an encrypted cryptographic private key, and then stores the cryptographic public key and the encrypted cryptographic private key on the key server via the interface server. The user terminal also transmits a first request to the interface server. The interface server further generates a plaintext file key randomly based on the first request, encrypts the plaintext file key using the cryptographic public key to generate a ciphertext file key, and then stores the ciphertext file key on the key server and transmits it to the user terminal. The user terminal decrypts the ciphertext file key using the cryptographic private key to obtain the plaintext file key, and then transmits the plaintext file key and a file to the file server using a secure communication protocol. The file server encrypts the file based on the plaintext file key to generate an encrypted file, and then stores the encrypted file.

[0015] This invention uses multiple keys and key pairs to protect the content of files, and the keys and key pairs are encrypted during transmission and storage, or deleted after use. Therefore, this invention achieves more secure file storage. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the architecture of a secure file storage system according to an embodiment of the present invention.

[0017] Figures 2 to 6 This is a flowchart illustrating a method for secure file storage according to an embodiment of the present invention.

[0018] Figure 7-1 and Figure 7-2 This is a flowchart illustrating a method for secure file storage according to another embodiment of the present invention.

[0019] Explanation of main component symbols

[0020] 11 Client

[0021] 12 Interface Server

[0022] 13 Key Server

[0023] 14 File Servers

[0024] Steps 21-28, 31-37, 41-49, 51-58, 61-68, 701-711. Detailed Implementation

[0025] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification.

[0026] Figure 1 This is a schematic diagram of the architecture of a secure file storage system according to an embodiment of the present invention. The secure file storage system includes a client 11, an interface server 12, a key server 13, and a file server 14.

[0027] In one embodiment, the user terminal 11 may be an electronic device such as a user's mobile phone or computer, or application software installed on the electronic device; the interface server 12 may be connected to the user terminal 11 and the key server 13 via wired or wireless network communication; the file server 14 may be connected to the user terminal 11 via wired or wireless network communication.

[0028] In one embodiment, the interface server 12, the key server 13, and the file server 14 are three servers that operate separately.

[0029] In another embodiment, any two of the interface server 12, key server 13 and file server 14 can be merged into the same server, while the other one is a separate server.

[0030] In another embodiment, the interface server 12, the key server 13, and the file server 14 are merged into a single server.

[0031] Client 11, interface server 12, key server 13, and file server 14 can be used to execute... Figures 2 to 6 The flowchart illustrates the method for secure file storage. Each step will be explained in detail below. Figures 2 to 6 The process is shown below.

[0032] Figure 2 This is a flowchart illustrating the process of creating an encryption context in the method for storing this secure file.

[0033] First, in step 21, the user terminal 11 receives the password entered by the user.

[0034] In step 22, the client 11 uses an Oblivious Pseudo Random Function (OPRF) to generate a first value based on the password and a random number, and then transmits the first value to the interface server 12.

[0035] In step 23, the interface server 12 uses an unintentional pseudo-random function to generate a second value based on the first value, and then transmits the second value to the user terminal 11.

[0036] In step 24, the user terminal 11 uses an unintentional pseudo-random function and generates an initial key corresponding to the above-mentioned password based on the second value.

[0037] In step 25, the user terminal 11 uses asymmetric encryption technology to generate a cryptographic key pair, which includes a cryptographic public key and a cryptographic private key. The user terminal 11 uses an initial key to encrypt the cryptographic private key to generate an encrypted cryptographic private key.

[0038] In one embodiment, the asymmetric encryption technology here may be the RSA (Rivest-Shamir-Adleman) encryption algorithm or the Advanced Encryption Standard (AES), or other equivalent asymmetric encryption technologies.

[0039] In step 26, the client 11 uses asymmetric encryption technology to generate a signature key pair, which includes a signature public key and a signature private key. The client 11 then uses an initial key to encrypt the signature private key to generate an encrypted signature private key.

[0040] In one embodiment, the asymmetric encryption technology here may be the RSA (Rivest-Shamir-Adleman) encryption algorithm, the Elliptic Curve Digital Signature Algorithm (ECDSA), the Edwards-curve Digital Signature Algorithm (EdDSA), or other equivalent asymmetric encryption technologies.

[0041] In step 27, the client 11 transmits the cryptographic public key, the encrypted cryptographic private key, the signing public key, and the encrypted signing private key to the interface server 12.

[0042] In step 28, the interface server 12 stores the cryptographic public key, the encrypted cryptographic private key, the signing public key, and the encrypted signing private key to the key server 13. The aforementioned four public keys and the encrypted private key can be used for... Figures 4 to 6 The process is shown below.

[0043] Client 11 does not permanently store any passwords, keys, public keys, or private keys used in previous processes. In other words, after a preset period of time, client 11 will delete all passwords, keys, public keys, and private keys used in previous processes.

[0044] If the user terminal 11 needs to execute before the preset time, Figures 4 to 6 The process shown allows you to directly use the currently stored initial key, cryptographic private key, and signing private key for... Figures 4 to 6 The process.

[0045] Conversely, if the initial key, cryptographic private key, and signing private key have been deleted after the preset time, and if client 11 needs to execute... Figures 4 to 6 The process shown requires execution first. Figure 3 Process to obtain Figures 4 to 6 The process requires an initial key, a cryptographic private key, and a signing private key.

[0046] Figure 3 This is a flowchart illustrating the process of obtaining the encryption context in the above-described method for secure file storage.

[0047] First, in step 31, the client 11 sends a request to obtain the encryption context to the interface server 12.

[0048] In step 32, the interface server 12 responds to the request and queries the key server 13 for the encryption password private key and encryption signature private key of the user terminal 11, that is, the encryption password private key and encryption signature private key generated in the previous steps 25 and 26.

[0049] In step 33, the key server 13 transmits the encrypted password private key and the encrypted signature private key of the user terminal 11 to the interface server 12.

[0050] In step 34, the interface server 12 transmits the encrypted password private key and the encrypted signature private key to the user terminal 11.

[0051] In step 35, the user terminal 11 receives the password entered by the user.

[0052] In step 36, the client 11, in cooperation with the interface server 12, generates an initial key based on the password. The details of step 36 are the same as those of steps 22-24.

[0053] In step 37, the user terminal 11 uses the initial key to decrypt the encrypted private key to obtain the private key, and the user terminal 11 uses the initial key to decrypt the encrypted signature private key to obtain the signature private key.

[0054] The password entered by the user in step 35 must be the same as the password entered in step 21, so that a match can be generated in step 36. Figure 2 The same initial key is used in the process to ensure that subsequent steps can be executed correctly.

[0055] As mentioned above, after a preset time, client 11 will delete the previous... Figure 3 The initial key, cryptographic private key, and signing private key obtained during the process.

[0056] At this point, if client 11 still needs to execute... Figures 4 to 6 The process shown needs to be executed again first. Figure 3 The process involves obtaining the required initial key, cryptographic private key, and signing private key.

[0057] Figure 4 This is a flowchart illustrating the process of changing the encryption context in the aforementioned secure file storage method, which is used to handle user password changes.

[0058] First, in execution Figure 4 Before the process can begin, it must be executed first. Figure 2 The process is to create an cryptographic context or perform... Figure 3 The process retrieves the created cryptographic context.

[0059] Next, in step 41, the client 11 receives the new password entered by the user.

[0060] In step 42, the user terminal 11 transmits a signature to the interface server 12.

[0061] In one embodiment, the signature information includes a new first value generated by the user terminal 11 using an unintentional pseudo-random function based on the new password and a random number, and includes a signature generated by the user terminal 11 using a signature private key.

[0062] In step 43, the interface server 12 responds to the signature information and queries the key server 13 for the signature public key of the user terminal 11.

[0063] In step 44, the key server 13 transmits the signing public key of the user terminal 11 to the interface server 12.

[0064] In step 45, the interface server 12 uses the signing public key to verify the signature. If the signature verification fails, the interface server 12 terminates. Figure 4 The process continues. Conversely, if the signature verification is successful, the process proceeds to step 46.

[0065] In step 46, the interface server 12 uses an unintentional pseudo-random function to generate a new second value based on the new first value, and then transmits the new second value to the user terminal 11.

[0066] In step 47, the user terminal 11 uses an unintentional pseudo-random function and generates a new initial key corresponding to the new password based on the new second value.

[0067] In step 48, the client 11 uses the new initial key to encrypt the password private key to generate a new encrypted password private key, and uses the new initial key to encrypt the signature private key to generate a new encrypted signature private key, and then transmits the new encrypted password private key and the new encrypted signature private key to the interface server 12.

[0068] In step 49, the interface server 12 stores the new encrypted password private key and the new encrypted signature private key to the key server 13 to replace the original encrypted password private key and encrypted signature private key.

[0069] Figure 5 This is a flowchart illustrating the file upload process in the aforementioned secure file storage method.

[0070] First, in execution Figure 5 Before the process can begin, it must be executed first. Figure 2 The process is to create an cryptographic context or perform... Figure 3 The process retrieves the created cryptographic context.

[0071] Next, in step 51, the client 11 is about to upload a file to the file server 14, so it sends a request to obtain the encrypted file key of the file to the interface server 12.

[0072] In one embodiment, the request includes a signature generated by the user terminal 11 using a signing private key.

[0073] In step 52, the interface server 12 responds to the request and queries the key server 13 for the signature public key of the client 11.

[0074] In step 53, the key server 13 transmits the signing public key of the user terminal 11 to the interface server 12.

[0075] In step 54, the interface server 12 verifies the signature using the signature public key. If the signature verification is successful, the process proceeds to step 55. If the signature verification fails, the interface server 12 rejects the request and terminates the process. Figure 5 The process, without generating the plaintext file key as described below.

[0076] In other words, the interface server 12 generates the plaintext file key as described below only when the signature verification is successful.

[0077] In step 55, the interface server 12 randomly generates a plaintext file key for the file, and encrypts the plaintext file key using a cryptographic public key to generate a ciphertext file key, and then stores the ciphertext file key to the key server 13.

[0078] In step 56, the interface server 12 transmits the encrypted file key to the user terminal 11.

[0079] In step 57, the client 11 uses the encrypted private key to decrypt the encrypted file key to obtain the plaintext file key of the file.

[0080] In step 58, the client 11 uses a secure communication protocol to upload the plaintext file key and the file to the file server 14, and specifies an encryption algorithm.

[0081] In one embodiment, the sending end of the secure communication protocol encrypts the transmitted data, and the receiving end decrypts the received data. The secure communication protocol may be, for example, Hypertext Transfer Protocol Secure (HTTPS), or other equivalent secure communication protocols.

[0082] Accordingly, file server 14 uses the plaintext file key and the encryption algorithm to encrypt the file to generate an encrypted file, and stores the encrypted file.

[0083] In one embodiment, the encryption algorithm may employ the Advanced Encryption Standard (AES) or other equivalent symmetric encryption techniques.

[0084] In one embodiment, file server 14 can use the plaintext file key to encrypt the file to produce the encrypted file.

[0085] In addition, there is a one-to-one correspondence between the plaintext file key and the file.

[0086] In detail, if file server 14 stores multiple files, before each file is uploaded to file server 14, interface server 12 will generate a different plaintext file key for each file.

[0087] Figure 6 This is a flowchart illustrating the process of downloading files in the aforementioned secure file storage method.

[0088] First, in execution Figure 6 Before the process can begin, it must be executed first. Figure 2 The process is to create an cryptographic context or perform... Figure 3 The process retrieves the created cryptographic context.

[0089] Next, in step 61, the client 11 is about to download a file from the file server 14, so it sends a request to obtain the encrypted file key of the file to the interface server 12.

[0090] In one embodiment, the request includes a signature generated by the user terminal 11 using a signing private key.

[0091] In step 62, the interface server 12 responds to the request by querying the key server 13 for the signature public key of the client 11 and the ciphertext file key of the file.

[0092] In step 63, the key server 13 transmits the signing public key of the user terminal 11 and the ciphertext file key of the file to the interface server 12.

[0093] In step 64, the interface server 12 verifies the signature using the signature public key. If the signature verification fails, the interface server 12 rejects the request and terminates the process. Figure 6 Process. If the signature verification is successful, the process proceeds to step 65.

[0094] In step 65, the interface server 12 transmits the encrypted file key to the user terminal 11.

[0095] In step 66, the client 11 uses the encrypted private key to decrypt the encrypted file key to obtain the plaintext file key of the file.

[0096] In step 67, client 11 uses the aforementioned secure communication protocol to send a request to download the file to file server 14. This request includes the plaintext file key and specifies an encryption algorithm. Furthermore, the encryption algorithm specified here must be the same as the encryption algorithm specified in step 58.

[0097] In step 68, the file server 14 uses the plaintext file key and the encryption algorithm to decrypt the encrypted file corresponding to the file back into the file, and uses the aforementioned secure communication protocol to transmit the file to the user terminal 11.

[0098] In one embodiment, the file server 14 can use the plaintext file key to decrypt the encrypted file back into the file.

[0099] In detail, for the same file, the same plaintext file key will be used in steps 58 and 68, meaning there is a one-to-one correspondence between the plaintext file key and the file. Therefore, in step 58, the plaintext file key will be used to encrypt the uploaded file into the encrypted file, and in step 68, the plaintext file key will be used to decrypt the encrypted file into the encrypted file.

[0100] Figure 7-1 and Figure 7-2 This is a flowchart illustrating a method for secure file storage according to another embodiment of the present invention. See below for further details. Figure 7-1 and Figure 7-2 This describes the process of using this secure file storage method.

[0101] First, in step 701, the user terminal 11 receives the password entered by the user.

[0102] In step 702, the client 11, in cooperation with the interface server 12, generates an initial key corresponding to the password. The details of step 702 are the same as those of steps 22-24.

[0103] In step 703, the client 11 generates a cryptographic key pair using asymmetric encryption technology, which includes a cryptographic public key and a cryptographic private key. Furthermore, the client 11 encrypts the cryptographic private key using the initial key to generate an encrypted cryptographic private key.

[0104] In step 704, the user terminal 11 transmits the public key and the private key of the encrypted password to the interface server 12.

[0105] In step 705, the interface server 12 stores the public key and the private key of the encryption key to the key server 13.

[0106] In step 706, the client 11 is about to upload a file to the file server 14, therefore, a request to obtain the encrypted file key of the file is sent to the interface server 12.

[0107] In step 707, the interface server 12 randomly generates a plaintext file key and uses the cryptographic public key to encrypt the plaintext file key to generate the corresponding ciphertext file key.

[0108] In step 708, the interface server 12 stores the encrypted file key to the key server 13.

[0109] In step 709, the interface server 12 transmits the encrypted file key to the user terminal 11.

[0110] In step 710, the user terminal 11 uses the aforementioned encrypted private key to decrypt the encrypted file key in order to obtain the plaintext file key of the file.

[0111] In step 711, the client 11 uploads the plaintext file key and the file to the file server 14 using a secure communication protocol, and specifies an encryption algorithm. Accordingly, the file server 14 uses the plaintext file key and the encryption algorithm to encrypt the file to generate a corresponding encrypted file, and stores the encrypted file.

[0112] The present invention also provides a computer-readable storage medium, such as memory, magnetic tape, disk, or optical disk. This computer-readable storage medium can be used to store instructions, which can be read by the aforementioned client, interface server, key server, and file server to execute the secure file storage method of any of the above embodiments. In one embodiment, the computer-readable storage medium is a non-transitory computer-readable storage medium.

[0113] In summary, the files of this invention are encrypted and stored on a file server, and all files are transmitted using the aforementioned secure communication protocol. Furthermore, the aforementioned private key, signature private key, and file key are all stored and transmitted in an encrypted state, or transmitted using the aforementioned secure communication protocol. Moreover, the aforementioned password, first value, second value, and initial key are deleted from the secure file storage system of this invention after use and are not permanently stored. Therefore, this invention can provide secure file upload, secure storage, and secure download services without the risk of file content leakage.

[0114] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the invention. Any person skilled in the art can modify and alter the above embodiments without departing from the spirit and scope of the invention. Therefore, the scope of protection of the present invention should be as set forth in the claims.

Claims

1. A method for secure file storage, executed by a user terminal, an interface server, a key server, and a file server, the secure file storage method comprising: The client receives a password and works with the interface server to generate an initial key corresponding to that password. The user terminal uses a first asymmetric encryption technique to generate a cryptographic public key and a cryptographic private key, and uses the initial key to encrypt the cryptographic private key to generate an encrypted cryptographic private key; The user terminal stores the public key and the private key of the encrypted password to the key server through the interface server; The client sends a first request to the interface server, which in turn causes the interface server to randomly generate a plaintext file key. The plaintext file key is then encrypted using the cryptographic public key to generate a ciphertext file key. The ciphertext file key is then stored in the key server and transmitted to the client. The user terminal uses the encrypted private key to decrypt the encrypted file key in order to obtain the plaintext file key; The user terminal uses a secure communication protocol to transmit the plaintext file key and a file to the file server. as well as The file server encrypts the file using the plaintext file key to generate an encrypted file, which is then stored.

2. The method for secure file storage as described in claim 1, wherein, The client uses an unintentional pseudo-random function in conjunction with the interface server to generate the initial key.

3. The method for secure file storage as described in claim 1, wherein, The method also includes: The user terminal uses a second asymmetric encryption technique to generate a signature public key and a signature private key, and uses the initial key to encrypt the signature private key to generate an encrypted signature private key; The user client stores the signing public key and the cryptographic signing private key to the key server through the interface server; and The interface server uses the signature public key to verify the signature in the first request.

4. The method for secure file storage as described in claim 3, wherein, The interface server generates the plaintext file key only when the signature verification is successful.

5. The method for secure file storage as described in claim 3, wherein, After a preset period of time, the client deletes the initial key, the cryptographic private key, and the signing private key.

6. The method for secure file storage as described in claim 5, wherein, After the preset time has elapsed, the secure file storage method further includes: The user terminal obtains the encryption key and the encryption signature key from the key server through the interface server. The user receives the password and works with the interface server to generate the initial key. The user terminal uses the initial key to decrypt the encrypted private key, thereby obtaining the private key; and The user terminal uses the initial key to decrypt the cryptographic signature private key to obtain the signature private key. The initial key, the cryptographic private key, and the signature private key are used for subsequent encryption context changes, file uploads, or file downloads.

7. The method for secure file storage as described in claim 3, wherein, The method also includes: The client receives a new password and works with the interface server to generate a new initial key corresponding to the new password. The user terminal uses the new initial key to encrypt the private key of the password, so as to generate a new encrypted private key of the password; The client uses the new initial key to encrypt the signing private key, thereby generating a new encrypted signing private key; and The user terminal stores the new encrypted password private key and the new encrypted signature private key to the key server through the interface server.

8. The method for secure file storage as described in claim 1, wherein, When the client uses the secure communication protocol to transmit the plaintext file key and the file to the file server, it specifies an encryption algorithm so that the file server can use the plaintext file key and the encryption algorithm to encrypt the file to generate the encrypted file.

9. The method for secure file storage as described in claim 8, wherein, The method also includes: The client transmits a second request to the file server, wherein the second request includes the plaintext file key and specifies the encryption algorithm; and The file server uses the plaintext file key and the encryption algorithm to decrypt the encrypted file back into the file and then transmits the file to the user's terminal.

10. A secure file storage system, comprising a client, an interface server, a key server, and a file server, wherein: The client receives a password and works with the interface server to generate an initial key corresponding to that password. The client is also used to generate a cryptographic public key and a cryptographic private key using a first asymmetric encryption technology, to encrypt the cryptographic private key using the initial key to generate an encrypted cryptographic private key, and then to store the cryptographic public key and the encrypted cryptographic private key to the key server through the interface server. The user client sends a first request to the interface server; The interface server randomly generates a plaintext file key based on the first request, encrypts the plaintext file key using the cryptographic public key to generate a ciphertext file key, and then stores the ciphertext file key in the key server and transmits it to the user terminal. The client also uses the encrypted private key to decrypt the encrypted file key, obtain the plaintext file key, and use a secure communication protocol to transmit the plaintext file key and a file to the file server. as well as The file server uses the plaintext file key to encrypt the file, thereby generating an encrypted file, which is then stored.

Images