Secure file sharing method and system based on trusted data object packaging module
By combining the Trusted Data Object Encapsulation Module (TDE) with encryption and an attribute database, the problem of inefficient authorization management and coarse-grained access control in existing access control schemes is solved. Fine-grained access control and autonomous control of data objects are realized, and large file encryption and rapid decision-making are supported.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-19
- Publication Date
- 2026-04-14
AI Technical Summary
Existing access control schemes suffer from inefficient authorization management, coarse-grained access control, and weak auditability of access activities, making it difficult to achieve fine-grained control over secure data access.
By employing a Trusted Data Object Encapsulation Module (TDE), and deeply binding access policies to manifest.json through encrypted data payload and a key access server, attribute-based access control is implemented. This supports a hybrid approach of AES symmetric encryption and RSA asymmetric encryption, and an attribute-based access control mechanism is designed.
It implements fine-grained access control for data objects, ensuring data autonomy, supports large file encryption, enables rapid decision-making, and ensures that policy binding is tamper-proof, meeting enterprise-level data security requirements.
Smart Images
Figure CN121859337A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of information security, specifically relating to a secure file sharing method and system based on a trusted data object encapsulation module. Background Technology
[0002] Humanity is undergoing the most significant transformation since the Industrial Revolution, a transformation based on the digital economy. Due to the emergence of the digital economy, many market players are now producing and exchanging data or information. Human society has seen the emergence of a fourth sector derived from the tertiary sector: the information or data services industry. Data, as the fifth major factor of production, has become a crucial strategic resource for nations, playing an increasingly prominent role in social progress, economic development, and national security.
[0003] The circulation of data elements among multiple entities through sharing or trading is a crucial foundation for the orderly release of data value. It not only carries the generation, flow, and realization of data value but also contains the accumulation, transfer, and management of data security risks. Therefore, data security is a prerequisite for protecting the value of data elements and a cornerstone of the digital economy's development. Without data security, there is no national security.
[0004] Current mainstream access control schemes mainly include operating system file management systems based on access control lists (ACLs), such as Windows access control lists and Linux permission masks; and role-based access control systems (RBACs), where users are granted a set of predefined permissions based on their roles. Although existing access control schemes can achieve secure data access, they suffer from problems such as inefficient authorization management, coarse-grained access control, and weak auditability of access activities.
[0005] To address the aforementioned issues, a Trust Data Encapsulation (TDE) system is urgently needed to achieve fine-grained access control while protecting data reliability and integrity. This solution designs a data encapsulation method that deeply binds shared data with authorization policies to ensure continuous data controllability, and constructs an attribute-based access control (ABAC) approach to implement fine-grained access control. Summary of the Invention
[0006] (a) Technical problems to be solved The technical problem to be solved by this invention is how to provide a secure file sharing method and system based on a trusted data object encapsulation module, so as to solve the problems that existing access control schemes can achieve secure data access, but have problems such as inefficient authorization management, coarse access control granularity, and weak auditability of access activities.
[0007] (II) Technical Solution To address the aforementioned technical issues, this invention proposes a secure file sharing method based on a Trusted Data Object Encapsulation Module (TDE). This method establishes a TDE file, which includes an encrypted data payload and a manifest.json file. Encrypted payload: An encrypted version of the protected object; manifest.json: A JSON-formatted data structure containing all the information needed to request access to the decryption key, namely the access policy, integrity verification, and encryption algorithm; specifically including: encrypted metadata and encrypted data index; the encrypted data payload and encrypted metadata are linked through the encrypted data index.
[0008] A secure shared file system based on a trusted data object encapsulation module, comprising: an encryption / decryption client, an identity server, an attribute database, and a key access server; the system implements encryption and decryption method steps; Encryption / decryption client: The component responsible for initiating and executing the encryption and decryption process; data owners and data users log in / register through the client and invoke system functions; the encryption / decryption client is the only component that can access the content; Identity server: Obtains the encryption / decryption client's public key and signature bound to the session; the identity server needs to have the ability to send web requests to the authorization decision point, which contain sufficient information to identify the requester; the identity server needs to have the ability to customize access tokens and bind authorization attributes to the tokens; Attribute Database: Receives authentication requests from the identity server. The request contains requester information and system context information. The attribute database is responsible for retrieving the attributes of the corresponding user from the database, converting the incoming information into a set of corresponding attribute objects, encapsulating them into TDE declaration object format, and returning them. Key Access Server: Responsible for authorizing clients to access repackaged data key materials for encryption and decryption. Upon receiving a data access request from a data user, the Key Access Server receives the user's public key, policy information for the encrypted data, and performs attribute matching. If the match is successful, the Key Access Server returns the repackaged data key material to the data user. When communicating with the Key Access Server, a valid DPoP OIDC access token must be used. The Key Access Server will verify the authenticity of the token, its signature, and its internal attribute declarations. Even a valid and trusted OIDC access token will be rejected if it lacks a valid attribute declaration.
[0009] (III) Beneficial Effects This invention proposes a secure file sharing method and system based on a trusted data object encapsulation module. The beneficial effects of this invention are: data owners can create and share encrypted data by binding attribute-based access control policies to data objects in an encrypted manner, and can maintain independent control over the data regardless of where the data flows.
[0010] This invention provides standardized data encryption and encapsulation functionality. It employs a hybrid encryption method combining AES symmetric encryption and RSA asymmetric encryption to ensure the security of data transmission and storage. It also supports large file encryption (file size ≤ 64GB), meeting enterprise-level data encryption requirements and ensuring high efficiency in the encryption process. An attribute-based access control mechanism is designed and implemented. It supports multi-level policy rules (Any of, All of, Hierarchy), enabling strict control over user permissions through fine-grained policy settings, while also supporting rapid decision-making (decision time ≤ 35ms when there are ≤ 10 attributes), ensuring efficient and accurate access control.
[0011] A secure file-sharing method and system based on a trusted data object encapsulation module has the following characteristics: 1. Reliability: Supports data encryption and protection of encryption keys.
[0012] 2. Attribute-based access control: Supports ABAC and implements policy-driven and highly scalable access control mechanisms.
[0013] 3. Policy Binding: Based on public key signatures, it supports cryptographic binding between data and metadata, ensuring the policy cannot be tampered with.
[0014] 4. Offline creation: TDE files can be created without a network connection and without access keys to the server. Attached Figure Description
[0015] Figure 1 This is a schematic diagram of the TDE component of the present invention; Figure 2This is a sequence diagram of the encryption process; Figure 3 This is a sequence diagram of the decryption process; Figure 4 A schematic diagram of the TDE component; Figure 5 Graph for encryption implementation; Figure 6 The implementation diagram is for decryption. Detailed Implementation
[0016] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.
[0017] The circulation of data elements among multiple entities through sharing or transactions is a crucial foundation for the orderly release of data value. It not only carries the generation, flow, and realization of data value but also involves the accumulation, transfer, and management of data security risks. Data security is a prerequisite for protecting the value of data elements and a cornerstone of the digital economy's security. Access control is the first line of defense for data security. In data circulation and sharing scenarios, access control technology can effectively manage data, prevent unauthorized access, protect sensitive data, meet compliance requirements, and ensure data integrity.
[0018] To address the existing problems, the purpose of this invention is to provide a secure file sharing method based on the Trust Data Encapsulation (TDE) module, which solves the problem of maintaining autonomous control over data regardless of where the data flows.
[0019] The core of a TDE file is an encrypted data payload and encrypted metadata (manifest), linked through an encrypted data index. This ensures that data can be shared or access restricted according to precise security requirements in cross-domain environments.
[0020] TDE Components: TDE consists of two parts, including: encrypted data payload and manifest.json; Encrypted payload: An encrypted version of a protected object (such as a file or email). manifest.json: A JSON-formatted data structure containing all the information needed to request access to the decryption key, including access policy, integrity verification, encryption algorithm, etc. Specifically, it includes encrypted metadata and an encrypted data index. Details such as Figure 1 As shown: Encrypted metadata section: Method: Object Encryption Method integrityInformation: Integrity verification; encryptionInformation: Contains information describing the encryption method; Type: The encapsulated key (the type of scheme used to access the key and authorize the payload); Policy: Access policy (the policy object is JSON-stringified and then base64 encoded).
[0021] Encrypted data index section: payload: Metadata required to access the TDE payload, including how to handle the payload and references to the payload file; Type: Payload type, indicating where the payload is obtained; url: A URL pointing to the location of the payload; Protocol: Specifies the protocol used for encryption. Currently, only zip and zipstream are supported. Isencrypted: Specifies whether the payload is encrypted; In summary, the beneficial effects of this invention are: data owners can create and share encrypted data by binding attribute-based access control policies to data objects in an encrypted manner, and can maintain independent control over the data regardless of where the data flows.
[0022] Example 1: The Trust Data Encapsulation (TDE) module for secure file sharing addresses the problems of inefficient authorization management, coarse-grained access control, and weak auditability of access activities in existing file transfer methods. This invention can automatically generate large amounts of random trajectory data and more realistically simulate the motion trajectory of moving targets.
[0023] This disclosure provides a secure shared file system using a Trust Data Encapsulation (TDE) module. The system mainly comprises four entities: an encryption / decryption client, an identity server, an attribute database, and a key access server.
[0024] Encryption / decryption client: This entity is responsible for initiating and executing the encryption and decryption process. Data owners and users log in / register through the client and invoke system functions. The encryption / decryption client is the only component that can access the content (ciphertext or plaintext).
[0025] Identity Server: This entity can be any system that supports the OIDC protocol, must conform to the OIDC standard, and support custom access tokens. Specifically, the identity server needs to obtain the encryption / decryption client's public key and signature bound to the session; the identity server needs to have the ability to send web requests to the Authorization Decision Point (PDP), which contain sufficient information to identify the requester; and the identity server needs to have the ability to customize access tokens and bind authorization attributes to the token.
[0026] Attribute Database: This entity receives authentication requests from the identity server. The request contains requester information and system context information. The attribute database is responsible for retrieving the attributes of the corresponding user from the database, converting the incoming information into a set of corresponding attribute objects (tde_claims), encapsulating them into TDE claim object format, and returning them.
[0027] Key Access Server (KAS): This entity is responsible for authorizing and decrypting clients to access repackaged data key materials. Upon receiving a data user's access request, the KAS receives the user's public key, the policy for the encrypted data, and performs attribute matching. If a match is successful, the KAS returns the repackaged data key material to the user, whose client can then access it encrypted. Communication with the KAS requires a valid DPoP OIDC access token. The KAS verifies the token's authenticity, signature, and internal attribute claims. Even valid and trusted OIDC access tokens will be rejected if they lack valid attribute claims.
[0028] The encryption method mainly includes the following steps, such as: Figure 1 As shown: Step S11, Registration Phase; According to a specific implementation method of this disclosure, step S11 specifically includes: Step S11.1: Configure the encrypted client with the server address and server public key.
[0029] Step S11.2: The identity server registers the client and user identities.
[0030] Step S11.3: Configure global attributes in the attribute database.
[0031] Step S12, Authentication Phase; According to a specific implementation method of this disclosure, step S12 specifically includes: Step S12.1: The encrypted client sends an authentication request to the identity server.
[0032] Step S12.2: The identity server executes the OIDC authentication protocol to complete the authentication.
[0033] Step S12.3: The identity server customizes user access tokens.
[0034] Step S12.4: The identity server returns an identity token containing user information to the encrypted client.
[0035] Step S13, Offline Encryption Stage; Step S13.1: The encryption client generates a symmetric key to encrypt data.
[0036] Step S13.2: The encrypted client uses the server's public key to encrypt the symmetric key, thus obtaining the encapsulated key.
[0037] Step S13.3: The encrypted client generates integrity verification information.
[0038] Step S13.4: The encryption client encapsulates the encrypted data, the encapsulated key, the integrity verification information, the access policy, and the server address to generate a TDE file.
[0039] The decryption method mainly includes the following steps, such as: Figure 2 As shown: Step S21, Registration Phase; Step S21.1: Decrypt the client configuration Key Access public key.
[0040] Step S21.2: The identity server registers the client and user identities.
[0041] Step S21.3: Configure global attributes in the attribute database.
[0042] Step S22, Authentication Phase; Step S22.1: The encrypted client sends an authentication request to the identity server.
[0043] Step S22.2: The identity server executes the OIDC authentication protocol to complete the authentication.
[0044] Step S22.3: The identity server customizes user access tokens.
[0045] Step S22.4: The identity server returns an identity token containing user information to the encrypted client.
[0046] Step S23, Decryption stage; Step S23.1: Decrypt the client to parse the TDE, obtain the integrity verification information, the encapsulated key, and the access policy.
[0047] Step S23.2: Decrypt the client to generate the RSA public-private key pair.
[0048] Step S23.3: Decrypt the client request to decrypt, carrying the token, access policy, its own public key and the encapsulated key to access the key access server.
[0049] Step S23.4: The identity server parses the identity and obtains the identity information.
[0050] Step S23.5: The attribute database maps identity attributes to the key access server.
[0051] Step S23.6: The key access server verifies the validity of the token and the access policy.
[0052] Step S23.7: The key access server re-encapsulates the key using the client's public key.
[0053] Step S23.8: The key access server returns the repackaged key to the decryption client.
[0054] To ensure intuitive visualization, this module adopts a B / S architecture, with the front-end using the Vue.js framework and the back-end using the Gin framework. Vue.js provides a flexible component-based development approach, effectively improving the front-end's responsiveness and user experience. It also leverages its ecosystem of plugins and tools, such as Vue Router and Vuex, to implement front-end and back-end routing and state management. The back-end provides a high-performance RESTful API through the Gin framework. Gin's lightweight and efficient characteristics enable the server to quickly respond to a large number of concurrent requests, while its middleware mechanism simplifies the implementation of common functions such as authentication. This overall architecture, based on the separation of front-end and back-end, greatly improves development efficiency and system maintainability.
[0055] Beneficial effects: The beneficial effects of this invention are: data owners can create and share encrypted data by binding attribute-based access control policies to data objects in an encrypted manner, and can maintain independent control over the data regardless of where the data flows.
[0056] This invention provides standardized data encryption and encapsulation functionality. It employs a hybrid encryption method combining AES symmetric encryption and RSA asymmetric encryption to ensure the security of data transmission and storage. It also supports large file encryption (file size ≤ 64GB), meeting enterprise-level data encryption requirements and ensuring high efficiency in the encryption process. An attribute-based access control mechanism is designed and implemented. It supports multi-level policy rules (Any of, All of, Hierarchy), enabling strict control over user permissions through fine-grained policy settings, while also supporting rapid decision-making (decision time ≤ 35ms when there are ≤ 10 attributes), ensuring efficient and accurate access control.
[0057] A secure file-sharing method and system based on a trusted data object encapsulation module has the following characteristics: 1. Reliability: Supports data encryption and protection of encryption keys.
[0058] 2. Attribute-based access control: Supports ABAC and implements policy-driven and highly scalable access control mechanisms.
[0059] 3. Policy Binding: Based on public key signatures, it supports cryptographic binding between data and metadata, ensuring the policy cannot be tampered with.
[0060] 4. Offline creation: TDE files can be created without a network connection and without access keys to the server.
[0061] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.
Claims
1. A secure file sharing method based on a trusted data object encapsulation module, characterized in that, This method establishes a Trusted Data Object Encapsulation Module (TDE) file, which includes: an encrypted data payload and a manifest.json file; Encrypted payload: An encrypted version of the protected object; manifest.json: A JSON-formatted data structure containing all the information needed to request access to the decryption key, namely the access policy, integrity verification, and encryption algorithm; specifically including: encrypted metadata and encrypted data index; the encrypted data payload and encrypted metadata are linked through the encrypted data index.
2. The secure file sharing method based on a trusted data object encapsulation module as described in claim 1, characterized in that, Encrypted metadata includes: Method: Object Encryption Method integrityInformation: Integrity verification; encryptionInformation: Contains information describing the encryption method; Type: The type of key being encapsulated, used for accessing the key and the scheme type that provides authorization for the payload; Policy: Access policy. The policy object is JSON-stringified and then base64 encoded.
3. The secure file sharing method based on a trusted data object encapsulation module as described in claim 2, characterized in that, The encrypted data index includes: payload: Metadata required to access the TDE payload, including how to handle the payload and references to the payload file; Type: Payload type, indicating where the payload is obtained; url: A URL pointing to the location of the payload; Protocol: Specifies the protocol used for encryption; Isencrypted: Specifies whether the payload is encrypted.
4. The secure file sharing method based on a trusted data object encapsulation module as described in claim 3, characterized in that, Protocol supports zip and zipstream.
5. A secure shared file system based on a trusted data object encapsulation module that implements the method of any one of claims 1-4, characterized in that, The system includes: an encryption / decryption client, an identity server, an attribute database, and a key access server; the system implements encryption and decryption methods. Encryption / decryption client: The component responsible for initiating and executing the encryption and decryption process; data owners and data users log in / register through the client and invoke system functions; the encryption / decryption client is the only component that can access the content; Identity server: Obtains the encryption / decryption client's public key and signature bound to the session; the identity server needs to have the ability to send web requests to the authorization decision point, which contain sufficient information to identify the requester; the identity server needs to have the ability to customize access tokens and bind authorization attributes to the tokens; Attribute Database: Receives authentication requests from the identity server. The request contains requester information and system context information. The attribute database is responsible for retrieving the attributes of the corresponding user from the database, converting the incoming information into a set of corresponding attribute objects, encapsulating them into TDE declaration object format, and returning them. Key Access Server: Responsible for authorizing clients to access repackaged data key materials for encryption and decryption. Upon receiving a data access request from a data user, the Key Access Server receives the user's public key, policy information for the encrypted data, and performs attribute matching. If the match is successful, the Key Access Server returns the repackaged data key material to the data user. When communicating with the Key Access Server, a valid DPoP OIDC access token must be used. The Key Access Server will verify the authenticity of the token, its signature, and its internal attribute declarations. Even a valid and trusted OIDC access token will be rejected if it lacks a valid attribute declaration.
6. The secure shared file system based on the trusted data object encapsulation module as described in claim 5, characterized in that, An identity server is any system that supports the OIDC protocol, and it needs to comply with the OIDC standard and support custom access tokens.
7. The secure shared file system based on a trusted data object encapsulation module as described in claim 5, characterized in that, The encryption method includes the following steps: Step S11, Registration Phase; Step S11.1: Configure the encrypted client with the server address and server public key; Step S11.2: The identity server registers the client and user identities; Step S11.3: Configure global attributes in the attribute database; Step S12, Authentication Phase; Step S12.1: The encrypted client sends an authentication request to the identity server; Step S12.2: The identity server executes the OIDC authentication protocol to complete the authentication. Step S12.3: The identity server customizes user access tokens; Step S12.4: The identity server returns an identity token containing user information to the encrypted client; Step S13, Offline Encryption Stage; Step S13.1: The encryption client generates a symmetric key to encrypt data; Step S13.2: The encrypted client uses the server's public key to encrypt the symmetric key, thus obtaining the encapsulated key; Step S13.3: The encrypted client generates integrity verification information; Step S13.4: The encryption client encapsulates the encrypted data, the encapsulated key, the integrity verification information, the access policy, and the server address to generate a TDE file.
8. The secure shared file system based on the trusted data object encapsulation module as described in claim 5, characterized in that, The decryption method includes the following steps: Step S21, Registration Phase; Step S21.1: Decrypt the client configuration Key Access public key; Step S21.2: The identity server registers the client and user identities; Step S21.3: Configure global attributes in the attribute database; Step S22, Authentication Phase; Step S22.1: The encrypted client sends an authentication request to the identity server; Step S22.2: The identity server executes the OIDC authentication protocol to complete the authentication. Step S22.3: The identity server customizes user access tokens; Step S22.4: The identity server returns an identity token containing user information to the encrypted client; Step S23, Decryption stage; Step S23.1: Decrypt the client to parse the TDE, obtain the integrity verification information, the encapsulated key, and the access policy; Step S23.2: Decrypt the client to generate the RSA public-private key pair; Step S23.3: Decrypt the client requesting decryption, carrying the token, access policy, its own public key, and the encapsulated key to access the key access server; Step S23.4: The identity server parses the identity to obtain identity information; Step S23.5: The attribute database maps identity attributes to the key access server; Step S23.6: The key access server verifies the token validity and access policy; Step S23.7: The key access server re-encapsulates the key using the client's public key; Step S23.8: The key access server returns the repackaged key to the decryption client.
9. The secure shared file system based on the trusted data object encapsulation module as described in claim 5, characterized in that, The system adopts a B / S architecture, with the front end using the Vue.js framework to improve the responsiveness and user experience of the front end interface. At the same time, it utilizes plugins and tools in its ecosystem, such as Vue Router and Vuex, to achieve front-end and back-end routing management and state management.
10. The secure shared file system based on the trusted data object encapsulation module as described in claim 5, characterized in that, The system's backend is developed using the Gin framework, which provides a high-performance RESTful API, enabling the server to quickly respond to a large number of concurrent requests. At the same time, the middleware mechanism simplifies the implementation of common functions.