Document security management method and system based on intelligent password key

Abstract

The invention discloses a document security management method and system based on an intelligent password key, and belongs to the technical field of document security. The invention aims to solve the problems of cross-language performance barriers of Java and C password hardware, difficulty in compatibility of multi-manufacturer intelligent password keys and adaptation of heterogeneous platforms, and performance bottleneck of single encryption of large files by the intelligent password keys. According to the technical scheme, the method comprises two-factor identity authentication, a JNI-based cross-language cross-platform interaction architecture, software and hardware collaborative hybrid encryption and signature log auditing. The system adopts a layered decoupling architecture of a display layer, an application service layer, a basic service layer, a data layer and an infrastructure layer. According to the invention, efficient cooperation of software and hardware and multi-environment adaptation are realized, the encryption performance bottleneck is broken through, the full-life-cycle security of the document is guaranteed, and the method is suitable for severe security scenes such as a secret evaluation mechanism.

Description

Technical Field

[0001] This invention relates to the field of document security management, specifically to a document security management method and system based on smart cryptographic keys, which is particularly suitable for scenarios such as security assessment institutions that need to strictly comply with data security and cryptography-related laws and regulations and achieve full lifecycle security control of sensitive documents. Background Technology

[0002] With the implementation of laws and regulations such as the "Data Security Law of the People's Republic of China" and the "Cryptography Law of the People's Republic of China", security assessment agencies, as professional organizations undertaking security assessments of commercial cryptography applications, need to establish and improve a full-process data security management system and take effective technical measures to ensure the security, confidentiality and traceability of sensitive electronic documents during internal storage and interaction with clients.

[0003] Currently, security assessment agencies generally use traditional methods to address document security issues, primarily including: using encrypted USB drives for encrypted storage and cross-terminal transmission of documents; encrypting documents using compressed files and then sending them to clients via email, instant messaging tools, etc., with the decryption password transmitted simultaneously in plaintext; and internally protecting important documents through physical isolation and dedicated personnel monitoring. However, the above-mentioned existing technologies have significant drawbacks: 1) Encrypted USB drives pose security risks: Some encrypted USB drives do not use real encryption technology, but only achieve the "encryption" effect through simple password protection or hardware disguise. They can be cracked with professional tools or have their storage chips replaced to obtain internal documents, and cannot effectively guarantee data security. 2) The encryption method of compressed files poses risks of transmission and cracking: the decryption password needs to be transmitted synchronously in plaintext, which is easily stolen by man-in-the-middle; if the password complexity is low, even if a high-strength encryption algorithm is used, it is easy to be cracked by brute force, leading to document leakage. 3) Internal management methods have blind spots in traceability and control: relying on physical isolation and dedicated personnel to guard the documents cannot effectively control the document operation behavior of the users. It is difficult to detect whether the documents have been copied or tampered with without authorization, and it is impossible to accurately trace and hold accountable after the leakage.

[0004] To improve document security, some solutions attempt to introduce hardware security devices such as smart password keys (USB keys), but face two major technical challenges in practical applications: Challenge 1: There are language and performance barriers between the upper-layer Java business logic and the underlying C cryptographic hardware. Furthermore, it needs to be compatible with smart cryptographic keys from different manufacturers and adapted to heterogeneous operating system platforms such as Windows and Kylin, resulting in high technical integration complexity. Existing solutions mostly adopt single-language development or dedicated hardware adaptation solutions, which cannot achieve efficient cross-language collaboration and have poor hardware compatibility and platform adaptability, thus limiting system deployment and promotion. Challenge 2: The smart password key's SM4-CBC algorithm alone suffers from severe performance bottlenecks when encrypting large files. For example, encrypting a 1MB file can take up to 10 minutes, which cannot meet the needs of security assessment agencies for rapidly processing large volumes of sensitive documents daily, severely restricting the system's usability and user experience. Existing solutions either sacrifice security for pure software encryption or tolerate low performance for pure hardware encryption, making it difficult to balance security and efficiency.

[0005] Therefore, there is an urgent need for a technical solution that can overcome the above-mentioned technical difficulties, achieve cross-language and cross-platform compatibility, balance security and encryption performance, and cover the entire lifecycle of document security management, so as to meet the compliance requirements and actual business needs of scenarios such as security assessment institutions. Summary of the Invention

[0006] The first technical objective of this invention is to provide a document security management method based on smart cryptographic keys. This method is used to solve the language performance barrier between upper-layer Java business and lower-layer C cryptographic hardware, the compatibility of smart cryptographic keys from multiple vendors and the adaptation problem of Windows-Kylin heterogeneous platforms, and at the same time solve the performance bottleneck problem of smart cryptographic keys encrypting large files alone.

[0007] The technical solution to achieve the objective of this invention is: the document security management method based on smart cryptographic keys in this invention includes the following steps: S1. Identity Authentication: A two-factor authentication mechanism combining digital certificates and smart password keys is used to authenticate user identities, assign operation permissions according to user roles, and record login operation logs with digital signatures. S2. Secure File Lifecycle Management: This includes file archiving, file distribution, file decryption, and file integrity verification processes, among which: S2.1 Constructing a cross-language, cross-platform interactive architecture: Low-latency data interaction between the Java business module and the C language cryptographic processing module is achieved through JNI technology; the C language cryptographic processing module conforms to the national cryptographic standard and interfaces with the smart cryptographic key library file, and the smart cryptographic key library file conforms to the national cryptographic standard and interacts with smart cryptographic key devices from multiple manufacturers; the C language cryptographic processing module is cross-platform compiled to achieve seamless adaptation to Windows and Kylin heterogeneous operating systems; S2.2. Adopt a hardware-software hybrid encryption method: The hardware layer of the smart cryptographic key completes the random number generation and SM2 public key encryption and encapsulation of the SM4-ECB session key. The software layer uses the SM4-CBC symmetric encryption algorithm to encrypt large files at high speed, generating secure data packets of file ciphertext and digital envelopes, thus breaking through the performance bottleneck of hardware encryption. S3. Log Auditing: Generates immutable log records with the operator's digital signature for all operations, enabling traceability and non-repudiation of operational behavior.

[0008] Furthermore, the specific data link of the cross-language and cross-platform interaction architecture in step S2.1 is as follows: the PC terminal establishes a communication connection with the Java business module, the Java business module forwards cryptographic operation requests and business data to the C language cryptographic processing module through the JNI interface, the C language cryptographic processing module completes data interaction with the smart cryptographic key library file in accordance with the national cryptographic standard, and the smart cryptographic key library file completes key retrieval and random number generation operations with the smart cryptographic key device in accordance with the national cryptographic standard.

[0009] Furthermore, the cross-platform compilation of the aforementioned C language cryptography processing module adopts conditional compilation instructions, which are adapted to the Windows MSVC compiler and the Kylin operating system GCC compiler respectively, so as to achieve the same C language code running without difference on heterogeneous platforms.

[0010] Furthermore, the specific process of the hardware-software collaborative hybrid encryption method described in step S2.2 is as follows: i) The smart cryptographic key hardware layer generates a 16-byte random number and outputs the associated key metadata to the digital envelope; ii) The SM2 public key is used to encrypt the SM4-ECB session key to obtain the encrypted SM4-ECB session key, which is then written into a digital envelope; iii) The encrypted SM4-ECB session key is used to encrypt the software layer SM4-CBC key, and the random number is combined to generate a usable SM4-CBC key with high randomness; iv) The software layer performs high-speed encryption on large files using the SM4-CBC key to generate ciphertext. v) Encapsulate the ciphertext of the file with a digital envelope containing the encrypted SM4-ECB session key to form a secure data packet, the encryption speed of which is more than 100 times faster than that of encryption by a smart key alone.

[0011] Furthermore, the aforementioned SM4-CBC key is a one-time key, with each file corresponding to a unique SM4-CBC key, implementing a one-file-one-key encryption strategy.

[0012] Furthermore, the two-factor authentication mechanism in step S1 includes: verifying the legitimacy of the smart key hardware held by the user, and verifying the smart key PIN code entered by the user; the verification of the PIN code is completed inside the smart key, and the number of consecutive incorrect attempts is limited to no more than 5.

[0013] Furthermore, the above-mentioned file archiving process also includes: checking the format and size compliance of the uploaded files, generating a digital signature for the file's SM3 hash value using the archivist's SM2 signing private key, encrypting the file using the SM4 algorithm and storing the ciphertext, and securely deleting the original plaintext file.

[0014] Furthermore, the above-mentioned document outgoing process also includes: encrypting the session key of the encrypted file using the borrower's SM2 public key, and generating an outgoing packet after adding timestamp, maximum number of decryption attempts, validity period and digital watermark information.

[0015] Furthermore, the above file decryption process also includes: completing the decryption operation in the terminal memory, and then securely cleaning up the plaintext data and key information in the memory by overwriting random data after use, so as to avoid plaintext being stored on the ground.

[0016] Furthermore, the above-mentioned file integrity verification process includes: recalculating the SM3 hash value of the file, comparing it with the original hash value with digital signature at the time of archiving, and verifying the digital signature using the signing public key. If there is a discrepancy, a security alarm is immediately triggered and the abnormal information is recorded to the audit log.

[0017] A second objective of this invention is to provide a document security management system based on a smart cryptographic key for implementing the above-described method.

[0018] The technical solution to achieve the second objective of this invention is: the document security management system based on smart cryptographic keys that implements the above method adopts a layered and decoupled architecture design, which is divided into an infrastructure layer, a data layer, a basic service layer, an application service layer, and a presentation layer from bottom to top. Each layer independently carries a specific function and works collaboratively through standardized interfaces, specifically including: The infrastructure layer includes a software platform, a hardware platform, and a network environment. The software platform covers the Windows operating system, the domestic Kylin operating system, and a database system. The hardware platform includes PCs and smart password keys. All components are deployed in a secure internal network environment to provide the basic software and hardware support required for system operation, ensuring the security, stability, and controllability of the underlying operating environment. The data layer is used to undertake the management function of the system's core data assets. It includes four types of persistent data carriers: log files, configuration files, file repositories, and database data. It is used to store and manage various types of data. Log files support the auditing and tracing of operation behavior, configuration files realize the unified configuration of system parameters, file repositories store core business file assets, and database data manages structured business information, providing a unified and reliable data access foundation for upper-layer services. The basic service layer includes a cryptographic operation module, a smart cryptographic key middleware, a file read / write module, a log service module, and a database read / write module. The cryptographic operation module and the smart cryptographic key middleware are key modules, developed in C language and conforming to corresponding standard interface specifications. The basic service layer provides cross-language calling interfaces to Java applications in the application service layer through JNI technology, enabling hardware association and high-performance operation for cryptographic operations and smart cryptographic key interaction. Simultaneously, the file read / write, log service, and database read / write modules support the general data interaction and operation recording needs of the upper layer, resolving the language performance barrier between Java business logic and the underlying C cryptographic hardware. The application service layer includes an access control module, a file archiving module, a file sending module, a file decryption module, a file encryption module, and a file verification module, all implemented using Java. The application service layer calls the cryptographic service built in C language within the basic service layer to perform high-strength cryptographic operations, utilizes a smart cryptographic key middleware for secure key management, controls user and role access permissions through the access control module, incorporates a built-in hardware-software hybrid encryption unit, calls the smart cryptographic key from the basic service layer to securely encapsulate session keys, and simultaneously uses the software SM4-CBC algorithm to encrypt large files at high speed, generating ciphertext and secure digital envelope data packets. The presentation layer includes client applications adapted to Windows and Kylin operating systems. By calling the unified interface of the application service layer, it provides users in different operating system environments with a consistent functional experience and operation interface, achieving seamless usage support across heterogeneous platforms.

[0019] Furthermore, the aforementioned smart cryptographic key middleware uses a standardized interface, providing a unified key management and cryptographic service call interface to the application service layer, while being compatible with smart cryptographic key devices from different manufacturers, allowing hardware adaptation to be completed without modifying the upper-layer business logic.

[0020] Furthermore, the business files stored in the file repository in the aforementioned data layer are saved in encrypted form, and the log files are digitally signed using the operator's SM2 private key to ensure that the log records are tamper-proof and non-repudiable, providing legitimate and valid data support for audit trails.

[0021] The present invention has the following positive effects: (1) The present invention effectively solves the language performance barrier between the upper-layer Java business and the lower-layer C cryptographic hardware, the compatibility of smart cryptographic keys from multiple vendors, and the adaptation problem of Windows-Kylin heterogeneous platforms by constructing a technical architecture of "JNI cross-language bridging + national cryptographic standard unified interface + cross-platform compilation". Specifically: 1) JNI technology is used to realize low-latency data interaction between Java business modules and C language cryptographic processing modules, breaking the cross-language interaction barrier and ensuring efficient collaboration between the flexible business logic of the upper layer and the high-performance cryptographic operation of the lower layer; 2) The core smart cryptographic key middleware follows the national cryptographic standard to build a standardized interface, which is backward compatible with smart cryptographic key devices from different vendors. Hardware adaptation can be completed without modifying the upper-layer business logic, which greatly reduces the difficulty of hardware integration; 3) Conditional compilation instructions are used for the C language cryptographic processing module to adapt to the Windows MSVC compiler and the Kylin operating system GCC compiler respectively, so as to realize the same C language code running without difference under heterogeneous platforms, ensuring seamless deployment of the system in different operating system environments, and improving the system's environmental adaptability and promotion.

[0022] (2) This invention innovatively adopts a "software-hardware collaborative" hybrid encryption method, which completely solves the performance bottleneck problem of smart cryptographic keys encrypting large files alone, while ensuring the security of the encryption process. Specifically: 1) Clearly define the division of labor between the hardware layer and the software layer: The hardware layer of the smart cryptographic key is responsible for sensitive operations such as random number generation and SM2 public key encryption and encapsulation of the SM4-ECB session key, ensuring hardware-level security protection of core key assets; The software layer uses the SM4-CBC symmetric encryption algorithm to perform high-speed encryption of large files, using the efficiency of software encryption to overcome the performance limitations of hardware encryption. According to actual tests, the encryption speed is more than 100 times higher than that of smart cryptographic keys encrypting alone, and the encryption time of a 1MB file can be controlled within 2 seconds, significantly improving the practicality of the system; 2) Generate secure data packets of file ciphertext and digital envelopes, which not only ensure the security of key transmission and storage through digital envelopes, but also ensure file processing efficiency through high-speed encryption of the software layer, achieving the dual goals of not reducing the security level and greatly improving the processing efficiency.

[0023] (3) The system of this invention adopts a layered decoupled architecture design, which is divided into an infrastructure layer, a data layer, a basic service layer, an application service layer and a presentation layer from bottom to top. Each layer independently carries specific functions and works together through standardized interfaces, which brings the following advantages: 1) Clear responsibilities and reduced maintenance costs: The functional boundaries of each layer are clear. For example, the basic service layer encapsulates core technical capabilities, and the application service layer carries business logic. When it is necessary to iterate business functions or replace hardware devices, only the corresponding layer modules need to be modified, without changing the overall architecture, which greatly reduces the system maintenance and upgrade costs; 2) Strong reusability and improved development efficiency: The cryptographic operation, file reading and writing, log service and other modules of the basic service layer can be reused by different business modules in the upper layer, avoiding repeated development and improving the system development efficiency; 3) Consistent cross-platform experience: The presentation layer is adapted to Windows and Kylin heterogeneous operating systems. By calling the unified interface of the application service layer, it provides users with a consistent operating experience and solves the problem of fragmented user experience under heterogeneous platforms.

[0024] (4) This invention can realize full life cycle security management and control, covering the entire process of document archiving, external distribution, decryption and integrity verification. Combined with two-factor authentication and signed log auditing, it forms a closed-loop security system of "identity verifiable, operation traceable and document verifiable", which meets the compliance requirements of confidentiality assessment institutions.

[0025] (5) This invention follows the principle of "key not being stored in the ground". The private key generated in the smart password key cannot be exported. The session key and data encryption key have short lifespans and are destroyed immediately after use, which greatly reduces the risk of key leakage.

[0026] (6) All operation logs of this invention are digitally signed by the operator, ensuring that the logs are tamper-proof and non-repudiable, providing a legal and valid electronic evidence chain for tracing security incidents and determining responsibility. Attached Figure Description

[0027] To make the content of this invention easier to understand, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings, wherein... Figure 1 This is a schematic diagram of the architecture of the file security management system based on smart password keys in this invention; Figure 2 This is a business process diagram of the document security management method based on smart cryptographic keys in this invention; Figure 3 This is a business process diagram of the hardware platform in this invention; Figure 4 This is a flowchart illustrating the production process of securely outsourcing encrypted documents and digital envelopes in this invention. Detailed Implementation

[0028] The present invention will be further described in detail below with reference to specific embodiments. It should be noted that the embodiments are only used to explain the present invention and do not constitute a limitation on the scope of protection of the present invention.

[0029] See Figure 1 The file security management system based on smart cryptographic keys in this invention adopts a layered and decoupled architecture design, which is divided into an infrastructure layer, a data layer, a basic service layer, an application service layer, and a presentation layer from bottom to top. Each layer independently carries a specific function and works together through standardized interfaces. The specific implementation details are as follows: The infrastructure layer serves as the cornerstone of the entire system's operation, and its specific components and implementation methods are as follows: 1) Software Platform: Deploy Windows 10 / 11 operating system and domestic Kylin V10 operating system, adapted to 32-bit / 64-bit terminals; deploy MySQL 8.0 database system to store structured data such as user information, role permissions, and system configuration; 2) Hardware Platform: A PC with an Intel Core i5 or higher configuration is used as the terminal device; multi-vendor smart cryptographic keys (such as those from brands like Longmai and Watchdata) conforming to the GM / T0016 and GM / T0017 national cryptographic standards are selected to implement hardware-level security operations such as identity authentication, key generation, and digital signatures. See [link to relevant documentation]. Figure 3 ; 3) Network environment: All components are deployed on the internal LAN of the security assessment agency, and external networks are isolated through security devices such as firewalls and intrusion detection systems to ensure the security and controllability of the underlying operating environment.

[0030] The data layer is responsible for managing the system's core data assets. Its specific composition and implementation are as follows: 1) Log files: stored in text format, recording detailed information on all operations such as user login / logout, file archiving, external transmission, decryption, and verification, including operation time, operator, operation object, operation result, digital signature, etc. The storage path is a local encrypted disk on the server, and the retention period is no less than 1 year; 2) Configuration file: System parameters are stored in XML format, including smart password key adaptation parameters, encryption algorithm configuration, log retention period, etc., and can be uniformly modified through the system administrator interface; 3) File Repository: Deployed in the encrypted storage area of ​​the server, used to store archived encrypted files. The file format is a custom .bin format, which contains information such as file ciphertext, key ciphertext, and session ciphertext; 4) Database data: Stored in a MySQL database, sensitive fields (such as user PIN code hash value and role permission information) are encrypted using the SM4 algorithm to achieve secure management of structured business data.

[0031] The basic service layer encapsulates reusable core technology support capabilities, including their specific composition and implementation methods: 1) Core module development and adaptation: The cryptographic operation module and smart cryptographic key middleware are developed in C language and follow the national cryptographic standard; cross-platform adaptation is achieved by using conditional compilation instructions. In the Windows environment, the MSVC 2019 compiler is used to compile and generate .dll dynamic link libraries, and in the Kylin environment, the GCC compiler is used to compile and generate .so dynamic link libraries. 2) Cross-language interaction implementation: A bridge for interaction between Java and C languages ​​is built through JNI technology. Specifically, the Java application loads the above dynamic link library through the System.loadLibrary method, defines native methods to declare C language function interfaces (such as signing, encryption, key generation, etc.), and realizes the forwarding of requests and the reception of results from the Java business module to the C language cryptographic processing module. 3) General support modules: The file read / write module uses Java NIO technology to achieve efficient file read / write; the log service module implements the functions of generating, signing, and storing operation logs; the database read / write module uses the MyBatis framework to implement interaction with the MySQL database.

[0032] The application service layer carries the core business logic of the system and is developed using the Java language. Its specific composition and implementation method are as follows: 1) Access Control Module: Based on the RBAC (Role-Based Access Control) model, it implements role assignment and permission control for users (system administrator, document administrator, auditor, general employee, customer). For example, the document administrator has the permission to send files out, while the general employee only has the permission to archive and decrypt files. 2) File Processing Module: Includes sub-modules for file archiving, outgoing, decryption, encryption, and verification. It has a built-in hardware-software hybrid encryption unit. The specific logic is as follows: it calls the smart cryptographic key from the basic service layer to generate random numbers and encapsulate session keys; it then calls the cryptographic operation module to complete the software layer SM4-CBC encryption. See [link to relevant documentation]. Figure 4 ; 3) Identity Authentication Module: Implements two-factor authentication logic and connects to the smart password key middleware of the basic service layer to complete hardware legitimacy verification and PIN code verification.

[0033] The presentation layer serves as the interaction point between the system and the user. It uses Java Swing to develop client applications, which are adapted to Windows 10 / 11 and Kylin V10 operating systems. It provides a unified interface display for login, file operation, and log query interfaces. It calls the business functions of the application service layer through HTTP interfaces to ensure a consistent user experience across different platforms.

[0034] See Figure 2 The document security management method based on smart cryptographic keys in this invention includes three core steps: identity authentication, secure processing of the entire file lifecycle, and log auditing. The specific implementation process is as follows: S1. Identity Authentication: S1.1 The user inserts the smart password key into the PC terminal's USB port, opens the client application, and enters the PIN code; The S1.2 client application calls the PIN code verification function of the smart key dynamic link library through the JNI interface. The verification process is completed inside the smart key, and the application layer cannot obtain the plaintext PIN code. If the incorrect PIN code is entered more than 5 times consecutively, the smart key will be automatically locked. After the S1.3 verification is successful, the client application reads the SM2 signature public key from the smart key and compares it with the user's public key stored in the database to confirm the user's identity. S1.4 Assign corresponding operation menus based on user roles (such as the log query menu that is only visible to auditors), and generate login logs with user digital signatures, recording information such as login time, terminal IP, and smart password key serial number, and store them in the data layer log file.

[0035] S2. Secure File Lifecycle Management: This includes sub-processes such as file archiving, external transmission, decryption, encryption, and verification. The core implementation logic revolves around a cross-language, cross-platform interactive architecture and a hybrid encryption method combining software and hardware. Specific sub-process implementation details are as follows: S2.1 File archiving process for ordinary enterprise users: S2.1.1 Users upload plaintext files to be archived through the client application. The file archiving module of the application service layer performs compliance checks on the files in terms of format (supports .docx, .pdf, .txt, etc.) and size (single file not exceeding 100MB). S2.1.2 employs a hybrid hardware and software encryption method to process files: S2.1.2.1 The client application calls the SKF_GenRandom function of the smart password key dynamic link library through the JNI interface to generate two 16-byte random numbers (used as the file encryption key and IV, respectively). S2.1.2.2 The application calls the cryptographic operation module of the basic service layer and uses the SM4-CBC algorithm to encrypt the plaintext file to obtain the ciphertext file; The S2.1.2.3 application calls the SKF_ECCSignData function of the smart key through the JNI interface to sign the SM3 hash value of the file with the user's signing private key and obtain the signature value; S2.1.3 encapsulates the ciphertext of the file, the signature value, the ciphertext of the encryption key, and other information into a .bin format file and stores it in the data layer file repository. At the same time, it securely deletes the local plaintext file (using a random data overwrite method). The S2.1.4 log service module generates archived logs with user signatures, recording information such as archive time, file name, and file size, and stores them in log files.

[0036] S2.2 Document Distribution Process for Enterprise Custodians: S2.2.1 The enterprise custodian queries and selects encrypted files to be sent out through the client application and enters the borrower (customer) information; S2.2.2 The application calls the cryptographic operation module of the basic service layer, and uses the JNI interface to call the smart cryptographic key to decrypt the ciphertext file and obtain the plaintext file; S2.2.3 re-encrypts the file using a hybrid "hardware and software" encryption method: S2.2.3.1 The application queries the borrower's SM2 encryption public key, and uses the JNI interface to call the SKF_GenRandom function of the smart key to generate a random number, which is used as the file encryption key and IV; S2.2.3.2 The software layer uses the SM4-CBC algorithm to encrypt the plaintext file, resulting in a new ciphertext file; S2.2.3.3 The smart password key generates an SM4-ECB session key. The session key is then encrypted with the borrower's public key to obtain the session key ciphertext. The session key is then used to encrypt the file encryption key to obtain the file key ciphertext. S2.2.3.4 Encapsulate the IV, file key ciphertext, session key ciphertext, new file ciphertext and timestamp, maximum number of decryption attempts (e.g., 3 times), validity period (e.g., 7 days), and digital watermark (including borrower ID) into an outgoing packet; S2.2.3.5 transmits the outgoing packets to the client and simultaneously generates an outgoing log with the custodian's signature, which is then stored in a log file.

[0037] S2.3 Customer's file decryption process: S2.3.1 The customer imports the outsourced package into the client application, inserts their personal smart key, and enters the PIN code; S2.3.2 The application reads the IV, file key ciphertext, session key ciphertext, and file ciphertext from the outgoing packet; S2.3.3 calls the SKF_ImportSessionKey function of the smart cryptographic key through the JNI interface to decrypt the session key ciphertext using the personal encryption private key to obtain the session key; and calls the SKF_Decrypt function to decrypt the file key ciphertext using the session key to obtain the file encryption key. The S2.3.4 application calls the cryptographic module, uses the SM4-CBC algorithm to decrypt the ciphertext of the file using the file encryption key and IV, and obtains the plaintext file; the decryption process is completed in the terminal memory, and the plaintext is not stored on the ground; The S2.3.5 application calls the SKF_ECCVerify function of the smart password key to verify the file signature and confirm the file integrity; After S2.3.6 is finished, the application cleans up the plaintext data and key information in memory by randomly overwriting data.

[0038] The implementation details of the key sub-steps in S2.4 (file signing, encryption, decryption) are as follows: S2.4.1 Document Signing Steps: S2.4.1.1 The Java application calls the file read / write module of the basic service layer to read source file data; S2.4.1.2 The cryptographic operation module is called to calculate the hash value of the source file using the SM3 hash algorithm; S2.4.1.3 calls the SKF_ECCSignData and SKF_ExportPublicKey functions of the Smart Cryptographic Key DLL dynamic link library through the JNI interface, performs SM2-SM3 signing on the hash value with the signing private key to obtain the signature value, and exports the signing public key; S2.4.1.4 encapsulates the source file, signature value, and signature public key in a custom format.

[0039] S2.4.2 File Encryption Steps: S2.4.2.1 The Java application calls the file read / write module to read source file data and the user-encryption public key mapping list; S2.4.2.2 Locate the recipient's public encryption key based on their username; S2.4.2.3 Generate two 16-byte random numbers (file encryption key and IV) by calling the SKF_GenRandom function through the JNI interface. S2.4.2.4 The cryptographic operation module is called to encrypt the source file using the SM4-CBC algorithm to obtain the ciphertext of the file; S2.4.2.5 calls the SKF_ECCExportSessionKey function through the JNI interface to generate and export the session key ciphertext encrypted with the recipient's public key; S2.4.2.6 calls the SKF_Encrypt function through the JNI interface to encrypt the file key using the session key and the SM4 algorithm to obtain the ciphertext of the file key; S2.4.2.7 encapsulates the IV, file key ciphertext, session key ciphertext, and file ciphertext into a .bin file.

[0040] S2.4.3 file decryption steps: The S2.4.3.1 Java application calls the file read / write module to read the .bin encrypted file and extract the IV, file key ciphertext, session key ciphertext, and file ciphertext. S2.4.3.2 Call the SKF_ImportSessionKey function through the JNI interface to decrypt the session key ciphertext using the private key in the smart cryptographic key; S2.4.3.3 uses the JNI interface to call the SKF_Decrypt function to decrypt the file key ciphertext using the session key to obtain the file encryption key; S2.4.3.4 The cryptographic operation module is called to use the SM4-CBC algorithm to decrypt the ciphertext of the file to obtain the plaintext; S2.4.3.5 calls the file read / write module to generate plaintext data in memory, which is then safely cleaned up after use.

[0041] S2.5 Log Auditing Steps: The S2.5.1 system automatically generates log records for all operations (login / logout, file archiving, sending, decryption, verification, etc.). Each log entry includes fields such as operation time, operator, operation object, operation result, terminal information, and smart password key serial number. After the S2.5.2 log is generated, the operator digitally signs it using a smart password key to ensure that the log cannot be tampered with; S2.5.3 Auditors can query logs by time range, operation type, operator, and other conditions through the log query module of the client application, and log export and printing are supported; S2.5.4 When it is necessary to trace security events, auditors can call the log signature verification function to verify the legality of log signatures and confirm the authenticity of logs through smart password keys.

[0042] The implementation guarantee for addressing the first difficulty in the background technology (cross-language and cross-platform compatibility) in this invention is as follows: 1) JNI Interface Optimization: Employ memory pool technology to reduce the number of memory allocation and deallocation operations between Java and C, thereby reducing cross-language interaction latency; Define a unified interface data format (such as JSON) to avoid data parsing errors; 2) Compatibility with national cryptographic standards: The smart cryptographic key middleware strictly follows GM / T0016 "Smart Cryptographic Key Cryptographic Application Interface Specification" and GM / T0017 "Smart Cryptographic Key Technical Specification", uniformly encapsulating the interface functions of different manufacturers' devices. The upper-layer business modules call through the unified interface to achieve "one-time development, multi-vendor adaptation". 3) Cross-platform compilation verification: The C language module was compiled and tested in Windows 10 / 11 (32 / 64-bit) and Kylin V10 (32 / 64-bit) environments to ensure that functions such as password calculation and smart password key interaction run without difference.

[0043] The present invention provides the following implementation guarantee for addressing the second difficulty (performance bottleneck) in the background technology: 1) Algorithm parameter optimization: The SM4-CBC algorithm uses a 128-bit key and a 128-bit block length. The software layer encryption adopts a multi-threaded parallel processing method to improve the encryption efficiency of large files. 2) Key transfer optimization: The generation and encryption process of session keys and file encryption keys are completed quickly within the smart key or the JNI interface layer, reducing data transmission time; 3) Performance testing and verification: Three file sizes of 1MB, 10MB and 100MB were selected for testing. The smart password key took 10 minutes to encrypt a 1MB file alone. The method of this invention took 2 seconds to encrypt a 1MB file, 3 seconds to encrypt a 10MB file and 5 seconds to encrypt a 100MB file. All of these measures meet the business processing requirements.

[0044] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A document security management method based on smart cryptographic keys, characterized in that, Includes the following steps: S1. Identity Authentication: A two-factor authentication mechanism combining digital certificates and smart password keys is used to authenticate user identities, assign operation permissions according to user roles, and record login operation logs with digital signatures. S2. Secure File Lifecycle Management: This includes file archiving, file distribution, file decryption, and file integrity verification processes, among which: S2.1 Constructing a cross-language, cross-platform interactive architecture: Low-latency data interaction between the Java business module and the C language cryptographic processing module is achieved through JNI technology; the C language cryptographic processing module conforms to the national cryptographic standard and interfaces with the smart cryptographic key library file, and the smart cryptographic key library file conforms to the national cryptographic standard and interacts with smart cryptographic key devices from multiple manufacturers; the C language cryptographic processing module is cross-platform compiled to achieve seamless adaptation to Windows and Kylin heterogeneous operating systems; S2.

2. Adopt a hardware-software hybrid encryption method: The hardware layer of the smart cryptographic key completes the random number generation and SM2 public key encryption and encapsulation of the SM4-ECB session key. The software layer uses the SM4-CBC symmetric encryption algorithm to encrypt large files at high speed, generating secure data packets of file ciphertext and digital envelopes, thus breaking through the performance bottleneck of hardware encryption. S3. Log Auditing: Generates immutable log records with the operator's digital signature for all operations, enabling traceability and non-repudiation of operational behavior.

2. The document security management method based on smart password keys according to claim 1, characterized in that, The specific data link of the cross-language and cross-platform interaction architecture in step S2.1 is as follows: the PC terminal establishes a communication connection with the Java business module, the Java business module forwards cryptographic operation requests and business data to the C language cryptographic processing module through the JNI interface, the C language cryptographic processing module completes data interaction with the smart cryptographic key library file in accordance with the national cryptographic standard, and the smart cryptographic key library file completes key retrieval and random number generation operations with the smart cryptographic key device in accordance with the national cryptographic standard.

3. The document security management method based on smart password keys according to claim 2, characterized in that, The cross-platform compilation of the C language cryptography processing module adopts conditional compilation instructions, which are adapted to the Windows MSVC compiler and the Kylin OS GCC compiler respectively, so as to realize the same C language code running without difference on heterogeneous platforms.

4. The document security management method based on smart password keys according to claim 1, characterized in that, The specific process of the hardware-software co-encryption method described in step S2.2 is as follows: i) The smart cryptographic key hardware layer generates a 16-byte random number and outputs the associated key metadata to the digital envelope; ii) The SM2 public key is used to encrypt the SM4-ECB session key to obtain the encrypted SM4-ECB session key, which is then written into a digital envelope; iii) The encrypted SM4-ECB session key is used to encrypt the software layer SM4-CBC key, and the random number is combined to generate a usable SM4-CBC key with high randomness; iv) The software layer performs high-speed encryption on large files using the SM4-CBC key to generate ciphertext. v) Encapsulate the ciphertext of the file with a digital envelope containing the encrypted SM4-ECB session key into a secure data packet.

5. The document security management method based on smart password keys according to claim 4, characterized in that, The SM4-CBC key is a one-time key, with each file corresponding to a unique SM4-CBC key, implementing a one-file-one-key encryption strategy.

6. The document security management method based on smart cryptographic keys according to claim 1, characterized in that, The two-factor authentication mechanism described in step S1 includes: verifying the legitimacy of the smart key hardware held by the user, and verifying the smart key PIN code entered by the user; the verification of the PIN code is completed inside the smart key, and the number of consecutive incorrect attempts is limited to no more than 5.

7. The document security management method based on smart password keys according to claim 1, characterized in that, The file archiving process also includes: checking the format and size compliance of the uploaded files, generating a digital signature for the file's SM3 hash value using the archivist's SM2 signing private key, encrypting the file using the SM4 algorithm and storing the ciphertext, and securely deleting the original plaintext file.

8. The document security management method based on smart password keys according to claim 1, characterized in that, The file outgoing process also includes: encrypting the session key of the encrypted file using the borrower's SM2 public key, and then generating an outgoing packet by adding a timestamp, maximum number of decryption attempts, validity period and digital watermark information.

9. The document security management method based on smart cryptographic keys according to claim 1, characterized in that, The file decryption process also includes: completing the decryption operation in the terminal memory, and then securely cleaning up the plaintext data and key information in the memory by randomly overwriting the data to avoid plaintext being stored on the ground.

10. The document security management method based on smart cryptographic keys according to claim 1, characterized in that, The file integrity verification process includes: recalculating the SM3 hash value of the file, comparing it with the original hash value with digital signature at the time of archiving, and verifying the digital signature using the signing public key. If there is a discrepancy, a security alarm is immediately triggered and the abnormal information is recorded to the audit log.

11. A document security management system based on a smart cryptographic key for implementing the method of claim 1, characterized in that, The architecture adopts a layered and decoupled design, divided from bottom to top into an infrastructure layer, a data layer, a basic service layer, an application service layer, and a presentation layer. Each layer independently carries specific functions and works collaboratively through standardized interfaces, including: The infrastructure layer includes a software platform, a hardware platform, and a network environment. The software platform covers the Windows operating system, the domestic Kylin operating system, and a database system. The hardware platform includes PCs and smart password keys. All components are deployed in a secure internal network environment to provide the basic software and hardware support required for system operation, ensuring the security, stability, and controllability of the underlying operating environment. The data layer is used to undertake the management function of the system's core data assets. It includes four types of persistent data carriers: log files, configuration files, file repositories, and database data. It is used to store and manage various types of data. Log files support the auditing and tracing of operation behavior, configuration files realize the unified configuration of system parameters, file repositories store core business file assets, and database data manages structured business information, providing a unified and reliable data access foundation for upper-layer services. The basic service layer includes a cryptographic operation module, a smart cryptographic key middleware, a file read / write module, a log service module, and a database read / write module. The cryptographic operation module and the smart cryptographic key middleware are key modules, developed in C language and conforming to corresponding standard interface specifications. The basic service layer provides cross-language calling interfaces to the Java applications in the application service layer through JNI technology, enabling hardware association and high-performance operation for cryptographic operations and smart cryptographic key interaction. Simultaneously, the file read / write, log service, and database read / write modules support the general data interaction and operation recording needs of the upper layer, resolving the language performance barrier between Java business logic and the underlying C cryptographic hardware. The application service layer includes an access control module, a file archiving module, a file sending module, a file decryption module, a file encryption module, and a file verification module, all implemented using Java. The application service layer calls the cryptographic service built in C language within the basic service layer to perform high-strength cryptographic operations, utilizes a smart cryptographic key middleware for secure key management, controls user and role access permissions through the access control module, incorporates a built-in hardware-software hybrid encryption unit, calls the smart cryptographic key from the basic service layer to securely encapsulate session keys, and simultaneously uses the software SM4-CBC algorithm to encrypt large files at high speed, generating ciphertext and secure digital envelope data packets. The presentation layer includes client applications adapted to Windows and Kylin operating systems. By calling the unified interface of the application service layer, it provides users in different operating system environments with a consistent functional experience and operation interface, achieving seamless usage support across heterogeneous platforms.

12. The document security management system based on intelligent cryptographic keys according to claim 11, characterized in that: The smart cryptographic key middleware uses a standardized interface, providing a unified key management and cryptographic service call interface to the application service layer, and is compatible with smart cryptographic key devices from different manufacturers, allowing hardware adaptation without modifying the upper-layer business logic.

13. The document security management system based on intelligent password keys according to claim 11, characterized in that: The business files stored in the file repository in the data layer are saved in encrypted form, and the log files are digitally signed with the operator's SM2 private key to ensure that the log records are tamper-proof and non-repudiable, providing legitimate and valid data support for audit trails.

Images