OFD file protection method and device, equipment and medium

Abstract

The invention discloses an OFD file protection method and device, equipment and a medium, and relates to the technical field of computers. Comprising the following steps: calling a symmetric encryption interface of preset commercial hardware cryptographic equipment by using a file encryption symmetric key generated by the preset commercial hardware cryptographic equipment to encrypt a plaintext file and a plaintext-ciphertext mapping table file containing a corresponding relationship between the plaintext file and a ciphertext file so as to obtain a ciphertext file and an encrypted mapping table file; encrypting the file encryption symmetric key by using a preset commercial hardware password device to obtain a packaging key, and storing and managing the packaging key by using the preset commercial hardware password device; and generating a decryption entry file, and generating a target OFD file based on the decryption entry file, the ciphertext file and the encrypted mapping table file. Therefore, the safe hosting of the OFD file encryption key, the standard management of the whole life cycle and the high-performance encryption and decryption operation can be realized.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to an OFD file protection method, apparatus, device, and medium. Background Technology

[0002] OFD (Open Fixed-layout Document) is an open document format standard used to precisely maintain the fixed layout and format of documents, and is widely used in government, finance, and judicial fields. Common OFD document protection schemes typically store the encryption symmetric key directly inside the document, which poses a risk of key leakage. At the same time, these schemes lack a standardized solution for the lifecycle management of the document's encryption symmetric key, and their encryption and decryption efficiency is low when processing documents containing a large number of high-resolution images or complex layouts.

[0003] As can be seen from the above, how to achieve secure custody of OFD file encryption keys, standardized management throughout their entire lifecycle, and high-performance encryption and decryption operations is an urgent problem to be solved. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide an OFD file protection method, apparatus, device, and medium, capable of secure custody of OFD file encryption keys, standardized management throughout their entire lifecycle, and high-performance encryption and decryption operations. The specific solution is as follows: Firstly, this application provides a method for protecting OFD files, including: A file encryption symmetric key is generated using a pre-set commercial hardware cryptographic device to encrypt plaintext files within OFD packets. The plaintext file is then encrypted using the symmetric encryption interface of the pre-set commercial hardware cryptographic device to obtain a ciphertext file. Generate a plaintext-ciphertext mapping table file containing the correspondence between the plaintext file and the ciphertext file, and use the file encryption symmetric key to call the symmetric encryption interface of the preset commercial hardware cryptographic device to encrypt the plaintext-ciphertext mapping table file to obtain the encrypted mapping table file; The file encryption symmetric key is encrypted using the preset commercial hardware cryptographic device to obtain a packaging key, and the packaging key is stored and managed using the preset commercial hardware cryptographic device. A decryption entry file is generated, and a target OFD file is generated based on the decryption entry file, the ciphertext file, and the encrypted mapping table file; wherein, the decryption entry file is used to obtain a packaging key from the preset commercial hardware cryptographic device, so as to complete the file decryption process corresponding to the file in the target OFD file based on the obtained packaging key.

[0005] Optionally, the OFD file protection method further includes: If an access request for the target OFD file is received, the corresponding packaging key is obtained from the preset commercial hardware cryptographic device based on the access request and the decryption entry file, and the packaging key is decrypted by the preset commercial hardware cryptographic device based on the visitor identity information contained in the access request to obtain the corresponding file encryption symmetric key. The encrypted mapping table file contained in the target OFD file is decrypted using the file encryption symmetric key and the preset commercial hardware cryptographic device to obtain the corresponding plaintext-ciphertext mapping table file. Then, the corresponding ciphertext file in the target OFD file is decrypted using the preset commercial hardware cryptographic device in response to the access request.

[0006] Optionally, after generating the target OFD file based on the decryption entry file, the ciphertext file, and the encrypted mapping table file, the method further includes: The file to be protected is determined from the target OFD file, and an integrity protection file is assembled based on the file to be protected; The preset commercial hardware cryptographic device is invoked to generate a hash value for the integrity protection file, and the hash value is signed using a preset signing private key to generate a signature value file.

[0007] Optionally, after generating the signature value file, the process further includes: If an integrity verification request for the target OFD file is received, the integrity protection file is read, and the preset commercial hardware cryptographic device is invoked to recalculate the hash value of the integrity protection file to obtain the hash value to be verified. The signature value file is read, and the signature verification interface of the preset commercial hardware cryptographic device is called to verify the hash value to be verified in response to the integrity verification request.

[0008] Optionally, storing and managing the packaging key using the preset commercial hardware cryptographic device includes: The packaging key is stored in the internal storage space of the preset commercial hardware cryptographic device; The preset commercial hardware cryptographic device performs lifecycle management of the file encryption symmetric key, including generation, encryption protection, distribution, use, and destruction, and controls the file encryption symmetric key to be externally invisible to the preset commercial hardware cryptographic device.

[0009] Optionally, the process of storing and managing the packaging key using the preset commercial hardware cryptographic device further includes: When the preset commercial hardware cryptographic device receives a request to call the packaged key, it calls the packaged key in the internal storage space through the preset commercial hardware cryptographic device and by using key buffer pool technology.

[0010] Optionally, the step of using the file encryption symmetric key to call the symmetric encryption interface of the preset commercial hardware cryptographic device to encrypt the plaintext file to obtain the ciphertext file includes: Based on preset encryption rules, several target plaintext files that need to be encrypted within the OFD packet are determined, and the target plaintext files are encrypted by calling the symmetric encryption interface of the preset commercial hardware cryptographic device using the file encryption symmetric key to obtain ciphertext files.

[0011] Secondly, this application provides an OFD file protection device, comprising: The file encryption module is used to generate a file encryption symmetric key for encrypting plaintext files within an OFD packet using a preset commercial hardware cryptographic device, and to use the file encryption symmetric key to call the symmetric encryption interface of the preset commercial hardware cryptographic device to encrypt the plaintext file to obtain a ciphertext file. The mapping table encryption module is used to generate a plaintext-ciphertext mapping table file containing the correspondence between the plaintext file and the ciphertext file, and to use the file encryption symmetric key to call the symmetric encryption interface of the preset commercial hardware cryptographic device to encrypt the plaintext-ciphertext mapping table file to obtain the encrypted mapping table file. The key management module is used to encrypt the file encryption symmetric key using the preset commercial hardware cryptographic device to obtain a packaging key, and to store and manage the packaging key using the preset commercial hardware cryptographic device. The file combination module is used to generate a decryption entry file and generate a target OFD file based on the decryption entry file, the ciphertext file, and the encrypted mapping table file; wherein, the decryption entry file is used to obtain a packaging key from the preset commercial hardware cryptographic device, so as to complete the file decryption process corresponding to the file in the target OFD file based on the obtained packaging key.

[0012] Thirdly, this application provides an electronic device, comprising: Memory, used to store computer programs; A processor is used to execute the computer program to implement the aforementioned OFD file protection method.

[0013] Fourthly, this application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned OFD file protection method.

[0014] This application provides an OFD file protection method, which involves generating a file encryption symmetric key for encrypting plaintext files within an OFD packet using a pre-set commercial hardware cryptographic device, and using the file encryption symmetric key to call the symmetric encryption interface of the pre-set commercial hardware cryptographic device to encrypt the plaintext file to obtain a ciphertext file; generating a plaintext-ciphertext mapping table file containing the correspondence between the plaintext file and the ciphertext file, and using the file encryption symmetric key to call the symmetric encryption interface of the pre-set commercial hardware cryptographic device to encrypt the plaintext-ciphertext mapping table file to obtain an encrypted mapping table file; encrypting the file encryption symmetric key using the pre-set commercial hardware cryptographic device to obtain a packaging key, and storing and managing the packaging key using the pre-set commercial hardware cryptographic device; generating a decryption entry file, and generating a target OFD file based on the decryption entry file, the ciphertext file, and the encrypted mapping table file.

[0015] As can be seen from the above, this application achieves hardware-level secure hosting and full lifecycle management of file encryption keys by deeply integrating commercial hardware cryptographic devices with the OFD file protection standard. This fundamentally avoids the risk of key leakage when stored and transferred in a software environment. At the same time, by using the high-performance cryptographic operation interface of the hardware device to encrypt and protect the integrity of document content, it significantly improves the anti-cracking capability and processing efficiency of OFD files in high-security scenarios. Thus, it can achieve secure hosting of OFD file encryption keys, standardized management of the entire lifecycle, and high-performance encryption and decryption operations. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0017] Figure 1 This is a flowchart of an OFD file protection method disclosed in this invention; Figure 2 This is a schematic diagram of an OFD file protection device disclosed in this invention; Figure 3 This is a structural diagram of an electronic device disclosed in this invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] OFD (Official Document Format) is an open document format standard used to precisely maintain the fixed layout and format of documents, and is widely used in government, finance, and judicial fields. Common OFD file protection schemes typically store the encryption symmetric key directly within the document, posing a risk of key leakage. Furthermore, these schemes lack a standardized solution for the lifecycle management of the file encryption symmetric key, and their encryption and decryption efficiency is low when processing documents containing a large number of high-resolution images or complex layouts. Therefore, this application provides an OFD file protection scheme that enables secure custody of OFD file encryption keys, standardized management throughout their entire lifecycle, and high-performance encryption and decryption operations.

[0020] See Figure 1 As shown in the figure, this application discloses an OFD file protection method, including: Step S11: Generate a file encryption symmetric key for encrypting plaintext files within an OFD packet using a preset commercial hardware cryptographic device, and use the file encryption symmetric key to call the symmetric encryption interface of the preset commercial hardware cryptographic device to encrypt the plaintext file to obtain a ciphertext file.

[0021] In this embodiment, the preset commercial hardware cryptographic device refers to a hardware module that conforms to national cryptographic industry standards and has functions such as secure key generation and storage, and cryptographic operations, such as a hardware security module (HSM) or a smart cryptographic key. Specifically, the step of using the file encryption symmetric key to call the symmetric encryption interface of the preset commercial hardware cryptographic device to encrypt the plaintext file to obtain a ciphertext file may include: determining one or more target plaintext files in the OFD document package that need to be encrypted based on a preset encryption strategy or rule. Subsequently, the symmetric encryption interface of the preset commercial hardware cryptographic device (such as an interface supporting algorithms such as SM4 and AES) is called to encrypt the selected target plaintext files one by one using the file encryption symmetric key to generate the corresponding ciphertext files. It should be noted that the encryption strategy can be determined according to the actual application situation. For example, the entry XML file describing the document structure and metadata is usually excluded from the encryption scope to maintain the standard compatibility and basic readability of the document; while the specific content files in the document (such as images, fonts, streaming content, etc.) are encrypted for protection.

[0022] Step S12: Generate a plaintext-ciphertext mapping table file containing the correspondence between the plaintext file and the ciphertext file, and use the file encryption symmetric key to call the symmetric encryption interface of the preset commercial hardware cryptographic device to encrypt the plaintext-ciphertext mapping table file to obtain the encrypted mapping table file.

[0023] In this embodiment, a plaintext-ciphertext mapping table file needs to be generated to record the encryption results and guide subsequent decryption. This file records the correspondence between each file (including unencrypted files) in the original OFD packet and its final state (plaintext or ciphertext) in the target OFD file, as well as information such as the source of the ciphertext file. After generating this mapping table, the aforementioned file encryption symmetric key is used to call the symmetric encryption interface of the commercial hardware cryptographic device to encrypt the mapping table file itself, resulting in an encrypted mapping table file to prevent the mapping relationship from being leaked.

[0024] Step S13: Encrypt the file encryption symmetric key using the preset commercial hardware cryptographic device to obtain the packaging key, and store and manage the packaging key using the preset commercial hardware cryptographic device.

[0025] In this embodiment, to protect the core file encryption symmetric key, it is re-encrypted using a pre-set commercial hardware cryptographic device to generate a wrapper key. Specifically, storing and managing the wrapper key using the pre-set commercial hardware cryptographic device can include: storing the wrapper key in the internal storage space of the pre-set commercial hardware cryptographic device; performing lifecycle management of the file encryption symmetric key's generation, encryption protection, distribution, use, and destruction through the pre-set commercial hardware cryptographic device, and controlling the file encryption symmetric key to be externally invisible within the pre-set commercial hardware cryptographic device. That is, the wrapper key is securely stored in the protected internal storage space of the commercial hardware cryptographic device, and its entire lifecycle (including generation, storage, distribution, use, and destruction) is autonomously managed by the hardware device. The file encryption symmetric key is always in an encrypted state (i.e., in wrapper key form) or an invisible state outside the hardware device, fundamentally avoiding the risk of key leakage in the software environment.

[0026] Furthermore, to improve key access efficiency, commercial hardware cryptographic devices can employ key pooling technology to manage wrapper keys. Specifically, when a request for a wrapper key is received, the hardware device quickly locates and retrieves the required wrapper key through its internal buffering mechanism, thereby reducing the overall latency of the encryption and decryption process.

[0027] Step S14: Generate a decryption entry file, and generate a target OFD file based on the decryption entry file, the ciphertext file, and the encrypted mapping table file.

[0028] In this embodiment, a decryption entry file is generated. This file exists in plaintext form within the final generated target OFD file package, and its purpose is to provide decryption guidance information to authorized users. The decryption entry file typically contains necessary metadata, such as the identifier of the encryption algorithm used, the index or identifier of the packaging key, and the location of the encrypted mapping table file. Based on the generated decryption entry file, ciphertext file, encrypted mapping table file, and other unencrypted files within the OFD package (such as the entry XML file), they are packaged according to the OFD format specification to finally generate the protected target OFD file.

[0029] Furthermore, this embodiment can also provide integrity protection functionality. Specifically, a set of files requiring integrity protection is determined from the target OFD file, and an integrity protection file is generated based on these files. A commercial hardware cryptographic device is invoked to calculate the hash value (such as an SM3 hash value) of the integrity protection file. Then, using the signing private key pre-stored in the hardware device, its digital signature interface is invoked to sign the hash value, generating a signature value file. When file integrity verification is required, the integrity protection file is read and its hash value is recalculated. Simultaneously, the signature value file is read, and the signature verification interface of the commercial hardware cryptographic device is invoked. The signature is verified using the corresponding verification public key, thereby confirming that the file has not been tampered with since it was signed.

[0030] In this embodiment, when an authorized user needs to access a protected target OFD file, a decryption process is triggered. Specifically, after receiving an access request for the target OFD file, the system first parses the plaintext decryption entry file in the target OFD file to obtain guidance information; based on this information and the visitor's identity, it obtains the corresponding packaging key from a preset commercial hardware cryptographic device; after the commercial hardware cryptographic device verifies the visitor's identity (e.g., through a password, digital certificate, etc.), it decrypts the packaging key to recover the file encryption symmetric key; subsequently, it uses the recovered key to decrypt the encrypted mapping table file to obtain a plaintext-ciphertext mapping table; finally, according to the guidance of the mapping table, it calls the commercial hardware cryptographic device to decrypt the corresponding ciphertext file, thereby enabling the user to access the document content normally.

[0031] As can be seen from the above, this application embodiment deeply integrates commercial hardware cryptographic devices into the OFD file protection process, achieving hardware-level secure generation, encryption, storage, and full lifecycle management of the core file encryption symmetric key, ensuring that the key is never exposed to the software environment. Simultaneously, it innovatively introduces and encrypts plaintext-ciphertext mapping table files and generates plaintext decryption entry files, constructing a hardware-driven, recognizable, and guided secure decryption and integrity verification mechanism. This solution not only fundamentally improves the anti-cracking capability of OFD documents and achieves standardization and normalization of key management, but also significantly improves the encryption and decryption efficiency of files containing large amounts of complex content through hardware acceleration and buffer pool optimization, thereby enabling secure management of OFD file encryption keys, standardized management throughout their lifecycle, and high-performance encryption and decryption operations.

[0032] See Figure 2 As shown in the figure, this application discloses an OFD file protection device, including: The file encryption module 11 is used to generate a file encryption symmetric key for encrypting plaintext files within an OFD packet using a preset commercial hardware cryptographic device, and to use the file encryption symmetric key to call the symmetric encryption interface of the preset commercial hardware cryptographic device to encrypt the plaintext file to obtain a ciphertext file.

[0033] The mapping table encryption module 12 is used to generate a plaintext-ciphertext mapping table file containing the correspondence between the plaintext file and the ciphertext file, and to use the file encryption symmetric key to call the symmetric encryption interface of the preset commercial hardware cryptographic device to encrypt the plaintext-ciphertext mapping table file to obtain the encrypted mapping table file.

[0034] The key management module 13 is used to encrypt the file encryption symmetric key using the preset commercial hardware cryptographic device to obtain a packaging key, and to store and manage the packaging key using the preset commercial hardware cryptographic device.

[0035] The file combination module 14 is used to generate a decryption entry file and generate a target OFD file based on the decryption entry file, the ciphertext file, and the encrypted mapping table file; wherein, the decryption entry file is used to obtain a packaging key from the preset commercial hardware cryptographic device, so as to complete the file decryption process corresponding to the file in the target OFD file based on the obtained packaging key.

[0036] In some specific embodiments, the file encryption module 11 may specifically include: The file encryption unit is used to determine several target plaintext files that need to be encrypted within the OFD packet based on preset encryption rules, and to use the file encryption symmetric key to call the symmetric encryption interface of the preset commercial hardware cryptographic device to encrypt the target plaintext files to obtain ciphertext files.

[0037] In some specific embodiments, the key management module 13 may specifically include: A key storage unit is used to store the packaged key in the internal storage space of the preset commercial hardware cryptographic device; The key management unit is used to perform lifecycle management of the file encryption symmetric key through the preset commercial hardware cryptographic device, including generation, encryption protection, distribution, use and destruction, and to control the file encryption symmetric key to be in an externally invisible state on the preset commercial hardware cryptographic device. The key retrieval unit is used to retrieve the packaged key in the internal storage space through the preset commercial hardware cryptographic device and by using key buffer pool technology when the preset commercial hardware cryptographic device receives a retrieval request for the packaged key.

[0038] In some specific embodiments, the OFD file protection device may further include: The key acquisition unit is configured to, if an access request for the target OFD file is received, obtain the corresponding packaging key from the preset commercial hardware cryptographic device based on the access request and the decryption entry file, and use the preset commercial hardware cryptographic device to decrypt the packaging key based on the visitor identity information contained in the access request to obtain the corresponding file encryption symmetric key. The file decryption unit is used to call the preset commercial hardware cryptographic device using the file encryption symmetric key to decrypt the encrypted mapping table file contained in the target OFD file to obtain the corresponding plaintext-ciphertext mapping table file, and to call the preset commercial hardware cryptographic device using the plaintext-ciphertext mapping table file to decrypt the corresponding ciphertext file in the target OFD file in response to the access request. The file integrity protection unit is used to determine the file to be protected from the target OFD file and assemble an integrity protection file based on the file to be protected; The file signing unit is used to call the preset commercial hardware cryptographic device to generate the hash value of the integrity protection file, and to sign the hash value using a preset signing private key to generate a signature value file. The file integrity verification unit is used to read the integrity protection file and call the preset commercial hardware cryptographic device to recalculate the hash value of the integrity protection file to obtain the hash value to be verified if an integrity verification request for the target OFD file is received. The signature verification unit is used to read the signature value file and call the signature verification interface of the preset commercial hardware cryptographic device to verify the hash value to be verified in response to the integrity verification request.

[0039] Furthermore, embodiments of this application also disclose an electronic device, Figure 3 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the OFD file protection method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be a computer.

[0040] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0041] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0042] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the OFD file protection method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0043] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed OFD file protection method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0044] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0045] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0046] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0047] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0048] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for protecting OFD files, characterized in that, include: A file encryption symmetric key is generated using a pre-set commercial hardware cryptographic device to encrypt plaintext files within OFD packets. The plaintext file is then encrypted using the symmetric encryption interface of the pre-set commercial hardware cryptographic device to obtain a ciphertext file. Generate a plaintext-ciphertext mapping table file containing the correspondence between the plaintext file and the ciphertext file, and use the file encryption symmetric key to call the symmetric encryption interface of the preset commercial hardware cryptographic device to encrypt the plaintext-ciphertext mapping table file to obtain the encrypted mapping table file; The file encryption symmetric key is encrypted using the preset commercial hardware cryptographic device to obtain a packaging key, and the packaging key is stored and managed using the preset commercial hardware cryptographic device. A decryption entry file is generated, and a target OFD file is generated based on the decryption entry file, the ciphertext file, and the encrypted mapping table file; wherein, the decryption entry file is used to obtain a packaging key from the preset commercial hardware cryptographic device, so as to complete the file decryption process corresponding to the file in the target OFD file based on the obtained packaging key.

2. The OFD file protection method according to claim 1, characterized in that, Also includes: If an access request for the target OFD file is received, the corresponding packaging key is obtained from the preset commercial hardware cryptographic device based on the access request and the decryption entry file, and the packaging key is decrypted by the preset commercial hardware cryptographic device based on the visitor identity information contained in the access request to obtain the corresponding file encryption symmetric key. The encrypted mapping table file contained in the target OFD file is decrypted using the file encryption symmetric key and the preset commercial hardware cryptographic device to obtain the corresponding plaintext-ciphertext mapping table file. Then, the corresponding ciphertext file in the target OFD file is decrypted using the preset commercial hardware cryptographic device in response to the access request.

3. The OFD file protection method according to claim 1, characterized in that, After generating the target OFD file based on the decryption entry file, the ciphertext file, and the encrypted mapping table file, the process further includes: The file to be protected is determined from the target OFD file, and an integrity protection file is assembled based on the file to be protected; The preset commercial hardware cryptographic device is invoked to generate a hash value for the integrity protection file, and the hash value is signed using a preset signing private key to generate a signature value file.

4. The OFD file protection method according to claim 3, characterized in that, After generating the signature value file, the process also includes: If an integrity verification request for the target OFD file is received, the integrity protection file is read, and the preset commercial hardware cryptographic device is invoked to recalculate the hash value of the integrity protection file to obtain the hash value to be verified. The signature value file is read, and the signature verification interface of the preset commercial hardware cryptographic device is called to verify the hash value to be verified in response to the integrity verification request.

5. The OFD file protection method according to claim 1, characterized in that, The storage and management of the packaging key using the preset commercial hardware cryptographic device includes: The packaging key is stored in the internal storage space of the preset commercial hardware cryptographic device; The preset commercial hardware cryptographic device performs lifecycle management of the file encryption symmetric key, including generation, encryption protection, distribution, use, and destruction, and controls the file encryption symmetric key to be externally invisible to the preset commercial hardware cryptographic device.

6. The OFD file protection method according to claim 5, characterized in that, The process of storing and managing the packaging key using the preset commercial hardware cryptographic device also includes: When the preset commercial hardware cryptographic device receives a request to call the packaged key, it calls the packaged key in the internal storage space through the preset commercial hardware cryptographic device and by using key buffer pool technology.

7. The OFD file protection method according to claim 1, characterized in that, The step of using the file encryption symmetric key to call the symmetric encryption interface of the preset commercial hardware cryptographic device to encrypt the plaintext file to obtain the ciphertext file includes: Based on preset encryption rules, several target plaintext files that need to be encrypted within the OFD packet are determined, and the target plaintext files are encrypted by calling the symmetric encryption interface of the preset commercial hardware cryptographic device using the file encryption symmetric key to obtain ciphertext files.

8. An OFD file protection device, characterized in that, include: The file encryption module is used to generate a file encryption symmetric key for encrypting plaintext files within an OFD packet using a preset commercial hardware cryptographic device, and to use the file encryption symmetric key to call the symmetric encryption interface of the preset commercial hardware cryptographic device to encrypt the plaintext file to obtain a ciphertext file. The mapping table encryption module is used to generate a plaintext-ciphertext mapping table file containing the correspondence between the plaintext file and the ciphertext file, and to use the file encryption symmetric key to call the symmetric encryption interface of the preset commercial hardware cryptographic device to encrypt the plaintext-ciphertext mapping table file to obtain the encrypted mapping table file. The key management module is used to encrypt the file encryption symmetric key using the preset commercial hardware cryptographic device to obtain a packaging key, and to store and manage the packaging key using the preset commercial hardware cryptographic device. The file combination module is used to generate a decryption entry file and generate a target OFD file based on the decryption entry file, the ciphertext file, and the encrypted mapping table file; wherein, the decryption entry file is used to obtain a packaging key from the preset commercial hardware cryptographic device, so as to complete the file decryption process corresponding to the file in the target OFD file based on the obtained packaging key.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the OFD file protection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store computer programs, wherein the computer programs, when executed by a processor, implement the OFD file protection method as described in any one of claims 1 to 7.

Images