File sharing system and method

Abstract

To provide a system and method for file sharing under access right management.SOLUTION: A file sharing system includes a key manager unit and a file storage unit. The key manager unit recognizes a correspondence between a first user identifier and a first public key in response to a registration request of a first user, generates a first key material for encrypting a first file into a first encrypted file, and generates first credential according to the first user identifier, a first file identifier, the first public key and the first key material after receiving an access-right claim request to the first file from the first user. The file storage unit stores the first encrypted file and the first credential. The first user uses the first user identifier, the first file identifier and a first private key to retrieve the first key material out of the first credential, and uses the first key material to decrypt the first encrypted file into the first file.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] This application is a non-provisional application claiming the benefit of an earlier provisional application having serial number 63 / 407,764 and filed on September 19, 2022, the substance of which is incorporated herein by reference.

[0002] The present invention relates to a system and method for file sharing, and more particularly to a system and method for file sharing under access rights management. [Background technology]

[0003] It is very common for users to store digital data files in cloud storage space for file sharing. Therefore, in order to effectively protect digital data files in cloud storage space from arbitrary access, exclusive access rights are required for users who access the digital data files. That is, the digital data files are encrypted in advance with a key known only to the user, and can then be decrypted by the user with the key to successfully retrieve the original data of the digital data files. Summary of the Invention [Problem to be solved by the invention]

[0004] However, in the above protection method, it is important to ensure that a user possesses a unique key. In such a situation, since the key owned by one user for a digital data file is different and independent from the key owned by another user for the same digital data file, there is a huge amount of encrypted data regarding the pairing association between the user and the file, which undesirably requires a huge amount of storage space.

[0005] Conventionally, access control lists are commonly set for data access. However, the amount of data in the access control list can be countless, N x F, because there are typically a huge number of N users and a huge number of F files associated with a file system. Therefore, operating systems may group users based on their access rights. In other words, management is performed according to users, groups, and files / directories. Although such management makes the access control list mechanism feasible, it brings about security problems such as identity fraud and access right tampering.

[0006] Furthermore, in a typical file-sharing process, a file to be shared is first uploaded by the file owner to a remote server or storage medium known to the file sharer, so that the file sharer can access the file in the remote server or storage medium. If the file is to be protected from unauthorized access, it is necessary to set exclusive access rights to the file or establish a unique encryption key for the file so that the file sharer can successfully access the file. When many file owners upload files and many file sharers are involved at the same time, the many diverse encryption keys from the file owners need to be distinguished and managed to ensure that only authorized users can access the correct file. Such management is complicated and impractical.

[0007] Therefore, the present invention provides a file sharing system and method to overcome the above drawbacks. [Means for solving the problem]

[0008] In a first aspect of the present invention, a file sharing system includes a first user device having an asymmetric first key pair including at least a first user identifier, a first public key, and a first private key, and upon receiving a registration request for the first user device, the system acquires the first user identifier and the first public key of the first user device, automatically generates first key material, and uses the first key material to perform file sharing. Thea key management unit that encrypts a file into a first encrypted file, and generates first authentication information according to the first user identifier, the first file identifier, the first public key, and first key material after receiving an access right request to the first file from the first user device; and a file storage unit that stores the first encrypted file and the first authentication information and communicates with the key management unit, wherein the first user device uses the first user identifier, the first file identifier, and the first private key to extract the first key material from the first authentication information, and uses the first key material to decrypt the first encrypted file into the first file.

[0009] In a second aspect of the present invention, a file sharing method includes: device and the first file corresponds to a first file identifier. device has a first asymmetric key pair, the first key pair including at least a first user identifier, a first public key and a first private key. device Registration request for When you receive the first user identifier and the first public key Get The key management unit generating a first keying material and using the first keying material Encrypt the first file into a first encrypted file. Transform , the key management unit is the first user device after receiving an access right request to the first file from the first user, the first file identifier, the first public key, and the first key material, generate first authentication information, and send the first encrypted file and the first authentication information to the File storage unit Save the first user device retrieves the first keying material from the first authentication information using the first user identifier, the first file identifier, and a first private key, and uses the first keying material to decrypt the first encrypted file into the first file.

[0010] In a third aspect of the present invention, a file sharing method includes: device Owned by a second user deviceThe first user is adapted to use with a specific file that is to be shared with the first user, the specific file corresponding to a file identifier. device has a first user identifier, a first system public key, and a first system private key. device has a second user identifier, a second system public key and a second system private key. device First registration request When you receive the first user identifier and the first system public key Get and the second user device Second registration request When you receive the second user identifier and the second system public key Get The key management unit is configured to manage the specific file and the first user. device confirming an access right request to the specific file by the second user identifier and a file identifier, the access right request including the second user identifier and a file identifier, and the key management unit: Automatically generate specific key material and use the specific key material Encrypt the specified file to an encrypted file Transform , the above Second user identifier, file identifier , second system public key and specific key material For the fee Therefore, specific authentication information is generated, and the encrypted file and the specific authentication information are File storage unit Save the second user device uses the second user identifier, the file identifier, and the second system private key to extract the specific key material from the specific authentication information, and uses the specific key material to decrypt the encrypted file into the specific file. [Brief explanation of the drawings]

[0012] The present invention will become more readily apparent to those skilled in the art from the following detailed description and accompanying drawings.

[0013] [Figure 1] 1 is a schematic block diagram showing a file sharing system according to an embodiment of the present invention.

[0014] [Figure 2]FIG. 10 is a schematic block diagram showing a file sharing system according to another embodiment of the present invention.

[0015] [Figure 3] 1 is a flowchart illustrating a file sharing method according to an embodiment of the present invention.

[0016] [Figure 4] FIG. 10 is a schematic block diagram illustrating a file sharing system according to a further embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0017] The present invention will now be more particularly described with reference to the following embodiments. It should be noted that the following description of preferred embodiments of the present invention is presented here for purposes of illustration and description only. It is not intended to be exhaustive or to limit the invention to the precise form disclosed.

[0018] Referring to FIG. 1, a file sharing system according to an embodiment of the present invention is illustrated. The file sharing system includes a key management unit 11 and a file storage unit 12 and can be used between multiple files and multiple users. The key management unit 11 may be, for example, but is not limited to, a cloud server. The file storage unit 12 may be, for example, but is not limited to, a cloud storage or a network-attached storage (NAS). The files may be, for example, but is not limited to, digital data files that can be stored and transmitted. The users may be, for example, but is not limited to, computers, smartphones, or other suitable information devices. For illustrative purposes, the file sharing system illustrated in FIG. 1 illustrates a first user 101, a second user 102, a first file 131, and a second file 132. The first file 131 corresponds to a first file identifier (F-ID), and the second file 132 corresponds to a second file identifier. The first user 101 generates an asymmetric, exclusive first key pair by any suitable conventional or newly developed means. The first key pair includes at least a first user identifier (U-ID), a first public key, and a first private key. Similarly, the second user 102 generates a second, asymmetric, exclusive key pair by any suitable conventional or newly developed means. The second key pair includes at least a second user identifier (U-ID), a second public key, and a second private key.

[0019] In response to a registration request from the first user 101, the key management unit 11 recognizes the correspondence between the first user identifier and the first public key. Then, the key management unit 11 generates a first keying material for encrypting the first file 131 into a first encrypted file 141, and associates the first keying material with the first file identifier to generate a first identifier key pair (F-ID, key_material). After receiving an access right request to the first file 131 from the first user 101, the key management unit 11 further generates first authentication information 1411 according to the first user identifier, the first file identifier, the first public key, and the first keying material. The access right request includes the first user identifier and the first file identifier. The first encrypted file 141 and the corresponding first authentication information 1411 are stored in the file storage unit 12. Then, to access the first file 131, the first user 101 uses the first user identifier, the first file identifier, and the first private key to extract first key material from the first authentication information 1411, and uses the first key material to decrypt the first encrypted file 141 into the first file 131.

[0020] Similarly, in response to a registration request from the second user 102, the key management unit 11 recognizes the correspondence between the second user identifier and the second public key. Then, after receiving an access right request to the first file 131 from the second user 102, the key management unit 11 generates second authentication information 1412 according to the second user identifier, the first file identifier, the second public key, and the first keying material. The access right request includes the second user identifier and the first file identifier. Furthermore, the first encrypted file 141 and the corresponding second authentication information 1412 are stored in the file storage unit 12. Then, to access the first file 131, the second user 102 uses the second user identifier, the first file identifier, and the second private key to extract the first keying material from the second authentication information 1412, and then uses the first keying material to decrypt the first encrypted file 141 into the first file 131.

[0021] In another example, when the first user 101 attempts to access the second file 132, the key management unit 11 further generates second keying material for encrypting the second file 132 into a second encrypted file 142, and associates the second keying material with a second file identifier to generate a second identifier key pair. After receiving an access right request from the first user 101 to the second file 132, the key management unit 11 further generates third authentication information 1421 according to the first user identifier, the second file identifier, the first public key, and the second keying material. The access right request includes the first user identifier and the second file identifier. The second encrypted file 142 and the corresponding third authentication information 1421 are stored in the file storage unit 12. Then, to access the second file 132, the first user 101 uses the first user identifier, the second file identifier, and the first private key to extract the second keying material from the third authentication information 1421, and uses the second keying material to decrypt the second encrypted file 142 into the second file 132.

[0022] In a further example, after receiving an access right request to the second file 132 from the second user 102, the key management unit 11 generates fourth authentication information 1422 according to the second user identifier, the second file identifier, the second public key, and the second key material. The access right request includes the second user identifier and the second file identifier. The second encrypted file 142 and the corresponding fourth authentication information 1422 are also stored in the file storage unit 12. Then, to access the second file 132, the second user 102 uses the second user identifier, the second file identifier, and the second private key to extract the second key material from the fourth authentication information 1422, and uses the second key material to decrypt the second encrypted file 142 to the second file 132.

[0023] In an embodiment, the first file identifier and the second file identifier are generated by the key management unit 11 according to a portion of the first file and a portion of the second file using a hash algorithm, respectively. For example, the file identifier is generated according to the file name of the file. In an embodiment, the first key material and the second key material are random numbers generated by the key management unit 11. In an embodiment, the first authentication information and the second authentication information are stored as extension data of the first encrypted file and the second encrypted file, respectively. In an embodiment, the first authentication information and the second authentication information and other authentication information are stored in a storage zone 120 specific to the authentication information data. In an embodiment, the storage zone 120 is configured in the file storage unit 12 and is retrievable by authorized users based on the user identifier and the file identifier for later accessing the files. In an embodiment, the file storage unit 12 is configured by a local storage device or multiple cloud storage devices.

[0024] Please refer to FIG. 2, which schematically illustrates a file sharing system according to another embodiment of the present invention. Similar to the file sharing system illustrated in FIG. 1, the file sharing system according to this embodiment includes a key management unit 11 and a file storage unit 12 communicating with the key management unit 11. The file sharing system according to this embodiment further includes an identity verification unit 15 communicating with the key management unit 11. For example, the identity verification unit 15 performs identity verification of the users 101 and 102 who attempt to access the files 131 and 132. If the identity verification fails, the key management unit 11 denies the users 101 and 102 their requests for access to the files 131 and 132. On the other hand, if the users 101 and 102 pass the identity verification, the key management unit 11 is notified to process the users 101 and 102's requests for access to the files 131 and 132. Then, the key management unit 11 can generate authentication information according to the user identifier, the file identifier, the public key, and the key material. The authentication algorithm may be implemented by a FIDO-compliant physical security key (e.g., a USB key), an account-password set commonly used in the art, or any other suitable conventional or newly developed algorithm. The identity verification unit 15 may be integrated into the same chip of the same server as the key management unit 11, for example. In other words, the identity verification unit 15 may be configured as a sub-module of the key management unit 11.

[0025] Please refer to FIG. 3. A flowchart of a file sharing method according to the present invention is shown. In step 301, the key management unit 11 generates key materials for encrypting a file 31 to be shared into an encrypted file 32. In step 302, the key management unit 11 receives a registration request from the user 30. From the registration request, the key management unit 11 can recognize the correspondence between the user identifier and the public key (U-ID, public_key) of the user 30. In step 303, the user 30 issues an access right request to the key management unit 11 to request access to information of the file 31, such as a file identifier (F-ID), where the access right request includes the user identifier corresponding to the user 30 and the file identifier corresponding to the file 31. In step 304, after receiving the access right request, the key management unit 11 generates authentication information according to the user identifier, the file identifier, the public key, and the key materials. The authentication information is then stored in one of two exemplary ways, shown in step 305 or step 306. In step 305, the authentication information is stored as extension data of the encrypted file. For example, the authentication information and the encrypted file are stored in the same storage zone and associated with each other. In step 306, the authentication information is stored in a storage zone 320 specific to the authentication information. The storage zone 320 may be part of a file storage unit 12, for example, implemented on a local storage device or comprised of multiple cloud storage devices. In an embodiment, the storage zone is searchable by authorized users based on a user identifier and a file identifier.

[0026] According to the above-described embodiment of the file sharing system and method, file access rights management under key management can be improved. This file sharing system can protect files among multiple users without increasing the system complexity. This method utilizes the distinction between file owners and file sharers to manage the two, so management can be performed without password identification. A file owner is defined as someone who has the authority to transmit an original file to the key management unit and encrypt it into an encrypted file, and a file sharer is defined as someone who has the authority to obtain authentication information to decrypt the encrypted file. According to the present invention, one file can correspond to multiple file owners and multiple file sharers, and a user can play either the role of the file owner or the role of the file sharer. The file owner has the right to upload the original file to be encrypted to the key management unit, and the file sharer is entitled to obtain authentication information specific to the file after passing identity verification.

[0027] In an embodiment, each user of the file sharing system has two key pairs. One key pair includes a system public key (Sys_Public) and a system private key (Sys_Private), and the other key pair includes an authentication public key (Auth_Public) and an authentication private key (Auth_Private). The user identifier (U-ID) and the two public keys (Auth_Public, Sys_Public) are combined to form the registration data (U-ID, Auth_Public) and (U-ID, Sys_Public) of the key management unit 11. Therefore, before the file owner transmits the original file or the undecrypted file to the key management unit 11, the file owner can inform the key management unit 11 of the file owner and the file sharer through an access right request. Furthermore, the file owner can inform the key management unit 11 of the storage options for the authentication information, for example, storing it in a specific storage zone or storing it together with the associated encrypted file.

[0028] Therefore, after receiving an access right request and a credential storage policy from a user who plays the role of "file owner" for all file accessors (which may include "file owner" and "file sharers"), the key management unit 11 can use the above-described file sharing system and method to encrypt the file. The key management unit 11 then generates key material to encrypt the file to form an encrypted file. One or more credential information corresponding to the encrypted file is generated based on the content of the access right request, and the one or more credential information corresponds to one or more file accessors who have access rights. The credential information of all file accessors and the encrypted file can then be stored according to the storage policy and made available for inquiry and access by one or more file accessors.

[0029] In this way, before a user playing the role of a "file sharer" accesses a file, the key management unit 11 (or the identity verification unit 15) first verifies the file accessor, for example, by the following process: The key management unit 11 randomly generates a byte sequence and asks the file accessor to generate a corresponding digital signature based on the file accessor's authentication private key (Auth_Private), so that the key management unit 11 can use the authentication private key (Auth_Private) for signature authentication. In this way, only authenticated file accessors have the right to request corresponding authentication information from the key management unit 11.

[0030] Furthermore, an authenticated file accessing user can request corresponding authentication information by providing a user identifier and a file identifier (U-ID, F-ID) to the key management unit 11 (or the file storage unit 12). This request can result in two scenarios: one is that the requested authentication information does not exist, meaning the file accessing user does not have the right to access the file; the other is that the requested authentication information exists, and the file accessing user can use his / her own system private key (Sys_Private) to extract the authentication information from it. The file accessing user can extract key material from the authentication information according to his / her own system private key, decrypt the resulting encrypted file, and access the contents of the original file. In addition, a "file owner" can issue an access right change request to the key management unit 11. For a "file owner" who passes identity verification, the key management unit 11 can regenerate one or more authentication information related to the contents of the change request and update the corresponding authentication information according to the management policy of the key management unit 11.

[0031] Furthermore, by applying the technical framework of the above-mentioned file sharing system and method, a method for enhancing file upload security by modifying the file sharing procedure can be further developed. In an embodiment, the method adopts a "single file multi-accessor protection mechanism" with file sharing procedure adjustment, ensuring that the file owner can upload the file after file creation and share it safely, even before the file is created, as long as the recipients of the file sharing are known.

[0032] 4 illustrates a schematic diagram of a file sharing system according to a further embodiment of the present invention. In this embodiment, a first user 101 (e.g., a "file sharer" as defined above) knows that a "file owner" (who may be an unregistered user) intends to upload a specific file. Therefore, after completing identity verification by the identity verification unit 15 (or the key management unit 11), the "file sharer" generates a pseudo user 41 representing the "file owner" and its unique user identifier (U-ID), and requests the key management unit 11 to generate a file identifier (F-ID) representing the file to be shared. This forms a unique pair (U-ID, F-ID). The file sharer may further request the key management unit 11 to create a virtual pseudo user agent 42 on behalf of the pseudo user 41 and generate a corresponding pseudo public-private key pair (Sys_Public, Sys_Private) using a sufficiently strong verification passcode. The pseudo public-private key pair and the verification passcode, or alternatively, only the private key and the verification passcode, are sent to the pseudo user 41, i.e., the "file owner." In this way, before a file to be shared is uploaded, the key management unit 11 can first generate corresponding key material based on the file identifier (F-ID) included in the pair (U-ID, F-ID). Furthermore, one or more authenticated file sharers can further issue access right requests to the key management unit 11 based on the file identifier (F-ID). The access right request includes the file identifier and the user identifier of the file sharer. The key management unit 11 then generates corresponding authentication information based on the file identifier, the user identifier, and the user's first public key.

[0033] When the pseudo user 41 (i.e., the file owner) is ready to upload a file to be shared, the key management unit 11, which already knows that the user is the pseudo user 41, can authenticate the identity passcode through the identity verification unit 15 (or the key management unit 11). The key management unit 11 itself (or the pseudo user agent 42) then encrypts the file to be shared using the key material in the same manner as described above, and then stores the authentication information of all file sharers and the encrypted file according to the management policy. In this way, the "file owner" does not need to be a registered user, but uses the identity of the pseudo user 41 to upload the file. Note that the rights associated with the pseudo user 41, the pseudo user agent 42, the temporary public-private key pair, and the identity passcode have a time limit. Upon expiration, the pseudo user 41, the pseudo user agent 42, the temporary public-private key pair, and the identity passcode are invalidated by the identity verification unit 15 (or the key management unit 11). As for the file sharers involved in the access rights request, all of them can access the file according to the "single file multiple accesses protection mechanism." In this way, file sharing can be initiated not only by the file owner but also by the file sharer, which avoids mistakes in complex encryption settings or access rights settings and significantly reduces management costs.

[0034] While the present invention has been described in terms of what are presently considered to be the most practical and preferred embodiments, it is to be understood that the invention is not necessarily limited to the disclosed embodiments. On the contrary, the invention is intended to cover various modifications and similar arrangements included within the spirit and scope of the appended claims, and is to be accorded the broadest interpretation so as to encompass all such modifications and similar arrangements.

Claims

1. a first user device having an asymmetric first key pair including at least a first user identifier, a first public key, and a first private key; a key management unit that, upon receiving a registration request for the first user device, obtains a first user identifier and the first public key of the first user device, automatically generates a first key material, and encrypts a first file into a first encrypted file using the first key material; and, upon receiving an access right request for the first file from the first user device, generates first authentication information according to the first user identifier, the first file identifier, the first public key, and the first key material; a file storage unit for storing the first encrypted file and the first authentication information and communicating with the key management unit; The first user device uses the first user identifier, the first file identifier, and a first private key to extract the first key material from the first authentication information, and uses the first key material to decrypt the first encrypted file into the first file.

2. The file sharing system of claim 1 , wherein the key management unit executes a hash algorithm based on a portion of the first file to generate a random number as the first key material.

3. The file sharing system according to claim 1 , wherein the first authentication information is stored as extension data of the first encrypted file.

4. The file sharing system of claim 1, characterized in that the first authentication information is stored in a storage zone specialized for authentication information data, and the storage zone specialized for authentication information data is searchable by the first user device according to the first user identifier and the first file identifier.

5. The file sharing system of claim 1, further comprising an identity verification unit that communicates with the first user device and a key management unit to perform verification of the first user device, and that notifies the key management unit of processing of an access right request to the first file from the first user device depending on the verification result.

6. 2. The file sharing system of claim 1, further comprising: a second user device having an asymmetric second key pair, the second key pair including at least a second user identifier, a second public key, and a second private key; the key management unit obtains the second user identifier and the second public key upon receiving a registration request for the second user device; and generates second authentication information according to the second user identifier, the first file identifier, the second public key, and the first key material upon receiving an access right request from the second user device to the first file; the second authentication information is stored in the file storage unit and associated with the first encrypted file; and the second user device extracts the first key material from the first authentication information using the second user identifier, the first file identifier, and the second private key, and uses the first key material to decrypt the first encrypted file into the first file.

7. A file sharing method adapted for use with a key management unit, a first file, and a first user device, wherein the first file corresponds to a first file identifier, and the first user device has a first asymmetric key pair, the first key pair including at least a first user identifier, a first public key, and a first private key; the key management unit receives a registration request for the first user device and obtains the first user identifier and the first public key; the key management unit generates a first key material and encrypts the first file into a first encrypted file using the first key material; The key management unit generates first authentication information according to the first user identifier, the first file identifier, the first public key and the first key material after receiving an access right request to the first file from the first user device; storing the first encrypted file and the first authentication information in a file storage unit; The first user device extracts the first key material from the first authentication information using the first user identifier, the first file identifier, and a first private key, and uses the first key material to decrypt the first encrypted file into the first file.

8. further adapted for use with a second user device; the second user device has a second asymmetric key pair; the second key pair includes at least a second user identifier, a second public key, and a second private key; the key management unit receives a registration request for the second user device and obtains the second user identifier and the second public key; The key management unit generates second authentication information according to the second user identifier, the first file identifier, the second public key, and the first key material after receiving an access right request to the first file from the second user device; the second authentication information is stored in a file storage unit and associated with the first encrypted file; 8. The file sharing method of claim 7, wherein the second user device retrieves the first keying material from the first authentication information using the second user identifier, the first file identifier, and a second private key, and uses the first keying material to decrypt the first encrypted file into the first file.

9. 1. A file sharing method adapted for use with a key management unit and a specific file owned by a first user device and shared with a second user device, the specific file corresponding to a file identifier, the first user device having a first user identifier, a first system public key, and a first system private key, and the second user device having a second user identifier, a second system public key, and a second system private key; the key management unit acquires the first user identifier and the first system public key when receiving a first registration request for the first user device, and acquires the second user identifier and the second system public key when receiving a second registration request for the second user device; the key management unit confirms the specific file and a request for access to the specific file from the first user device, the request for access to the specific file including the second user identifier and a file identifier; The key management unit automatically generates a specific key material, encrypts the specific file into an encrypted file using the specific key material, and generates specific authentication information according to the second user identifier, the file identifier, the second system public key, and the specific key material; storing the encrypted file and specific authentication information in a file storage unit; A file sharing method characterized in that the second user device extracts the specific key material from the specific authentication information using the second user identifier, file identifier, and second system private key, and uses the specific key material to decrypt the encrypted file to the specific file.

10. 10. The full sharing method of claim 9, wherein the first user device further has a first authentication public key and a first authentication private key, and the second user device further has a second authentication public key and a second authentication private key, the key management unit obtains the first user identifier and the first authentication public key upon receiving a first registration request of the first user device, and obtains the second user identifier and the second authentication public key upon receiving a second registration request of the second user device, and the key management unit performs authentication of the second user device before the second user device is allowed to access the specific file.

11. The key management unit randomly generates a specific byte sequence for the second user device, and requests a digital signature derived from the second authentication private key and the specific byte sequence from the second user device; 11. The file sharing method of claim 10, wherein the key management unit performs authentication of the second user device by authenticating the digital signature with the second authentication public key to determine whether the second user device is entitled to request the specific authentication information from the key management unit.

Images