CN105740725B - A kind of document protection method and system - Google Patents
A kind of document protection method and system Download PDFInfo
- Publication number
- CN105740725B CN105740725B CN201610064511.9A CN201610064511A CN105740725B CN 105740725 B CN105740725 B CN 105740725B CN 201610064511 A CN201610064511 A CN 201610064511A CN 105740725 B CN105740725 B CN 105740725B
- Authority
- CN
- China
- Prior art keywords
- file
- user
- ticket
- key
- document
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2107—File encryption
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Databases & Information Systems (AREA)
- Storage Device Security (AREA)
- Document Processing Apparatus (AREA)
Abstract
The invention discloses a kind of document protection method and system, system manager creates security catalog, and the system manager ID and system manager ticket is generated according to system administrator information；Manager possesses the operating right that table is described to user right；User authentication carries out the verification of user identity using customized user ticket；The all permissions information of user is all recorded in user right and describes in table；It persistently detects the user's operation in security catalog and is made whether the response protected to file in real time；Protection is re-packaged into unified formatted file especially by extracting after file content is encrypted；Using three layers of key generating structure of file achieve the purpose that file is encrypted or decrypts.The present invention is based on security catalogs, and by managing user, monitoring file, layering generation file key and file management, the file for being embodied as arbitrary format provides real-time, safe and efficient protection.
Description
Technical field
The present invention relates to file protections more particularly to a kind of unrelated with protected file format based on security catalog
Sensitive document guard method and system.
Background technology
In recent years, flourishing with network and digitizing technique, the digitlization of file makes file become people
Store the most direct and universal carrier of sensitive information.Due to storing the sensibility and confidentiality of information, the protection of sensitive document is asked
Topic has caused more and more attention.
Existing file protection tool is divided into two major classes：File protecting system and encryption software.It is most general at present
Universal file protecting system is the EFS (encrypted file system) that Microsoft provides.EFS needs document to be protected by encryption
To provide sensitive information protection to the user.However, need document to be protected, EFS only to provide full disk encryption for what user specified,
File encryption is namely achieved the effect that by one entire disk partition of one-time pad encryption.This be undoubtedly it is relatively time consuming because
The size of disk partition several GB easily, are far longer than the size of file itself, some and the unrelated information of file are also encrypted
, this is unwanted for users.And the encryption software (such as Lockdir) that some are widely used, in fact not
File is encrypted, but is moved the file into the particular zones Windows, then hiding these files makes generally to use
Family is all invisible, then a false file is forged in the original position of file, to confuse disabled user.In fact, such as
Fruit attacker uses some file sniff tools (such as FolderSniffer), can have soon found that these files being hidden.And
Since file itself is not encrypted, the sensitive information in that file will directly be exposed, and such so-called encryption is soft
Part is in fact unsafe.
Therefore, the method and system of existing relevant document protection has the following problems, can not accomplish comprehensively and effectively to protect
Protect file：
(1) it can not solve the problems, such as when protect sensitive document；
When a sensitivity is intercepted and captured by attacker, if information is stored hereof in the form of plaintext, attacker
It is easy to be obtained with the sensitive information in file.Therefore, ideal file protection schemes need to minimize the letter in file
Breath is with the time existing for plaintext version.Some files protection software only when user using software and choose need document to be protected when
Protection just is provided to file, and since file is existing for plaintext version, to be easy to be leaked and illegally before being chosen by user
It obtains, therefore such protected mode is relatively unsafe.
(2) safety of protection sensitive document mode is very low；
The mode of protection sensitive document mainly has hidden file at present and by file encryption two ways, the latter's is protected
The safety of file will be apparently higher than the former.However, current file protection software (such as Lockdir) is based on the angle for facilitating realization
Degree considers that is used is hidden file method mostly so that sensitive document is still present in plaintext version in computer, is attacked
Person just can be easy to obtain the sensitive information in file, safety once detecting hidden file using file prospecting tools
It is very low.
(3) validity of encryption key managing method is low；
It is directly to use user to generate the most common method of file encryption key currently based on encrypted file protection tool
Password.Since password generally comprises user information (such as birthday, phone), such encryption key can not resist exhaustive attack.It is more
Several file system (such as EFS) all generate file encryption key using the above method.The encryption key of each file is phase
With.Once the key of some file is cracked, that protected file of others in systems all becomes dangerous.Cause
This needs to design more effective key schedule to provide safer protection for sensitive document.
(4) it is difficult to support the application under multi-user shared environment；
Traditional file protection software (such as file encrypts great master) can only judge the legitimacy of user according to password.When with
When family needs shared file, need to give password to shared user.The shared user for obtaining password has as administrator
File operation permission, the access right and operation grade, such file for not differentiating between user protect software not adapt to multi-purpose
Use under the shared environment of family.
It (five) can not balancing safety and validity；
For a user, ideal file protection tool should compromise between security and validity.However, existing file
System is generally required to expend and protects a file for quite a long time, ignored due to one entire disk partition of one-time pad encryption
It is the stand-by period of user, inefficient.Existing method is difficult to realize the text of the safety and validity of balanced file protection tool
Part protection mechanism.
Invention content
In order to overcome the above-mentioned deficiencies of the prior art, a kind of efficient document protection method of present invention offer and system, make
It uses security catalog as the carrier of sensitive document, the protection of actual time safety is provided for the file of arbitrary format.
Technical solution provided by the invention is：
A kind of document protection method, this method are based on security catalog, by managing user, monitoring file, layering generation text
Part key and file management method provide actual time safety protection for the file of arbitrary format, include the following steps：
1) system manager creates security catalog, and the information of the system manager is stored；
Specifically：System manager creates corresponding security catalog after selecting directory path, system to receive file path, and
By the information storage of the administrator in user management module；In embodiments of the present invention, the security catalog road of administrator's selection
Diameter will be processed and stored in system, at the same user management module can be generated after receiving administrator information its ID and
Ticket, and form together with its authority information an administrator right record and be automatically recorded in user right and describe table UPDL
In.Administrator ticket is generated by formula 1：
TicketuHash=(passwordu|rand_numu| device_info) (formula 1)
In formula 1, TicketuHash is TicketuCryptographic Hash, TicketuIt is the ticket of user u；passworduRefer to
Be administrator's password；rand_numuRefer to that user management module is the random number that administrator generates, this random number is once
Generation is then recorded in UPDL in the record of administrator；And device_info refers to then bound facility information (such as small enterprise
The server apparatus information of industry), needing the when of generating ticket that will dynamically be extracted every time, without record.It obtains
Ticket is recorded in after will being calculated its cryptographic Hash in UPDL, to carry out user's checking.It is irreversible due to hash function
Property, even if having obtained ticket, it is also difficult to obtain the password of user, therefore such ticket is safe.
2) ordinary user is registered by inputting user information, by the equipment letter with security catalog binding of Dynamic Extraction
Breath is contacted, and obtains the user ticket of the user, and be recorded in user right and describe in table (UPDL)；Specific execution is as follows
Operation：
User management module receives user information (including username and password) and generates a random number for the user, and
The facility information of the random number and user password and Dynamic Extraction bound with security catalog (is defaulted as creating security catalog
Local computer/server) contact, carried out obtaining the user ticket of the user after operation with hash function.Often
The user of a new registration will generate seven tuples, and { User ID, user code, user role, random number, initial time terminate
Time, user ticket } and be recorded in user right and describe in table (UPDL)；
3) when ordinary user is logged in using username and password, user ticket by the user be recorded in
The ticket of the user in UPDL is compared, it is determined whether is logined successfully；It is specific to execute following operation：
User management module after obtaining username and password, for the user by with registration when it is identical in a manner of generate one
Interim ticket is opened, and decrypts scanning UPDL, is compared with the correct ticket for the user being recorded in UPDL, if completely
It is identical, it logins successfully, otherwise refuses user and log in；
4) when ordinary user's new files, following operation is executed：
It, should when user creates a file in security catalog by continuing to monitor the user behavior in security catalog
File is that document to be protected, the present invention is needed to protect this document；It is monitored especially by file monitoring device, file
Monitor detects that circular document management module protects this document immediately for the newly-built behavior of user；
This document is protected, following operation is executed：
41) it is that the new files generate file encryption key, the file encryption key is three layers of key generating structure；
It specifically includes：Document management module receives the file protection notice that file monitoring device transmits, to hierarchical encryption pipe
Manage the file encryption key of module request this document.Hierarchical encryption management module passes through the generation method of three layers of key structure, profit
With document, the corresponding random number of this document, the cryptographic Hash of the cryptographic Hash of facility information, the absolute path of security catalog, with
And a master key, it is calculated by two layers and generates the encryption key of the new files and return to document management module；
The generation method of three layers of key structure specifically comprises the following steps：
First, a master key is generated with hardware fingerprint, the generation key generated by master key will be used as key to encrypt
UPDL, and generate the file encryption key of each sensitive document.Key is wherein generated to be generated by formula 2
geneKeySD=ZMK|path_SDModP (formula 2)
In formula 2, MK is the master key positioned at Fig. 5 structure top ends, and pathSDIt is the safety specified when creating security catalog
The cryptographic Hash of directory address.P is a big prime number, and Z is then the prime factor in P finite fields.It is close that generation is calculated by formula 2
After key, key management module ultimately generates the file encryption key of this document by formula 3：
Wherein, geneKeySDRefer to the generation key generated in formula 2, andThen generated by formula 4
For the different fileinfo of each file.G is a kind of constructed fuction, for enhancing the safety of entire generating function (as selected
The value of odd bits is taken to construct file encryption key)
In formula 4,It is the different message authentication code of each file, andThen it is recorded on unified format text
The different random number of each file, dev in partinfoRefer to dynamically extracting when fileinfo generates binds with security catalog
Facility information cryptographic Hash；
42) encryption key for utilizing the new files encrypts the content of new files and is encapsulated as customized unified lattice
Formula file；
Specifically：Document management module receives the file key returned from hierarchical encryption management module, encrypts new files
Content and be encapsulated as customized unified formatted file；Self-defined unified formatted file includes that file header and file content two are big
Part, file content are the encrypted ciphertext of original, and file header is raw filename and its filename length, file after encapsulation
Total length and its file header length, facility information cryptographic Hash, the plaintext of Message Authentication Code.Such one kind is unrelated with file format
File protecting system can meet user demand to the greatest extent, rather than specific file can only be encrypted, be increased
The practicability of the invention.
In the embodiment of the present invention, the self-defined unified file format of use specifically includes：
42a) file header of a protected file indicates unified lattice with the hexadecimal string of a 8Byte first
The total length of formula file, back to back 8Bytes then indicate the length of unified formatted file head；
42b) the unified next 32Byte of formatted file head is the cryptographic Hash for the facility information bound with security catalog, and
The random number of one 16Byte, and 32Byte for examining protected file integrality message authentication code；
42c) in the last filename and its length for further comprising original document of unified formatted file head, for decrypting
Restore original；
It is 42d) encrypted original after unified formatted file head, as the file content of unified formatted file,
It is presented in the form of ciphertext；Since the size of file content is unknown and may be quite big, symmetric encipherment algorithm is used
File content is encrypted；
5) when user changes existing protected file, the present invention is decrypted this document by decruption key, and
Revert to native file format；After user modifies and preserves to original, the present invention uses the step 4) guard method again
This document is protected again；
Changing existing protected file is specifically：File monitoring device detects that user attempts to open a protected text
Part, circular document management module restore protected file.Document management module is produced using hierarchical encryption management module
This document is decrypted in raw decruption key, and reverts to native file format.User modifies and preserves to original.
Again it protects and is specifically：File monitoring device detect user act of revision and circular document management module to text
Part is protected again；The file encryption key that document management module please look for novelty to hierarchical encryption management module, hierarchical encryption pipe
Reason module generates new encryption key according to the new document of file after modification, and returns to document management module；File pipe
Reason module receives new file encryption key, and modified file is encrypted again, and is encapsulated as unified formatted file
It protects.
Present invention simultaneously provides a kind of file protecting systems based on security catalog, comprise the following modules：
M1) user management module
The module is mainly used for controlling access of the user for security catalog, provides user right distribution and user authentication work(
Can, it is broadly divided into two parts：Access control and rights management.Present invention uses customized user ticket to use
The verification of family identity, user ticket are transparent for user.One security catalog has its founder, such user to become
For the manager of security catalog, and it is then the role that they are possessed by management to reach pipe for the management of other users
Manage the purpose of their permission.The user right that all permissions information of user is all recorded in a locking describes table (UPDL)
In, only administrator possesses the operating right to UPDL, and administrator is managed by changing the relevant information in UPDL multi-purpose
Access right of the other users for security catalog under the operating environment at family.
M2) file monitoring device
User is creating a new file, and after changing a file, the file monitoring device of this system can detect use
Family for file operation behavior and file is protected in first time circular document management module.File monitor
As the process that a backstage is run always, user's operation in lasting detection security catalog simultaneously makes a response in real time.
M3) document management module
Document management module is the nucleus module of this system, is responsible for providing safeguard protection to file.The present invention is providing guarantor
During shield service, original format of file is not considered, but is extracted after file content is encrypted and be re-packaged into
Unified formatted file (see Fig. 4).Unified formatted file includes file header and file content two large divisions, and file content is original
Encrypted ciphertext, file header are raw filename and its filename length, file total length and its file header length after encapsulation,
Facility information cryptographic Hash, the plaintext of Message Authentication Code.A kind of such file protecting system unrelated with file format can be most
Big degree meets user demand, rather than specific file can only be encrypted, and increases the practicability of the invention.
M4) hierarchical encryption management module
In the ciphering process of the present invention, the generation of key will use three layers of key generating structure, generate master key respectively,
Key and file encryption key are generated, ensures that the master key of first layer few as possible can be used and changed, while being different
The different encryption key of file generated, to ensure that other file keys remain peace after a file key is leaked
It is complete and any information that can crack other keys can not be obtained from the key being leaked.
Compared with prior art, the beneficial effects of the invention are as follows：
The present invention provides a kind of document protection method and system, is based on security catalog, by manage user, monitoring file,
Layering generates file key and file management method, and actual time safety protection is provided for the file of arbitrary format.It is provided by the invention
Technical solution has the following advantages：
First, user can be as needed in extent of competence operation file.For the user of an administrator right,
Multiple security catalogs can be created as needed.With regard to the use of individual security catalogue, for any user into security catalog
For, using the customized user ticket of this system rather than directly user is tested using password input by user
Card can correctly verify the identity of user in the case where ensureing the safety conditions of password of user.Meanwhile in order to enable multi-user
Shared file, the present invention also design and safeguard that a user right describes table (UPDL), and for different users, we assign it
Different role, by authorizing permission come the series of rules for user's defining operation and catalogue safe to use, with reality for role
An existing improved access control based roles；
Secondly, it is contemplated that the ease of use of user, while realizing and sensitive document is comprehensively protected in real time, the present invention
Devise a file monitoring device.Monitor monitors always the file operation behavior of security catalog as backstage finger daemon, when
User creates a file in security catalog, or is pressed from both sides in copy catalogue to security catalog from alternative document, file monitoring device energy
Enough detections immediately and circular document management assembly progress encrypting and protecting files.After user modifies to sensitive document, file
Monitor can also monitor the behavior and circular document management assembly carries out re-encrypted to modified file.File monitoring
Device enables the behavior of user persistently and in real time to be detected, user is without particularly selecting certain files to encrypt, energy
The case where enough effectivelying prevent user to forget encryption due to carelessness after newly-built sensitive document；
Again, existing encryption software can only all be encrypted the format of specific file, for some file formats
For example the file formats such as .7Z (format that 7-zip softwares use) and .iso all cannot be encrypted and protect.It is this in order to solve
A kind of the problem of file protection is dependent on file format, the self-defined new file format of the present invention, original sensitive document is encapsulated
In unified formatted file so that the file of arbitrary format can be encrypted protection under this systems.Finally, in order to enhance this hair
The safety of bright protection system, a kind of hierarchical encryption generating structure has also been devised in we.Using master key, key and text are generated
Three layers of key of part encryption key are finally reached as each protected file generated is distinctive and incoherent encryption key
Purpose.Not only it can guarantee that core-master key of file encryption was not frequently used and causes to reveal, but also can guarantee the close of file encryption
Key is regularly replaced cracks difficulty to increase.
Description of the drawings
Fig. 1 is the system construction drawing of the embodiment of the present invention.
Fig. 2 is document protection method flow provided in an embodiment of the present invention and system module relational graph.
Fig. 3 is the flow chart of user access control in the embodiment of the present invention.
Fig. 4 is the unified file format defined in the embodiment of the present invention.
Fig. 5 is that the hierarchical encryption in the embodiment of the present invention manages structure chart.
Specific implementation mode
Below in conjunction with the accompanying drawings, the present invention, the model of but do not limit the invention in any way are further described by embodiment
It encloses.
The present invention provides a kind of document protection method and system, is based on security catalog, by manage user, monitoring file,
Layering generates file key and file management method, and actual time safety protection is provided for the file of arbitrary format.
Below by user for server creates a shared security catalog, the present invention will be described in detail.Fig. 1
It show the system structure of the present embodiment, Fig. 2 is document protection method flow provided in this embodiment and system module relational graph,
Present invention specific implementation includes the following steps：
A1) administrator creates security catalog
Administrator inputs account number cipher and enters file protecting system, selects an installation path in server, is protected to file
Protecting system application creates a security catalog.
The security catalog path of administrator's selection will be processed and stored in system, while user management module is receiving
Its ID and ticket can be generated after to administrator information, and an administrator right record is formed certainly together with its authority information
It is dynamic to be recorded in UPDL.Administrator ticket is generated by formula 1：
TicketuHash=(passwordu|rand_numu| device_info) (formula 1)
In formula 1, TicketuHash is TicketuCryptographic Hash, TicketuIt is the ticket of user u；passworduRefer to
Be administrator's password；rand_numuRefer to that user management module is the random number that administrator generates, this random number is once
Generation is then recorded in UPDL in the record of administrator；And device_info refers to then bound facility information (such as small enterprise
The server apparatus information of industry), needing the when of generating ticket that will dynamically be extracted every time, without record.It obtains
Ticket is recorded in after will being calculated its cryptographic Hash in UPDL, to carry out user's checking.It is irreversible due to hash function
Property, even if having obtained ticket, it is also difficult to obtain the password of user, therefore such ticket is safe.
A2) ordinary user registers
After ordinary user's login service device, before the security catalog created using the person of being managed, need first to register.It is common to use
After the registration of family, user management module will receive the username and password of user, and generate { ID, role, a use for the user
Family code, initial time, terminate the time, ticket, random number } seven tuples record be automatically saved in UPDL.ID is in fact
UPDL is the ID of each user distribution, and user code is the cryptographic Hash of user name, and initial time and termination time refer to user's energy
The life cycle of enough catalogues safe to use, the generating mode of ticket is as described in formula 1.Role Information acquiescence is ordinary user.
A3) user logs in
Fig. 3 is the flow chart of user access control in the embodiment of the present invention.User logs in security catalog to operate sensitive text
Part.When user inputs user name code entry, after user management module can receive login username input by user and password,
And judge whether the user is validated user with the inspection mechanism in module.When inspection, the access control of user management module
System generates an interim ticket by formula 1, then decrypts the record that UPDL searches the user.Comparison record ticket and
After interim ticket, if the two is completely the same, which logins successfully into security catalog, and otherwise system will judge this
User is illegal and refuses user and enters security catalog.
A4) validated user new files
Validated user creates a file using the present invention in security catalog.File monitoring device designed by the present invention will
Intrinsic function can be called to monitor the user behavior in security catalog in real time, when this " new files " for detecting user operate
When, circular document management module protects file to file monitoring device immediately.Document management module receives file monitoring device
File protection request.
A5 file encryption key) is generated
Fig. 5 is that hierarchical encryption provided in an embodiment of the present invention manages structure.Document management module is receiving file monitoring device
After the file protection request of transmission, the encryption key of this document is asked to hierarchical encryption management module.File encryption key generates
Key structure as shown in Figure 5.First, a master key is generated with hardware fingerprint, the generation key generated by master key will
UPDL is encrypted as key, and generates the file encryption key of each sensitive document.Key is wherein generated to be generated by formula 2
geneKeySD=ZMK|path_SDModP (formula 2)
In formula 2, MK is the master key positioned at Fig. 5 structure top ends, and pathSDIt is the safety specified when creating security catalog
The cryptographic Hash of directory address.P is a big prime number, and Z is then the prime factor in P finite fields.Generation key is calculated by formula 2
Later, key management module ultimately generates the file encryption key of this document by formula 3：
Wherein, geneKeySDRefer to the generation key generated in formula 2, andThen generated by formula 4
For the different fileinfo of each file.G is a kind of constructed fuction, for enhancing the safety of entire generating function (as selected
The value of odd bits is taken to construct file encryption key)
In formula 4,It is the different message authentication code of each file, andThen it is recorded on unified format text
The different random number of each file, dev in partinfoRefer to dynamically extracting when fileinfo generates binds with security catalog
Facility information cryptographic Hash.
A6 file encryption key) is returned
The encryption key of this document of generation is returned to document management module by hierarchical encryption management module.
A7 unified formatted file) is generated
File encryption module is after receiving file encryption key, using symmetric encipherment algorithm to the content of sensitive document
Information is encrypted, and by file encryption key, and the information such as raw filename are encapsulated as a kind of unified protected as file header
File format is protected, Fig. 4 is the unified file format defined in the embodiment of the present invention, wherein the file header of a protected file
Indicate the total length of unified formatted file with the hexadecimal string of a 8Byte first, back to back 8Bytes then tables
The length of unified formatted file head is shown.Next 32Byte is the cryptographic Hash for the facility information bound with security catalog, and
The random number of one 16Byte, and 32Byte for examining protected file integrality message authentication code.In unified lattice
The last filename and its length for further comprising original document of formula file header, for restoring original in decryption.In unified lattice
It is encrypted original after formula file header, as the file content of unified formatted file, is presented in the form of ciphertext.Due to
The size of file content is unknown and may be quite big, therefore file content is encrypted using symmetric encipherment algorithm.
A8) user opens a protected file
User, which opens, reads a protected file.File monitoring device detects the opening operation of user, circular document
Management module implements decryption with for users to use to file.
A9) hierarchical encryption management module returns to decruption key
Hierarchical encryption management module generates the file decryption key of this document according to formula 3, and returns to document management module.
The present embodiment uses symmetric cryptographic key, and wherein encryption key and decruption key is identical, so also by formula 3
Generate decruption key.Key is not stored in the present embodiment, every time by 3 dynamic generation key of formula.
A10) document management module restores protected file
Document management module receives the file decryption key of hierarchical encryption management module return, using decruption key to quilt
The file of the protection is decrypted, and reverts to original document, for users to use.
A11) user copies a file to security catalog
User copies a file to security catalog, occurs new unprotected file in security catalog.File monitoring
Device detects the user behavior in security catalog, captures new file and is copied into security catalog, and circular document manages mould immediately
The file newly copied is packaged into protected file by block, document management module according to the guard method encryption of new files.
A12) user is from security catalog copied files
User copies a protected file to other file from security catalog, the folder path where file
Changed.The generation key that key production module is generated according to formula 2 is changed due to the change of path_SD,
So that file decryption key and correct decruption key at this time is different, file cannot be decrypted recovery, ensure that sensitivity
File can only operate in security catalog, control the propagation of sensitive document.
A13) user changes file
After user has modified a sensitive document, the summary info of file is changed, and file monitoring device detects use
The act of revision at family, circular document management module carry out re-encrypted encapsulation to file.Document management module is received from key pipe
The new file encryption key that reason module is transmitted is to the content of original from newly encrypting and be packaged into new unified formatted file
It is stored in security catalog.Since document is changed, modified file cannot be decrypted in old key.
A14) administrator changes normal user permission
Administrator changes the associated rights of ordinary user according to the transfer of personnel of company.The life of user management module formula 2
It is decrypted at key pair UPDL.Administrator changes the permission of user by changing the role of user.Modification is used after finishing
UPDL can be automatically saved encryption by family management module.
In above-described embodiment, technical solution of the present invention can realize following effect：
(1) existing file protecting system (such as typical windows file protecting system EFS) is single with disk partition
Position carries out file protection, is exactly once one-time pad encryption to disk to the protection of file.Since the size of disk partition is often non-
Normal is big, the comparable length of encryption times.Experiment shows the file of same size, and the guard time of EFS is the tens of of the present invention
Times.And the present invention protects sensitive document as unit of file, the time of one file of protection is much smaller than files systems such as EFS
System；
(2) popular file protection software is all based on specific format for the protection of file.It is non-soft for some
The specified format of part, can not be protected using software.And reality small business when managing sensitive document, the kind of file
Class is often very more and is difficult to predict, and in this case, file protection software cannot carry enterprise's sensitive document
For comprehensive reliable safeguard measure.File protecting system proposed by the present invention is a kind of system that file format is unrelated, no matter former
What the format of beginning file is, can all be encrypted be encapsulated as a kind of unified format, overcomes existing file encryption software only
The defect of the file of specific format can be encrypted；
(3) since the system is and to bind particular device based on security catalog, and say, if sensitive document copied
In shellfish to other equipment or other catalogues, sensitive document cannot all be read by correct decryption, ensure that sensitive document can only be
It is operated under the control of administrator, limits the propagation of sensitive document；
(4) existing All Files protect tool not have the function of user authority management, for all users,
File content is checked and changes as long as possessing password and arbitrarily decrypting.Such file protected mode can only be based on the machine,
And in small business, in order to facilitate the management of information, some private files, which must be placed on server, to be shared, this is just needed
A kind of flexible user management mode is wanted to be directed to different grades of user.The access of improved based role proposed by the present invention
Control mode, for defining different roles, carries out user to reach by assigning different permissions for role to be different
The purpose of management so that the present invention can also play a role well in multi-user shared environment.
It should be noted that the purpose for publicizing and implementing example is to help to further understand the present invention, but the skill of this field
Art personnel are appreciated that：It is not departing from the present invention and spirit and scope of the appended claims, various substitutions and modifications are all
It is possible.Therefore, the present invention should not be limited to embodiment disclosure of that, and the scope of protection of present invention is with claim
Subject to the range that book defines.
Claims (10)
1. a kind of document protection method, this method is based on security catalog, by managing user, monitoring file, layering generation file
Key and file management provide actual time safety protection for the file of arbitrary format, include the following steps：
1) system manager creates security catalog；The system manager ID and system are generated according to the system administrator information
Administrator ticket；By the system manager ID and system manager ticket, the authority information with the system manager
The authority records for forming a system manager together, are automatically recorded in user right and describe in table；The system manager's
The random number and set with what security catalog was bound that ticket includes system manager's password, is generated for the system manager
Standby information；The facility information with security catalog binding is needing the when of generating ticket dynamically to be extracted every time；
2) ordinary user is registered by inputting user information, and the user information includes username and password, by the use
It family information and dynamically extracts the facility information that obtained described and security catalog is bound and contacts, generate the user of the user
Ticket, regenerating seven tuples, { User ID, user code, user role, random number, initial time terminate time, user
Ticket }, it is recorded in user right and describes in table；
3) ordinary user logs in, and by the user ticket of the user and is recorded in user right and describes the user in table
Ticket be compared, it is determined whether login successfully；
4) when ordinary user's new files, following operation is executed：
By continuing to monitor the user behavior in security catalog, when user creates a file in security catalog, this is newly-built
File is to need document to be protected, generates file encryption key for the new files first, recycles the new files
Encryption key, encrypt the content of new files and be encapsulated as customized unified formatted file, thus protect the newly-built text
Part；
5) when user changes existing protected file, the file is decrypted by decruption key, and revert to original
File format；After user modifies and preserves to original, then weight carried out to this document using the step 4) guard method
New protection.
2. document protection method as described in claim 1, characterized in that step 1) the system manager ticket is given birth to by formula 1
At：
TicketuHash=(passwordu|rand_numu| device_info) (formula 1)
In formula 1, TicketuHash is TicketuCryptographic Hash；TicketuIt is the ticket of user u；passworduRefer to pipe
Reason person's password；rand_numuRefer to that user management module is the random number that administrator generates, this random number is if generating
User right is recorded in describe in table in the record of system manager；Device_info refers to setting bound in security catalog
Standby information.
3. document protection method as described in claim 1, characterized in that step 2) specifically executes following operation:
21) it is that the user generates a random number according to the user name of user and user password；
22) facility information of the random number, user password and Dynamic Extraction bound with security catalog is contacted, uses Hash
Function carries out operation, obtains the user ticket of the user；
23) generating seven tuples, { User ID, user code, user role, random number, initial time terminate time, user
Ticket }, it is recorded in user right and describes in table.
4. document protection method as described in claim 1, characterized in that the facility information with security catalog binding is to create
The local computer or server of security catalog.
5. document protection method as described in claim 1, characterized in that step 3) determines whether user logins successfully, specific logical
The following operation of execution is crossed to complete：
User name and user password are obtained, is that user generation one is faced according to the method for generating user ticket described in step 2)
When ticket, and decrypt scanning user right table is described, obtain the ticket for being recorded in the user that user right describes in table；
By the interim ticket with it is described be recorded in user right and describe the ticket of the user in table be compared, if complete
It is exactly the same, it logins successfully；Otherwise refusal user logs in, login failed for user.
6. document protection method as described in claim 1, characterized in that step 4) protects file, and specific execution is as follows
Operation：
41) it is that the new files generate file encryption key, the file encryption key is three layers of key structure；The generation text
The specific method of part encryption key is：For one master key of the file generated, the making a summary of the file, the text are recycled
The cryptographic Hash of the absolute path of the corresponding random number of part, the cryptographic Hash of the facility information and security catalog is calculated by two layers
Generate the encryption key of this document；
42) encryption key is utilized, the content of the file is encrypted, is encapsulated as customized unified formatted file, it is thus complete
The pairs of file is protected.
7. document protection method as claimed in claim 6, characterized in that one master key of the generation is especially by hardware fingerprint
Generate a master key；Two layers of the calculating generates encryption key, specifically：File encryption key is generated by formula 3：
In formula 3, geneKeySDRefer to the generation key generated by formula 2；It is then to be directed to often by what formula 4 generated
The different fileinfo of a file；G is constructed fuction, the safety for enhancing entire generating function；
The formula 2 is：
geneKeySD=ZMK|path_SDMod P (formula 2)
In formula 2, MK is master key；Path_SD is the cryptographic Hash for the security catalog address specified when creating security catalog；P is
One big prime number；Z is the prime factor in P finite fields；
The formula 4 is：
In formula 4,It is the different message authentication code of each file；It is recorded on each file in unified formatted file
Different random numbers；devinfoRefer to the facility information bound with security catalog that dynamic extracts when fileinfo generates
Cryptographic Hash.
8. document protection method as described in claim 1, characterized in that step 4) the customized unified file format is specific
It is specific as follows including file header and file content：
42a) file header includes the hexadecimal character of the 8Bytes of a total length for being used to indicate unified formatted file
The hexadecimal string of string and the 8Bytes of the length for indicating unified formatted file head；
42b) file header further includes the cryptographic Hash for the facility information of back to back 32Bytes bound with security catalog, one
The message authentication code of the random number of a 16Bytes and 32Bytes for examining protected file integrality；
42c) in the length of the last filename and original document comprising original document of the file header, for being gone back in decryption
Former original；
It is 42d) encrypted original after the file header, as the file content of unified formatted file, with ciphertext
Form is presented.
9. a kind of file protecting system for realizing any document protection method of claim 1~8, the file protecting system
Including user management module, file monitoring device, document management module and hierarchical encryption management module；
User management module realizes user right distribution and user authentication for controlling access of the user for security catalog；Institute
The manager for being created as security catalog for stating security catalog, possesses the operating right that table is described to user right；The user recognizes
Card carries out the verification of user identity using customized user ticket；The all permissions information of user is all recorded in user's power
In limit description table；
User's operation and be in real time made whether of the file monitoring device for persistently detecting in security catalog protects file
Response；
Document management module is used to provide safeguard protection to file, after the protection is encrypted by extracting file content
It is re-packaged into unified formatted file；
Hierarchical encryption management module is used to generate three layers of key generating structure of file, and three layers of key generating structure includes master
Key generates key and file encryption key, is encrypted or decrypts to file to achieve the purpose that.
10. file protecting system as claimed in claim 9, characterized in that the format of the unified formatted file includes file header
And file content, the file content are the encrypted ciphertext of original；The file header includes raw filename, original document
The plaintext of name length, file total length after encapsulation, file header length, facility information cryptographic Hash and Message Authentication Code.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610064511.9A CN105740725B (en) | 2016-01-29 | 2016-01-29 | A kind of document protection method and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610064511.9A CN105740725B (en) | 2016-01-29 | 2016-01-29 | A kind of document protection method and system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN105740725A CN105740725A (en) | 2016-07-06 |
| CN105740725B true CN105740725B (en) | 2018-08-28 |
Family
ID=56248016
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610064511.9A Active CN105740725B (en) | 2016-01-29 | 2016-01-29 | A kind of document protection method and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN105740725B (en) |
Families Citing this family (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106650492B (en) * | 2016-12-14 | 2019-06-07 | 北京大学 | A kind of multiple device file guard method and device based on security catalog |
| CN108985075A (en) * | 2017-06-02 | 2018-12-11 | 成都小娱网络科技有限公司 | A kind of image file disk encryption system and method for lightweight |
| CN109598137B (en) * | 2017-09-30 | 2021-08-13 | 广东亿迅科技有限公司 | Method and system for safely processing data |
| CN110688647A (en) * | 2018-07-06 | 2020-01-14 | 英研智能移动股份有限公司 | Computer task judging method and server system suitable for same |
| CN109299617A (en) * | 2018-09-19 | 2019-02-01 | 中国农业银行股份有限公司贵州省分行 | A kind of file encryption and decryption system |
| CN110046134B (en) * | 2019-04-09 | 2021-08-31 | 北京信安世纪科技股份有限公司 | Database log recording method and system and database log recording detection method |
| CN110166458B (en) * | 2019-05-23 | 2022-08-02 | 王怀尊 | Three-level key encryption method |
| CN112398791B (en) * | 2019-08-15 | 2023-08-01 | 奇安信安全技术(珠海)有限公司 | Method and device for protecting website from tampering, system, storage medium and electronic device |
| CN112380554A (en) * | 2020-11-26 | 2021-02-19 | 北京京航计算通讯研究所 | Electronic document encryption calibration system and method based on operating system |
| CN113377813B (en) * | 2021-06-08 | 2023-08-29 | 上海商米科技集团股份有限公司 | Global unique identification code generation method, device, system and computer readable medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101652767A (en) * | 2007-03-30 | 2010-02-17 | 微软公司 | Model-based access control |
| CN102201040A (en) * | 2010-03-22 | 2011-09-28 | 北京大学 | Method, system and device for processing electronic documents |
| CN104125069A (en) * | 2014-07-07 | 2014-10-29 | 武汉理工大学 | Secure file catalogue file encryption system towards sharing |
| CN104717643A (en) * | 2013-12-12 | 2015-06-17 | 北京大学 | Mobile device safety communication platform |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7921284B1 (en) * | 2001-12-12 | 2011-04-05 | Gary Mark Kinghorn | Method and system for protecting electronic data in enterprise environment |
| EP2891108A4 (en) * | 2012-08-31 | 2016-11-30 | Pkware Inc | System and methods for data verification and replay prevention |
-
2016
- 2016-01-29 CN CN201610064511.9A patent/CN105740725B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101652767A (en) * | 2007-03-30 | 2010-02-17 | 微软公司 | Model-based access control |
| CN102201040A (en) * | 2010-03-22 | 2011-09-28 | 北京大学 | Method, system and device for processing electronic documents |
| CN104717643A (en) * | 2013-12-12 | 2015-06-17 | 北京大学 | Mobile device safety communication platform |
| CN104125069A (en) * | 2014-07-07 | 2014-10-29 | 武汉理工大学 | Secure file catalogue file encryption system towards sharing |
Non-Patent Citations (3)
| Title |
|---|
| "SDDRM：基于分段的电子文档动态版权管理";许东阳等;《北京大学学报（自然科学版）》;20120731;第48卷(第4期);第565-573页 * |
| "The UCONABC Usage Control Model";Jaehong Park et al.;《ACM Transactions on Information and System Security》;20040229;第7卷(第1期);第128-174页 * |
| "基于角色和规则引擎的UCON应用模型";熊智等;《计算机工程与设计》;20130331;第34卷(第3期);第831-836页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN105740725A (en) | 2016-07-06 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN105740725B (en) | A kind of document protection method and system | |
| JP6941146B2 (en) | Data security service | |
| US11003742B2 (en) | Method and system for secure distribution of selected content to be protected | |
| JP7045837B2 (en) | Federated key management | |
| EP2957063B1 (en) | Policy enforcement with associated data | |
| CN103189872B (en) | Safety in networked environment and the effectively method and apparatus of Content Selection | |
| CN101174295B (en) | Off-line DRM authentication method and system | |
| CN104239820B (en) | A kind of safety storage apparatus | |
| JP6678457B2 (en) | Data security services | |
| US11372993B2 (en) | Automatic key rotation | |
| Deshmukh et al. | Transparent Data Encryption--Solution for Security of Database Contents | |
| US20140331338A1 (en) | Device and method for preventing confidential data leaks | |
| CN103745164B (en) | A kind of file safety storage method based on environmental and system | |
| Belenko et al. | “Secure Password Managers” and “Military-Grade Encryption” on Smartphones: Oh, Really? | |
| CN106650492B (en) | A kind of multiple device file guard method and device based on security catalog | |
| CN109753768A (en) | A kind of WEB software enciphering method | |
| US20210111870A1 (en) | Authorizing and validating removable storage for use with critical infrastrcture computing systems | |
| Halcrow | Demands, solutions, and improvements for Linux filesystem security | |
| JP5361850B2 (en) | Access management system | |
| Zheng et al. | Research on digital rights management model for spatial data files | |
| Liu et al. | Design and Implementation of a PKI-Based Electronic Documents Protection Management System | |
| CN104318173B (en) | File non-proliferation technology based on LAN cross validation | |
| Singla et al. | Hybrid Algorithm for Cloud Data Security | |
| CN103346998B (en) | A kind of document security guard method crushing encryption based on file | |
| KR101387939B1 (en) | System for controlling backup storage |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |