CN116842545A - File encryption-based data anti-luxury method and system - Google Patents

Abstract

The invention discloses a file encryption-based data anti-luxury method and a file encryption-based data anti-luxury system, wherein the method comprises the following steps: 1) Authenticating the identity of the user, and ensuring the authenticity and legality of the identity; 2) Uploading a file to be encrypted to a system by a user, and encrypting the file by the system and generating a secret key; 3) Storing the encrypted file and the key in different places to ensure the separation of the file and the key; 4) When a user needs to use the encrypted file, the user needs to provide a correct key to decrypt, so that only an authorized user can access the file; 5) When the user finds that the file is illegally accessed or leaked, tracking and backtracking can be performed through the system. The invention provides a reliable data anti-luxury solution, which adopts an advanced encryption algorithm, and can effectively protect the privacy and data security of users; meanwhile, by means of the key separation and tracking backtracking functions, illegal access and leakage of data can be effectively prevented, and the capability of preventing the data from being stolen is improved.

Description

File encryption-based data anti-luxury method and system

Technical Field

The invention relates to the field of computer data security based on information security technology, in particular to a data anti-luxury method and system based on file encryption.

Background

Data security has been an important topic in the internet field. During the process of data storage, transmission and processing, data may be affected by hacking, virus infection, system failure and other problems, resulting in data leakage, loss or tampering. In recent years, data leakage and illegal access frequently occur, which brings serious economic and reputation losses to enterprises and individuals and even endangers national security. Therefore, protecting the security and confidentiality of data is a highly desirable problem.

However, existing data security techniques do not fully address these issues. The traditional encryption method needs to encrypt the data, but management and protection of the secret key often become a short board for data security, and the security of the data is threatened due to the secret key leakage. In addition, the conventional encryption method cannot prevent data from being illegally accessed or leaked. Therefore, a more secure and reliable data anti-halving method is needed to solve these problems.

The invention provides a file encryption-based data anti-luxury method and system, which can effectively improve the safety and confidentiality of data and effectively prevent the data from being revealed and illegally accessed. The method and the system generate the secret key and store the secret key separately by encrypting the file, ensure that only an authorized user can access the file, and control, track and trace the access of the file to prevent the file from being tampered or revealed, thereby ensuring the security and confidentiality of the data.

Disclosure of Invention

The invention discloses a file encryption-based data anti-luxury method and a file encryption-based data anti-luxury system, wherein the method comprises the following steps: 1) Authenticating the identity of the user, and ensuring the authenticity and legality of the identity; 2) Uploading a file to be encrypted to a system by a user, and encrypting the file by the system and generating a secret key; 3) Storing the encrypted file and the key in different places to ensure the separation of the file and the key; 4) When a user needs to use the encrypted file, the user needs to provide a correct key to decrypt, so that only an authorized user can access the file; 5) When the user finds that the file is illegally accessed or leaked, tracking and backtracking can be performed through the system.

The technical scheme of the invention is as follows: a data anti-luxury method based on file encryption comprises the following steps:

1) Before the user uses the system, the user needs to carry out identity authentication first, so that the authenticity and legality of the user identity are ensured;

2) Uploading a file to be encrypted to a system by a user, and encrypting the file by the system and generating a secret key;

3) Storing the encrypted file and the key in different places, ensuring the separation of the file and the key and improving the data security;

4) When a user needs to use the encrypted file, the user needs to provide a correct key to decrypt, so that only an authorized user can access the file;

5) When the user finds that the file is illegally accessed or leaked, the system can track and trace back so as to take corresponding measures in time.

Furthermore, the method is characterized in that in the step 1), the identity authentication means that the identity information of the user is confirmed through a series of verification means so as to ensure that only legal users can use the system; the identity authentication can be realized in various modes, such as account password login, short message verification code login, face recognition and the like; in the data anti-luxury system, the identity authentication can adopt an account number and password login mode; the user needs to provide the correct account number and password to successfully log in the system, otherwise, the system cannot be used; the purpose of identity authentication is to ensure the authenticity and legality of the identity of the user, prevent illegal users from using the system, and protect the security and privacy of data; only the user after identity authentication can use the system, so that the security and the anti-luxury capability of the data are ensured.

Further, the method is characterized in that in step 2), the system should encrypt the uploaded file to ensure that the file content can be securely stored and transmitted; the encryption algorithm can adopt a symmetric encryption algorithm or an asymmetric encryption algorithm; in the encryption process, the system should generate a key, store the key in the key management device, and store the encrypted file in the system at the same time; the key management device can be a hardware device or a software device, and is used for storing and managing the key, so that the security and the effectiveness of the key are ensured; for hardware devices, physical devices such as smart cards and USB passwords can be adopted, and for software devices, software tools such as encryption software and a key management system can be adopted; by encrypting the file and storing the secret key in the secret key management equipment, confidentiality and integrity of data can be effectively protected, and illegal access or leakage of the data can be prevented; meanwhile, the security and the effectiveness of the secret key are also guaranteed, and the security and the anti-luxury capability of data are improved.

Still further, the method is characterized in that in step 3), the separation of the file and the key means that the encrypted file should be stored in a storage device with a certain security level, such as an encrypted USB, an encrypted hard disk, etc., and the key should be stored in a specific key management device, such as a smart card, HSM, etc., to ensure the separation of the file and the key; by respectively storing the file and the secret key in different places, the risk of data leakage can be effectively reduced, and the safety of the data is improved; for sensitive data, strict authority control is set in the equipment for storing the key, and only authorized users are allowed to access the key, so that the security of the data is further improved.

Furthermore, the method is characterized in that in step 4), the user needs to perform identity authentication first, and then can acquire the key stored in the key management device to decrypt the key, so as to access the encrypted file; by requiring the user to provide the correct key for decryption, the illegal user can be effectively prevented from acquiring the file content, and the confidentiality and the integrity of the data are protected; only authorized users can access the encrypted files, so that the safety and the anti-luxury capability of the data are ensured; a virtual keyboard is used when inputting a key, two-factor authentication is used, etc., to prevent the key from being intercepted by a malicious program or hacker.

Furthermore, in step 5), the tracking and backtracking means that the system should record the information of time, place, user, etc. of each file access, and encrypt and store the information safely, so as to track and backtrack when necessary; by the tracking and backtracking functions of the system, illegal access and leakage of the file can be found in time, and corresponding measures such as revocation authority, key modification and the like are adopted to protect the safety and the anti-luxury capability of the data; meanwhile, the tracking and backtracking functions are also beneficial to evaluating and optimizing the safety of the data, and the safety and the anti-luxation capability of the data are improved.

The invention also discloses a data anti-luxury system based on file encryption, which is characterized in that the confidentiality and the integrity of data can be protected through the functions of file encryption processing, key management, access control and the like, and the security and the anti-luxury capability of the data are improved; wherein the core module comprises: the system comprises a user identity authentication module, a file encryption module, a key management module, a file decryption module, an access control module and a tracking and backtracking module; wherein, the liquid crystal display device comprises a liquid crystal display device,

the user identity authentication module is used for verifying the identity of a user and ensuring the authenticity and legality of the identity of the user; the user needs to carry out identity authentication before using the system so that the system can authorize and authenticate the user;

the file encryption module is used for carrying out encryption processing on the file uploaded by the user so as to ensure that the file content can be safely stored and transmitted; the system can encrypt the file by adopting a symmetric encryption algorithm or an asymmetric encryption algorithm, and specifically selects which algorithm needs to be evaluated and selected according to actual conditions;

the key management module is used for generating and managing keys. The system can generate a secret key and store the secret key in a secret key management device, wherein the secret key management device can be a hardware device or a software device and is used for storing and managing the secret key so as to ensure the safety and the effectiveness of the secret key;

the file decryption module is used for decrypting the encrypted file; when a user needs to use the encrypted file, the user needs to provide a correct key to decrypt, so that only an authorized user can access the file;

the access control module is used for controlling the access of the file, and only authorized users can access the encrypted file; the access control module can also record information such as time, place, user and the like of each file access, and carry out encryption processing and safe storage on the information so as to trace and trace back when needed;

the tracking backtracking module can verify the integrity of the file by the system so as to prevent the file from being tampered; when the user finds that the file is illegally accessed or leaked, the system can track and trace back so as to take corresponding measures in time.

Advantageous effects

Compared with the prior art, the invention has the beneficial effects that:

(1) Compared with the traditional encryption method, the invention adopts a plurality of guarantee measures such as advanced encryption algorithm, key management and the like, can improve the security and confidentiality of data, and effectively prevents the leakage and illegal access of the data, thereby enhancing the data security;

(2) The access control and tracking backtracking function can help an administrator to manage and monitor the access of data more conveniently, and simultaneously support batch operation and automatic management, so that the efficiency of data management can be improved;

(3) The system of the invention adopts a protection mechanism of separating the secret key from the file, can help the user to better manage own data, and improves the data management capability of the user.

Description of the embodiments

For the purpose of making the objects, technical solutions and advantages of the embodiments of the present invention more apparent, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention, and it is apparent that the described embodiments are some embodiments of the present invention, but not all embodiments of the present invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.

The invention comprises the following steps: the user needs to provide a user name and a password before using the system; the system performs identity verification according to the user name and the password provided by the user, so as to ensure the authenticity and the legality of the user identity; the user enters a file uploading page, selects a file to be encrypted and uploads the file to the system; the system encrypts the file and generates a secret key to ensure the security of the file; the encrypted file is stored in an encrypted file storage area of the system, so that the safety of the file is ensured; the secret key is stored in a secret key management area of the system, so that the security of the secret key is ensured; the system stores the encrypted file storage area and the key management area in different positions respectively, so as to ensure the separation of the file and the key; the system checks the key input by the user, so that only the authorized user can access the file; if the key is correct, the system decrypts the encrypted file and enables the user to download or browse the file, so that the security of the file is ensured; the user enters a tracking backtracking page, and inputs related information (such as file names, time stamps and the like) to inquire; the system searches and analyzes the file access record and the user operation record according to the query condition, so that the safety of the file is ensured; the system generates a corresponding report informing an administrator or user to process in order to take corresponding measures in time.

FIG. 1 is a flowchart of an embodiment of a file encryption-based data anti-theft method according to the present invention, which mainly comprises the following steps:

s101, a user needs to provide a user name and a password before using the system;

s102, the system performs identity verification according to a user name and a password provided by a user, so as to ensure the authenticity and legality of the user identity;

s201, a user enters a file uploading page, selects a file to be encrypted and uploads the file to a system;

s202, the system encrypts the file and generates a secret key;

s301, storing the encrypted file in an encrypted file storage area of a system, and ensuring the security of the file;

s302, the secret key is stored in a secret key management area of the system, so that the security of the secret key is ensured;

s303, the system stores the encrypted file storage area and the key management area in different positions respectively so as to ensure the separation of the file and the key;

s401, the system checks the secret key input by the user, so that only the authorized user can access the file;

s402, if the key is correct, the system decrypts the encrypted file and enables the user to download or browse the file, so that the security of the file is ensured;

s501, a user enters a tracking backtracking page, and inputs related information (such as file names, time stamps and the like) to query;

s502, the system searches and analyzes the file access record and the user operation record according to the query condition, so that the safety of the file is ensured;

s503, the system generates a corresponding report, and notifies an administrator or a user to process so as to take corresponding measures in time.

Specifically, in step S101, the user needs to provide a user name and a password for authentication before using the present system. The purpose of this step is to ensure the identity authenticity and legitimacy of the user, only authenticated users can use the functionality of the system.

In step S102, when performing authentication, the system compares the user name and password provided by the user with the user information stored previously, and if the authentication is passed, the user can enter the system to perform operation; if the authentication is not passed, the user cannot enter the system.

In step S201, the user needs to enter a file upload page, select a file to be encrypted, and upload the file to the system. When uploading files, the user can select the files needing to be encrypted and upload the files to the system through the uploading function of the system.

In step S202, the system encrypts the file uploaded by the user to ensure the security of the file. The system encrypts the file using a certain encryption algorithm so that an unauthorized user cannot read the file contents. At the same time, the system generates a key for subsequent file decryption operations. The encrypted file and the secret key are respectively stored in an encrypted file storage area and a secret key management area of the system, so that separation of the file and the secret key is ensured, and the data security is improved.

In step S301, the encrypted file needs to be saved properly to ensure the security of the file. The system will store the encrypted file in an encrypted file storage area, which is a secure storage space that is only accessible to authorized users. Thus, an unauthorized user cannot read the encrypted file, and the security of the file is ensured.

In step S302, the key is the key to access the encrypted file, and proper protection is required in the system. The system will store the keys in a key management area, which is also a secure storage space, which is only accessible by authorized users. Thus, an unauthorized user cannot acquire the key, and therefore cannot decrypt the file, so that the security of the key is ensured.

In step S303, the system stores the encrypted file storage area and the key management area in different locations, respectively, in order to further enhance security. Therefore, separation of the file and the key can be ensured, even if one storage area is attacked, the encrypted file and the key cannot be revealed at the same time, and the security of the system is improved.

In step S401, the user needs to input a key to access the encrypted file, and in order to ensure that only authorized users can access the file, the system needs to verify the key input by the user. The system compares the key entered by the user with the previously stored key, and if the key is correct, the user is authorized to access the encrypted file, otherwise the user cannot access the file. Through the step, the system can ensure that only authorized users can access the encrypted file, and the security of the file is improved.

In step S402, if the key input by the user is correct, the system decrypts the encrypted file using the key. The decrypted file may be downloaded or browsed by the user so that the user may perform a corresponding operation using the file. In this process, the system still needs to ensure the security of the file. The system will authenticate the user before he downloads or browses the file to ensure that only authorized users can access the file. Meanwhile, the system can also control the operation authority of the user so as to ensure that the user can only perform authorized operation.

In step S501, in order to trace back, the user needs to enter a corresponding page for querying. The user needs to input related information such as file names, time stamps and the like for inquiry so that the system can accurately find corresponding files and related access and operation records.

In step S502, the system performs retrieval and analysis of the file access record and the user operation record according to the query condition input by the user. The system will analyze the access records and the operation records to determine if there is an unauthorized user accessing or operating the file. Meanwhile, the system can also check whether abnormal access and operation behaviors exist, and if abnormal conditions exist, the system can make corresponding alarms and reports and timely inform an administrator or a user to process. Through the step, the system can ensure the security of the file, effectively detect and track unauthorized access and operation behaviors, discover and process abnormal conditions in time, and protect the confidentiality and the integrity of the file.

In step S503, the system generates a corresponding report, and notifies the administrator or the user of the processing, so as to take corresponding measures in time, such as investigation of an abnormal situation, prohibition of unauthorized access, modification of access rights, and the like. An administrator or user can make corresponding decisions and processes based on the information in the report to protect the security and confidentiality of the file.

For example, doctors and nurses need to perform identity authentication before using the system, so as to ensure the authenticity and legitimacy of the identity. This can be verified by using the hospital ID and password to ensure that only authorized personnel can access the medical records. The doctor or nurse uploads the medical record to be encrypted to the system, which encrypts the record and generates a key. This can ensure confidentiality and integrity of medical records. The encrypted medical records and the secret key are respectively stored in different places, for example, the medical records are stored in a database, and the secret key is stored on another server, so that the separation of the file and the secret key is ensured, and the data security is improved. When a doctor or nurse needs to view a medical record, the correct key needs to be provided for decryption to ensure that only authorized personnel can access the medical record. If an unauthorized user accesses or leaks a medical record, the system can track and trace back to take corresponding measures in time. By analyzing by using the access records and the operation records, the system can detect and track unauthorized access and operation behaviors, timely discover and process abnormal conditions, and protect confidentiality and integrity of medical records.

The above examples are provided for the purpose of describing the present invention only and are not intended to limit the scope of the present invention. The scope of the invention is defined by the appended claims. Various equivalents and modifications that do not depart from the spirit and principles of the invention are intended to be included within the scope of the invention.

Claims (7)

1. A data anti-luxury method based on file encryption comprises the following steps:

before the user uses the system, the user needs to carry out identity authentication first, so that the authenticity and legality of the user identity are ensured;

uploading a file to be encrypted to a system by a user, and encrypting the file by the system and generating a secret key;

storing the encrypted file and the key in different places, ensuring the separation of the file and the key and improving the data security;

when a user needs to use the encrypted file, the user needs to provide a correct key to decrypt, so that only an authorized user can access the file;

when the user finds that the file is illegally accessed or leaked, the system can track and trace back so as to take corresponding measures in time.

2. The method according to claim 1, wherein in step 1), the identity authentication means confirms the identity information of the user through a series of verification means, so as to ensure that only legal users can use the system; the identity authentication can be realized in various modes, such as account password login, short message verification code login, face recognition and the like; in the data anti-luxury system, the identity authentication can adopt an account number and password login mode; the user needs to provide the correct account number and password to successfully log in the system, otherwise, the system cannot be used; the purpose of identity authentication is to ensure the authenticity and legality of the identity of the user, prevent illegal users from using the system, and protect the security and privacy of data; only the user after identity authentication can use the system, so that the security and the anti-luxury capability of the data are ensured.

3. The method according to claim 1, wherein in step 2), the system should encrypt the uploaded file to ensure that the file content can be securely stored and transferred; the encryption algorithm can adopt a symmetric encryption algorithm or an asymmetric encryption algorithm; in the encryption process, the system should generate a key, store the key in the key management device, and store the encrypted file in the system at the same time; the key management device can be a hardware device or a software device, and is used for storing and managing the key, so that the security and the effectiveness of the key are ensured; for hardware devices, physical devices such as smart cards and USB passwords can be adopted, and for software devices, software tools such as encryption software and a key management system can be adopted; by encrypting the file and storing the secret key in the secret key management equipment, confidentiality and integrity of data can be effectively protected, and illegal access or leakage of the data can be prevented; meanwhile, the security and the effectiveness of the secret key are also guaranteed, and the security and the anti-luxury capability of data are improved.

4. The method according to claim 1, characterized in that in step 3) said separation of files and keys means that the encrypted files should be stored in a storage device of a certain security level, such as an encrypted USB, an encrypted hard disk, etc., and the keys should be stored in a specific key management device, such as a smart card, HSM, etc., to ensure separation of files and keys; by respectively storing the file and the secret key in different places, the risk of data leakage can be effectively reduced, and the safety of the data is improved; for sensitive data, strict authority control is set in the equipment for storing the key, and only authorized users are allowed to access the key, so that the security of the data is further improved.

5. The method according to claim 1, wherein in step 4), the user needs to perform identity authentication before obtaining the key stored in the key management device for decryption, so as to access the encrypted file; by requiring the user to provide the correct key for decryption, the illegal user can be effectively prevented from acquiring the file content, and the confidentiality and the integrity of the data are protected; only authorized users can access the encrypted files, so that the safety and the anti-luxury capability of the data are ensured; a virtual keyboard is used when inputting a key, two-factor authentication is used, etc., to prevent the key from being intercepted by a malicious program or hacker.

6. The method according to claim 1, wherein in step 5), the tracking and backtracking means that the system should record information such as time, place, user, etc. of each file access, and encrypt and store the information for tracking and backtracking when needed; by the tracking and backtracking functions of the system, illegal access and leakage of the file can be found in time, and corresponding measures such as revocation authority, key modification and the like are adopted to protect the safety and the anti-luxury capability of the data; meanwhile, the tracking and backtracking functions are also beneficial to evaluating and optimizing the safety of the data, and the safety and the anti-luxation capability of the data are improved.

7. The data anti-luxury system based on file encryption is characterized in that confidentiality and integrity of data can be protected through functions of file encryption processing, key management, access control and the like, and safety and anti-luxury capability of the data are improved; wherein the core module comprises: the system comprises a user identity authentication module, a file encryption module, a key management module, a file decryption module, an access control module and a tracking and backtracking module; wherein, the liquid crystal display device comprises a liquid crystal display device,

the user identity authentication module is used for verifying the identity of a user and ensuring the authenticity and legality of the identity of the user; the user needs to carry out identity authentication before using the system so that the system can authorize and authenticate the user;

the file encryption module is used for carrying out encryption processing on the file uploaded by the user so as to ensure that the file content can be safely stored and transmitted; the system can encrypt the file by adopting a symmetric encryption algorithm or an asymmetric encryption algorithm, and specifically selects which algorithm needs to be evaluated and selected according to actual conditions;

the key management module is used for generating and managing keys. The system can generate a secret key and store the secret key in a secret key management device, wherein the secret key management device can be a hardware device or a software device and is used for storing and managing the secret key so as to ensure the safety and the effectiveness of the secret key;

the file decryption module is used for decrypting the encrypted file; when a user needs to use the encrypted file, the user needs to provide a correct key to decrypt, so that only an authorized user can access the file;

the access control module is used for controlling the access of the file, and only authorized users can access the encrypted file; the access control module can also record information such as time, place, user and the like of each file access, and carry out encryption processing and safe storage on the information so as to trace and trace back when needed;

the tracking backtracking module can verify the integrity of the file by the system so as to prevent the file from being tampered; when the user finds that the file is illegally accessed or leaked, the system can track and trace back so as to take corresponding measures in time.