KR20070061222A - Real time decryption method using the file system - Google Patents

Abstract

A method for decrypting an encrypted file in real-time by using a file system is provided to enable an application program to use the encrypted file by decrypting the encrypted file in a memory through a file decryptor in real-time. An access request to the encrypted file is transferred to a file decryptor control program. The file decryptor control program transfers file information and key information to the file decryptor through an MFB(Mount File Block). A mounting/control program of the file decryptor registers the file information to an FIB(File Information Block) and a KIB(Key Information Block). The application program executing the encrypted file is executed by a mounting/control program. The application program reads and uses the encrypted file from the file decryptor. If the application program is terminated, the mounting/control program removes the encrypted file registered to the file decryptor.

Description

Real-time decryption method of encrypted file using file system {REAL TIME DECRYPTION METHOD USING THE FILE SYSTEM}

1 is an overall conceptual diagram showing a method for decrypting an encrypted file according to an embodiment of the present invention;

2 is a diagram showing the structure of an encryption file decoder according to an embodiment of the present invention;

3 is a view showing the structure of an encrypted file according to an embodiment of the present invention;

4 is a diagram showing an encryption method according to an embodiment of the present invention;

5 is a conceptual diagram showing the structure of a file system according to an embodiment of the present invention;

6 is a diagram showing the structure of a file information block according to an embodiment of the present invention;

7 is a view showing the structure of a key information block according to an embodiment of the present invention;

8 is a diagram showing the structure of a file installation information block transferred between a cipher file decoder control program and a file system during file installation according to an embodiment of the present invention;

9 is a flowchart when installing / removing files according to an embodiment of the present invention;

10 is a flowchart illustrating a file decoding processing thread according to an embodiment of the present invention;

11 is a usage scenario including a control program for using an encrypted file decoder according to an embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

100: application

200: password file decoder

300: encryption file decoder control program

400: Filesystem

500: storage device

600: encrypted file

The present invention relates to an information protection technology, and more particularly, to a method for real-time decryption of an encrypted file using a file system that allows an application program to decrypt the encrypted file in real time.

In general, an encrypted file is decrypted and executed by an application program. As described above, when the encrypted file is to be used, the encrypted file is first decrypted, the decrypted file is used by the application program, and then re-encrypted. Alternatively, an encrypted file may be intercepted at the input / output of each application program, and the encrypted file may be decrypted and re-encrypted at the end.

However, for example, a read-only encrypted file has a disadvantage that it must be re-encrypted after decryption is executed. Moreover, when the size of the encrypted file is large, decryption and re-encryption takes a long time, resulting in inconvenience in use. And waste of resources throughout the system. In particular, when encrypted in a read-only medium such as a CD-ROM, there is a disadvantage that must be used by decoding (copying) to a hard disk.

Accordingly, the present invention has been made to solve the above problems of the prior art, an object of the present invention is to encrypt using a file system that can be used in the application by decrypting the encrypted file in real time in the memory using the encryption file decoder The present invention provides a method for real-time decoding of a file.

The real-time decryption method of the encrypted file using the file system of the present invention for achieving the above object, the encrypted file decoder which is a virtual file system interworking between the file system and the application program for the encrypted file in a specific format, An encrypted file decoder and an application program may be used to decrypt the encrypted file in real time using an encryption file decoder control program that controls the encryption file decoder.

Hereinafter, a real-time decryption method of an encrypted file using the file system of the present invention will be described in detail with reference to the accompanying drawings.

1 is an overall conceptual diagram illustrating a method of decrypting an encrypted file according to an embodiment of the present invention.

As shown in FIG. 1, a file consisting of a typical application program 100, a file system 400, and a storage device 500 is stored in the storage device 500, which is a minimum unit of data by the file system 400. The way it is done is determined.

Here, in the present invention, the encryption file decoder control program 300 for interlocking the encryption file decoder 200 between the application program 100 and the file system 400 and controlling the encryption file decoder 200 is applied. It is linked with the program 100 and the encryption file decoder 200. This encrypted file decoder 200 means a virtual file system.

In this way, the encrypted file 600 stored in the storage device 500 is decrypted in real time through the encryption file decoder 200 and transmitted to the application program 100. The encrypted file decoder control program 300 is a control program for driving the encrypted file decoder 200. The cipher file decoder 200 operates in the kernel mode like the file system 400.

2 is a diagram showing the structure of an encryption file decoder according to an embodiment of the present invention.

As shown in FIG. 2, the cipher file decoder 200 is a file system driver, which is a Create / Open 205, Read 206, Close 207, File System Control 208, Directory Control 209, Device device. File decoding processing thread 201 for file decoding processing in a general structure including control 210, file install / removal 204 of the target file to be decrypted, and FIB list 202 for storing information of the target file. The KIB list 203 manages key information of an encrypted file.

3 is a diagram showing the structure of an encrypted file according to an embodiment of the present invention.

As shown in FIG. 3, the encrypted file is composed of an encrypted file header 601 of 512Byet and encrypted data 602. The header structure is FingerPrint, Version, Initial Vector (IV), KeyCV, It is made of unused.

4 is a diagram illustrating an encryption method according to an embodiment of the present invention.

As shown in Fig. 4, the counter mode is used as a block cipher algorithm as a method used for encryption. The counter 701 uses the initial vectors IV and 705 and the file offset 706 to decode at arbitrary file positions. Here, any algorithm such as ARIA, AES (Advanced Encryption Standard) can be applied as the block encryption algorithm. As described above, a process of decoding plain text data into cipher text data or decrypting cipher text data into plain text data is performed by a block cipher algorithm.

5 is a conceptual diagram illustrating a structure of a file system according to an embodiment of the present invention.

As shown in Fig. 5, the file system includes FileObject # 1 (801), FileObject # 2 (802), FileObject # 3 (803), CCB # 1 (804), and CCB # 2 (806) that are created at the time of file creation. , General structure including CCB # 3 (807), FCB # 1 (805), FCB # 2 (808), FIB # (901), FIB # (902), FIB # (903) generated during file installation There is a Key Information Block (KIB) including a File Information Block (FIB), a KIB # 904, and a KIB # 905.

6 is a diagram showing the structure of a file information block according to an embodiment of the present invention.

As shown in FIG. 6, the file information block (FIB) 910 includes a KIB pointer, an encrypted file name, a file name for a decoder, a file allocation size, a file size, a file attribute, a current file offset, Flags, Next, and a reference counter. , Reference counter 1, and counter (for block ciphers).

7 illustrates a structure of a key information block according to an embodiment of the present invention.

As shown in FIG. 7, the key information block (KIB) 911 includes a file decoding key, algorithm context information, KeyCV, Next, and a reference counter.

8 is a diagram illustrating the structure of a file installation information block transferred between a file decryption control program and a file system during file installation according to an embodiment of the present invention.

As shown in Fig. 8, a file installation information block (MFB) 912 includes a reserved area, a file decryption key, a file name length for a decoder, a file name for a protector, an encrypted file name length, and an encrypted file name. It includes.

9 is a flowchart illustrating file installation / removal according to an embodiment of the present invention.

As shown in FIG. 9, upon receiving a file installation command or a file removal command from the encryption file decoder control program 300, the encryption file decoder 200 determines whether it is an installation (Mount, 2041). If there is a presence, a KIB is generated (2042 to 2043). If this file is already installed, the FIB exists, and if it is determined (2044), the FIB is created (2045) and the FIB and KIB reference counters are increased (2046). On the other hand, if the file removal command is not a file installation command, it is determined whether the FIB exists (2047), and if not, it ends. Decreases the FIB reference counter (2048) and removes the FIB if the FIB is not in use (Counter = 0, 2049) (2051), otherwise sets the elimination wait (2050).

10 is a flowchart illustrating processing of a file decoding processing thread according to an embodiment of the present invention.

As shown in FIG. 10, the file decryption processing thread is a thread existing in the cipher file decoder 200 and processes four commands of file opening, file closing, file reading, and file information reading.

If the command entered in the command waiting state (2011) is a file open command (2012), the file is opened (2016) and the header of the file is read (2017) to check whether it is an encrypted file (FingerPrint) (2018), If the file is encrypted, it is checked whether the input key is correct (2019). If the key is correct, the initial vector (IV) and FileOffset are initialized. After that, the Status becomes Success and the instruction processing ends (SetEvent) 2021 to 2022. On the other hand, if it is determined in step 2018 that the file is not encrypted, the file is closed (2023) and the status becomes an error and the command processing ends.

In addition, if the command input in the command waiting state (2011) is a file read command (2014), it checks whether FileOffset is the requested FileOffset and moves the file position. After adjusting the FileOffset as described above (2026 to 2027) and setting the IV (2028 to 2029), the file data is read and decoded by the length of the file (2030 to 2032.), and it is determined whether the decoding has been completed as much as desired (2033). When the decoding is completed as much as desired, the FileOffset is updated (2034).

When the command input in the command waiting state (2011) is the file closing (2013), the file that is opened is simply closed (2025), and when the command input in the command waiting state (2011) is reading the file information ( 2015) Read and send file information (2035).

11 is a usage scenario including a control program for using an encrypted file decoder according to an embodiment of the present invention.

As shown in FIG. 11, when the encrypted file 600 is accessed (1), it is transmitted to the encryption file decoder control program 300 through the system program (explorer) 1000 (2), and the file of FIG. The file information and the key information are transmitted to the encrypted file decoder 200 through the installation information block MFB (③). Accordingly, the installation / removal program of the encryption file decoder 200 installs (registers) the encrypted file information in the FIB and KIB. In this case, the file displayed by the cipher file decoder shows only the files installed (registered) in the FIB. After installation, the encryption file decoder control program 300 executes the application program 100 (④), and the application program 100 reads and uses the file through the encryption file decoder 200 (⑤ to ⑥). When the application program 100 terminates (⑦), the encryption file decoder control program 300 removes the file installed in the encryption file decoder 200 (⑧).

Here, the cipher file decoder (file system) has only a root directory. Encrypted files have a specific file extension, and the encrypted file decoder uses the name and original file extension that correspond to the encrypted file. The cryptographic file decoder handles the cryptographic file header itself and treats it as if the application has no cryptographic file header. The initial vector and file offset are used as counter inputs so that file decoding can be performed at arbitrary positions. The file decoding is performed in the file decoding processing thread 201 of FIG. 2 and processes four instructions as shown in FIG. Decryption of the file is performed on file reading.

Although the present invention has been described in more detail with reference to some embodiments, the present invention is not necessarily limited to these embodiments, and various modifications can be made without departing from the spirit of the present invention.

As described above, the real-time decryption method of the encrypted file using the file system according to the present invention can be used to decrypt the encrypted file in real time irrespective of the application program, particularly useful for large read-only files.

In addition, according to the present invention, not only re-encryption is required by using an encrypted file decoder, but also an encryption method selected by a user because it is not an encryption method dependent on a specific operating system.

Claims (11)

Installing an encrypted file in an encryption file decoder, which is a virtual file system that is interoperable between a file system and an application program, for a file encrypted in a specific format, and interworking with the encryption file decoder and an application program to install the encrypted file decoder and the application program. A real-time decryption method of an encrypted file using a file system, characterized in that for decrypting the encrypted file in real time using a control file encryption control program. The method of claim 1, wherein And an encrypted file installed in the encrypted file decoder at the end of an application program by the encrypted file decoder control program. The method of claim 2, wherein the installation and removal of the encrypted file in the encrypted file decoder, Upon receiving the file installation command from the encryption file decoder control program, it is determined whether there is a key information block (KIB), and if not, a key information block is generated, and if there is a file information block (FIB), a file information block is generated and a FIB is generated. Increments the counting value of the reference counter and the KIB reference counter, Upon receiving the file removal command from the Cryptographic File Decoder Control Program, it determines if the file information block (FIB) exists and exits if it is not there, and decreases the counting value of the FIB reference counter, and removes the file information block if it is not in use. And is processed by setting the removal wait using the file information block Real time decryption method of an encrypted file using a file system, characterized in that. The method of claim 1, wherein A method for real-time decryption of an encrypted file using a file system, characterized by using a counter mode that can be decrypted at an arbitrary file location using an initial vector and a file offset as a block encryption algorithm. The method of claim 4, wherein the block cipher algorithm, A method for real-time decryption of an encrypted file using a file system, characterized in that it uses any one of an ARIA, an symmetric key encryption (SEED), and an AES (Advanced Encryption Standard) having the same encryption key and decryption key. The method of claim 1, wherein the encryption file decoder, A real-time decryption method of an encrypted file using a file system, comprising a thread for processing four commands: file open, file close, file read, and file information read. The method of claim 6, wherein the file opener, Opening the file in response to the file open command; Checking whether a file is encrypted by reading a header of the corresponding file; If the file is not an encrypted file, closing the file and checking whether the input key is a set value if the file is an encrypted file; And Initializing an initial vector (IV) and a FileOffset if the key is a set value; Real time decryption method of an encrypted file using a file system, characterized in that the processing. The method of claim 6, wherein the file read, Checking whether the FileOffset is the FileOffset requested by the FileOffset in response to the file reading command and moving the file location; Setting the initial vector IV and reading and decoding the file data by the file length; And Updating FileOffset When Decoding is More Than Set Real time decryption method of an encrypted file using a file system, characterized in that the processing. Transmitting a request for access to an encrypted file to an encrypted file decoder control program; Transferring file information and key information to an encrypted file decoder through a file installation information block (MFB) in the encrypted file decoder control program; Registering the encrypted file information in a file information block (FIB) and a key information block (KIB) by an installation / control program of the encrypted file decoder; Executing an application program to be executed by the encrypted file decoder control program; Reading and using an encrypted file by an encryption file decoder in the application program; And Removing the encrypted file registered in the encryption file decoder by the encryption file decoder control program when the application is terminated. Real time decryption method of an encrypted file using a file system comprising a. The method of claim 3 or 9, wherein the file information block, Key information block (KIB) pointer, encrypted file name, file name for decoder, file allocation size, file size, file attribute, current file offset, Flags, Next, reference counter, reference counter 1, Counter (for block password) Real-time decryption method of the encrypted file using a file system comprising a. The method of claim 3 or 9, wherein the key information block, A real-time decryption method of an encrypted file using a file system, comprising a file decryption key, algorithm context information, KeyCV, Next, and reference counter.

Images