WO2015176394A1

WO2015176394A1 - File encryption method and device, and encrypted file reading method, device and terminal

Info

Publication number: WO2015176394A1
Application number: PCT/CN2014/083921
Authority: WO
Inventors: 周志军; 惠文武
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-05-20
Filing date: 2014-08-07
Publication date: 2015-11-26
Also published as: CN105095783A

Abstract

Provided are a file encryption method and device, and encrypted file reading method, device and terminal. The file encryption method is used to encrypt a file stored on a device, and comprises: a key generation step of generating a first key for a file to be stored; a first encryption step of encrypting the first key according to a preset second key; and a second encryption step of encrypting the file to be stored according to the first key, and according to the preset second key, storing the encrypted first key in the file header of the encrypted file to be stored. The technical solution of the present invention automatically encrypts and decrypts the file without deploying a server, and supports an off line encryption and decryption method.

Description

The present invention relates to the field of information security, and in particular, to a file encryption method and apparatus, a method, device, and terminal for reading an encrypted file. BACKGROUND Some valuable documents are the hard work of the authors, such as online courseware, including files in various formats (word, exceK ppt, etc.) and audio and video files, all of which need to be protected by encryption to prevent illegal access. and use. At present, the usual file encryption and decryption methods and systems are inefficient, especially for large audio and video files in the field of online education. The encryption and decryption takes a long time and the user experience is very poor. At present, the transparent file encryption and decryption method based on the underlying operating system is mostly based on windows hooks or filter drivers. In order to obtain information such as key files, network authentication is required, so it is necessary to deploy a networked server. It is inconvenient for users to use, because it involves network transmission, it is not efficient, especially it does not support offline use. SUMMARY OF THE INVENTION In order to solve the above problems, the present invention provides a file encryption method, a device, a method, a device, and a terminal for encrypting a file, which can automatically perform encryption and decryption of a file without deploying a server, and support encryption and decryption for offline use. method. In order to achieve the above object, an embodiment of the present invention provides a file encryption method for encrypting a file stored on a device, where the encryption method includes: a key generation step: generating a first key for the file to be saved; a first encryption step: performing encryption processing on the first key according to a preset second key; a second encryption step: performing encryption processing on the file to be saved according to the first key, according to a preset The first key encrypted by the second key is saved in the header of the encrypted file to be saved. In the above encryption method, the method further includes: a first determining step: determining, according to the stored file protection policy, whether to perform encryption processing on the file to be saved, where the file protection policy is required for the encrypted file to be satisfied a set of conditions; when the file to be saved needs to be encrypted, the key generation step is entered. In the above encryption method, before the first determining step, the method further includes: configuring the step: configuring the file protection policy according to the first user operation instruction and storing the file protection policy. The above-mentioned encryption method, wherein the key generation step includes generating a first key for the to-be-save file according to the hardware information of the device, the time information, and/or the attribute information of the file to be saved. The above-mentioned encryption method, wherein the attribute information of the file to be saved includes: directory information to which the file to be saved belongs, a file type of the file to be saved, and/or a file name of the file to be saved. The above encryption method, wherein the file header of the file to be saved stores a key for encrypting the file to be saved, and the key generation step is specifically: from a file header of the file to be saved Obtaining a key used to encrypt the file to be saved as a first key of the file to be saved. The embodiment of the present invention further provides a method for reading an encrypted file, where the file header of the encrypted file stores a first key of the encrypted file after encryption, and the reading method includes: obtaining the step: Obtaining the first key of the encrypted encrypted file in a file header of the encrypted file; first decrypting step: decrypting the encrypted first key according to the pre-stored second key, and obtaining the decrypted first a second decrypting step: decrypting the encrypted file according to the decrypted first key, and obtaining the decrypted file for reading. The reading method, wherein the second decrypting step further comprises: a second determining step: receiving a second user operation instruction, determining whether the second user operation instruction belongs to a preset rejection operation instruction set; When the second user operation instruction belongs to the preset rejection operation instruction set, a prompt message is issued indicating that the second user operation instruction is not allowed to be executed. The embodiment of the present invention further provides a file encryption device, configured to encrypt a file stored on a device, where the encryption device includes: a key generation module, configured to generate a first key for the file to be saved; The encryption module is configured to perform encryption processing on the first key according to the preset second key; the second encryption module is configured to perform encryption processing on the to-be-stored file according to the first key, The first key encrypted by the preset second key is saved in the header of the encrypted file to be saved. The above-mentioned encryption device, further comprising: a first determining module, configured to determine, according to the stored file protection policy, whether to perform encryption processing on the file to be saved, where the file protection policy is a set of conditions that the encrypted file needs to satisfy; When the file to be saved needs to be encrypted, the key generation module is accessed. The above encryption device further includes: a configuration module, configured to configure a file protection policy according to the first user operation instruction and store the file protection policy. The above-mentioned encryption device, wherein the key generation module is further configured to generate a first key for the to-be-save file according to the hardware information of the device, the time information, and/or the attribute information of the file to be saved. The above-mentioned encryption device, wherein the attribute information of the file to be saved includes: directory information to which the file to be saved belongs, file type of the file to be saved, and/or file name of the file to be saved. The above-mentioned encryption device, wherein a key for encrypting the file to be saved is stored in a file header of the file to be saved, and the key generation module is further configured to be from a file header of the file to be saved. Obtaining a key used to encrypt the file to be saved as a first key of the file to be saved. The embodiment of the present invention further provides an apparatus for reading an encrypted file, where the header of the encrypted file stores the first key of the encrypted file, and the reading apparatus includes: an acquiring module, and setting Obtaining, from the header of the encrypted file, a first key of the encrypted encrypted file; the first decrypting module is configured to decrypt the encrypted first key according to the pre-stored second key, Obtaining the decrypted first key; the second decrypting module is configured to decrypt the encrypted file according to the decrypted first key, and obtain the decrypted file for reading. The above-mentioned reading device, further comprising: a second determining module, configured to receive a second user operation instruction, determine whether the second user operation instruction belongs to a preset rejection operation instruction set; and the prompting module is set to be When the second user operation instruction belongs to the preset rejection operation instruction set, a prompt message is issued indicating that the second user operation instruction is not allowed to be executed. A further embodiment of the present invention provides a terminal comprising the apparatus as described above. The beneficial effects of the foregoing technical solutions of the embodiments of the present invention are as follows: The embodiment of the present invention provides a file encryption method, a device, a method, a device, and a terminal for reading an encrypted file, which can automatically complete encryption and decryption of a file without deploying a server. , Supports offline encryption and decryption methods. BRIEF DESCRIPTION OF DRAWINGS FIG. 1 is a schematic flowchart of a file encryption method according to Embodiment 1 of the present invention. FIG. 2 is a schematic flowchart of a method for reading an encrypted file according to Embodiment 1 of the present invention. FIG. 3 is a schematic flowchart of a file encryption method according to Embodiment 2 of the present invention. 4 is a schematic flowchart of a method for reading an encrypted file according to Embodiment 2 of the present invention. FIG. 5 is a schematic flowchart of a file encryption method according to Embodiment 3 of the present invention. FIG. 6 is a schematic structural diagram of a system for realizing automatic encryption and decryption by using the file encryption method and the method for reading an encrypted file provided by the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS In order to make the technical problems, technical solutions, and advantages of the present invention more comprehensible, the following detailed description will be made in conjunction with the accompanying drawings and specific embodiments. The embodiment of the present invention is directed to the prior art, when a file is transparently encrypted and decrypted, a server needs to be deployed, and an offline use problem is not supported, and a file encryption method, a device, a method, a device, and a terminal for reading an encrypted file are provided. It can automatically encrypt and decrypt files without deploying a server, and supports encryption and decryption methods for offline use. The file encryption method provided in Embodiment 1 of the present invention is used to encrypt a file stored on a device. As shown in FIG. 1 , the method includes: Step S100: Generate a first key for a file to be saved; Step S102, Encrypting the first key according to the preset second key; Step S104, performing encryption processing on the file to be saved according to the first key, and encrypting according to the preset second key The first key is saved to the header of the encrypted file to be saved. When the file encrypted by the encryption method is used for reading, the method for reading the encrypted file specifically includes: Step S200: Obtaining the encrypted encrypted file from the file header of the encrypted file a key; step S202, decrypting the encrypted first key according to the pre-stored second key to obtain the decrypted first key; Step S204, according to the decrypted first key pair The encrypted file is decrypted, and the decrypted file is obtained for reading. In the embodiment of the present invention, a file encryption key can be automatically generated for the file to encrypt the file, and the generated file encryption key is re-encrypted according to the preset second key, and the encrypted file is encrypted. The key is stored in the file header of the encrypted file, and when the encrypted file is read, the file is obtained from the header. After the encrypted file encryption key, the encrypted file encryption key can be decrypted according to the pre-stored key, the decrypted file encryption key is obtained, and the file is decrypted according to the decrypted file encryption key. The file to be saved may be a file to be saved after being generated for the first time, or may be a file to be saved after performing a related operation on the previously generated file. The encryption and decryption process of the file is non-perceived and transparent to the user, and does not need to deploy a network server, and can be used offline, thereby achieving the purpose of convenient use and efficient file protection by the user. In the encryption, a symmetric encryption algorithm may be used. When a file is encrypted using a symmetric encryption algorithm, the encryption key at this time is the password of the file is recorded as the first password, and then the password of the file is determined according to the second key. If the encryption is performed using a symmetric encryption algorithm, the second key can be recorded as a second password, and the encrypted first password is stored in the file header; when the file encrypted by the encryption method is read, only The stored second password decrypts the encrypted first password, and after obtaining the first password, the file can be read by decrypting the file. Of course, other encryption algorithms may also be used, such as an asymmetric encryption algorithm. When an asymmetric encryption algorithm is used to encrypt a file using the first encryption key and the second encryption key is used to encrypt the first encryption key, When the file is read, the encrypted first encryption key needs to be decrypted according to the pre-stored second decryption key corresponding to the second encryption key to obtain the first encryption key, and then according to the asymmetric encryption used in the encryption. The algorithm obtains the first decryption key corresponding to the first encryption key to decrypt the file to read the file. The above-mentioned encryption method, wherein the key generation step further generates a first key for the to-be-save file according to the hardware information of the device, the time information, and/or the attribute information of the file to be saved. The first key may be generated according to the hardware information of the device, where the hardware information may be one-to-one corresponding to the device, that is, one device corresponds to one hardware information, and the hardware information of different devices is different, and the hardware information should be difficult to obtain. For example, it may be MAC address information; at the same time, the first key may be generated by combining the time information, that is, the current storage time of the file and the attribute information of the file, so that each file corresponds to a first key, and different The first key of the file is different. The attribute information of the file to be saved includes: directory information to which the file to be saved belongs, file type of the file to be saved, and/or file name of the file to be saved. If the file to be saved has been encrypted before, it is not necessary to regenerate an encryption key for the file to be saved for encrypting the file to be saved, and the previous encryption key can be directly used, that is, one file is originally an encrypted file. After the editing, the data needs to be saved again. When the data is saved again, the previous encryption key can be reused. Therefore, in the above encryption method, the file header of the file to be saved is stored in the file header of the file to be saved. Encrypting the key, the key generating step is: acquiring a key for encrypting the to-be-save file as a first key of the to-be-save file from a file header of the file to be saved . The purpose of the above operation is to obtain a key for encrypting the file to be saved from the file header of the file to be saved, and directly use the key as the first key to encrypt the file to be saved, without generating the first secret. key. The encryption method of the above, wherein the encryption method includes: the first determining step: determining, according to the stored file protection policy, whether the file to be saved is encrypted. The file protection policy is a set of conditions that the encrypted file needs to meet; when the file to be saved needs to be encrypted, the key generation step is entered. The purpose of the above operation is to determine whether to encrypt the saved file by using a pre-stored file protection policy, thereby controlling whether the file needs to be encrypted. The file protection policy is a set of conditions that the encrypted file needs to meet, that is, the file protection policy may include multiple conditions, and if a file satisfies any of the multiple conditions, the file needs to be encrypted, such as the file. The protection policy includes the following conditions: files belonging to directory 1; files with word type and "encrypted" files, if a file belongs to directory 1, the file needs to be encrypted, or a word file. The name is "Measurement Report Data - Encryption" and the file also needs to be encrypted. Of course, file protection policies can take many forms. Only one of them can be listed here. Any other condition that can filter files can be used as a file protection policy. For the pre-stored file protection policy, it should be able to be modified to adapt to different requirements. Therefore, in the above encryption method, the first determining step further includes: configuring the step: according to the first user operation instruction, the configuration file Protect the policy and store it. The purpose of the above operation is to configure the file protection policy according to the user's instructions to adapt to different needs of users. After the encrypted file is read, since the file is an encrypted file, it means that the content of the file cannot be easily leaked. Therefore, when the encrypted file is opened for reading, some operations of the user should be avoided. The content of the file is leaked. Therefore, the reading method, wherein the second decrypting step further comprises: a second determining step: receiving a second user operation instruction, determining whether the second user operation instruction belongs to a preset The refusal operation instruction set; the prompting step: when the second user operation instruction belongs to the preset refusal operation instruction set, issue a prompt message indicating that the second user operation instruction is not allowed to be executed. The purpose of the above operation is to avoid the execution of some operations by monitoring the user's operation instructions. If the encrypted file is opened, the copy, paste, and screenshot operations of the encrypted file should be prohibited. It is not allowed to send the contents of the file to other processes through pipes, networks, shared memory, clipboard, etc. other devices. 3 is a schematic flowchart of a file encryption method according to Embodiment 2 of the present invention. As shown in the figure, the method includes: Step S300: Generate a file key for a file to be encrypted according to device hardware information; Step S302: Perform a file encryption using a file key Encryption; Step S304, encrypting the file key, and saving the encrypted file key to the file header of the encrypted file; Step S306, saving the encrypted file by the file system. 4 is a schematic flowchart of a method for reading an encrypted file according to Embodiment 2 of the present invention. As shown in the figure, the method includes: Step S400: An application reads a file; Step S402, intercepting a file content of the file, to prevent the application directly acquiring The content of the file is displayed; step S404, determining whether the file needs to be decrypted, if yes, proceeding to step S406, otherwise proceeding to step S414; step S406, obtaining the encrypted file key from the file header, decrypting the file key a file key; step S408, decrypting the file by using the file key; step S410, the application presents the obtained decrypted file content; step S412, monitoring an operation instruction of the file, prohibiting performing an unallowed operation on the file Instruction; step S414, the application directly presents the obtained file content. FIG. 5 is a schematic flowchart of a file encryption method according to Embodiment 3 of the present invention. As shown in the figure, the method includes: Step S500: An application saves a file; Step S502, intercepting a file content of the file, to prevent the file system directly acquiring the file content for saving Step S504, determining whether the file needs to be encrypted, if yes, proceeding to step S506, otherwise proceeding to step S516; step S506, determining whether the file is an encrypted file, and if yes, proceeding to step S508, otherwise proceeding to step S510; Obtaining the encrypted file key from the file header, decrypting it, and obtaining the file key; Step S510, generating a file key for the file to be encrypted according to the device hardware information; Step S512, encrypting the file after the file content is written by using the file key; Step S514, encrypting the file key, and encrypting the file file The key is saved to the file header of the encrypted file; in step S516, the file is saved by the file system. The embodiment of the present invention further provides a file encryption device, configured to encrypt a file stored on a device, where the encryption device includes: a key generation module, configured to generate a first key for the file to be saved; The encryption module is configured to perform encryption processing on the first key according to the preset second key; the second encryption module is configured to perform encryption processing on the to-be-stored file according to the first key, The first key encrypted by the preset second key is saved in the header of the encrypted file to be saved. The above-mentioned encryption device, further comprising: a first determining module, configured to determine, according to the stored file protection policy, whether to perform encryption processing on the file to be saved, where the file protection policy is a set of conditions that the encrypted file needs to satisfy; When the file to be saved needs to be encrypted, the key generation module is accessed. The above encryption device further includes: a configuration module, configured to configure a file protection policy according to the first user operation instruction and store the file protection policy. The above-mentioned encryption device, wherein the key generation module is further configured to generate a first key for the to-be-save file according to the hardware information of the device, the time information, and/or the attribute information of the file to be saved. The above-mentioned encryption device, wherein the attribute information of the file to be saved includes: directory information to which the file to be saved belongs, file type of the file to be saved, and/or file name of the file to be saved. The above-mentioned encryption device, wherein a key for encrypting the file to be saved is stored in a file header of the file to be saved, and the key generation module is further configured to be from a file header of the file to be saved. Obtaining a key used to encrypt the file to be saved as a first key of the file to be saved. The present invention also provides an apparatus for reading an encrypted file, wherein a header of the encrypted file is stored in a header of the encrypted file, and the reading apparatus includes: an acquiring module, configured to be Obtaining, by the file header of the encrypted file, the first key of the encrypted encrypted file; the first decrypting module is configured to decrypt the encrypted first key according to the pre-stored second key, to obtain decryption The first decryption module is configured to decrypt the encrypted file according to the decrypted first key, and obtain the decrypted file for reading. The above-mentioned reading device, further comprising: a second determining module, configured to receive a second user operation instruction, determine whether the second user operation instruction belongs to a preset rejection operation instruction set; and the prompting module is set to be When the second user operation instruction belongs to the preset rejection operation instruction set, a prompt message is issued indicating that the second user operation instruction is not allowed to be executed. Embodiments of the present invention also provide a terminal, including the apparatus as described above. 6 is a schematic structural diagram of a system for implementing automatic encryption and decryption by using the file encryption method and the encrypted file reading method provided by the present invention. As shown in the figure, the method includes: a file system 60 configured to manage files in the system, including The file encryption/decryption module 61 is configured to implement the functions of the first encryption module, the second encryption module, the first decryption module, and the second decryption module of the foregoing apparatus, and encrypt and decrypt the content to be encrypted and decrypted according to the key; The key generation module 62 is configured to generate a file key. The configuration module 63 is configured to configure the stored file protection policy. The file filtering driver module 64 is configured to implement the function of the acquiring module of the device, and is used for intercepting the application. The file interaction between the program and the file system can intercept the file data, that is, the module needs to go through the module for reading and saving the file; the application 65 is set to operate on the file stored in the file system, Read, modify, save the file; monitor module 66, set to implement The function of the second judging module and the prompting module of the device monitors the operation instruction issued by the user, prohibits execution of the impermissible operation instruction, and does not allow the clear text content to be sent to other processes through the pipeline, the network, the shared memory, the clipboard, and the like. Or other machines, screen shots are also not allowed. The process of encrypting and decrypting files is based on the underlying driver of the system, running in kernel mode, so the efficiency is very high. The above is a preferred embodiment of the present invention, and it should be noted that those skilled in the art can also make several improvements and retouchings without departing from the principles of the present invention. It should be considered as the scope of protection of the present invention. Industrial applicability The encryption and decryption scheme provided by the embodiment of the invention can automatically complete the encryption and decryption of the file and does not need to deploy the service to support offline use.

Claims

Claim

A file encryption method for encrypting a file stored on a device, the encryption method comprising: a key generation step: generating a first key for a file to be saved;

a first encryption step: performing encryption processing on the first key according to a preset second key; a second encryption step: performing encryption processing on the file to be saved according to the first key, according to a preset The first key encrypted by the second key is saved in the header of the encrypted file to be saved.

The encryption method according to claim 1, further comprising: a first determining step: determining, according to the stored file protection policy, whether to encrypt the file to be saved, the file protection The policy is a set of conditions that the encrypted file needs to satisfy; when the file to be saved needs to be encrypted, the key generation step is entered.

The encryption method according to claim 2, wherein before the first determining step, the method further comprises: configuring the step of: configuring a file protection policy according to the first user operation instruction and storing.

The encryption method according to claim 1, wherein the key generation step includes generating, for the file to be saved, the hardware information, the time information, and/or the attribute information of the file to be saved. The first key.

The encryption method according to claim 4, wherein the attribute information of the file to be saved includes: directory information to which the file to be saved belongs, file type of the file to be saved, and/or the file to be saved The file name.

The encryption method according to claim 1, wherein the file header of the file to be saved stores a key for encrypting the file to be saved, and the key generation step is specifically:

And obtaining, by the file header of the file to be saved, a key used to encrypt the file to be saved as a first key of the file to be saved.

A method for reading an encrypted file, wherein a header of the encrypted file is stored in a header of the encrypted file, and the reading method includes: Obtaining step: obtaining, from a file header of the encrypted file, a first key of the encrypted encrypted file;

a first decrypting step: decrypting the encrypted first key according to the pre-stored second key to obtain the decrypted first key; and second decrypting step: according to the decrypted first key pair The encrypted file is decrypted, and the decrypted file is obtained for reading.

The reading method according to claim 7, wherein the second decrypting step further comprises: a second determining step: receiving a second user operation instruction, determining whether the second user operation instruction belongs to a preset Reject the instruction set;

Prompting step: When the second user operation instruction belongs to a preset set of reject operation instructions, a prompt message is issued indicating that the second user operation instruction is not allowed to be executed.

A file encryption device, configured to encrypt a file stored on a device, the encryption device comprising: a key generation module configured to generate a first key for a file to be saved; and a first encryption module configured to Encrypting the first key according to the preset second key; the second encryption module is configured to perform encryption processing on the file to be saved according to the first key, and according to the preset second The first key after the key is encrypted is saved in the header of the encrypted file to be saved.

The encryption device according to claim 9, further comprising: a first determining module, configured to determine, according to the stored file protection policy, whether to perform encryption processing on the file to be saved, where the file protection policy is required for encrypting the file a set of satisfied conditions; when the file to be saved needs to be encrypted, the key generation module is entered.

11. The encryption device of claim 10, further comprising: a configuration module configured to configure a file protection policy and store according to the first user operation instruction.

The encryption device according to claim 9, wherein the key generation module is configured to be the file to be saved according to hardware information of the device, time information, and/or attribute information of the file to be saved. Generate the first key.

The encryption device according to claim 12, wherein the attribute information of the file to be saved includes: directory information to which the file to be saved belongs, file type of the file to be saved, and/or the file to be saved The file name.

The encryption device according to claim 9, wherein a file for encrypting the file to be saved is stored in a file header of the file to be saved, and the key generation module is configured to be from the A key used to encrypt the file to be saved is obtained as a first key of the file to be saved.

An apparatus for reading an encrypted file, wherein a header of the encrypted file is stored in a header of the encrypted file, the reading apparatus comprising: an acquiring module, configured to be encrypted from the Obtaining a first key of the encrypted encrypted file in a file header of the file; the first decrypting module is configured to decrypt the encrypted first key according to the pre-stored second key, to obtain the decrypted first a second decryption module is configured to decrypt the encrypted file according to the decrypted first key, and obtain the decrypted file for reading.

The reading device according to claim 15, further comprising: a second determining module, configured to receive a second user operation instruction, and determine whether the second user operation instruction belongs to a preset set of reject operation instructions;

The prompting module is configured to issue a prompt message when the second user operation instruction belongs to the preset set of the reject operation instruction, indicating that the second user operation instruction is not allowed to be executed.

17. A terminal comprising the apparatus of any of claims 9-16.