WO2023226308A1 - 一种文件共享方法、系统、电子设备及可读存储介质 - Google Patents

一种文件共享方法、系统、电子设备及可读存储介质 Download PDF

Info

Publication number
WO2023226308A1
WO2023226308A1 PCT/CN2022/130386 CN2022130386W WO2023226308A1 WO 2023226308 A1 WO2023226308 A1 WO 2023226308A1 CN 2022130386 W CN2022130386 W CN 2022130386W WO 2023226308 A1 WO2023226308 A1 WO 2023226308A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
file
ciphertext
dynamic
public
Prior art date
Application number
PCT/CN2022/130386
Other languages
English (en)
French (fr)
Inventor
麻付强
徐峥
Original Assignee
苏州元脑智能科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 苏州元脑智能科技有限公司 filed Critical 苏州元脑智能科技有限公司
Publication of WO2023226308A1 publication Critical patent/WO2023226308A1/zh

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/045Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network arrangements or protocols for supporting network services or applications
    • H04L67/01Protocols
    • H04L67/06Protocols specially adapted for file transfer, e.g. file transfer protocol [FTP]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H04L9/16Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms the keys or algorithms being changed during operation
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • This application relates to the field of computer technology, and in particular to a file sharing method, system, equipment and non-volatile readable storage medium.
  • the purpose of this application is to provide a file sharing method, system, electronic device and readable storage medium to improve the security of key data and the data itself in the data sharing solution.
  • the specific plan is as follows:
  • this application provides a file sharing method, which is applied to the file owner, including:
  • determine the first dynamic key corresponding to the target file including:
  • determine the first dynamic key corresponding to the target file according to the type including:
  • the first dynamic key of the file of the same type as the target file in the historical upload information is determined as The first dynamic key corresponding to the target file. If different first dynamic keys are used for files of the same type, the first dynamic key corresponding to the target file is calculated based on the random number.
  • determine the first dynamic key corresponding to the target file including:
  • the first dynamic key corresponding to the target file is calculated based on the random number.
  • send an update request for shared information to the cloud sharing end including:
  • use the first private key to sign the first dynamic key, the first public key, the key ciphertext, and the file ciphertext to obtain signature information including:
  • this application provides a file sharing method, including:
  • the file access end generates a second dynamic key, generates a second public key based on the second dynamic key and its own two pairs of public and private keys, and sends an access request for the target file to the cloud sharing end;
  • the cloud sharing terminal queries the shared information of the target file based on the access request.
  • the shared information includes: the first dynamic key, the first public key, the key ciphertext, the file ciphertext and the signature information; the first dynamic key and the first public key are The key and the second public key in the access request are sent to the file owner; the shared information is obtained based on the method of claim 1;
  • the file owner generates the first public key based on the first dynamic key and its own two pairs of public and private keys. If the first public key sent by the cloud sharing terminal is equal to the first public key generated by itself, then the file owner generates the first public key based on the first dynamic key and its own two pairs of public and private keys.
  • the dual private key generates a first private key, generates a re-encryption key based on the first private key and the second public key, and sends the re-encryption key to the cloud sharing end;
  • the cloud sharing end uses the re-encryption key to re-encrypt the key ciphertext to obtain the key re-encryption cipher text, the key re-encryption cipher text, the first public key, the first dynamic key, the key cipher text, the file cipher text and
  • the signature information is sent to the file access terminal;
  • the file access end uses the first public key to verify the signature information and obtains the target result. If the target result is consistent with the first dynamic key, the first public key, the key ciphertext and the file ciphertext sent by the cloud sharing end, it uses the second
  • the dynamic key and its own double private key calculate the second private key, use the second private key to decrypt the key and re-encrypt the ciphertext to obtain the symmetric key, and use the symmetric key to decrypt the file ciphertext to obtain the plaintext of the target file.
  • the cloud sharing end queries the sharing information of the target file based on the access request, it also includes:
  • the cloud sharing end verifies the legality of the file access end; if the file access end is legal, the cloud sharing end queries the sharing information of the target file based on the access request; if the file access end is legal, the cloud sharing end returns a notification message that the access is illegal to the file access end. .
  • the file owner and/or file access terminal queries the file ciphertext stored in the cloud sharing terminal based on ciphertext search technology.
  • this application provides a file sharing method, applied to the file owner, including:
  • the shared information includes: the first dynamic key, the first public key, the key ciphertext, the file ciphertext and the signature information; the shared information is obtained by any of the above methods;
  • the first private key is generated based on the first dynamic key and the double private key of the file owner;
  • this application provides a file sharing system, including: the above file owning end, the cloud sharing end and the file access end.
  • the file owning end also performs other methods mentioned above.
  • the file sharing system also includes a key generation center for providing public and private key pairs and parameters for encryption and decryption to the file owner and the file accesser.
  • this application provides an electronic device, including:
  • Memory used to store computer programs
  • a processor is used to execute a computer program to implement the aforementioned disclosed file sharing method.
  • the present application provides a non-volatile readable storage medium for storing a computer program, wherein when the computer program is executed by a processor, the aforementioned disclosed file sharing method is implemented.
  • this application provides a file sharing method, which is applied to the file owner, including: obtaining the target file to be shared, and determining the first dynamic key corresponding to the target file; based on the first dynamic key and the file
  • the dual private key on the owning end generates the first private key; selects the unpaired public key and private key from the two pairs of public and private keys on the file owning end, and generates the first public key based on the first dynamic key, the selected public key and private key ;Use the first public key to encrypt the randomly selected symmetric key to obtain the key ciphertext;Use the symmetric key to encrypt the target file to obtain the file ciphertext;Use the first private key to encrypt the first dynamic key and the first public key.
  • the key, key ciphertext, and file ciphertext are signed to obtain the signature information; the first dynamic key, the first public key, the key ciphertext, the file ciphertext, and the signature information are uploaded to the cloud sharing terminal as shared information to Share target files.
  • this application sets two pairs of public and private keys for the file owner, and the dual private keys do not directly encrypt the file. Instead, after generating the first private key based on the dual private keys, the first public key is used to encrypt the file. Symmetric keys for encrypting files, thus reducing the risk of the file owner's dual private keys being compromised.
  • this solution can dynamically change the first dynamic key, first private key, and first public key corresponding to different files, which not only prevents private data such as encryption keys from not being updated for a long time, but also reduces the risk of such private data and To reduce the risk of leakage of shared data, it can also encrypt different files in a fine-grained manner, set different access permissions for different files, and improve the security of shared files.
  • the file sharing system, device and non-volatile readable storage medium provided by this application also have the above technical effects.
  • Figure 1 is a flow chart of a file sharing method disclosed in this application.
  • FIG. 2 is a flow chart of another file sharing method disclosed in this application.
  • Figure 3 is a schematic diagram of a file sharing system disclosed in this application.
  • FIG. 4 is a schematic diagram of shared information generation disclosed in this application.
  • Figure 5 is a schematic diagram of a kind of shared information disclosed in this application being accessed by the data owner;
  • Figure 6 is a schematic diagram of a kind of shared information disclosed in this application being updated by the data owner;
  • Figure 7 is a schematic diagram of a shared information disclosed in this application being accessed by a data user and generating a proxy re-encryption key
  • Figure 8 is a schematic diagram comparing the re-encrypted shared information and the original shared information disclosed in this application;
  • Figure 9 is a structural block diagram of a file sharing system disclosed in this application.
  • Figure 10 is a structural block diagram of an electronic device disclosed in this application.
  • this application provides a file sharing solution that can dynamically change the key data corresponding to different files and improve the security of the key data and the data itself in the data sharing solution.
  • an embodiment of the present application discloses a file sharing method, which is applied to the file owner and includes:
  • the target file can be generated by the file owner, or it can be a file obtained or received by the file owner from elsewhere.
  • the data in the file can be messages, strings, packets, documents, codes, etc.
  • files can be classified according to file format or file importance, and then the first dynamic key corresponding to the file is determined according to the classified file type, so that the same first dynamic key can be used for files of the same type. .
  • the uploaded file type and the first dynamic key used can be recorded in the historical upload information for subsequent query.
  • determining the first dynamic key corresponding to the target file includes: determining the type of the target file, and determining the first dynamic key corresponding to the target file according to the type; the type is determined according to the file format or file importance. Classification.
  • determining the first dynamic key corresponding to the target file according to the type includes: if the same first dynamic key is used for files of the same type, when there is a file of the same type as the target file in the historical upload information, the historical upload information The first dynamic key of the file of the same type as the target file in the information is determined as the first dynamic key corresponding to the target file. If a different first dynamic key is used for the same type of file, the first dynamic key corresponding to the target file is calculated based on the random number. A dynamic key.
  • the file importance can be defined by the file owner. For example: If the document owner's e-commerce system involves documents such as payment and checkout, they can be set to an important level, while documents such as product introductions can be set to a secondary level, and so on. Of course, the file importance can also be simply set as: high, medium, or low. The file owner tags each of his files with corresponding labels of high, medium, and low, and the files can be classified according to the labels later.
  • determining the first dynamic key corresponding to the target file includes: if different first dynamic keys are used for different files, calculating the first dynamic key corresponding to the target file based on random numbers.
  • the first dynamic key R 1 r 1 G
  • r 1 is a random number
  • G is the basis of the elliptic curve
  • G ⁇ G 1 is the elliptic curve additive cyclic group of order p.
  • S103 Select an unpaired public key and a private key from the two pairs of public and private keys on the file owner, and generate a first public key based on the first dynamic key, the selected public key and the private key.
  • execution order of S102 and S103 can be interchanged, and the interchange will not affect the implementation of this embodiment.
  • the first private key is used to sign the first dynamic key, the first public key, the key ciphertext, and the file ciphertext to obtain the signature information, which includes: splicing the first dynamic key, The first public key, key ciphertext and file ciphertext are concatenated to obtain a splicing result; the splicing result is converted into a hash string; the hash string is signed using the first private key to obtain the signature information.
  • the file owner can also change the shared information of the target file on the cloud sharing side at any time to change the access key of the target file, thereby changing the access permissions of the target file. Therefore, in a specific implementation, a deletion request for shared information is sent to the cloud sharing end so that the cloud sharing end deletes the shared information, and then the file owner generates new sharing information for the target file and uploads the new sharing information to the cloud sharing end. end to change the sharing information of the target file.
  • the file owner can also generate new sharing information for the target file independently without sending a deletion request, and directly upload the new sharing information to the cloud sharing end, and then the cloud sharing end can update the sharing information of the target file based on the new sharing information.
  • sending an update request for shared information to the cloud sharing terminal includes: sending an update for updating the first dynamic key, the first public key, the key ciphertext, the file ciphertext or the signature information. Request to cloud share. It can be seen that any information in the shared information can be updated, thus ensuring file security.
  • this embodiment sets two pairs of public and private keys for the file owner, and the dual private keys do not directly encrypt the file. Instead, after generating the first private key based on the dual private keys, the first public key is used to encrypt the file. It is a symmetric key used to encrypt files, thus reducing the risk of the file owner’s dual private keys being leaked.
  • this solution can dynamically change the first dynamic key, first private key, and first public key corresponding to different files, which not only prevents private data such as encryption keys from not being updated for a long time, but also reduces the risk of such private data and To reduce the risk of leakage of shared data, it can also encrypt different files in a fine-grained manner, set different access permissions for different files, and improve the security of shared files.
  • the embodiment of the present application discloses another file sharing method, which is executed after the file ciphertext is uploaded to the cloud sharing terminal, that is, the steps shown in FIG. 2 are executed after the steps shown in FIG. 1 are executed.
  • the method provided by this embodiment includes:
  • the file access terminal generates a second dynamic key, generates a second public key based on the second dynamic key and its own two pairs of public and private keys, and sends an access request for the target file to the cloud sharing terminal.
  • the cloud sharing terminal queries the shared information of the target file based on the access request.
  • the shared information includes: the first dynamic key, the first public key, the key ciphertext, the file ciphertext and the signature information; combine the first dynamic key and the third A public key and a second public key in the access request are sent to the file owner; the shared information is obtained by the method executed by the file owner.
  • the file owner generates a first public key based on the first dynamic key and its own two pairs of public and private keys. If the first public key sent by the cloud sharing terminal is equal to the first public key generated by itself, then the file owner generates a first public key based on the first dynamic key. Generate a first private key with its own double private key, generate a re-encryption key based on the first private key and the second public key, and send the re-encryption key to the cloud sharing end.
  • the cloud sharing terminal uses the re-encryption key to re-encrypt the key ciphertext to obtain the key re-encryption cipher text, and re-encrypts the key cipher text, the first public key, the first dynamic key, the key cipher text, and the file encryption key.
  • the document and signature information are sent to the file access terminal.
  • the file access terminal uses the first public key to verify the signature information and obtains the target result. If the target result is consistent with the first dynamic key, the first public key, the key ciphertext and the file ciphertext sent by the cloud sharing terminal, then use The second dynamic key and its own double private key calculate the second private key, use the second private key to decrypt the key and re-encrypt the ciphertext to obtain the symmetric key, and use the symmetric key to decrypt the file ciphertext to obtain the plaintext of the target file.
  • the file access end uses the first public key to verify the signature information
  • the target result obtained includes: the hash value of the first dynamic key, the first public key, the key ciphertext and the file ciphertext, so comparing the target results
  • the hash value of the first dynamic key, the first public key, the key ciphertext, and the file ciphertext is the same as the hash value of the first public key, the first dynamic key, the key ciphertext, and the file ciphertext sent by the cloud sharing terminal. If the hash values are consistent, it is determined that the target result is consistent with the signature information, and the signature verification is passed; if they are inconsistent, the signature verification is deemed to have failed.
  • the cloud sharing terminal before the cloud sharing terminal queries the shared information of the target file based on the access request, it also includes: the cloud sharing terminal verifies the legality of the file accessing terminal; if the file accessing terminal is legal, the cloud sharing terminal queries the target based on the access request. Sharing information of the file; if the file access end is illegal, the cloud sharing end returns a notification message of illegal access to the file access end.
  • the cloud sharing end verifies the legality of the file access end, and can verify whether the file access end is a legal user of the cloud sharing end, such as verifying the account number, password and other information used by the file access end.
  • the method further includes: the file owner and/or the file access terminal queries the file ciphertext stored in the cloud sharing terminal based on the ciphertext search technology. That is to say: when the file owner or file accesser wants to query a certain file on the cloud sharing terminal, it first encrypts the keywords of the file, and then performs the query based on the encrypted ciphertext. It can be seen that the cloud sharing end can only see the cipher text of the file but not the plain text of the file, thus reducing the risk of the file itself being leaked by the cloud sharing end.
  • the file access terminal can access the files in the cloud sharing terminal.
  • This process uses heavy encryption technology to further ensure the security of the files.
  • the key generation center sets a bilinear mapping e:G 1 ⁇ G 1 ⁇ G T , G 1 is an elliptic curve additive cyclic group of order p, and G T is a multiplicative cyclic group of order p.
  • H ⁇ 0,1 ⁇ * ⁇ Z q , Z q is an integer cyclic group of order q.
  • the data owner uses the key generation center to obtain its own two pairs of asymmetric public and private keys (a, A) and (b, B), where a and b are private keys and A and B are public keys.
  • Dynamic encryption public key P 11 H(R 1 *a)*G+B, P 11 is the first public key.
  • the dynamic encryption private key P 12 H(a*R 1 )+b, P 12 is the first private key.
  • Use P 11 to encrypt the symmetric key k to obtain the first level ciphertext C 1 (rP 11 ,kZ r ), r ⁇ Z q , and C 1 is the key ciphertext.
  • Use k to encrypt file m to obtain the file ciphertext C Enc k (m), where Enc represents an encryption algorithm.
  • Enc represents an encryption algorithm.
  • Randomly select r 2 ⁇ Z q , then the second dynamic key R 2 r 2 G.
  • Dynamic encryption public key P 21 H(R 2 *c)*G+D, P 21 is the second public key.
  • the dynamic encryption private key P 22 H(c*R 2 )+d, P 22 is the second private key.
  • the random number r 2 can be deleted to ensure the security of the dynamic key and dynamic encryption public key.
  • the data user requests the cloud service provider to access the shared information, and the request parameters include P 21 .
  • the cloud service provider initially determines the user's legitimacy, and then sends R 1 and P 11 in the shared information, as well as P 21 in the request parameters, to the data owner as a sharing request.
  • the data owner After receiving the sharing request, the data owner uses R 1 and its own two pairs of public and private keys to calculate P 11 and P 12 .
  • the service provider uses the re-encryption key to re-encrypt the first-level ciphertext in the shared information to obtain the second-level ciphertext.
  • C 2 is the key re-encrypted ciphertext.
  • the service provider sends ⁇ C 2 , P 11 , R 1 , C 1 , C, ⁇ to the data user.
  • the cloud service provider performs re-encryption and plays the role of ciphertext conversion. It can convert the ciphertext encrypted by the data owner's public key into the same plaintext encrypted by the data user's public key. Then the data user can Decrypts the converted ciphertext using its own private key.
  • the cloud service provider has a re-encryption key authorized by the data owner for the data user, and the cloud service provider cannot obtain any information about the plaintext.
  • Use P 11 to verify ⁇ to obtain the target result. If ⁇ P 11 , R 1 , C 1 , C ⁇ in the target result is consistent with ⁇ P 11 , R 1 , C 1 , C ⁇ sent by the service provider, use R 2 , c, d calculate P 22 , use P 22 to decrypt C 2 , and obtain the symmetric key Use k to decrypt C to obtain the file plaintext m Dec k (C), where Dec represents a decryption algorithm.
  • the data owner encrypts the data before uploading the data.
  • the file access terminal can access the files in the cloud sharing terminal. This process uses heavy encryption technology to further ensure the security of the files. safety.
  • a file sharing system provided by an embodiment of the present application is introduced below.
  • the file sharing system described below and the file sharing method described above may be referred to each other.
  • an embodiment of the present application discloses a file sharing system, including: the above file owning end 901, a cloud sharing end 902 and a file access end 903.
  • the file owning end 901 also executes the method in Figure 1 and other available The method of its execution.
  • the file sharing system also includes a key generation center, which is used to provide public and private key pairs and parameters for encryption and decryption to the file owner and the file accesser.
  • a key generation center which is used to provide public and private key pairs and parameters for encryption and decryption to the file owner and the file accesser.
  • the file owner 901 is specifically configured to: determine the type of the target file, and determine the first dynamic key corresponding to the target file according to the type; classify the type according to the file format or file importance.
  • the file owner 901 is specifically configured to: if the same first dynamic key is used for files of the same type, when there is a file of the same type as the target file in the historical upload information, the historical upload information The first dynamic key of the file with the same type as the target file is determined as the first dynamic key corresponding to the target file. If the same first dynamic key is used for the same type of file, the first dynamic key corresponding to the target file is calculated based on the random number. Dynamic key.
  • the file owner 901 is specifically configured to: if different first dynamic keys are used for different files, calculate the first dynamic key corresponding to the target file based on a random number.
  • the file owning end 901 is specifically used to: send a deletion request of shared information to the cloud sharing end, so that the cloud sharing end deletes the shared information; generate new shared information for the target file, and upload the new shared information Go to the cloud sharing end to change the sharing information of the target file.
  • the cloud sharing terminal 901 before the cloud sharing terminal 901 queries the shared information of the target file based on the access request, the cloud sharing terminal verifies the legality of the file accessing terminal; if the file accessing terminal is legal, the cloud sharing terminal queries the target file based on the access request. Sharing information; otherwise, the cloud sharing end returns an illegal access notification message to the file access end.
  • the file owning end 901 and/or the file accessing end 903 queries the file ciphertext stored in the cloud sharing end based on ciphertext search technology.
  • this embodiment provides a file sharing system that can dynamically change the key data corresponding to different files, thereby improving the security of the key data and the data itself in the data sharing solution.
  • the embodiment of the present application discloses a file sharing method applied to the file owner, including: downloading shared information from the cloud sharing end; the shared information includes: a first dynamic key, a first public key, a key ciphertext, and a file ciphertext. and signature information; the shared information is obtained based on the method shown in Figure 1. After the signature information is verified based on the first public key, the first private key is generated based on the first dynamic key and the dual private key of the file owner. Use the first private key to decrypt the key ciphertext to obtain the symmetric key. Use the symmetric key to decrypt the file ciphertext to obtain the plaintext of the target file.
  • the following embodiment provides a dynamic key-based proxy re-encryption system.
  • a dynamic key is used to encrypt the shared file, and the user's private key is not directly involved in the encryption, thus ensuring the security of the user's private key.
  • this embodiment uses a separate key to encrypt each shared file, realizing a fine-grained decryption right assignment function, and can also realize the conversion of decryption rights through proxy re-encryption technology.
  • the sharing system based on proxy re-encryption can realize the assignment of decryption rights while maintaining data confidentiality.
  • data owners usually only share a certain part of their documents with partners, rather than all cloud data. For example: sharing management-related data with the logistics department, sharing product information data with sales partners, etc., instead of sharing all data with every user.
  • this embodiment adopts a separate key for a file to achieve assigned sharing of files instead of sharing all of one's files with a certain partner.
  • the system provided by this embodiment includes a data owner, a cloud service provider, and a key generation center. Among them, data owners and data users are connected to the cloud service provider and key generation center through interfaces respectively.
  • the key generation center generates asymmetric public and private key pairs for data owners and data users.
  • the data owner is responsible for the preparation and generation of shared files, and uses the key generation center to obtain its own two pairs of asymmetric public and private keys (a, A) and (b, B).
  • the two private keys a and b are always kept secret by the data owner. Saved and not directly involved in encryption operations.
  • the data owner uses random number r 1 to generate R 1 .
  • Use R 1 and the unpaired public and private key to generate the dynamic encryption public key P 11 and use R 1 and the double private key to generate the dynamic encryption private key P 12 .
  • P 12 is calculated from two private keys, achieving the security of dynamic private keys. Delete the random number r 1 to ensure the security of R 1 and P 11 .
  • the data owner generates a symmetric key k, encrypts the shared file, and obtains the encrypted shared file (i.e., file ciphertext).
  • Use P 11 to encrypt the symmetric encryption key to obtain the first layer of encrypted ciphertext.
  • Use P 12 to calculate the signature information. This process uses a dynamic encryption public key for encryption.
  • the two pairs of public and private keys do not directly participate in the encryption operation, which reduces the possibility of key leakage and improves the security of the key.
  • the signature information is obtained by signing P 12 , so sharing P 11 allows each end to verify the signature information.
  • Data owners can generate any number of dynamic keys based on their own public and private key pairs at different times. Data owners use different dynamic keys to encrypt different shared files, achieving fine-grained encryption functions. At the same time, in order to classify shared files of the same type, the same dynamic key can be used to encrypt shared files of the same type. Files can be classified according to their importance levels, such as: general, medium, and important; they can also be classified according to the file generation time.
  • the data owner downloads the shared information ⁇ R 1 , P 11 , C 1 , C, ⁇ from the cloud service provider, and then calculates the dynamic encryption public key P 11 and the dynamic encryption private key P 12 .
  • data owners can also update shared information.
  • the data owner uses the random number r 3 to generate the third dynamic key R 3 .
  • the third public key P 31 is generated using R 3 and the unpaired public and private keys.
  • the cloud service provider keeps C unchanged and replaces other information.
  • the data owner updates the dynamic key to achieve secure storage of shared files when the dynamic key is leaked. Because the dynamic key is changed, the re-encryption key is also changed, and the access permissions of the original shared file are updated. .
  • the data user uses the key generation center to obtain its own two pairs of asymmetric public and private keys (c, C) and (d, D), where c and d are private keys and C and D are public keys.
  • C cG, c ⁇ Z q
  • D dG, d ⁇ Z q .
  • Randomly select r 2 ⁇ Z q , then the second dynamic key R 2 r 2 G.
  • Dynamic encryption public key P 21 H(R 2 *c)*G+D, P 21 is the second public key.
  • the dynamic encryption private key P 22 H(c*R 2 )+d, P 22 is the second private key.
  • the random number r 2 can be deleted to ensure the security of the dynamic key and dynamic encryption public key.
  • the data user requests the cloud service provider to access the shared information, and the request parameters include P 21 .
  • the cloud service provider initially determines the user's legitimacy, and then sends R 1 and P 11 in the shared information, as well as P 21 in the request parameters, to the data owner as a sharing request.
  • Cloud service providers are used for storage of encrypted data and proxy re-encryption execution.
  • the cloud storage service system provided by the cloud service provider stores the shared information uploaded by the data owner and accepts the data owner's request to access their own data.
  • the data owner also receives the sharing request from the data user from the cloud service provider, generates a re-encryption key, and uploads the re-encryption key to the cloud service provider.
  • the service provider obtains the re-encryption key uploaded by the data owner. As shown in Figure 7, the service provider uses the re-encryption key to re-encrypt the data owner's shared information, obtains the re-encrypted shared information, and sends the re-encrypted shared information to the data user.
  • the service provider After the service provider obtains the re-encryption key sent by the data owner, it uses the re-encryption key to re-encrypt the first-level ciphertext in the shared information to obtain the second-level ciphertext C 2 .
  • the service provider sends ⁇ C 2 , P 11 , R 1 , C 1 , C, ⁇ to the data user.
  • Use R 2 , c, d to calculate P 22 , use P 22 to decrypt C 2 to obtain the symmetric key, use k to decrypt C to obtain the file plaintext m Deck k (C), Dec represents a decryption algorithm.
  • the shared information sent by the data owner to the cloud contains more re-encryption key ciphertext and second dynamic key than the shared information sent by the cloud to the data user for decrypting the file.
  • the key ciphertext is obtained by re-encrypting the first level ciphertext in the shared information with the re-encryption key.
  • this embodiment uses a dynamic key to encrypt shared files.
  • the user's private key does not directly participate in file encryption, ensuring the security of the user's private key.
  • this embodiment uses a separate key to encrypt each shared file. , realizing fine-grained decryption right assignment and encryption.
  • the same dynamic key can be used to encrypt shared files of the same type.
  • the data owner updates the dynamic key, which enables safe storage of shared files when the dynamic key is leaked, and can dynamically cancel access permissions to shared files.
  • An electronic device provided by an embodiment of the present application is introduced below.
  • the electronic device described below and the file sharing method and system described above may be mutually referenced.
  • an electronic device including:
  • Memory 1001 used to store computer programs
  • the processor 1002 is used to execute computer programs to implement the methods disclosed in any of the above embodiments.
  • non-volatile readable storage medium described below and the file sharing method, system and device described above can be referred to each other. .
  • RAM random access memory
  • ROM read-only memory
  • electrically programmable ROM electrically erasable programmable ROM
  • registers hard disks, removable disks, CD-ROMs, or anywhere in the field of technology. any other known form of readable storage medium.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本申请公开了计算机技术领域内的一种文件共享方法、系统、电子设备及可读存储介质。本申请为文件拥有端设定了两对公私钥,且其中的双私钥并不直接加密文件,而是根据双私钥生成第一私钥后,利用此第一公钥加密用于加密文件的对称密钥,因此可降低文件拥有端私钥被泄露的风险。同时,该方案可使不同文件对应的第一动态密钥、第一私钥、第一公钥动态变化,不仅避免了加密密钥等隐私数据的长久不更新,还可以降低此类隐私数据以及共享数据的泄露风险,还能够细粒度加密不同文件,为不同文件设定不同的访问权限,提高共享文件的安全性。相应地,本申请提供的一种文件共享系统、设备及非易失性可读存储介质,也同样具有上述技术效果。

Description

一种文件共享方法、系统、电子设备及可读存储介质
相关申请的交叉引用
本申请要求于2022年05月27日提交中国专利局,申请号为202210583975.6,申请名称为“一种文件共享方法、系统、设备及可读存储介质”的中国专利申请的优先权,其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域,特别涉及一种文件共享方法、系统、设备及非易失性可读存储介质。
背景技术
现有数据共享方案一般是:数据拥有者使用自身私钥加密数据,而数据访问者使用数据拥有者的私钥对应的公钥解密数据。该过程不仅需要共享数据拥有者的公钥,还需要使用数据拥有者的私钥加密数据,不能保证数据拥有者私钥的安全。并且,各文件都用数据拥有者的私钥加密,可能因该私钥长久不更新而导致数据泄露。
发明内容
有鉴于此,本申请的目的在于提供一种文件共享方法、系统、电子设备及可读存储介质,以提高数据共享方案中密钥类数据以及数据本身的安全性。其具体方案如下:
第一方面,本申请提供了一种文件共享方法,应用于文件拥有端,包括:
获取待共享的目标文件,并确定目标文件对应的第一动态密钥;
基于第一动态密钥和文件拥有端的双私钥生成第一私钥;
从文件拥有端的两对公私钥中选择不成对的公钥和私钥,并基于第一动态密钥、所选公钥和私钥生成第一公钥;
利用第一公钥对随机选择的对称密钥进行加密,得到密钥密文;
利用对称密钥加密目标文件,得到文件密文;
利用第一私钥对第一动态密钥、第一公钥、密钥密文、文件密文进行签名,得到签名信息;
将第一动态密钥、第一公钥、密钥密文、文件密文及签名信息作为共享信息上传至云共享端,以共享目标文件。
可选地,确定目标文件对应的第一动态密钥,包括:
确定目标文件的类型,并按照类型确定目标文件对应的第一动态密钥;类型按照文件格式或文件重要程度进行分类。
可选地,按照类型确定目标文件对应的第一动态密钥,包括:
若针对相同类型的文件采用同一第一动态密钥,则在历史上传信息中存在与目标文件类型相同的文件时,将历史上传信息中与目标文件类型相同的文件的第一动态密钥确定为目标文件对应的第一动态密钥,若针对相同类型的文件采用不同第一动态密钥,基于随机数计算目标文件对应的第一动态密钥。
可选地,确定目标文件对应的第一动态密钥,包括:
若针对不同文件采用不同第一动态密钥,则基于随机数计算目标文件对应的第一动态密钥。
可选地,还包括:
发送共享信息的更新请求至云共享端,以使云共享端使用更新请求中目标文件的新共享信息更新共享信息。
可选地,发送共享信息的更新请求至云共享端,包括:
发送用于更新第一动态密钥、第一公钥、密钥密文、文件密文或签名信息的更新请求至云共享端。
可选地,利用第一私钥对第一动态密钥、第一公钥、密钥密文、文件密文进行签名,得到签名信息,包括:
拼接第一动态密钥、第一公钥、密钥密文和文件密文,得到拼接结果;
将拼接结果转换为哈希字符串;
利用第一私钥对哈希字符串进行签名,得到签名信息。
第二方面,本申请提供了一种文件共享方法,包括:
文件访问端生成第二动态密钥,基于第二动态密钥和自身两对公私钥生成第二公钥,发送目标文件的访问请求至云共享端;
云共享端基于访问请求查询目标文件的共享信息,共享信息包括:第一动态密钥、第一公钥、密钥密文、文件密文及签名信息;将第一动态密钥及第一公钥、访问请求中的第二公钥发送至文件拥有端;共享信息基于权利要求1的方法获得;
文件拥有端基于第一动态密钥和自身两对公私钥生成第一公钥,若云共享端发送的第一公钥和自身生成的第一公钥相等,则基于第一动态密钥和自身双私钥生成第一私钥,基于第 一私钥和第二公钥生成重加密密钥,将重加密密钥发送至云共享端;
云共享端利用重加密密钥重加密密钥密文得到密钥重加密密文,将密钥重加密密文、第一公钥、第一动态密钥、密钥密文、文件密文及签名信息发送至文件访问端;
文件访问端利用第一公钥验证签名信息,得到目标结果,若目标结果与云共享端发送的第一动态密钥、第一公钥、密钥密文及文件密文一致,则利用第二动态密钥和自身双私钥计算第二私钥,利用第二私钥解密密钥重加密密文得到对称密钥,利用对称密钥对文件密文进行解密,得到目标文件的明文。
可选地,云共享端基于访问请求查询目标文件的共享信息之前,还包括:
云共享端验证文件访问端的合法性;若文件访问端合法,则云共享端基于访问请求查询目标文件的共享信息;若文件访问端合法,云共享端向文件访问端返回访问不合法的通知消息。
可选地,还包括:
文件拥有端和/或文件访问端基于密文搜索技术查询云共享端中存储的文件密文。
第三方面,本申请提供了一种文件共享方法,应用于文件拥有端,包括:
从云共享端下载共享信息;共享信息包括:第一动态密钥、第一公钥、密钥密文、文件密文及签名信息;共享信息上述任一项的方法获得;
基于第一公钥验证签名信息通过后,基于第一动态密钥和文件拥有端的双私钥生成第一私钥;
利用第一私钥解密密钥密文得到对称密钥;
利用对称密钥解密文件密文得到目标文件的明文。
第四方面,本申请提供了一种文件共享系统,包括:如上的文件拥有端、云共享端及文件访问端,文件拥有端还执行上述其他项的方法。
可选地,文件共享系统还包括密钥生成中心,用于为文件拥有端和文件访问端提供公私钥对以及用于加解密的参数。
第五方面,本申请提供了一种电子设备,包括:
存储器,用于存储计算机程序;
处理器,用于执行计算机程序,以实现前述公开的文件共享方法。
第六方面,本申请提供了一种非易失性可读存储介质,用于保存计算机程序,其中,计算机程序被处理器执行时实现前述公开的文件共享方法。
通过以上方案可知,本申请提供了一种文件共享方法,应用于文件拥有端,包括:获取 待共享的目标文件,并确定目标文件对应的第一动态密钥;基于第一动态密钥和文件拥有端的双私钥生成第一私钥;从文件拥有端的两对公私钥中选择不成对的公钥和私钥,并基于第一动态密钥、所选公钥和私钥生成第一公钥;利用第一公钥对随机选择的对称密钥进行加密,得到密钥密文;利用对称密钥加密目标文件,得到文件密文;利用第一私钥对第一动态密钥、第一公钥、密钥密文、文件密文进行签名,得到签名信息;将第一动态密钥、第一公钥、密钥密文、文件密文及签名信息作为共享信息上传至云共享端,以共享目标文件。
可见,本申请为文件拥有端设定了两对公私钥,且其中的双私钥并不直接加密文件,而是根据双私钥生成第一私钥后,利用此第一公钥加密用于加密文件的对称密钥,因此可降低文件拥有端的双私钥被泄露的风险。同时,该方案可使不同文件对应的第一动态密钥、第一私钥、第一公钥动态变化,不仅避免了加密密钥等隐私数据的长久不更新,还可以降低此类隐私数据以及共享数据的泄露风险,还能够细粒度加密不同文件,为不同文件设定不同的访问权限,提高共享文件的安全性。
相应地,本申请提供的一种文件共享系统、设备及非易失性可读存储介质,也同样具有上述技术效果。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案,下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍,显而易见地,下面描述中的附图仅仅是本申请的实施例,对于本领域普通技术人员来讲,在不付出创造性劳动的前提下,还可以根据提供的附图获得其他的附图。
图1为本申请公开的一种文件共享方法流程图;
图2为本申请公开的另一种文件共享方法流程图;
图3为本申请公开的一种文件共享系统示意图;
图4为本申请公开的一种共享信息生成示意图;
图5为本申请公开的一种共享信息被数据拥有者访问的示意图;
图6为本申请公开的一种共享信息被数据拥有者更新的示意图;
图7为本申请公开的一种共享信息被数据使用者访问以及代理重加密密钥生成的示意图;
图8为本申请公开的一种重加密共享信息和原共享信息的对比示意图;
图9为本申请公开的一种文件共享系统的结构框图;
图10为本申请公开的一种电子设备的结构框图。
具体实施方式
下面将结合本申请实施例中的附图,对本申请实施例中的技术方案进行清楚、完整地描述,显然,所描述的实施例仅仅是本申请一部分实施例,而不是全部的实施例。基于本申请中的实施例,本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例,都属于本申请保护的范围。
目前,现有数据共享方案不仅需要共享数据拥有者的公钥,还需要使用数据拥有者的私钥加密数据,不能保证数据拥有者私钥的安全。并且,各文件都用数据拥有者的私钥加密,可能因该私钥长久不更新而导致数据泄露。为此,本申请提供了一种文件共享方案,能够使不同文件对应的密钥类数据动态变化,提高数据共享方案中密钥类数据以及数据本身的安全性。
参见图1所示,本申请实施例公开了一种文件共享方法,应用于文件拥有端,包括:
S101、获取待共享的目标文件,并确定目标文件对应的第一动态密钥。
其中,目标文件可以由文件拥有端产生,也可以是文件拥有端从别处获取或接收的文件,该文件中的数据具体可以是消息、字符串、报文、文档、代码等。
在一种具体实施方式中,可以按照文件格式或文件重要程度分类文件,然后按照分类所得的文件类型确定文件对应的第一动态密钥,从而可以针对相同类型的文件采用同一第一动态密钥。为此,可以将上传的文件类型及采用的第一动态密钥记录在历史上传信息中,以便后续查询。在一种具体实施方式中,确定目标文件对应的第一动态密钥,包括:确定目标文件的类型,并按照类型确定目标文件对应的第一动态密钥;类型按照文件格式或文件重要程度进行分类。其中,按照类型确定目标文件对应的第一动态密钥,包括:若针对相同类型的文件采用同一第一动态密钥,则在历史上传信息中存在与目标文件类型相同的文件时,将历史上传信息中与目标文件类型相同的文件的第一动态密钥确定为目标文件对应的第一动态密钥,若针对相同类型的文件采用不同第一动态密钥,基于随机数计算目标文件对应的第一动态密钥。
其中,文件重要程度可由文件拥有者自行定义。例如:若文件拥有者的电商系统中涉及的付款、结账等文件可设定为重要等级,而商品介绍等文件可设定为次要等级,其他以此类推。当然,文件重要程度也可以简单设定为:高、中、低,文件拥有者对自己的每个文件都打上高、中、低对应的标签,后期便可以依据标签分类文件。
在一种具体实施方式中,可以针对不同文件采用不同第一动态密钥,也即:一文件一第 一动态密钥。因此在一种具体实施方式中,确定目标文件对应的第一动态密钥,包括:若针对不同文件采用不同第一动态密钥,则基于随机数计算目标文件对应的第一动态密钥。例如:第一动态密钥R 1=r 1G,r 1为随机数,G为椭圆曲线的基,G∈G 1,G 1为阶为p的椭圆曲线加法循环群。
S102、基于第一动态密钥和文件拥有端的双私钥生成第一私钥。
S103、从文件拥有端的两对公私钥中选择不成对的公钥和私钥,并基于第一动态密钥、所选公钥和私钥生成第一公钥。
在本实施例中,S102和S103的执行顺序可以互换,互换后不影响本实施例的实现。
S104、利用第一公钥对随机选择的对称密钥进行加密,得到密钥密文。
S105、利用对称密钥加密目标文件,得到文件密文。
S106、利用第一私钥对第一动态密钥、第一公钥、密钥密文、文件密文进行签名,得到签名信息。
具体的,可以先将第一动态密钥、第一公钥、密钥密文、文件密文拼接,再将拼接结果转换为哈希字符串,然后再利用第一私钥对转换得到的哈希字符串进行签名,以得到签名信息。因此在一种具体实施方式中,利用第一私钥对第一动态密钥、第一公钥、密钥密文、文件密文进行签名,得到签名信息,包括:拼接第一动态密钥、第一公钥、密钥密文和文件密文,得到拼接结果;将拼接结果转换为哈希字符串;利用第一私钥对哈希字符串进行签名,得到签名信息。
S107、将第一动态密钥、第一公钥、密钥密文、文件密文及签名信息作为共享信息上传至云共享端,以共享目标文件。
当然,文件拥有端还可以随时更改目标文件在云共享端的共享信息,以更改目标文件的访问密钥,也就更改了目标文件的访问权限。因此在一种具体实施方式中,发送共享信息的删除请求至云共享端,以使云共享端删除共享信息,之后文件拥有端针对目标文件生成新共享信息,并将新共享信息上传至云共享端,以更改目标文件的共享信息。当然,文件拥有端还可以不发送删除请求,自主针对目标文件生成新共享信息后,直接将新共享信息上传至云共享端,后续云共享端基于新共享信息更新目标文件的共享信息即可。因此文件拥有端还发送共享信息的更新请求至云共享端,以使云共享端使用更新请求中目标文件的新共享信息更新共享信息。因此在一种具体实施方式中,发送共享信息的更新请求至云共享端,包括:发送用于更新第一动态密钥、第一公钥、密钥密文、文件密文或签名信息的更新请求至云共享端。可见,共享信息中的任意信息都能被更新,由此也可保障文件安全性。
可见,本实施例为文件拥有端设定了两对公私钥,且其中的双私钥并不直接加密文件,而是根据双私钥生成第一私钥后,利用此第一公钥加密用于加密文件的对称密钥,因此可降低文件拥有端的双私钥被泄露的风险。同时,该方案可使不同文件对应的第一动态密钥、第一私钥、第一公钥动态变化,不仅避免了加密密钥等隐私数据的长久不更新,还可以降低此类隐私数据以及共享数据的泄露风险,还能够细粒度加密不同文件,为不同文件设定不同的访问权限,提高共享文件的安全性。
本申请实施例公开了另一种文件共享方法,该方法在文件密文上传至云共享端后执行,也就是:执行完图1所示的步骤后再执行图2所示的步骤。
参见图2所示,本实施例提供的方法包括:
S201、文件访问端生成第二动态密钥,基于第二动态密钥和自身两对公私钥生成第二公钥,发送目标文件的访问请求至云共享端。
S202、云共享端基于访问请求查询目标文件的共享信息,共享信息包括:第一动态密钥、第一公钥、密钥密文、文件密文及签名信息;将第一动态密钥及第一公钥、访问请求中的第二公钥发送至文件拥有端;共享信息由上述文件拥有端执行的方法获得。
S203、文件拥有端基于第一动态密钥和自身两对公私钥生成第一公钥,若云共享端发送的第一公钥和自身生成的第一公钥相等,则基于第一动态密钥和自身双私钥生成第一私钥,基于第一私钥和第二公钥生成重加密密钥,将重加密密钥发送至云共享端。
S204、云共享端利用重加密密钥重加密密钥密文得到密钥重加密密文,将密钥重加密密文、第一公钥、第一动态密钥、密钥密文、文件密文及签名信息发送至文件访问端。
S205、文件访问端利用第一公钥验证签名信息,得到目标结果,若目标结果与云共享端发送的第一动态密钥、第一公钥、密钥密文及文件密文一致,则利用第二动态密钥和自身双私钥计算第二私钥,利用第二私钥解密密钥重加密密文得到对称密钥,利用对称密钥对文件密文进行解密,得到目标文件的明文。
其中,文件访问端利用第一公钥验证签名信息,得到的目标结果中包括:第一动态密钥、第一公钥、密钥密文及文件密文的哈希值,因此对比目标结果中的第一动态密钥、第一公钥、密钥密文、文件密文的哈希值与云共享端发送的第一公钥、第一动态密钥、密钥密文及文件密文的哈希值若一致,则确定目标结果与签名信息一致,验签通过;若不一致,认为验签不通过。
在一种具体实施方式中,云共享端基于访问请求查询目标文件的共享信息之前,还包 括:云共享端验证文件访问端的合法性;若文件访问端合法,则云共享端基于访问请求查询目标文件的共享信息;若文件访问端不合法,云共享端向文件访问端返回访问不合法的通知消息。其中,云共享端验证文件访问端的合法性,可以验证文件访问端是否是云共享端的合法用户,如:检验文件访问端所使用的账号、密码等信息。
在一种具体实施方式中,还包括:文件拥有端和/或文件访问端基于密文搜索技术查询云共享端中存储的文件密文。也即:文件拥有端或文件访问端想要在云共享端查询某一文件时,先对该文件的关键字进行加密,而后再基于加密所得密文进行查询。可见,云共享端只能看到文件密文而不能看到文件明文,因此可降低文件本身被云共享端泄露的风险。
可见,当文件密文上传至云共享端后,文件访问端可以访问云共享端中的文件,该过程采用重加密技术,进一步保障了文件的安全性。
下述实施例结合具体算来介绍上述两个实施例提供的方案。
密钥生成中心设定一个双线性映射e:G 1×G 1→G T,G 1是一个阶为p的椭圆曲线加法循环群,G T是一个阶为p的乘法循环群。随机产生一个椭圆曲线的基G∈G 1,Z=e(G,G)∈G T,Z为椭圆曲线基点G双线性映射的结果,e为双线性映射,双线性映射性质为:e(aG,bG)=e(G,G) ab。其中,H{0,1} *→Z q,Z q是一个阶为q的整数循环群。
数据拥有者利用密钥生成中心获得自身两对非对称的公私钥(a,A)和(b,B),其中,a和b为私钥,A和B为公钥。数据拥有者的公钥A=aG,a∈Z q;公钥B=bG,b∈Z q。对称密钥k∈G T。随机选取r 1∈Z q,那么第一动态密钥R 1=r 1G。动态加密公钥P 11=H(R 1*a)*G+B,P 11即为第一公钥。动态加密私钥P 12=H(a*R 1)+b,P 12即为第一私钥。利用P 11对对称密钥k加密得到第一层密文C 1=(rP 11,kZ r),r∈Z q,C 1即为密钥密文。利用k加密文件m得到文件密文C=Enc k(m),Enc表示一种加密算法。对R 1、C 1、C取哈希后,用P 12进行签名,得到签名信息σ,将{R 1,P 11,C 1,C,σ}上传到云服务提供商。其中,由于数据拥有者将数据上传给半可信的云服务提供商后,就失去对数据的控制权。因此,出于安全考虑,数据拥有者在上传数据之前对数据进行加密处理。
数据使用者利用密钥生成中心获得自身两对非对称的公私钥(c,C)和(d,D),其中,c和d为私钥,C和D为公钥,C=cG,c∈Z q,D=dG,d∈Z q。随机选取r 2∈Z q,那么第二动态密钥R 2=r 2G。动态加密公钥P 21=H(R 2*c)*G+D,P 21即为第二公钥。动态加密私钥P 22=H(c*R 2)+d,P 22即为第二私钥。生成R 2后,可以删除随机数r 2,保证动态密钥和动态加密公钥的安全性。
数据使用者请求云服务提供商以访问共享信息,请求参数中包括P 21。云服务提供商初步 判断用户的合法性,然后将共享信息中的R 1以及P 11,还有请求参数中的P 21作为共享请求发送给数据拥有者。
数据拥有者接收共享请求后,利用R 1和自己的两对公私钥计算P 11、P 12,在自己计算得到的P 11与云服务提供商发送的P 11一致时,利用P 12和P 21得到重加密密钥rk=(P 22/P 12)G=(1/P 12)P 21,将重加密密钥上传到云服务提供商处。
服务提供商利用重加密密钥对共享信息中的第一层密文进行重加密,得到第二层密文
Figure PCTCN2022130386-appb-000001
C 2即为密钥重加密密文。服务提供商将{C 2,P 11,R 1,C 1,C,σ}发送给数据使用者。其中,云服务提供商进行重加密,扮演了密文转换的角色,能够将由数据拥有者公钥加密的密文转换为由数据使用者公钥对同一明文加密的密文,然后数据使用者可利用其自身私钥解密转换后的密文。在密文转换过程中,云服务提供商拥有一个由数据拥有者授权的针对数据使用者的重加密密钥,且云服务提供商无法获得有关明文的任何信息。
数据使用者预先计算了R 2=r 2G。利用P 11验证σ得到目标结果,若目标结果中的{P 11,R 1,C 1,C}与服务提供商发送的{P 11,R 1,C 1,C}一致,则利用R 2、c、d计算P 22,利用P 22对C 2解密,获得对称密钥
Figure PCTCN2022130386-appb-000002
利用k解密C获得文件明文m=Dec k(C),Dec表示一种解密算法。
可见,数据拥有者在上传数据之前对数据进行加密处理,当文件密文上传至云共享端后,文件访问端可以访问云共享端中的文件,该过程采用重加密技术,进一步保障了文件的安全性。
下面对本申请实施例提供的一种文件共享系统进行介绍,下文描述的一种文件共享系统与上文描述的一种文件共享方法可以相互参照。
参照图9,本申请实施例公开了一种文件共享系统,包括:如上的文件拥有端901、云共享端902及文件访问端903,文件拥有端901还执行图1中的方法以及其他可供其执行的方法。
该文件共享系统还包括密钥生成中心,密钥生成中心用于为文件拥有端和文件访问端提供公私钥对以及用于加解密的参数。具体可参照文中其他地方的相关介绍,在此不再赘述。
在一种具体实施方式中,文件拥有端901具体用于:确定目标文件的类型,并按照类型确定目标文件对应的第一动态密钥;类型按照文件格式或文件重要程度进行分类。
在一种具体实施方式中,文件拥有端901具体用于:若针对相同类型的文件采用同一第一动态密钥,则在历史上传信息中存在与目标文件类型相同的文件时,将历史上传信息中与目标文件类型相同的文件的第一动态密钥确定为目标文件对应的第一动态密钥,若针对相同 类型的文件采用同一第一动态密钥,基于随机数计算目标文件对应的第一动态密钥。
在一种具体实施方式中,文件拥有端901具体用于:若针对不同文件采用不同第一动态密钥,则基于随机数计算目标文件对应的第一动态密钥。
在一种具体实施方式中,文件拥有端901具体用于:发送共享信息的删除请求至云共享端,以使云共享端删除共享信息;针对目标文件生成新共享信息,并将新共享信息上传至云共享端,以更改目标文件的共享信息。
在一种具体实施方式中,云共享端901基于访问请求查询目标文件的共享信息之前,云共享端验证文件访问端的合法性;若文件访问端合法,则云共享端基于访问请求查询目标文件的共享信息;否则,云共享端向文件访问端返回访问不合法的通知消息。
在一种具体实施方式中,文件拥有端901和/或文件访问端903基于密文搜索技术查询云共享端中存储的文件密文。
其中,关于本实施例中各个端的工作过程可以参考前述实施例中公开的相应内容,在此不再进行赘述。
可见,本实施例提供了一种文件共享系统,能够使不同文件对应的密钥类数据动态变化,提高数据共享方案中密钥类数据以及数据本身的安全性。
下面对本申请实施例提供的一种应用于文件拥有端的文件共享方法进行介绍,下文描述的文件共享方法与文中其他地方描述的相关内容可以相互参照。
本申请实施例公开了一种应用于文件拥有端的文件共享方法,包括:从云共享端下载共享信息;共享信息包括:第一动态密钥、第一公钥、密钥密文、文件密文及签名信息;共享信息基于图1所示的方法获得。基于第一公钥验证签名信息通过后,基于第一动态密钥和文件拥有端的双私钥生成第一私钥。利用第一私钥解密密钥密文得到对称密钥。利用对称密钥解密文件密文得到目标文件的明文。
上述过程可参照图5以及相关介绍,可见数据拥有者也可以从云端下载、解密自己上传的文件密文。
基于本申请的发明构思,下述实施例提供了一种基于动态密钥的代理重加密系统。本实施例通过采用动态密钥对共享文件进行加密,用户私钥不直接参与加密,保障用户私钥的安全性。同时,本实施例对每一个共享文件采用单独的密钥进行加密,实现了细粒度的解密权指派功能,还能够通过代理重加密技术实现解密权的转换。
基于代理重加密的共享系统能够在保持数据机密性的同时,实现了解密权的指派,并且在实际应用中,数据拥有者通常只会与合作伙伴共享自身某一部分文档,而不是全部云端数据。比如:与后勤部门共享管理有关数据,与销售合作伙伴共享产品资料数据等,而不是与每一个用户共享所有的数据。为此,本实施例针对一个文件采用单独的密钥,可实现文件的指派性共享,而不是与某一合作伙伴共享自己的所有文件。
如图3所示,本实施例提供的系统包括数据拥有者、数据拥有者、云服务提供商、密钥生成中心。其中,数据拥有者和数据使用者分别通过接口与云服务提供商、密钥生成中心相连。
密钥生成中心为数据拥有者和数据使用者生成非对称的公私钥对。
数据拥有者负责共享文件的准备和生成,利用密钥生成中心获得自身两对非对称的公私钥(a,A)和(b,B),两个私钥a、b永远由数据拥有者秘密保存,不直接参与加密运算。
如图4所示,数据拥有者利用随机数r 1生成R 1。利用R 1和不成对的公私钥生成动态加密公钥P 11,利用R 1和双私钥生成动态加密私钥P 12。P 12由两个私钥计算得到,实现了动态私钥的安全性。删除随机数r 1,保证R 1和P 11的安全性。数据拥有者生成对称密钥k,对共享文件进行加密,得到加密共享文件(即文件密文)。利用P 11对对称加密密钥进行加密,得到第一层加密密文。利用P 12计算得到签名信息。该过程采用动态加密公钥进行加密,两对公私钥不直接参与加密运算,降低了密钥泄露的可能,提高了密钥的安全性。将加密共享文件、第一层加密密文、P 11、动态密钥R 1、签名信息作为共享信息上传到云服务提供商,由云服务提供商保存。其中,签名信息由P 12签名得到,故共享P 11,可使各端对签名信息进行验证。
数据拥有者可以在不同时刻根据自己的公私钥对生成任意个动态密钥。数据拥有者分别利用不同的动态密钥加密不同的共享文件,实现了细粒度的加密功能。同时,为了对同类型的共享文件进行归类处理,可以对相同类型的共享文件采用相同的动态密钥进行加密。文件可按照重要等级分类,如:按照一般、中等、重要这三个类型分类;还可以按照文件生成时间进行分类。
如图5所示,数据拥有者从云服务提供商中下载共享信息{R 1,P 11,C 1,C,σ},之后计算动态加密公钥P 11、动态加密私钥P 12。利用动态加密公钥P 11验证σ的有效性。利用动态加密私钥P 12解密C 1得到对称密钥k。利用k解密C,得到文件明文。可见,数据拥有者也可以从云端下载、解密自己上传的文件密文。
如图6所示,数据拥有者还可以更新共享信息。具体的,数据拥有者利用随机数r 3生成第三动态密钥R 3。利用R 3和不成对的公私钥生成第三公钥P 31。利用R 3和两对私钥计算第三私 钥P 32。利用P 31对对称密钥重新加密,得到新的密钥密文C 3。利用P 32生成签名信息1。将新得到的共享信息{R 3,P 31,C 3,C,签名信息1}发送至云服务提供商。云服务提供商保存C不变,对其他信息进行替换。数据拥有者更新动态密钥,可以实现当动态密钥泄露时,实现共享文件安全存储,因为更改了动态密钥,也就更改了重加密密钥,那么原共享文件的访问权限就得到了更新。
如图7所示,数据使用者利用密钥生成中心获得自身两对非对称的公私钥(c,C)和(d,D),其中,c和d为私钥,C和D为公钥,C=cG,c∈Z q,D=dG,d∈Z q。随机选取r 2∈Z q,那么第二动态密钥R 2=r 2G。动态加密公钥P 21=H(R 2*c)*G+D,P 21即为第二公钥。动态加密私钥P 22=H(c*R 2)+d,P 22即为第二私钥。生成R 2后,可以删除随机数r 2,保证动态密钥和动态加密公钥的安全性。
数据使用者请求云服务提供商以访问共享信息,请求参数中包括P 21。云服务提供商初步判断用户的合法性,然后将共享信息中的R 1以及P 11、还有请求参数中的P 21作为共享请求发送给数据拥有者。云服务提供商用于加密数据的存储、代理重加密的执行。云服务提供商提供的云存储服务系统存储数据拥有者上传的共享信息,同时接受数据拥有者访问自己数据的请求。
数据拥有者还接收云服务提供商发来的数据使用者的共享请求,生成重加密密钥,将重加密密钥上传到云服务提供商处。
服务提供商得到数据拥有者上传的重加密密钥。如图7所示,服务提供商利用重加密密钥将数据拥有者的共享信息进行重加密,得到重加密共享信息,并将重加密共享信息发送给数据使用者。
服务提供商得到数据拥有者发送的重加密密钥后,利用重加密密钥对共享信息中的第一层密文进行重加密,得到第二层密文C 2。服务提供商将{C 2,P 11,R 1,C 1,C,σ}发送给数据使用者。
数据使用者计算R 2=r 2G。利用R 2、c、d计算P 22,利用P 22对C 2解密,获得对称密钥,利用k解密C获得文件明文m=Dec k(C),Dec表示一种解密算法。
如图8所示,数据拥有者发给云端的共享信息,比云端发给数据使用者的、用于解密文件的共享信息多了重加密密钥密文和第二动态密钥,而重加密密钥密文由重加密密钥对共享信息中的第一层密文重加密获得。
可见,本实施例采用动态密钥对共享文件进行加密,用户私钥不直接参与文件加密,保 障了用户私钥的安全性,同时,本实施例对每一个共享文件采用单独的密钥进行加密,实现了细粒度的解密权指派和加密。同时,为了对同类型的共享文件进行归类处理,可以对相同类型的共享文件采用相同的动态密钥进行加密。数据拥有者更新动态密钥,可以实现当动态密钥泄露时,也能实现共享文件的安全存储,同时可以动态取消共享文件的访问权限。
下面对本申请实施例提供的一种电子设备进行介绍,下文描述的一种电子设备与上文描述的一种文件共享方法及系统可以相互参照。
参照图10,本申请实施例公开了一种电子设备,包括:
存储器1001,用于保存计算机程序;
处理器1002,用于执行计算机程序,以实现上述任意实施例公开的方法。
下面对本申请实施例提供的一种非易失性可读存储介质进行介绍,下文描述的一种非易失性可读存储介质与上文描述的一种文件共享方法、系统及设备可以相互参照。
一种非易失性可读存储介质,用于保存计算机程序,其中,计算机程序被处理器执行时实现前述实施例公开的文件共享方法。关于该方法的具体步骤可以参考前述实施例中公开的相应内容,在此不再进行赘述。
本申请涉及的“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象,而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换,以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外,术语“包括”和“具有”以及他们的任何变形,意图在于覆盖不排他的包含,例如,包含了一系列步骤或单元的过程、方法或设备不必限于清楚地列出的那些步骤或单元,而是可包括没有清楚地列出的或对于这些过程、方法或设备固有的其它步骤或单元。
需要说明的是,在本申请中涉及“第一”、“第二”等的描述仅用于描述目的,而不能理解为指示或暗示其相对重要性或者隐含指明所指示的技术特征的数量。由此,限定有“第一”、“第二”的特征可以明示或者隐含地包括至少一个该特征。另外,各个实施例之间的技术方案可以相互结合,但是必须是以本领域普通技术人员能够实现为基础,当技术方案的结合出现相互矛盾或无法实现时应当认为这种技术方案的结合不存在,也不在本申请要求的保护范围之内。
本说明书中各个实施例采用递进的方式描述,每个实施例重点说明的都是与其它实施例 的不同之处,各个实施例之间相同或相似部分互相参见即可。
结合本文中所公开的实施例描述的方法或算法的步骤可以直接用硬件、处理器执行的软件模块,或者二者的结合来实施。软件模块可以置于随机存储器(RAM)、内存、只读存储器(ROM)、电可编程ROM、电可擦除可编程ROM、寄存器、硬盘、可移动磁盘、CD-ROM、或技术领域内所公知的任意其它形式的可读存储介质中。
本文中应用了具体个例对本申请的原理及实施方式进行了阐述,以上实施例的说明只是用于帮助理解本申请的方法及其核心思想;同时,对于本领域的一般技术人员,依据本申请的思想,在具体实施方式及应用范围上均会有改变之处,综上,本说明书内容不应理解为对本申请的限制。

Claims (20)

  1. 一种文件共享方法,其特征在于,应用于文件拥有端,包括:
    获取待共享的目标文件,并确定所述目标文件对应的第一动态密钥;
    基于所述第一动态密钥和所述文件拥有端的双私钥生成第一私钥;
    从所述文件拥有端的两对公私钥中选择不成对的公钥和私钥,并基于所述第一动态密钥、所选公钥和私钥生成第一公钥;
    利用所述第一公钥对随机选择的对称密钥进行加密,得到密钥密文;
    利用所述对称密钥加密所述目标文件,得到文件密文;
    利用所述第一私钥对所述第一动态密钥、所述第一公钥、所述密钥密文、所述文件密文进行签名,得到签名信息;
    将所述第一动态密钥、所述第一公钥、所述密钥密文、所述文件密文及所述签名信息作为共享信息上传至云共享端,以共享所述目标文件。
  2. 根据权利要求1所述的方法,其特征在于,所述确定所述目标文件对应的第一动态密钥,包括:
    确定所述目标文件的类型,并按照所述类型确定所述目标文件对应的第一动态密钥;所述类型按照文件格式或文件重要程度进行分类。
  3. 根据权利要求2所述的方法,其特征在于,还包括:
    记录所述类型及所述目标文件对应的第一动态密钥,生成历史上传信息。
  4. 根据权利要求2所述的方法,其特征在于,所述按照所述类型确定所述目标文件对应的第一动态密钥,包括:
    若针对相同类型的文件采用同一第一动态密钥,则在所述历史上传信息中存在与所述目标文件类型相同的文件时,将所述历史上传信息中与所述目标文件类型相同的文件的第一动态密钥确定为所述目标文件对应的第一动态密钥,若针对相同类型的文件采用不同第一动态密钥,基于随机数计算所述目标文件对应的第一动态密钥。
  5. 根据权利要求1所述的方法,其特征在于,所述确定所述目标文件对应的第一动态密钥,包括:
    若针对不同文件采用不同第一动态密钥,则基于随机数计算所述目标文件对应的第一动态密钥。
  6. 根据权利要求4至5任一项所述的方法,其特征在于,所述基于随机数计算所述目标文件对应的第一动态密钥,包括:
    获取椭圆曲线的基和所述随机数;
    计算所述椭圆曲线的基和所述随机数的乘积值,并将所述乘积值确定为所述目标文件对应的第一动态密钥。
  7. 根据权利要求1至5任一项所述的方法,其特征在于,还包括:
    发送所述共享信息的更新请求至所述云共享端,以使所述云共享端使用所述更新请求中所述目标文件的新共享信息更新所述共享信息。
  8. 根据权利要求7所述的方法,其特征在于,所述发送所述共享信息的更新请求至所述云共享端,包括:
    发送用于更新所述第一动态密钥、所述第一公钥、所述密钥密文、所述文件密文或所述签名信息的更新请求至所述云共享端。
  9. 根据权利要求1至5任一项所述的方法,其特征在于,还包括:
    发送所述共享信息的删除请求至所述云共享端,以使所述云共享端使用所述删除请求删除所述共享信息。
  10. 根据权利要求1所述的方法,其特征在于,所述利用所述第一私钥对所述第一 动态密钥、所述第一公钥、所述密钥密文、所述文件密文进行签名,得到签名信息,包括:
    拼接所述第一动态密钥、所述第一公钥、所述密钥密文和所述文件密文,得到拼接结果;
    将所述拼接结果转换为哈希字符串;
    利用所述第一私钥对所述哈希字符串进行签名,得到所述签名信息。
  11. 一种文件共享方法,其特征在于,包括:
    文件访问端生成第二动态密钥,基于所述第二动态密钥和自身两对公私钥生成第二公钥,发送目标文件的访问请求至云共享端;
    所述云共享端基于所述访问请求查询所述目标文件的共享信息,所述共享信息包括:第一动态密钥、第一公钥、密钥密文、文件密文及签名信息;将所述第一动态密钥及所述第一公钥、所述访问请求中的所述第二公钥发送至文件拥有端;所述共享信息基于权利要求1至10任一项所述的方法获得;
    所述文件拥有端基于所述第一动态密钥和自身两对公私钥生成第一公钥,若所述云共享端发送的所述第一公钥和自身生成的所述第一公钥相等,则基于所述第一动态密钥和自身双私钥生成第一私钥,基于所述第一私钥和所述第二公钥生成重加密密钥,将所述重加密密钥发送至所述云共享端;
    所述云共享端利用所述重加密密钥重加密所述密钥密文得到密钥重加密密文,将所述密钥重加密密文、所述第一公钥、所述第一动态密钥、所述密钥密文、所述文件密文及所述签名信息发送至所述文件访问端;
    所述文件访问端利用所述第一公钥验证所述签名信息,得到目标结果,若所述目标结果与所述云共享端发送的所述第一动态密钥、所述第一公钥、所述密钥密文及所述文件密文一致,则利用所述第二动态密钥和自身双私钥计算第二私钥,利用所述第二私钥解密所述密钥重加密密文得到对称密钥,利用所述对称密钥对所述文件密文进行解密,得到所述目标文件的明文。
  12. 根据权利要求11所述的方法,其特征在于,所述目标结果中的第一动态密钥、第一公钥、密钥密文、文件密文的哈希值,还包括:
    对比所述第一动态密钥、所述第一公钥、所述密钥密文、所述文件密文的哈希值与所述云共享端发送的所述第一公钥、所述第一动态密钥、所述密钥密文及所述文件密文的哈希值是否一致;
    当所述第一动态密钥、所述第一公钥、所述密钥密文、所述文件密文的哈希值与所述云共享端发送的所述第一公钥、所述第一动态密钥、所述密钥密文及所述文件密文的哈希值一致时,验证通过;
    当所述第一动态密钥、所述第一公钥、所述密钥密文、所述文件密文的哈希值与所述云共享端发送的所述第一公钥、所述第一动态密钥、所述密钥密文及所述文件密文的哈希值不一致时,验证不通过。
  13. 根据权利要求11所述的方法,其特征在于,所述云共享端基于所述访问请求查询所述目标文件的共享信息之前,还包括:
    所述云共享端验证所述文件访问端的合法性;若所述文件访问端合法,则所述云共享端基于所述访问请求查询所述目标文件的共享信息;若所述文件访问端不合法,所述云共享端向所述文件访问端返回访问不合法的通知消息。
  14. 根据权利要求13所述的方法,其特征在于,所述云共享端验证所述文件访问端的合法性包括:
    所述云共享端验证所述文件访问端是否为所述云共享端的合法用户;
    当所述文件访问端为所述云共享端的合法用户时,确定所述文件访问端合法;
    当所述文件访问端不为所述云共享端的合法用户时,确定所述文件访问端不合法。
  15. 根据权利要求11所述的方法,其特征在于,所述文件访问端得到所述目标文件的明文之前,还包括:
    所述文件拥有端和/或所述文件访问端基于密文搜索技术查询所述云共享端中存储的所述文件密文。
  16. 一种文件共享方法,其特征在于,应用于文件拥有端,包括:
    从云共享端下载共享信息;所述共享信息包括:第一动态密钥、第一公钥、密钥密文、文件密文及签名信息;所述共享信息基于权利要求1至7任一项所述的方法获得;
    基于所述第一公钥验证所述签名信息通过后,基于所述第一动态密钥和所述文件拥有端的双私钥生成第一私钥;
    利用所述第一私钥解密所述密钥密文得到对称密钥;
    利用所述对称密钥解密所述文件密文得到所述目标文件的明文。
  17. 一种文件共享系统,其特征在于,包括:如权利要求11所述的文件拥有端、云共享端及文件访问端,所述文件拥有端还执行如权利要求1至10任一项所述的方法。
  18. 根据权利要求17所述的系统,其特征在于,还包括:
    密钥生成中心,用于为所述文件拥有端和所述文件访问端提供公私钥对以及用于加解密的参数。
  19. 一种电子设备,其特征在于,包括:
    存储器,用于存储计算机程序;
    处理器,用于执行所述计算机程序,以实现如权利要求1至16任一项所述的方法。
  20. 一种可读存储介质,其特征在于,用于保存计算机程序,其中,所述计算机程序被处理器执行时实现如权利要求1至16任一项所述的方法。
PCT/CN2022/130386 2022-05-27 2022-11-07 一种文件共享方法、系统、电子设备及可读存储介质 WO2023226308A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210583975.6 2022-05-27
CN202210583975.6A CN114679340B (zh) 2022-05-27 2022-05-27 一种文件共享方法、系统、设备及可读存储介质

Publications (1)

Publication Number Publication Date
WO2023226308A1 true WO2023226308A1 (zh) 2023-11-30

Family

ID=82079124

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/130386 WO2023226308A1 (zh) 2022-05-27 2022-11-07 一种文件共享方法、系统、电子设备及可读存储介质

Country Status (2)

Country Link
CN (1) CN114679340B (zh)
WO (1) WO2023226308A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114679340B (zh) * 2022-05-27 2022-08-16 苏州浪潮智能科技有限公司 一种文件共享方法、系统、设备及可读存储介质
CN117235761B (zh) * 2023-09-22 2024-04-19 北京宝联之星科技股份有限公司 一种基于云计算的数据安全处理方法、系统和存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101958793A (zh) * 2010-03-03 2011-01-26 北京唐朝科技股份有限公司 双公钥密码身份识别、密钥认证与数字签名一体化解决方案
CN111191288A (zh) * 2019-12-30 2020-05-22 中电海康集团有限公司 一种基于代理重加密的区块链数据访问权限控制方法
CN112564907A (zh) * 2021-03-01 2021-03-26 北京信安世纪科技股份有限公司 密钥生成方法及装置、加密方法及装置、解密方法及装置
CN112702167A (zh) * 2020-12-14 2021-04-23 苏州浪潮智能科技有限公司 一种集群特征码获得方法、装置及电子设备
US20220150220A1 (en) * 2019-08-30 2022-05-12 Henry Verheyen Secure data exchange network
CN114679340A (zh) * 2022-05-27 2022-06-28 苏州浪潮智能科技有限公司 一种文件共享方法、系统、设备及可读存储介质

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102624527A (zh) * 2012-02-26 2012-08-01 光束(北京)国际工程技术研究院有限公司 加密数据的方法、装置和加密数据的传输方法及装置
CN105743646B (zh) * 2016-02-03 2019-05-10 四川长虹电器股份有限公司 一种基于身份的加密方法及系统
CN109144961B (zh) * 2018-08-22 2021-09-17 矩阵元技术(深圳)有限公司 授权文件共享方法及装置
CN111835500B (zh) * 2020-07-08 2022-07-26 浙江工商大学 基于同态加密与区块链的可搜索加密数据安全共享方法
CN113360886B (zh) * 2021-04-23 2023-02-28 山东英信计算机技术有限公司 一种加密数据共享的方法、装置、设备及可读介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101958793A (zh) * 2010-03-03 2011-01-26 北京唐朝科技股份有限公司 双公钥密码身份识别、密钥认证与数字签名一体化解决方案
US20220150220A1 (en) * 2019-08-30 2022-05-12 Henry Verheyen Secure data exchange network
CN111191288A (zh) * 2019-12-30 2020-05-22 中电海康集团有限公司 一种基于代理重加密的区块链数据访问权限控制方法
CN112702167A (zh) * 2020-12-14 2021-04-23 苏州浪潮智能科技有限公司 一种集群特征码获得方法、装置及电子设备
CN112564907A (zh) * 2021-03-01 2021-03-26 北京信安世纪科技股份有限公司 密钥生成方法及装置、加密方法及装置、解密方法及装置
CN114679340A (zh) * 2022-05-27 2022-06-28 苏州浪潮智能科技有限公司 一种文件共享方法、系统、设备及可读存储介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
MINGMING JIANG, ZHAO LIJUN, WANG YAN, WANG BAOCANG: "Quantum-security Certificateless Bidirectional Proxy Re-encryption for Cloud Data Sharing ", XINXI WANGLUO ANQUAN = NETINFO SECURITY, GONGANBU JISUANJI XINXI XITONG ANQUAN CHANPIN ZHILIANG JIANDU JIANYAN ZHONGXIN, CN, no. 8, 10 August 2018 (2018-08-10), CN , pages 17 - 24, XP093112054, ISSN: 1671-1122, DOI: 10.3969/j.issn.1671-1122.2018.08.003 *

Also Published As

Publication number Publication date
CN114679340B (zh) 2022-08-16
CN114679340A (zh) 2022-06-28

Similar Documents

Publication Publication Date Title
US10652015B2 (en) Confidential communication management
US11381398B2 (en) Method for re-keying an encrypted data file
KR101999188B1 (ko) 비밀 공유를 위한 타원 곡선 암호를 사용하는 개인용 장치 보안
Yan et al. Heterogeneous data storage management with deduplication in cloud computing
US9800416B2 (en) Distributed validation of digitally signed electronic documents
US9374373B1 (en) Encryption techniques for improved sharing and distribution of encrypted content
US7320076B2 (en) Method and apparatus for a transaction-based secure storage file system
WO2023226308A1 (zh) 一种文件共享方法、系统、电子设备及可读存储介质
CN114039790B (zh) 一种基于区块链的细粒度云存储安全访问控制方法
US20070127719A1 (en) Efficient management of cryptographic key generations
US8488782B2 (en) Parameterizable cryptography
CN113037484B (zh) 数据传输方法、装置、终端、服务器及存储介质
CN112291179B (zh) 一种实现设备认证的方法、系统及装置
CN114244508B (zh) 数据加密方法、装置、设备及存储介质
Tian et al. An efficient scheme of cloud data assured deletion
CN113609522A (zh) 数据授权及数据访问方法和装置
CN106790100B (zh) 一种基于非对称密码算法的数据存储和访问控制方法
CN113824713B (zh) 一种密钥生成方法、系统及存储介质
TW202304172A (zh) 位置密鑰加密系統
Xue-Zhou Network data encryption strategy for cloud computing
Jeevitha et al. Data Storage Security and Privacy in Cloud Computing
Karani et al. Secure File Storage Using Hybrid Cryptography
US20230362195A1 (en) Remote attestation transport layer security and split trust encryption
Basavarajegowda et al. Enhanced CP-ABE with RSA for Secure and Revocable Data Transmission of Big Data in Cloud.
CN115935426A (zh) 一种基于sgx的远程图像特征提取与检索方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22943495

Country of ref document: EP

Kind code of ref document: A1