WO2021218885A1 - 用于数据传输的安全保密方法和*** - Google Patents
用于数据传输的安全保密方法和*** Download PDFInfo
- Publication number
- WO2021218885A1 WO2021218885A1 PCT/CN2021/089789 CN2021089789W WO2021218885A1 WO 2021218885 A1 WO2021218885 A1 WO 2021218885A1 CN 2021089789 W CN2021089789 W CN 2021089789W WO 2021218885 A1 WO2021218885 A1 WO 2021218885A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- file
- data
- key
- encrypted
- sharing
- Prior art date
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
- H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
- H04L9/0618—Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
- H04L9/0631—Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/085—Secret sharing or secret splitting, e.g. threshold schemes
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
- H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/72—Signcrypting, i.e. digital signing and encrypting simultaneously
Definitions
- the invention belongs to a security and confidentiality method and system for data transmission, and particularly relates to a security and confidentiality method and system for file storage and sharing between edge and terminal intelligent equipment.
- edge and terminal smart devices With the advent of the Internet of Things, file sharing between edge and terminal smart devices will become quite popular, especially for protecting data files like human faces and other sensitive images, which has become a research hotspot. With the emergence of cloud storage, how to avoid the illegal theft of sensitive data files stored on edge and terminal smart devices during transmission has become a widely discussed content.
- Chinese invention patent application CN108804930A discloses a mobile phone storage system that prevents information theft.
- the mobile phone storage system is partitioned, and the storage system accesses data based on the security of the application environment, so as to improve the security of data information.
- the risk that the data and information stored therein may still be illegally leaked due to the loss of the protection of the trusted computing means after the storage component is disassembled.
- Chinese Invention Patent Application CN 110704858 A discloses a method and system for secure data storage in a distributed environment.
- the method includes the following steps: S1: For the data to be encrypted and stored, combine the timestamp and the random number, and pass the hash algorithm , Generate data fingerprints; S2: encrypt the data to form a ciphertext, each piece of data uses a random number as the encryption key; S3: divide the ciphertext into multiple data blocks; S4: store the data blocks distributed in each In the storage nodes, the storage content of each storage node is scheduled and managed by a unified scheduling center; in step S3, each time the ciphertext is divided, the number of this division is automatically determined by a random number. By storing data blocks in different storage nodes, the damage of some nodes will not affect the integrity of the data.
- the authentication and authorization process of the general network security platform system realizes online authorization through the function of the authentication server, so that the user has the right to use various functions and various online services, and through the cooperation with the service center, the user's power is reasonably maintained.
- the authentication module mainly completes the generation and distribution of authorization files, as well as the extraction and comparison of the hardware information of the computer.
- the user can process the file to be transmitted into a cipher text file through the file encryption authorization device. This ciphertext file can only be opened by a designated file encryption authorized device.
- File encryption authorization through the file encryption authorization function, you can encrypt a file and authorize a designated person to read the file.
- File decryption The file decryption function allows persons with decryption authority to read encrypted documents. The specific functions are as follows:
- Encryption and decryption module Encrypt the authorization file generated on the authentication server, and the authorization file is decrypted by this module.
- Transformation string module Transform the order of the user name, service registration KEY and extracted hardware information entered by the user at the initial stage, and send it to the authentication server.
- Extract information module used to extract the product number of computer hardware equipment (unchangeable hardware information, including hardware information of the enterprise control center and stand-alone users). The specific operation process of this module is transparent to the user.
- Generating authorization file module After obtaining the transformed user information, the authentication server generates an authorization file that stores user service information.
- Server information comparison module compares the authorization file information stored in the server with the authorization file obtained by transmission, and judges and revises the time in the authorization file. Authorize encrypted files.
- the purpose of the present invention is to provide a security method and system for file storage and sharing between edge and terminal smart devices.
- the security and confidentiality method for data transmission of the present invention includes the following steps: randomly divide each item of one or more original file information to be shared into two parts, and store the divided part in the management terminal, The other part is stored in the local device; the divided information is separately encrypted through user request; and the key is shared with the target sharer; the target sharer downloads the divided part of the data from the cloud server; the target sharer uses the obtained The key for decrypting and authenticating the downloaded part of the data and another piece of information stored in the local device respectively, restores and obtains the complete confidential information.
- Another security method for data transmission of the present invention further includes a data file and an authorization file whose part of information stored in the management terminal is the original file; and a part of the information stored in the local device is the original file of the original file. Map metafile.
- the local device is one or more clients (205) that can be easily operated by the client;
- the management terminal includes a database server (105),
- the database server 105 is a dedicated server or a cloud server, which is used to communicate with the client through the presentation layer state conversion web service layer (108) through the hypertext transmission security protocol; and the shared and secure storage manager (106), which uses For storing the data files of the original files that need to be shared in a back-end relational database relational system; and a certificate authority server (107) for communicating with the sharing and secure storage manager (106), which is The original file to be shared generates the authorization file.
- the certificate authority server protects the local map metafile and the data file by creating a certificate; the information of each original file that needs to be shared is based on the user The public key to generate the authorization file to ensure that only the target sharer can restore the original file information to be shared by combining the generated authorization file and the data file.
- Another security method for data transmission of the present invention wherein the user's file is stored in the memory of the client (205), and the memory is a TF card, RS-MMC card, miniSD card, MS card , CF card, SD card, MMC card, M2 card.
- Another security method for data transmission of the present invention wherein the interface architecture of the presentation layer state transition web service layer (108) is restricted to client-server restrictions, and the logic and data concerned by the user interface are stored The logic of concern is separated.
- the structure of the interface of the presentation layer state transition web service layer (108) is restricted to a unified interface, including: the resource ID (Resource identification in requests) contained in the request; the identifier of various independent resources is contained in the request, that is, the resource
- the identity itself and the identity sent to the client are independent; resources are operated through identity (Resource management through representations); messages are self-descriptive (Self-descriptive messages), that is, each message contains enough information to describe how to handle this information.
- Another method for data transmission security and confidentiality of the present invention wherein the user obtains from the certificate authority server (107) the digital certificate generated by the authority and the public shared between the user and the target sharer from the certificate authority server (107) through the following steps Key (if applicable):
- the user sends a request to the certificate authority to log in to the certificate authority on the client; waits for the certificate authority to confirm the login; the user sends a certificate generation request to the certificate authority to request the identity and public key; certificate authority The center issues the digital certificate to the user client.
- the shared and secure storage manager (106) performs the following steps through the application program interface (API) call of the presentation layer state transition service:
- API application program interface
- the "challenge and response" mechanism is implemented on HTTPS to allow multiple users to use it together; after the login verification is passed, the user will be granted a time-stamped string ("cookie”); from the client (205)
- the application program generates a two-dimensional QR code, allowing the sharing of the QR code between the identified parties, and the grantor scans the generated QR code and adds it to his own sharing list and clarifies which authorized sharing parties are authorized to share the QR code.
- Add shared members; process shared data files and their authorized files After creating the shared list, the user selects the shared materials with the target shared party (one or more) from the client (205) application interface, for each shared data file
- the target sharing party generates the authorization file of each grantee and signs it with the grantee’s public key to ensure that only the corresponding grantee can retrieve the shared information; for each sharing event, the sharing and safe storage
- the manager (106) sends the data file and the authorization file to the sharing parties (the grantee), and sends a notification to the grantee through the client application.
- Another security method for data transmission of the present invention wherein, when processing a user's request for downloading data files and authorized files, the sharing and secure storage manager (106) must verify that the user has the download authority, if If the user does not have permission, the requested data file and authorization file will not be sent to the user.
- the grantor stores the data file in the personal folder of the sharing and security storage manager (106), and uploads the image
- the meta file is stored in the SD card or USB flash memory of the client; in the step of creating the sharing list, the grantor adds multiple target sharing parties (grantees) by scanning the QR-code generated, and the grantee is added to the grantor’s own On the sharing list, select the shared material to share with the selected sharing list members; in the step of sharing the file with the grantee, the grantor prepares the authorization file for the grantee and sends the authorization file to the sharing and secure storage manager ( 106);
- the sharing and secure storage manager (106) records the authorization file in the database; sends an in-app notification to the grantee; in the step of retrieving the file by the grantee, the grantee downloads from the shared and
- the secure storage manager (106) requires the grantor's authorization file; the grantee runs a splitting utility to download the grantor'
- Another security method for data transmission wherein the authorization file and the data file are processed in the encryption stage as follows: extract the image meta file from the original data file, and divide the remaining part into the data file ( .usrs), the metafile is encrypted with a private key and a public key (such as RSA-2048) to form an authorization file (.usc) containing the second signature; and the remaining data file after the metafile is extracted Scramble and encrypt to form a data file (.usrs) file containing the first signature.
- a private key and a public key such as RSA-2048
- the data file is added to the data file by using an advanced encryption standard ("Advanced Encryption Standard", such as AES-256) or Rijndael encryption key
- the encrypted data is formed; the encrypted data is scrambled, part of which forms the scrambled image element data, and the other part forms the scrambled encrypted data; the scrambled and encrypted data is calculated by the SHA256 algorithm; the scrambled and encrypted data is passed through The SHA256 algorithm is calculated to obtain a 256-byte hash value; the grantor’s key is used to sign the 256-byte hash value to obtain the first signature; the first signature is incorporated into the scrambled and encrypted Among the data, a scrambled and encrypted data file containing the first signature is obtained.
- AES-256 Advanced Encryption Standard
- Rijndael encryption key Rijndael encryption key
- the image element data consists of a unique identifier, source file name, remote file name, disturbed image element data, and AES-256 key of the data file And the identity of the grantor’s certificate; encrypt the graphic metadata with the AES-256 key of the graphic metadata to form encrypted graphic metadata; encrypt the AES-256 key of the graphic metadata with the public key of the grantee , To form the encrypted image element data AES-256 key; combine the encrypted image element data and the encrypted image element data AES-256 key to form an encrypted image element data file containing the image element data key, and include
- the encrypted image metadata file of the image metadata key is calculated by the SHA256 algorithm to form a 256-bit hash value (Hash Value), and the second signature is generated through the signature of the grantor's private key, and the second signature is synthesized.
- the encrypted image metadata file containing the image metadata key is calculated by the SHA256 algorithm to form a 256-bit hash value (Hash Value), and the second signature is generated through the signature of the
- the following steps are performed on the authorization file and the data file in the recovery phase: the scrambled and encrypted data file with the first signature and the data file with the first signature are The encrypted graphic metadata file containing the graphic metadata key of the second signature is processed through the graphic metadata to obtain the required original file.
- Another security method for data transmission wherein, for the authorization file (.usc), 256 bits in the encrypted image metadata file containing the image metadata key with the second signature
- the hash value (Hash Value) is extracted, and the second signature is subjected to signature verification; if the signature is qualified, the encrypted image metadata file is divided into the encrypted image metadata AES-256 key and the encrypted image Metadata; if the signature is unqualified, stop processing the image metadata file; for the encrypted image metadata AES-256 key, use the grantee's private key (such as RSA-2048 private key) to decrypt
- the encrypted graphic element data AES-256 key forms the graphic element data AES-256 key, that is, the graphic element data AES-256 key is used to obtain the graphic element data from the encrypted graphic element data, so
- the graphic metadata includes all the above-mentioned unique identifiers, source file names, remote file names, disturbed graphic metadata, AES-256 keys of the data files, and information about the identity of the grantor's certificate.
- Another security method for data transmission wherein, for a data file (.usrs), the 256-bit hash value in the scrambled and encrypted data file with the first signature ( Hash Value) is extracted, and the first signature is signed and verified; if the signature is qualified, the scrambled and encrypted data is recovered using the scrambled image metadata to obtain confidential data, and the data file AES-256 encryption is used Key to decrypt the encrypted data to obtain a data file.
- the complete data obtained cannot be stored and retransmitted, and can only be used in certified applications.
- the advantage of the method of the present invention is that even if the local equipment is lost, there will be no leakage of sensitive data.
- the data is attacked by hackers during the transmission process, and hackers can obtain only part of the data, which is not complete.
- Figure 1 (a) is a flow chart of the security method of the present invention.
- Figure 1(b) is a diagram of the main components of the security system of the present invention.
- Figure 2 is a schematic diagram of using the system of the present invention to split a protected file and authorize file generation operations.
- Fig. 3 is an example of using the system of the present invention to protect the security of the sharing manager.
- Figure 4 is a schematic diagram of the system client application of the present invention being initialized to obtain an authorization certificate.
- Figure 5 is a schematic diagram of the authorization and data file processing process in the encryption phase of the present invention.
- Fig. 6 is a schematic diagram of the data file processing process in the encryption stage of the present invention.
- Figure 7 is a schematic diagram of SHA-256 used in the present invention.
- Fig. 8 is a schematic diagram of the processing procedure of the authorization file in the encryption phase of the present invention.
- Figure 9 is a schematic diagram of the authorization file restoration process in the restoration phase of the present invention.
- Fig. 10 is a schematic diagram of the data file restoration process in the restoration stage of the present invention.
- Figure 11 is a schematic diagram of the original file restoration steps of the present invention.
- Figure 12 is a structural diagram of the security system of the present invention.
- Fig. 13 is a computer product diagram of the portable or fixed storage unit of the security system of the present invention.
- Figure 1 (a) is a flow chart of the security method of the present invention.
- the information that needs to be kept secret is randomly divided into two parts, and the divided part is stored in the cloud server and the other part is stored in the local device; in step 102, the divided information is separately encrypted through the user request ; And share the key with the target sharer; in step 103, the target sharer downloads the divided part of the data from the cloud server; in step 104, the target sharer uses the obtained key to pair the downloaded part of the data and Another piece of information stored in the local device is decrypted and authenticated separately to obtain complete confidential information.
- the complete data obtained cannot be stored and retransmitted, and can only be used on certified applications.
- the advantage of the method of the present invention is that even if the local equipment is lost, there will be no leakage of sensitive data.
- the data is attacked by hackers during the transmission process, and hackers can obtain only part of the data, which is not complete.
- FIG. 1(b) is a diagram of the main components of the security system of the present invention.
- the security and confidentiality system of the present invention includes a client 110, which includes multiple user-side local devices or terminal smart devices, and a management terminal 111; the client 110 uses Hypertext Transfer Protocol Secure (HTTPS) ) Through the Internet Protocol network (Internet Protocol network) 109 through the presentation layer state transfer ("REpresentational State Transfer", REST) Web service layer 108 to communicate with the management terminal 111.
- HTTPS Hypertext Transfer Protocol Secure
- REST is a software architecture based on Web standards, which uses the HTTP protocol to process data communication. It is resource-centric, where each component is a resource, and the resource is accessed through a public interface using HTTP standard methods.
- a Web service is a collection of open protocols and standards used to exchange data between applications or systems. Software applications written in different languages and running on different platforms can use Web services to exchange data across computer networks. For example, the Internet is similar to process communication on a computer. This interoperability (for example, between Java and Python, or between Windows and Linux applications) is due to the use of open standards.
- the management terminal 111 of the security system of the present invention includes a database server 105, which can be deployed on a dedicated server or a public cloud platform. As described above, the client 110 of the security system of the present invention, such as edge and terminal smart devices, is connected to the database server 105 through HTTP-S to prevent network attacks.
- the management terminal 111 of the security system of the present invention also includes a sharing and secure storage manager 106, which is used to store and manage shared files, and communicate with the certificate authority server 107. For each individual shared file, the file format includes but not limited to: .jpg, .png. Each shared file needs to go through the process of partitioning, authorized encryption, storage and recovery.
- the shared file is randomly divided into two different parts, which are respectively stored in the public shared storage area of the client 110 and the management terminal 111 of the security system of the present invention.
- the public storage area includes the shared and secure storage manager. 106 and database server 105.
- the client terminal 110 is usually a device that is easy for the client to operate, such as a phone or a computer or a tablet computer of the client terminal, and the file stored in the client terminal 110 is generally a resident metafile.
- the format of the metafile is generally wmf format, which is a collection of multiple structures in a binary-coded, device-independent format. These structures include the metafile header, the color palette (optional), and the text of the metafile content Description (optional), metafile record.
- the public shared storage area stores corresponding data files, and the data files refer to parts other than the metafile of this map.
- Figure 2 is a schematic diagram of using the system of the present invention to split a protected file and authorize file generation operations.
- the secure file storage divides the original file 201 into two encrypted and connected parts.
- One part that is, the map metafile 202
- the other part that is, the corresponding data file 203
- the public shared memory that is, the shared manager and the security memory 206.
- the authorization file 204 is generated from the original file 201 and stored in the shared manager and the security storage 206.
- Encryption operations are performed on the metafile and the data file respectively.
- a certificate created by a CA is used to protect the metafile and data file.
- an authorization file is generated in each individual sharing event.
- each authorized file will be generated based on the public key of the sharing party to ensure that only the invited party can restore the shared information by combining the corresponding authorized file and data file.
- the authorization encryption process will be described in detail below.
- the sharing manager and the security storage 206 process the sharing records, and the sharing events will be stored in the back-end relational database management system ("Relational Database Management System, RDBMS").
- RDBMS Relational Database Management System
- the authentication process (including the login process) with the CA will be automatically processed by the sharing manager 206 without interaction with the user.
- Fig. 3 is an example of using the system of the present invention to protect the security of the sharing manager.
- the user's files are stored in the memory of the client application, the memory includes but not limited to TF card, RS-MMC card, miniSD card, MS card, CF card, SD card, MMC card , M2 card, etc.
- a presentation layer state transfer (REST, REpresentational State Transfer) interface 303 (ie, the REST Web service layer 108) is set up between the user application terminal 205 and the server application 302 of the management terminal 111.
- the purpose of setting the state transition interface of the presentation layer is mainly to facilitate the transfer of information between different software/programs in the network (such as the Internet).
- REST is usually based on the use of existing widely popular protocols and standards such as HTTP, URI, XML, and HTML.
- Resources are specified by URI.
- Operations on resources include obtaining, creating, modifying, and deleting. These operations correspond to the GET, POST, PUT, and DELETE methods provided by the HTTP protocol.
- Manipulate resources by manipulating the manifestations of resources.
- the manifestation of resources is XML or HTML, depending on whether the reader is a machine or a human, client software consuming Web services or a Web browser. Of course, it can also be in any other format, such as JSON.
- An example of the architectural limitation of the REST interface is the client-server limitation.
- the purpose of the client-server structural limitation is to separate the concerns of the client and the server. Separating the logic concerned by the user interface and the logic concerned by the data storage helps to improve the portability of the user interface across platforms. Simplifying the server module also contributes to the scalability of the server module.
- the request contains the resource ID (Resource identification in requests); the request contains the identification of various independent resources, for example, URIs in Web services.
- the resource itself and the identity sent to the client are independent.
- the server can send its own database information to the client in the form of HTML, XML or JSON, but these may not be the internal recording method of the server.
- Resources are operated through identification (Resource management through representations). When the client has an identification of a resource, including accompanying metadata, it has enough information to delete the resource.
- Self-descriptive messages Each message contains enough information to describe how to process this information.
- the media type midia-type
- the media type can determine what kind of analyzer is needed to analyze the media data.
- Hypermedia to drive the application state Hypermedia as the engine of application state (HATEOAS)
- HATEOAS Hypermedia as the engine of application state
- the link provided by the server dynamically discovers all available resources and executable operations. As the visit progresses, the server provides text hyperlinks in the response so that the client can get the currently available operations.
- the client does not need to record the structure information of the dynamic application provided by the server in a certain encoding method.
- the client 205 obtains the authorization of the certificate authority (CA) 304 through the certificate authority server 107.
- the specific authorization process is that during the initialization of the client application, the user will obtain the following information from the authorization center: (1) the digital certificate generated by the authorization center; and (2) the public key shared between the parties (if applicable) .
- the information is stored in the client mobile device and/or PC. Therefore, the user's private key will be securely stored on the user's device for later sharing and verification processes.
- the sharing manager 301 After the client application is successfully initialized, the sharing manager 301 will be automatically activated through a RESTful API call to indicate that the user has successfully registered. Then, sharing between different parties can be achieved.
- the sharing manager 301 stores data in a database, for example, a structured query language (“SQL”) database (“Structured Query Language server database”), and as described above, the sharing manager 301 manages the authorization files 204 and Data file 203.
- SQL structured query language
- SQL Structured Query Language server database
- a user shares his file with a friend (such as Bob)
- the user splits the file into an authorized file and a data file.
- the authorization file is encrypted with Bob's public key, so only Bob can decrypt it.
- FIG. 4 is a schematic diagram of the system client application of the present invention being initialized to obtain an authorization certificate.
- the user sends a request to the certificate authority to log in to the CA center on the client side; in step 402, waits for the CA center to confirm the login, and then, in step 403, the user sends a certificate generation request to the certificate authority to request an identity and Public key; Finally, in step 404, the CA center issues a certificate to the user client.
- the following describes in detail the working process of the sharing manager 301 in processing the sharing event in the file sharing phase.
- Access to the sharing manager service In the file sharing stage, for the server-side application of the sharing manager 301, the following services are provided through RESTful service API calls: customer login request; adding shared members; processing shared data files and their authorized files. The service simplifies connections with various clients including mobile and PC applications.
- the client's login request processes the user's user registration and login requests. And, it implements a "challenge and response" mechanism on HTTPS to allow multiple users to use it together. After having a successful login verification, the sharing manager will grant a time-stamped cookie to the user for subsequent operations.
- adding sharing members is achieved in the following ways: (a) generating a two-dimensional QR code from the client 205 application, and (b) working on the server side to indicate which are authorized sharing parties, that is, who has the right to obtain files.
- a QR code can be directly generated to allow the QR code to be shared between the identified parties, and the grantor only needs to scan the generated QR code to add it to his own shared list . Then, the grantor can select the desired sharing party for safe sharing. For the grantee, the CA will provide its public key during the sharing process so that it can be used to generate the authorization file.
- the grantor can select the shared material with the target sharing party(s) from the application interface of the client 205.
- an authorization file for each grantee will be generated and signed with the grantee’s public key to ensure that only the corresponding grantee can retrieve the shared information.
- the sharing manager 301 sends the data file and the authorization file to the sharing parties (the grantee), and sends a notification to the grantee through the client application.
- the sharing manager 301 When processing a user's request for downloading data files and authorization files, the sharing manager 301 must verify that the user has the downloading authority. If the user does not have permission, the requested data file and authorization file will not be sent to the user.
- Sharing in the course of action is divided into the following main steps:
- the grantor stores the data file in the personal folder of the sharing manager 301, and stores the metafile in the SD card or USB flash memory of the mobile phone.
- the grantor adds multiple target sharing parties (grantees) through the QR-code generated by scanning, and the grantee is added to the grantor’s own sharing list, selects the shared materials and the selected Shared by members of the shared list.
- the grantor prepares the authorization file for the grantee and sends the authorization file to the sharing manager 301; the sharing manager 301 records the authorization file in the database; The notification is sent to the grantee.
- the grantee In the step of retrieving the file by the grantee, the grantee requests the grantor's authorization file from the sharing manager 301; the grantee runs the splitting utility to download the grantor's data file from the sharing manager 301 and reconstruct the original file .
- the original file is divided into a public data file (containing a large amount of file data) and an authorization file (one for each grantee):
- FIG. 5 is a schematic diagram of the authorization and data file processing process in the encryption phase of the present invention.
- the processing steps for the authorization file and the data file are as follows: as described above, extract the metafile from the original data file, and divide the remaining part into data files (.usrs), and use the private key and public key ( For example, RSA-2048) is encrypted to form an authorization file (.usc) containing the second signature; and the remaining data file after extracting the metafile is scrambled and encrypted to form the first signature Data file (.usrs) file.
- FIG. 6 is a schematic diagram of the data file processing process in the encryption stage of the present invention, showing the data file encryption processing process of the grantor.
- the data file is encrypted by adding a key such as Advanced Encryption Standard ("Advanced Encryption Standard", such as AES-256) or Rijndael encryption method to the data file.
- a key such as Advanced Encryption Standard ("Advanced Encryption Standard", such as AES-256) or Rijndael encryption method
- AES-256 Advanced Encryption Standard
- Rijndael encryption method Rijndael encryption method
- SHA-256 is a type of SHA-2 Secure Hash Algorithm 2 (Secure Hash Algorithm 2), and is a cryptographic hash function algorithm standard.
- the scrambled and encrypted data is calculated by the SHA256 algorithm to obtain a 256-byte hash value; the grantor’s key is used to sign the 256-byte hash value to obtain a first signature; and the first signature Edit the scrambled and encrypted data to obtain the scrambled and encrypted data file containing the first signature.
- Figure 7 is a schematic diagram of SHA-256 used in the present invention.
- Figure 7 shows the t-th encrypted loop of SHA-2.
- the dark squares in the figure are pre-defined nonlinear functions.
- ABCDEFGH has eight initial values at the beginning, Kt is the t-th key, and Wt is the t-th word generated in this block.
- the original message is cut into fixed-length blocks. For each block, n words are generated (n depends on the algorithm), and the eight working segments of ABCDEFGH are cyclically encrypted through repeated operation loops n times.
- the eight-segment string generated in the last loop is the hash string corresponding to this block. If the original message contains several blocks, the hash string generated by these blocks must be mixed at the end to generate the final hash string.
- Fig. 8 is a schematic diagram of the authorization file processing process in the encryption phase of the present invention, showing the encryption processing process of the authorization file by the grantor.
- This map meta file is stored on the client's mobile phone.
- the image metadata here is about the authorization file.
- the authorization file is stored on the sharing manager of the management end. There are basically two files stored on the sharing manager of the management end. One It is the authorization file, and the other is a part that contains the image metadata. The original complete image can be restored only when it is integrated with the other part of the map metadata that contains the image metadata.
- the image metadata consists of a unique identifier ("unique ID"), the name of the source file, the name of the remote file, the disturbed image metadata, and the AES-256 encryption of the data file. Key and the identity of the grantor's certificate.
- the primitive data file is calculated by a certain algorithm, such as the SHA256 algorithm, to generate a 256-bit hash value (Hash Value), and the second signature is generated through the signature of the grantor's private key, and the inclusion graph with the second signature is synthesized.
- Encrypted image metadata file with metadata key is calculated by a certain algorithm, such as the SHA256 algorithm, to generate a 256-bit hash value (Hash Value), and the second signature is generated through the signature of the grantor's private key, and the inclusion graph with the second signature is synthesized.
- the grantee processes the encrypted file so as to reconstruct the grantor's original file from the data file and the authorized file.
- Figure 9 is a schematic diagram of the authorization file restoration process in the original file restoration stage of the present invention, showing the grantee's restoration process of the authorization file.
- the authorization file For the authorization file (.usc), extract the 256-bit hash value (Hash Value) from the encrypted image metadata file containing the image metadata key with the second signature, and then extract the second signature Perform signature verification. If the signature is qualified, the encrypted graphic metadata file is divided into the encrypted graphic metadata AES-256 key and the encrypted graphic metadata; if the signature is unqualified, processing of the graphic metadata file is suspended.
- the encrypted image element data AES-256 key use the grantee's private key (such as the RSA-2048 private key) to decrypt the encrypted image element data AES-256 key to form the image element data AES-256
- the key is to use the AES-256 key of the image metadata to obtain the image metadata from the encrypted image metadata.
- the image metadata includes all the above-mentioned unique IDs, source file names, remote file names, and scrambled The image metadata of the data file, the AES-256 key of the data file, and the identity information of the grantor’s certificate.
- FIG. 10 is a schematic diagram of the data file recovery process in the original file recovery stage of the present invention, showing the data file recovery process of the grantee.
- the data file For the data file (.usrs), extract the 256-bit hash value (Hash Value) from the scrambled and encrypted data file with the first signature, and perform signature verification on the first signature. If the signature is qualified, the scrambled and encrypted data is recovered using the scrambled image element data to obtain confidential data, and the encrypted data is decrypted using the data file AES-256 key to obtain the data file.
- Hash Value 256-bit hash value
- Figure 11 is a schematic diagram of the original file restoration steps of the present invention.
- the scrambled and encrypted data file with the first signature and the encrypted graphic metadata file containing the graphic metadata key with the second signature are processed through the graphic metadata to obtain the required original files.
- FIG. 12 is a structural diagram of the security system of the present invention.
- the server 1201 that measures the distance.
- the distance measuring server includes a processor 1210, where the processor may be a general-purpose or special-purpose chip (ASIC/eASIC), FPGA or NPU, etc., and a computer program product in the form of a memory 1220 or a computer-readable medium.
- the memory 1220 may be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, hard disk, or ROM.
- the memory 1220 has a storage space 1230 for executing program codes of any method steps in the above methods.
- the storage space 1230 for program codes may include respective program codes 1231 for implementing various steps in the above method.
- These program codes can be read or written into the processor 1210.
- These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards, or floppy disks.
- Such a computer program product is usually a portable or fixed storage unit as described with reference to FIG. 13.
- the storage unit may have storage segments, storage spaces, etc. arranged similarly to the storage 1220 in the server of FIG. 12.
- the program code can be compressed in an appropriate form, for example.
- the storage unit includes computer-readable codes 1231', that is, codes that can be read by, for example, a processor such as 1210, which, when run by a server, causes the server to perform the steps in the method described above. These codes, when run by the server, cause the server to execute the steps in the method described above.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- Theoretical Computer Science (AREA)
- Databases & Information Systems (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Health & Medical Sciences (AREA)
- General Physics & Mathematics (AREA)
- Bioethics (AREA)
- Health & Medical Sciences (AREA)
- Storage Device Security (AREA)
Abstract
一种用于数据传输的安全保密方法和***,其中,将需共享的一项或多项原始文件信息中的每一项随机分为两个部分,将被分割的一部分存放于管理端,另一部分存放于本地设备;通过用户请求对被分割的信息分别进行加密;并将密钥分享给目标共享者;目标共享者从云端服务器下载被分割的部分数据;目标共享者利用所获得的密钥对下载后的部分数据和存储于本地设备的另一部分信息分别进行解密认证,恢复并获得完整的被保密信息。采用上述方法得到的完整数据是不可存储及再转发的,只能在认证的应用上使用;在遗失本地设备的情况下,也不会泄露敏感资料;即使在传送过程中被黑客攻击,黑客也只能获得一部分不完整的资料。
Description
本发明属于数据传输的安全保密方法和***,特别涉及一种用于在边缘和终端智能设备之间进行档案存储与分享过程中的安全保密方法和***。
随着物联网的到来,边缘和终端智能设备之间的档案分享将变得相当普及,特别是对于保护类似人脸等敏感图像的数据档案,成为研究的热点。随着云存储的出现,如何避免存放在边缘和终端智能设备的敏感数据档案在传输过程中被非法窃取成为广泛探讨的内容。
中国发明专利申请CN108804930A公开了一种防信息窃取的手机存储***将手机存储***进行分区处理,并使得所述存储***基于应用环境的安全性存取数据,以提高数据信息的安全性。通过这种安排,规避在存储部件被拆卸后,由于失去了可信计算手段的保护,其中存储的数据信息仍可能被非法泄露的风险。
中国发明专利申请CN 110704858 A公开了一种分布式环境下数据安全存储方法以及***,所述方法包括以下步骤:S1:针对所需要加密存储的数据,结合时间戳以及随机数,通过哈希算法,生成数据指纹;S2:对数据进行加密形成密文,每条数据均采用随机数做为加密密钥;S3:将密文分割成多个数据块;S4:将数据块分布式存储在各个存储节点中,各个存储节点的存储内容由统一的调度中心进行调度和管 理;在步骤S3中,在每次密文分割时,自动通过随机数确定本次分割的数量。通过将数据块存储在不同的存储节点,部分节点的损坏不会影响数据的完整性。
一般的网络安全平台***的认证授权过程,通过认证服务器的功能,实现网上授权,使用户拥有使用各个功能和网上各个服务的权力,通过和服务中心的联合,合理维护用户的权力。认证模块主要完成授权文件的生成、发放以及对计算机本机的硬件信息提取、比对工作。用户可通过文件加密授权设备将待传输出去的文件加工成密文文件。此密文文件只有指定文件加密授权设备才能打开。文件加密授权:通过文件加密授权功能,可以加密文件,并授权给指定的人阅读该文件。文件解密:通过文件解密功能,可以让有解密权限的人员读取加密文档。具体功能如下:
加密与解密模块:对在认证服务器端生成的授权文件进行加密,授权文件通过该模块进行解密。变换字符串模块:将初始时用户输入的用户名、服务注册KEY以及提取的硬件信息进行变换顺序,并发送到认证服务器。提取信息模块:用于提取计算机硬件设备产品编号(不可变动的硬件信息,包括企业控制中心、单机用户的硬件信息)。此模块具体操作过程对用户透明。生成授权文件模块:认证服务器在得到经过变换后的用户信息后,生成一个存储用户服务信息的授权文件。服务器信息比对模块:将服务器中存储的授权文件信息与传输得到的授权文件进行比对,并对授权文件中的时间进行判断和校订。授权加密文件。
然而,上述技术方案或者是针对存储卡的丢失,或者是重点在 于如何将数据块进行随机分割。现有技术中缺少安全的分享平台,以避免存放在边缘和终端智能设备的数据档案中的敏感数据档案在传输过程中被非法窃取。
发明内容
本发明的目的在于提供一种用于在边缘和终端智能设备之间进行档案存储与分享过程中的安全保密方法和***。
本发明的用于数据传输的安全保密方法,包括如下步骤:将需共享的一项或多项原始文件信息中的每一项随机分为两个部分,将被分割的一部分存放于管理端,另一部分存放于本地设备;通过用户请求对所述被分割的信息进行分别加密;并将密钥分享给目标共享者;目标共享者从云端服务器下载被分割的部分数据;目标共享者利用所获得的密钥对所述下载后的部分数据和存储于本地设备的另一部信息分别进行解密认证,恢复并获得完整的被保密信息。
本发明的另一种用于数据传输的安全保密方法,还包括存放于管理端的一部分信息为所述原始文件的数据文件和授权文件;并且存放于本地设备的一部分信息为所述原始文件的本地图元文件。
本发明的再一种用于数据传输的安全保密方法,其中,所述本地设备为一个或多个能够易于为客户所操作的客户端(205);所述管理端包括数据库服务器(105),所述数据库服务器105为专用服务器或云端服务器,用于通过超文字传输安全协议经过表现层状态转换Web服务层(108)与所述客户端通信;以及共享与安全存储管理器(106),用于将需共享的原始文件的所述数据文件存储于后端关 系数据库关系***中;以及证书授权中心服务器(107),用于与所述共享与安全存储管理器(106)通信,为所述需共享的原始文件生成所述授权文件。
本发明的再一种用于数据传输的安全保密方法,其中,所述证书授权中心服务器通过创建证书保护所述本地图元文件和所述数据文件;对需共享的每项原始文件信息基于用户的公钥生成授权文件,以确保仅有目标共享者能通过结合所生成的授权文件和所述数据文件来恢复需共享的原始文件信息。
本发明的再一种用于数据传输的安全保密方法,其中,用户的文件存储于所述客户端(205)的存储器中,所述存储器为TF卡、RS-MMC卡、miniSD卡、MS卡、CF卡、SD卡、MMC卡、M2卡。本发明的再一种用于数据传输的安全保密方法,其中,所述表现层状态转换Web服务层(108)界面的架构限制为客户端-服务器限制,将用户界面所关注的逻辑和数据存储所关注的逻辑分离开。其中,所述表现层状态转换Web服务层(108)界面的架构限制为统一接口,包括:请求中包含资源的ID(Resource identification in requests);请求中包含了各种独立资源的标识,即资源本身和发送给客户端的标识是独立的;资源通过标识来操作(Resource manipulation through representations);消息具有自我描述性(Self-descriptive messages),即每一个消息都包含足够的信息来描述如何来处理这个信息。
本发明的再一种用于数据传输的安全保密方法,其中,用户通过下列步骤从所述证书授权中心服务器(107)获得授权中心生成的数字 证书和在用户与目标共享者之间共享的公共密钥(如适用):用户在客户端向证书授权中心发出要求登录证书授权中心的要求;等待证书授权中心确认登录;用户向证书授权中心发出证书产生请求,请求获得身份以及公钥;证书授权中心向用户客户端发出所述数字证书。
本发明的再一种用于数据传输的安全保密方法,其中,所述共享与安全存储管理器(106),经过表现层状态转换服务的应用程序接口(API)调用进行下列步骤:处理用户的登录请求,在HTTPS上实现了“挑战和响应”机制,以允许多个用户一起使用;在登录验证通过后,将向用户授予带时间戳的一小段字符串(“cookie”);从客户端(205)应用程序生成二维QR码,允许在已识别的各方之间共享所述QR代码,而授予者扫描生成的QR码添加到自己的共享列表中并且明确哪些是授权的共享方以添加共享成员;处理共享数据文件及其授权文件:在创建所述共享列表后,用户从客户端(205)应用界面中选择具有目标共享方(一个或多个)的共享材料,对于每个所述目标共享方生成每个被授予者的授权文件,并使用被授予者的公钥签名,以确保只有相应的被授予者才能检索共享的资料;对于每个共享事件,所述共享与安全存储管理器(106)将数据文件和授权文件发送给共享各方(被授予者),并通过客户端应用程序向被授予者发出通知。
本发明的再一种用于数据传输的安全保密方法,其中,在处理用户的下载数据文件和授权文件的请求时,所述共享与安全存储管理器(106)必须验证用户具有下载权限,如果用户没有权限,则请求的数据文件和授权文件将不会被发送给该用户。
本发明的再一种用于数据传输的安全保密方法,其中,在客户端初始化的步骤中,授予者将数据文件存储在共享与安全存储管理器(106)的个人文件夹中,并将图元文件存在客户端的SD卡或USB闪存中;创建共享列表的步骤中,授予者通过扫描产生的QR-码添加多个目标共享方(被授予者),被授予者被添加到授予者自身的共享列表上,选择共享材料与所选的共享列表成员分享;在与被授予者共享文件的步骤中,授予者为被授予者准备授权文件,并将授权文件发送至共享与安全存储管理器(106);共享与安全存储管理器(106)将所述授权文件记录至数据库中;将应用程序内通知发送至被授予者;在被授予者寻回文件的步骤中,被授予者从共享与安全存储管理器(106)要求授予者的授权文件;被授予者运行拆分实用程序以从所述共享与安全存储管理器(106)下载授予者的数据文件并重建原始文件。
本发明的再一种用于数据传输的安全保密方法,其中,在加密阶段对授权文件和数据文件进行如下处理步骤:从原始数据文件中提取图元文件,并剩余的部分分割为数据文件(.usrs),将图元文件利用私钥和公钥(例如RSA-2048)进行加密,形成包含第二签名的授权文件(.usc);并且利用对提取了图元文件后的剩余数据文件进行扰乱(scramble)和加密(encrypt),形成包含第一签名的数据文件(.usrs)文件。
本发明的再一种用于数据传输的安全保密方法,其中,将所述数据文件利用进阶加密标准(“Advanced Encryption Standard”,例如AES -256)或Rijndael加密法的密钥增加至数据文件中,形成加密数据;对所述加密数据进行扰乱,其中一部分形成扰乱的图元数据,一部分形成扰乱的加密数据;将扰乱和加密的数据通过SHA256算法进行计算;所述扰乱和加密的数据经过SHA256算法计算后获得256-字节的哈希值;利用授予者的密钥签署所述256-字节哈希值,获得第一签名;将所述第一签名编入所述扰乱和加密的数据中,获得包含第一签名的扰乱和加密的数据文件。
本发明的再一种用于数据传输的安全保密方法,其中,所述图元数据由唯一标识符,源文件名称,远端文件名称,扰乱的图元数据,数据文件的AES-256密钥以及授予者证书身份组成;给所述图元数据用图元数据的AES-256密钥加密,形成加密的图元数据;将图元数据的AES-256密钥用被授予者的公钥加密,形成加密的图元数据AES-256密钥;将加密的图元数据和加密的图元数据AES-256密钥合并,形成包含图元数据密钥的加密图元数据文件,将所述包含图元数据密钥的加密图元数据文件通过SHA256算法进行计算,形成生成256位的哈希值(Hash Value),通过授予者私钥的签署,生成第二签名,综合形成带有第二签名的包含图元数据密钥的加密图元数据文件。
本发明的再一种用于数据传输的安全保密方法,其中,在恢复阶段对授权文件和数据文件进行如下步骤:将所述带有第一签名的扰乱和加密的数据文件和所述带有第二签名的包含图元数据密钥的加密图元数据文件通过图元数据进行处理获得所需要的原始文件。
本发明的再一种用于数据传输的安全保密方法,其中,针对授权文件(.usc),将所述带有第二签名的包含图元数据密钥的加密图元数据文件中的256位哈希值(Hash Value)提取出来,并将所述第二签名进行签名认证;如果所述签名合格,即将加密的图元数据文件分割为加密的图元数据AES-256密钥和加密的图元数据;如所述签名不合格,则中止处理所述图元数据文件;对于所述加密的图元数据AES-256密钥,利用被授予者的私钥(例如RSA-2048私钥)解密所述加密的图元数据AES-256密钥,形成图元数据AES-256密钥,即利用所述图元数据AES-256密钥从所述加密的图元数据中获得图元数据,所述图元数据包括上述所有唯一标识符,源文件名称,远端文件名称,扰乱的图元数据,数据文件的AES-256密钥以及授予者证书身份的信息。
本发明的再一种用于数据传输的安全保密方法,其中,针对数据文件(.usrs),将所述带有所述第一签名的扰乱和加密的数据文件中的256位哈希值(Hash Value)提取出来,并将所述第一签名进行签名认证;如所述签名合格,则利用扰乱的图元数据恢复被扰乱和加密的数据,获得机密数据,并利用数据文件AES-256密钥,解密所述加密的数据,获得数据文件。
采用上述的安全保密方法和***,得到的完整数据是不可存储及再转发的,只能在认证的应用上使用。本发明方法的优点是即使遗失了本地设备,也不会有敏感资料洩漏问题。此外,资料在传送过程中给黑客攻击,黑客可拿到的只有一部分资料,并不是完整的。
为了更清楚地说明本发明实施例中的技术方案,下面将对实施例中所需要使用的附图作简单地介绍。显而易见地,下面描述中的附图仅仅是本发明的一些实例,对于本领域普通技术人员来讲,在不付出创新性劳动的前提下,还可以根据这些附图获得其他的附图。
图1(a)为本发明的安全保密方法的流程图。
图1(b)为本发明的安全保密***的主要组件图。
图2为利用本发明的***拆分受保护文件并授权文件生成操作的示意图。
图3为利用本发明的***对共享管理器进行安全保护的示例。
图4为本发明的***客户端应用初始化以获得授权证书的示意图。
图5为本发明加密阶段授权和数据文件处理过程示意图。
图6为本发明加密阶段数据文件处理过程示意图。
图7为本发明采用的SHA-256的原理图。
图8为本发明加密阶段授权文件处理过程示意图。
图9为本发明恢复阶段的授权文件恢复过程示意图。
图10为本发明恢复阶段的数据文件恢复过程示意图。
图11为本发明的原始文件恢复步骤示意图。
图12为本发明的安全保密***的结构图。
图13为本发明的安全保密***的便携式或者固定存储单元的计算机产品图。
现结合相应的附图,对本发明的具体实施例进行描述。然而,本发明可以以多种不同的形式实施,而不应被解释为局限于此处展示的实施例。提供这些实施例只是为了本发明可以详尽和全面,从而可以将本发明的范围完全地描述给本领域的技术人员。附图中说明的实施例的详细描述中使用的措辞不应对本发明造成限制。
图1(a)为本发明的安全保密方法的流程图。在步骤101,将需保密的信息随机分为两个部分,将被分割的一部分存放于云端服务器,另一部分存放于本地设备;在步骤102,通过用户请求对所述被分割的信息进行分别加密;并将密钥分享给目标共享者;在步骤103,目标共享者从云端服务器下载被分割的部分数据;在步骤104,目标共享者利用所获得的密钥对所述下载后的部分数据和存储于本地设备的另一部信息分别进行解密认证,获得完整的被保密信息。
采用上述方法,得到的完整数据是不可存储及再转发的,只能在认证的应用上使用。本发明方法的优点是即使遗失了本地设备,也不会有敏感资料洩漏问题。此外,资料在传送过程中给黑客攻击,黑客可拿到的只有一部分资料,并不是完整的。
图1(b)为本发明的安全保密***的主要组件图。本发明的安全保密***包含客户端110,所述客户端包括多个用户端本地设备或终端智能设备,以及管理端111;所述客户端110利用超文字传输安全协议(Hypertext Transfer Protocol Secure,HTTPS)通过网际互连协议网络(Internet Protocol network)109经过表现层状态转换 (“REpresentational State Transfer”,REST)Web服务层108与所述管理端111进行通信。
其中,REST是一种基于Web标准的软件架构,它使用HTTP协议处理数据通信。它以资源为中心,其中每个组成部分都是一个资源,并且资源通过使用HTTP标准方法的公共接口访问。一个Web服务就是一个用于在应用程序或***之间交换数据的开放协议和标准的集合。使用不同语言编写以及运行在不同平台上的软件应用可以使用Web服务跨计算机网络交换数据,比如互联网的方式类似于一台计算机上的进程通信。这种互操作性(比如,Java和Python,或者Windows和Linux应用程序之间)归功于开放标准的使用。
本发明的安全保密***的管理端111包含数据库服务器105,所述数据库服务器105可以部署在专用服务器或公共云平台上。如上文所述通过HTTP-S连接本发明的安全保密***的客户端110,例如边缘和终端智能设备,到数据库服务器105,以防止网络攻击。本发明的安全保密***的管理端111还包含共享与安全存储管理器106,所述共享与安全存储管理器106用于存储和管理共享文件,与证书授权中心服务器107进行通信。对于每个单独的共享文件,文件格式包括但是不限于:.jpg,.png。每个被共享的文件需要经过分割、授权加密、存储和恢复过程。
所述共享文件被随机分割为两个不同的部分,分别存储于本发明的安全保密***的客户端110和管理端111的公共共享存储区中,所述公共存储区包括共享和安全存储管理器106和数据库服务器105。 客户端110通常为客户终端的电话或者电脑或者平板电脑等易于为客户所操作的设备,存储在客户端110的文件一般为本地图元文件(resident metafile)。图元文件的格式一般为wmf格式,是一个以二进制编码的、设备无关格式的多个结构的集合,这些结构包括图元文件头、调色板(可选的)、图元文件内容的文本描述(可选的)、图元文件记录。公共共享存储区存储相应的数据文件,所述的数据文件是指本地图元文件以外的部分。
图2为利用本发明的***拆分受保护文件并授权文件生成操作的示意图。对于每一项单独被共享的材料,保密文件存储器将原始文件201分为两个加密的并且互相有联系的部分。其中一部分(即本地图元文件202)存储在客户端110的手机或电脑或其他移动终端205中,另外一部分(即相应的数据文件203)存储在公共共享存储器(即共享管理器和保安存储器206)中。从原始文件201生成授权文件204,并存储于所述共享管理器和保安存储器206中。
对所述图元文件和所述数据文件分别进行加密操作。例如,采用CA创建的证书保护所述图元文件和数据文件。对于共享的多项文件,在每个单独的共享事件中生成授权文件。而且,每个授权文件都将基于共享方的公钥生成,以确保只有受邀方才能通过结合相应的授权文件和数据文件来恢复共享的资料。在下文中将详述所述授权加密过程。
对于共享管理器206服务器端的应用,所述共享管理器和保安存储器206处理共享记录,并且共享事件将存储在后端关系数据库管 理***(“Relational Database Management System,RDBMS”)中。对于共享会话,与CA进行的验证过程(包括登录过程)将由共享管理器206自动处理,而无需与用户进行交互。
图3为利用本发明的***对共享管理器进行安全保护的示例。在用户应用端(客户端)205,用户的文件存储于客户应用端的存储器中,所述存储器包括但不限于TF卡、RS-MMC卡、miniSD卡、MS卡、CF卡、SD卡、MMC卡、M2卡等。在用户应用端205和管理端111的服务器端应用302之间设立表现层状态转换(REST,REpresentational State Transfer)界面303(即REST Web服务层108)。设置表现层状态转换界面的目的主要是便于不同软件/程序在网络(例如互联网)中互相传递信息。REST通常基于使用HTTP、URI、XML以及HTML这些现有的广泛流行的协议和标准。资源是由URI来指定。对资源的操作包括获取、创建、修改和删除,这些操作正好对应HTTP协议提供的GET、POST、PUT和DELETE方法。通过操作资源的表现形式来操作资源。资源的表现形式则是XML或者HTML,取决于读者是机器还是人、是消费Web服务的客户软件还是Web浏览器。当然也可以是任何其他的格式,例如JSON。
REST界面的架构限制的一个示例为客户端-服务器限制,客户端-服务器结构限制的目的是将客户端和服务器端的关注点分离。将用户界面所关注的逻辑和数据存储所关注的逻辑分离开来有助于提高用户界面的跨平台的可移植性。通过简化服务器模块也有助于服务器模块的可扩展性。
REST界面的架构限制的另一个示例为统一接口(Uniform Interface)这是RESTful***设计的基本出发点。它简化了***架构,减少了耦合性,可以让所有模块各自独立的进行改进。包括下列四个限制:请求中包含资源的ID(Resource identification in requests);请求中包含了各种独立资源的标识,例如,在Web服务中的URIs。资源本身和发送给客户端的标识是独立的。例如,服务器可以将自身的数据库信息以HTML XML或者JSON的方式发送给客户端,但是这些可能都不是服务器的内部记录方式。资源通过标识来操作(Resource manipulation through representations),当客户端拥有一个资源的标识,包括附带的元数据,则它就有足够的信息来删除这个资源。消息的自我描述性(Self-descriptive messages)每一个消息都包含足够的信息来描述如何来处理这个信息。例如,媒体类型(midia-type)就可以确定需要什么样的分析器来分析媒体数据。用超媒体驱动应用状态(Hypermedia as the engine of application state(HATEOAS)),同用户访问Web服务器的Home页面相似,当一个REST客户端访问了最初的REST应用的URI之后,REST客户端应该可以使用服务器端提供的链接,动态地发现所有可用的资源和可执行的操作。随着访问的进行,服务器在响应中提供文字超链接,以便客户端可以得到当前可用的操作。客户端无需用确定的编码的方式记录下服务器端所提供的动态应用的结构信息。
经过REST界面层,客户端205通过证书授权中心服务器107获得证书授权中心(Certificate Authority,CA)304的授权。具体授权过 程为,在客户端应用程序初始化期间,用户将从授权中心获得如下信息:(1)授权中心生成的数字证书;和(2)在各方之间共享的公共密钥(如适用)。所述信息存储在客户端移动设备和/或PC中。因此,用户的私钥将安全地存储在用户设备上,以便以后进行共享和验证过程。
客户端应用程序初始化成功后,共享管理器301将通过RESTful API调用被自动激活,以表示用户已成功注册。然后,可以实现不同方之间的共享。共享管理器301将数据存放于数据库,例如,结构化查询语言(“SQL”)数据库(“Structured Query Language server database”)中,并如上文所述,所述共享管理器301管理授权文件204和数据文件203。
在一个实施例中,当某用户与朋友(例如Bob)共享他的文件时,该用户将文件拆分为授权文件和数据文件。授权文件使用Bob的公钥加密,因此,只有Bob可以解密它。
图4为本发明的***客户端应用初始化以获得授权证书的示意图。在步骤401,用户在客户端向证书授权中心发出要求登录CA中心的要求;在步骤402,等待CA中心确认登录,随后,在步骤403,用户向证书授权中心发出证书产生请求,请求获得身份以及公钥;最后,在步骤404,CA中心向用户客户端发出证书。
下文详细说明文件共享阶段共享管理器301在处理共享事件时的工作过程。
访问共享管理器服务:在文件共享的阶段,对于共享管理器301 的服务器端的应用,经过RESTful服务API调用提供了以下服务:客户的登录请求;添加共享成员;处理共享数据文件及其授权文件。该服务简化了与包括移动和PC应用程序在内的各种客户端的连接。
在客户的登录请求步骤中,客户的登录请求处理用户的用户注册和登录请求。并且,它在HTTPS上实现了“挑战和响应”机制,以允许多个用户一起使用。拥有成功的登录验证后,共享管理器将向用户授予带时间戳的cookie,以进行后续操作。
在添加共享成员的步骤中,为了保护共享材料,共享管理器301必须严格执行对成员的验证。因此,添加共享成员通过以下方式实现:(a)从客户端205应用程序生成二维QR码,以及(b)服务器端工作以表示出哪些是授权的共享方,即谁有权获取文件。在客户端205的应用程序上,可以直接生成QR码,以允许在已识别的各方之间共享所述QR代码,而授予者只需扫描生成的QR码即可添加到自己的共享列表中。然后,授予者可以选择所需的共享方以进行安全共享。对于被授予者,CA将在共享过程中提供其公钥,以便用于生成授权文件。
在处理共享数据文件及其授权文件的步骤中,创建共享列表后,授予者可以从客户端205应用界面中选择具有目标共享方(一个或多个)的共享材料。对于每个人,将生成每个被授予者的授权文件,并使用被授予者的公钥签名,以确保只有相应的被授予者才能检索共享的资料。对于每个共享事件,共享管理器301将数据文件和授权文件发送给共享各方(被授予者),并通过客户端应用程序向被授予者发 出通知。
在处理用户的下载数据文件和授权文件的请求时,共享管理器301必须验证用户具有下载权限。如果用户没有权限,则请求的数据文件和授权文件将不会被发送给该用户。
行动过程中的共享:行动过程中的共享分为下列主要步骤:
在客户端初始化的步骤中,授予者将数据文件存储在共享管理器301的个人文件夹中,并将图元文件存在手机的SD卡或USB闪存中。
在创建共享列表的步骤中,授予者通过扫描产生的QR-码添加多个目标共享方(被授予者),被授予者被添加到授予者自身的共享列表上,选择共享材料与所选的共享列表成员分享。
在与被授予者共享文件的步骤中,授予者为被授予者准备授权文件,并将授权文件发送至共享管理器301;共享管理器301将所述授权文件记录至数据库中;将应用程序内通知发送至被授予者。
在被授予者寻回文件的步骤中,被授予者从共享管理器301要求授予者的授权文件;被授予者运行拆分实用程序以从共享管理器301下载授予者的数据文件并重建原始文件。
下文详细描述处理授予者原始文件的过程,除了本地图元文件外,将原始文件分成一个公共数据文件(包含大量文件数据)和授权文件(每个被授予者一个):
图5为本发明的加密阶段授权和数据文件处理过程示意图。对授权文件和数据文件的处理步骤如下:如上文所述,从原始数据文件中 提取图元文件,并剩余的部分分割为数据文件(.usrs),将图元文件利用私钥和公钥(例如RSA-2048)进行加密,形成包含第二签名的授权文件(.usc);并且利用对提取了图元文件后的剩余数据文件进行扰乱(scramble)和加密(encrypt),形成包含第一签名的数据文件(.usrs)文件。
其中,图6为本发明加密阶段数据文件处理过程示意图,展示了授予者对数据文件的加密处理过程。在数据文件(.usrs)处理流程的一个示例中,将数据文件利用例如进阶加密标准(“Advanced Encryption Standard”,例如AES-256)或Rijndael加密法的密钥增加至数据文件中,形成加密数据;对所述加密数据进行扰乱,其中一部分形成扰乱的图元数据,一部分形成扰乱的加密数据;将扰乱和加密的数据通过一定算法进行计算,例如SHA256算法。SHA-256是SHA-2安全散列演算法2(Secure Hash Algorithm 2)的一种,是密码杂凑函数演算法标准。所述扰乱和加密的数据经过SHA256算法计算后获得256-字节的哈希值;利用授予者的密钥签署所述256-字节哈希值,获得第一签名;将所述第一签名编入所述扰乱和加密的数据中,获得包含第一签名的扰乱和加密的数据文件。
图7为本发明采用的SHA-256的原理图。图7为SHA-2的第t个加密回圈。图中的深色方块是事先定义好的非线性函数。ABCDEFGH一开始分别是八个初始值,Kt是第t个金钥,Wt是本区块产生第t个字。原讯息被切成固定长度的区块,对每一个区块,产生n个字(n视演算法而定),透过重复运作回圈n次对ABCDEFGH 这八个工作区段循环加密。最后一次回圈所产生的八段字串合起来即是此区块对应到的杂凑字串。若原讯息包含数个区块,则最后还要将这些区块产生的杂凑字串加以混合才能产生最后的杂凑字串。
图8为本发明加密阶段授权文件处理过程示意图,展示了授予者对授权文件的加密处理过程。本地图元文件存储于客户端手机上,此处的图元数据是有关于授权文件的,授权文件存储于管理端的共享管理器上,存放在管理端的共享管理器上基本有两个文件,一个是授权文件,另一个是包含图元数据的一部分.当与本地图元文件包含图元数据的另一部分整合才可以恢复原来的完整图像。在授权文件(.usc)处理流程的一个示例中,图元数据由唯一标识符(“unique ID”),源文件名称,远端文件名称,扰乱的图元数据,数据文件的AES-256密钥以及授予者证书身份组成。给所述图元数据用图元数据的AES-256密钥加密,形成加密的图元数据;将图元数据的AES-256密钥用被授予者的公钥加密,形成加密的图元数据AES-256密钥;将加密的图元数据和加密的图元数据AES-256密钥合并,形成包含图元数据密钥的加密图元数据文件,将所述包含图元数据密钥的加密图元数据文件通过一定算法进行计算,例如SHA256算法,形成生成256位的哈希值(Hash Value),通过授予者私钥的签署,生成第二签名,综合形成带有第二签名的包含图元数据密钥的加密图元数据文件。
在原始文件恢复阶段,被授予者对所述加密文件进行处理,以便从数据文件和授权文件中重建授予者的原始文件。
图9为本发明原始文件恢复阶段的授权文件恢复过程示意图,展 示了被授予者对授权文件的恢复过程。针对授权文件(.usc),将所述带有第二签名的包含图元数据密钥的加密图元数据文件中的256位哈希值(Hash Value)提取出来,并将所述第二签名进行签名认证。如果所述签名合格,即将加密的图元数据文件分割为加密的图元数据AES-256密钥和加密的图元数据;如所述签名不合格,则中止处理所述图元数据文件。对于所述加密的图元数据AES-256密钥,利用被授予者的私钥(例如RSA-2048私钥)解密所述加密的图元数据AES-256密钥,形成图元数据AES-256密钥,即利用所述图元数据AES-256密钥从所述加密的图元数据中获得图元数据,所述图元数据包括上述所有unique ID,源文件名称,远端文件名称,扰乱的图元数据,数据文件的AES-256密钥以及授予者证书身份的信息。
图10为本发明原始文件恢复阶段的数据文件恢复过程示意图,展示了被授予者对数据文件的恢复过程。针对数据文件(.usrs),将所述带有所述第一签名的扰乱和加密的数据文件中的256位哈希值(Hash Value)提取出来,并将所述第一签名进行签名认证。如所述签名合格,则利用扰乱的图元数据恢复被扰乱和加密的数据,获得机密数据,并利用数据文件AES-256密钥,解密所述加密的数据,获得数据文件。
图11为本发明的原始文件恢复步骤示意图。将所述带有第一签名的扰乱和加密的数据文件和所述带有第二签名的包含图元数据密钥的加密图元数据文件通过图元数据进行处理获得所需要的原始文件。
图12为本发明的安全保密***的结构图。例如测定距离的服务器1201。该测定距离的服务器包括处理器1210,此处的处理器可以为通用或专用芯片(ASIC/eASIC)或FPGA或NPU等,和以存储器1220形式的计算机程序产品或者计算机可读介质。存储器1220可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。存储器1220具有用于执行上述方法中的任何方法步骤的程序代码的存储空间1230。例如,用于程序代码的存储空间1230可以包括分别用于实现上面的方法中的各种步骤的各个程序代码1231。这些程序代码可以被读出或者写入到所述处理器1210中。这些计算机程序产品包括诸如硬盘,紧致盘(CD)、存储卡或者软盘之类的程序代码载体。这样的计算机程序产品通常为如参考图13所述的便携式或者固定存储单元。该存储单元可以具有与图12的服务器中的存储器1220类似布置的存储段、存储空间等。程序代码可以例如以适当形式进行压缩。通常,存储单元包括计算机可读代码1231’,即可以由例如诸如1210之类的处理器读取的代码,这些代码当由服务器运行时,导致该服务器执行上面所描述的方法中的各个步骤。这些代码当由服务器运行时,导致该服务器执行上面所描述的方法中的各个步骤。
本文中所称的“一个实施例”、“实施例”或者“一个或者多个实施例”意味着,结合实施例描述的特定特征、结构或者特性包括在本发明的至少一个实施例中。此外,请注意,这里“在一个实施例中”的词语例子不一定全指同一个实施例。
以上所述仅用于说明本发明的技术方案,任何本领域普通技术人员均可在不违背本发明的精神及范畴下,对上述实施例进行修饰与改变。因此,本发明的权利保护范围应视权利要求范围为准。本发明已结合例子在上面进行了阐述。然而,在本发明公开范围以内的上述实施例以外的其它实施例也同样可行。本发明的不同的特点和步骤可以以不同于所描述的其它方法进行组合。本发明的范围仅受限于所附的权利要求书。更一般地,本领域普通技术人员可以轻易地理解此处描述的所有的参数,尺寸,材料和配置是为示范目的而实际的参数,尺寸,材料和/或配置将取决于特定应用或本发明教导所用于的应用。
Claims (34)
- 用于数据传输的安全保密方法,包括如下步骤:将需共享的一项或多项原始文件信息中的每一项随机分为两个部分,将被分割的一部分存放于管理端,另一部分存放于本地设备;通过用户请求对所述被分割的信息进行分别加密;并将密钥分享给目标共享者;目标共享者从云端服务器下载被分割的部分数据;目标共享者利用所获得的密钥对所述下载后的部分数据和存储于本地设备的另一部信息分别进行解密认证,恢复并获得完整的被保密信息。
- 如权利要求1所述的安全保密方法,其中存放于管理端的一部分信息为所述原始文件的数据文件和授权文件;并且存放于本地设备的一部分信息为所述原始文件的本地图元文件。
- 如权利要求2所述的安全保密方法,其中所述本地设备为一个或多个能够易于为客户所操作的客户端(205);所述管理端包括数据库服务器(105),所述数据库服务器105为专用服务器或云端服务器,用于通过超文字传输安全协议经过表现层状态转换Web服务层(108)与所述客户端通信;以及共享与安全存储管理器(106),用于将需共享的原始文件的所述数据文件存储于后端关系数据库关系***中;以及证书授权中心服务器(107),用于与所述共享与安全存储管理器(106)通信,为所述需共享的原始文件生成所述授权文件。
- 如权利要求3所述的安全保密方法,其中所述证书授权中心服务器通过创建证书保护所述本地图元文件和所述数据文件;对需共享的每项原始文件信息基于用户的公钥生成授权文件,以确保仅有目标共享者能通过结合所生成的授权文件和所述数据文件来恢复需共享的原始文件信息。
- 如权利要求3所述的安全保密方法,其中用户的文件存储于所述客户端(205)的存储器中,所述存储器为TF卡、RS-MMC卡、miniSD卡、MS卡、CF卡、SD卡、MMC卡、M2卡。
- 如权利要求3所述的安全保密方法,其中所述表现层状态转换Web服务层(108)界面的架构限制为客户端-服务器限制,将用户界面所关注的逻辑和数据存储所关注的逻辑分离开。
- 如权利要求3所述的安全保密方法,其中所述表现层状态转换Web服务层(108)界面的架构限制为统一接口,包括:请求中包含资源的ID(Resource identification in requests);请求中包含了各种独立资源的标识,即资源本身和发送给客户端的标识是独立的;资源通过标识来操作(Resource manipulation through representations);消息具有自我描述性(Self-descriptive messages),即每一个消息都包含足够的信息来描述如何来处理这个信息。
- 如权利要求3所述的安全保密方法,其中用户通过下列步骤从所述证书授权中心服务器(107)获得授权中心生成的数字证书和在用户与目标共享者之间共享的公共密钥(如适用):用户在客户端向证书授权中心发出要求登录证书授权中心的要求;等待证书授权中心确认登录;用户向证书授权中心发出证书产生请求,请求获得身份以及公钥;证书授权中心向用户客户端发出所述数字证书。
- 如权利要求3所述的安全保密方法,其中所述共享与安全存储管理器(106),经过表现层状态转换服务的应用程序接口(API)调用进行下列步骤:处理用户的登录请求,在HTTPS上实现了“挑战和响应”机制,以允许多个用户一起使用;在登录验证通过后,将向用户授予带时间戳的一小段字符串(“cookie”);从客户端(205)应用程序生成二维QR码,允许在已识别的各方之间共享所述QR代码,而授予者扫描生成的QR码添加到自己的共享列表中并且明确哪些是授权的共享方以添加共享成员;处理共享数据文件及其授权文件:在创建所述共享列表后,用户从客户端(205)应用界面中选择具有目标共享方(一个或多个)的共享材料,对于每个所述目标共享方生成每个被授予者的授权文件,并使用 被授予者的公钥签名,以确保只有相应的被授予者才能检索共享的资料;对于每个共享事件,所述共享与安全存储管理器(106)将数据文件和授权文件发送给共享各方(被授予者),并通过客户端应用程序向被授予者发出通知。
- 如权利要求9所述的安全保密方法,其中在处理用户的下载数据文件和授权文件的请求时,所述共享与安全存储管理器(106)必须验证用户具有下载权限,如果用户没有权限,则请求的数据文件和授权文件将不会被发送给该用户。
- 如权利要求3所述的安全保密方法,其中在客户端初始化的步骤中,授予者将数据文件存储在共享与安全存储管理器(106)的个人文件夹中,并将图元文件存在客户端的SD卡或USB闪存中;创建共享列表的步骤中,授予者通过扫描产生的QR-码添加多个目标共享方(被授予者),被授予者被添加到授予者自身的共享列表上,选择共享材料与所选的共享列表成员分享;在与被授予者共享文件的步骤中,授予者为被授予者准备授权文件,并将授权文件发送至共享与安全存储管理器(106);共享与安全存储管理器(106)将所述授权文件记录至数据库中;将应用程序内通知发送至被授予者;在被授予者寻回文件的步骤中,被授予者从共享与安全存储管理器(106)要求授予者的授权文件;被授予者运行拆分实用程序以从所述共享与安全存储管理器(106)下载授予者的数据文件并重建原始 文件。
- 如权利要求1所述的安全保密方法,其中在加密阶段对授权文件和数据文件进行如下处理步骤:从原始数据文件中提取图元文件,并剩余的部分分割为数据文件(.usrs),将图元文件利用私钥和公钥(例如RSA-2048)进行加密,形成包含第二签名的授权文件(.usc);并且利用对提取了图元文件后的剩余数据文件进行扰乱(scramble)和加密(encrypt),形成包含第一签名的数据文件(.usrs)文件。
- 如权利要求12所述的安全保密方法,其中将所述数据文件利用进阶加密标准(“Advanced Encryption Standard”,例如AES-256)或Rijndael加密法的密钥增加至数据文件中,形成加密数据;对所述加密数据进行扰乱,其中一部分形成扰乱的图元数据,一部分形成扰乱的加密数据;将扰乱和加密的数据通过SHA256算法进行计算;所述扰乱和加密的数据经过SHA256算法计算后获得256-字节的哈希值;利用授予者的密钥签署所述256-字节哈希值,获得第一签名;将所述第一签名编入所述扰乱和加密的数据中,获得包含第一签名的扰乱和加密的数据文件。
- 如权利要求12所述的安全保密方法,其中所述图元数据由唯一标识符,源文件名称,远端文件名称,扰乱的图元数据,数据文件的AES-256密钥以及授予者证书身份组成;给所述图元数据用图元数据的AES-256密钥加密,形成加密的图元数据;将图元数据的AES-256密钥用被授予者的公钥加密,形成加密的图元数据AES -256密钥;将加密的图元数据和加密的图元数据AES-256密钥合并,形成包含图元数据密钥的加密图元数据文件,将所述包含图元数据密钥的加密图元数据文件通过SHA256算法进行计算,形成生成256位的哈希值(Hash Value),通过授予者私钥的签署,生成第二签名,综合形成带有第二签名的包含图元数据密钥的加密图元数据文件。
- 如权利要求1所述的安全保密方法,其中在恢复阶段对授权文件和数据文件进行如下步骤:将所述带有第一签名的扰乱和加密的数据文件和所述带有第二签名的包含图元数据密钥的加密图元数据文件通过图元数据进行处理获得所需要的原始文件。
- 如权利要求15所述的安全保密方法,其中针对授权文件(.usc),将所述带有第二签名的包含图元数据密钥的加密图元数据文件中的256位哈希值(Hash Value)提取出来,并将所述第二签名进行签名认证;如果所述签名合格,即将加密的图元数据文件分割为加密的图元数据AES-256密钥和加密的图元数据;如所述签名不合格,则中止处理所述图元数据文件;对于所述加密的图元数据AES-256密钥,利用被授予者的私钥(例如RSA-2048私钥)解密所述加密的图元数据AES-256密钥,形成图元数据AES-256密钥,即利用所述图元数据AES-256密钥从所述加密的图元数据中获得图元数据,所述图元数据包括上述所有唯一标识符,源文件名称,远端文件名称,扰乱的图元数据,数据文件的AES-256密钥以及授予者证书身份的信息。
- 如权利要求15所述的安全保密方法,其中针对数据文件(.usrs),将所述带有所述第一签名的扰乱和加密的数据文件中的256位哈希值(Hash Value)提取出来,并将所述第一签名进行签名认证;如所述签名合格,则利用扰乱的图元数据恢复被扰乱和加密的数据,获得机密数据,并利用数据文件AES-256密钥,解密所述加密的数据,获得数据文件。
- 用于数据传输的安全保密***,包括:分割模块,将需共享的一项或多项原始文件信息中的每一项随机分为两个部分,将被分割的一部分存放于管理端,另一部分存放于本地设备;加密模块,通过用户请求对所述被分割的信息进行分别加密;并分享及数据下载模块,将密钥分享给目标共享者;目标共享者从云端服务器下载被分割的部分数据;认证与恢复模块,目标共享者利用所获得的密钥对所述下载后的部分数据和存储于本地设备的另一部信息分别进行解密认证,恢复并获得完整的被保密信息。
- 如权利要求18所述的安全保密***,其中存放于管理端的一部分信息为所述原始文件的数据文件和授权文件;并且存放于本地设备的一部分信息为所述原始文件的本地图元文件。
- 如权利要求19所述的安全保密***,其中所述本地设备为一个或多个能够易于为客户所操作的客户端(205);所述管理端包括数据库服务器(105),所述数据库服务器105为专用服务器或云端服务器,用于通过超文字传输安全协议经过表现层状态转换Web服务层(108)与所述客户端通信;以及共享与安全存储管理器(106),用于将需共享的原始文件的所述数据文件存储于后端关系数据库关系***中;以及证书授权中心服务器(107),用于与所述共享与安全存储管理器(106)通信,为所述需共享的原始文件生成所述授权文件。
- 如权利要求20所述的安全保密***,其中所述加密模块还包括所述证书授权中心服务器通过创建证书保护所述本地图元文件和所述数据文件;所述分享与下载模块还包括对需共享的每项原始文件信息基于用户的公钥生成授权文件,以确保仅有目标共享者能通过结合所生成的授权文件和所述数据文件来恢复需共享的原始文件信息。
- 如权利要求20所述的安全保密***,其中用户的文件存储于所述客户端(205)的存储器中,所述存储器为TF卡、RS-MMC卡、miniSD卡、MS卡、CF卡、SD卡、MMC卡、M2卡。
- 如权利要求20所述的安全保密***,其中所述表现层状态转换Web服务层(108)界面的架构限制为客户端-服务器限制模块,将用户界面所关注的逻辑和数据存储所关注的逻辑分离开。
- 如权利要求20所述的安全保密***,其中所述表现层状态转换Web服务层(108)界面的架构限制为统一接口模块,包括:请求中包含资源的ID(Resource identification in requests);请求中包含了各种独立资源的标识,即资源本身和发送给客户端的标识是独立的;资源通过标识来操作(Resource manipulation through representations);消息具有自我描述性(Self-descriptive messages),即每一个消息都包含足够的信息来描述如何来处理这个信息。
- 如权利要求20所述的安全保密***,其中所述加密模块还包括:用户通过从所述证书授权中心服务器(107)获得授权中心生成的数字证书和在用户与目标共享者之间共享的公共密钥(如适用),而且包括下列:验证请求模块,用户在客户端向证书授权中心发出要求登录证书授权中心的要求;确认登录模块,等待证书授权中心确认登录;证书请求模块,用户向证书授权中心发出证书产生请求,请求获得身份以及公钥;证书授予模块,证书授权中心向用户客户端发出所述数字证书。
- 如权利要求20所述的安全保密***,其中所述分享和下载模块中的所述共享与安全存储管理器(106),经过表现层状态转换服务的应用程序接口(API)调用,还包括下列模块:登录请求处理模块,处理用户的登录请求,在HTTPS上实现了“挑战 和响应”机制,以允许多个用户一起使用;在登录验证通过后,将向用户授予带时间戳的一小段字符串(“cookie”);确认共享成员模块,从客户端(205)应用程序生成二维QR码,允许在已识别的各方之间共享所述QR代码,而授予者扫描生成的QR码添加到自己的共享列表中并且明确哪些是授权的共享方以添加共享成员;共享数据文件和授权文件模块,处理共享数据文件及其授权文件:在创建所述共享列表后,用户从客户端(205)应用界面中选择具有目标共享方(一个或多个)的共享材料,对于每个所述目标共享方生成每个被授予者的授权文件,并使用被授予者的公钥签名,以确保只有相应的被授予者才能检索共享的资料;对于每个共享事件,所述共享与安全存储管理器(106)将数据文件和授权文件发送给共享各方(被授予者),并通过客户端应用程序向被授予者发出通知。
- 如权利要求26所述的安全保密***,其中所述认证和恢复模块还包括:验证模块,在处理用户的下载数据文件和授权文件的请求时,所述共享与安全存储管理器(106)必须验证用户具有下载权限,如果用户没有权限,则请求的数据文件和授权文件将不会被发送给该用户。
- 如权利要求20所述的安全保密***,其中所述分享和下载模块还包括:存储模块,授予者将数据文件存储在共享与安全存储管理器(106)的个人文件夹中,并将图元文件存在客户端的SD卡或USB闪存中;共享列表创建模块,授予者通过扫描产生的QR-码添加多个目标共享方(被授予者),被授予者被添加到授予者自身的共享列表上,选择共享材料与所选的共享列表成员分享;共享模块,授予者为被授予者准备授权文件,并将授权文件发送至共享与安全存储管理器(106);共享与安全存储管理器(106)将所述授权文件记录至数据库中;通知模块,将应用程序内通知发送至被授予者;所述认证与恢复模块,还包括被授予者从共享与安全存储管理器(106)要求授予者的授权文件;被授予者运行拆分实用程序以从所述共享与安全存储管理器(106)下载授予者的数据文件并重建原始文件。
- 如权利要求18所述的安全保密***,其中所述加密模块,还包括从原始数据文件中提取图元文件,并剩余的部分分割为数据文件(.usrs),将图元文件利用私钥和公钥(例如RSA-2048)进行加密,形成包含第二签名的授权文件(.usc);并且利用对提取了图元文件后的剩余数据文件进行扰乱(scramble)和加密(encrypt),形成包含第一签名的数据文件(.usrs)文件。
- 如权利要求29所述的安全保密***,其中将所述数据文件利用进阶加密标准(“Advanced Encryption Standard”,例如AES-256)或Rijndael加密法的密钥增加至数据文件中,形成加密数据;对所述加密数据进行扰乱,其中一部分形成扰乱的图元数据,一部分形成扰乱的加密数据;将扰乱和加密的数据通过SHA256算法进行计算;所述扰乱和加密的数据经过SHA256算法计算后获得 256-字节的哈希值;利用授予者的密钥签署所述256-字节哈希值,获得第一签名;将所述第一签名编入所述扰乱和加密的数据中,获得包含第一签名的扰乱和加密的数据文件。
- 如权利要求29所述的安全保密***,其中所述图元数据由唯一标识符,源文件名称,远端文件名称,扰乱的图元数据,数据文件的AES-256密钥以及授予者证书身份组成;给所述图元数据用图元数据的AES-256密钥加密,形成加密的图元数据;将图元数据的AES-256密钥用被授予者的公钥加密,形成加密的图元数据AES-256密钥;将加密的图元数据和加密的图元数据AES-256密钥合并,形成包含图元数据密钥的加密图元数据文件,将所述包含图元数据密钥的加密图元数据文件通过SHA256算法进行计算,形成生成256位的哈希值(Hash Value),通过授予者私钥的签署,生成第二签名,综合形成带有第二签名的包含图元数据密钥的加密图元数据文件。
- 如权利要求18所述的安全保密***,其中所述认证和恢复模块,将所述带有第一签名的扰乱和加密的数据文件和所述带有第二签名的包含图元数据密钥的加密图元数据文件通过图元数据进行处理获得所需要的原始文件。
- 如权利要求32所述的安全保密***,其中针对所述授权文件(.usc),将所述带有第二签名的包含图元数据密钥的加密图元数据文件中的256位哈希值(Hash Value)提取出来,并将所述第二签名进行签名认证;如果所述签名合格,即将加密的图元数据文件分割为加 密的图元数据AES-256密钥和加密的图元数据;如所述签名不合格,则中止处理所述图元数据文件;对于所述加密的图元数据AES-256密钥,利用被授予者的私钥(例如RSA-2048私钥)解密所述加密的图元数据AES-256密钥,形成图元数据AES-256密钥,即利用所述图元数据AES-256密钥从所述加密的图元数据中获得图元数据,所述图元数据包括上述所有唯一标识符(“unique ID”),源文件名称,远端文件名称,扰乱的图元数据,数据文件的AES-256密钥以及授予者证书身份的信息。
- 如权利要求32所述的安全保密***,其中针对所述数据文件(.usrs),将所述带有所述第一签名的扰乱和加密的数据文件中的256位哈希值(Hash Value)提取出来,并将所述第一签名进行签名认证;如所述签名合格,则利用扰乱的图元数据恢复被扰乱和加密的数据,获得机密数据,并利用数据文件AES-256密钥,解密所述加密的数据,获得数据文件。
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202010351824.9A CN113572614B (zh) | 2020-04-28 | 2020-04-28 | 用于数据传输的安全保密方法和*** |
CN202010351824.9 | 2020-04-28 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2021218885A1 true WO2021218885A1 (zh) | 2021-11-04 |
Family
ID=78158275
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2021/089789 WO2021218885A1 (zh) | 2020-04-28 | 2021-04-26 | 用于数据传输的安全保密方法和*** |
Country Status (2)
Country | Link |
---|---|
CN (1) | CN113572614B (zh) |
WO (1) | WO2021218885A1 (zh) |
Cited By (12)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN113794560A (zh) * | 2021-11-05 | 2021-12-14 | 深邦智能科技(青岛)有限公司 | 一种治超仪表数据传输加密方法及其*** |
CN114301634A (zh) * | 2021-12-09 | 2022-04-08 | 江苏网进科技股份有限公司 | 一种基于Oauth协议的门户***用户共享方法 |
CN114338222A (zh) * | 2022-01-11 | 2022-04-12 | 杭州弗兰科信息安全科技有限公司 | 一种密钥申请方法、***、装置及服务端 |
CN114500035A (zh) * | 2022-01-24 | 2022-05-13 | 杭州天宽科技有限公司 | 一种基于服务数据共享云平台的数据加密*** |
CN115001720A (zh) * | 2022-08-05 | 2022-09-02 | 北京融数联智科技有限公司 | 联邦学习建模安全传输的优化方法、装置、介质和设备 |
CN115208615A (zh) * | 2022-05-20 | 2022-10-18 | 北京科技大学 | 一种数控***数据加密传输方法 |
CN116155497A (zh) * | 2023-01-06 | 2023-05-23 | 南京通力峰达软件科技有限公司 | 一种车联网用户应用程序中的敏感数据加密和保存方法 |
CN116821942A (zh) * | 2023-08-30 | 2023-09-29 | 北京紫光青藤微***有限公司 | 用于写入数据的方法及*** |
CN116884556A (zh) * | 2023-09-07 | 2023-10-13 | 徐州医科大学 | 一种基于内联区块链的医学数据安全共享平台 |
CN117240625A (zh) * | 2023-11-14 | 2023-12-15 | 武汉海昌信息技术有限公司 | 一种涉及防篡改的数据处理方法、装置及电子设备 |
CN117353919A (zh) * | 2023-12-01 | 2024-01-05 | 卓望数码技术(深圳)有限公司 | 基于秘钥分享算法的数据安全存储方法、*** |
CN117792613A (zh) * | 2022-10-13 | 2024-03-29 | 道和邦(广州)电子信息科技有限公司 | Cspki基于洛数超算预密钥跨域安全通讯算法 |
Families Citing this family (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN115547441B (zh) * | 2022-09-14 | 2023-10-20 | 广东聚健康信息科技有限公司 | 一种基于个人健康医疗数据的安全获取方法及*** |
CN115580489B (zh) * | 2022-11-24 | 2023-03-17 | 北京百度网讯科技有限公司 | 数据传输方法、装置、设备及存储介质 |
CN117353940B (zh) * | 2023-10-23 | 2024-05-28 | 深圳市晶封半导体有限公司 | 一种数据传输链数据存储装置及方法 |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2002063852A2 (en) * | 2001-02-06 | 2002-08-15 | Hewlett-Packard Company | Method and apparatus for partial encryption of contents |
CN101751527A (zh) * | 2009-12-16 | 2010-06-23 | 梁文 | 多媒体文件在复制传播过程中的版权保护方法 |
CN102664928A (zh) * | 2012-04-01 | 2012-09-12 | 南京邮电大学 | 一种用于云存储的数据安全存取方法及用户端*** |
CN105356997A (zh) * | 2015-08-06 | 2016-02-24 | 华南农业大学 | 基于公共云的安全的分布数据管理方法 |
Family Cites Families (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102300093A (zh) * | 2011-08-31 | 2011-12-28 | 华中科技大学 | 一种用于数据文件分发的加密方法 |
CN103685162A (zh) * | 2012-09-05 | 2014-03-26 | ***通信集团公司 | 文件存储和共享方法 |
CN102833346B (zh) * | 2012-09-06 | 2015-12-02 | 上海海事大学 | 基于存储元数据的云敏感数据安全保护***及方法 |
-
2020
- 2020-04-28 CN CN202010351824.9A patent/CN113572614B/zh active Active
-
2021
- 2021-04-26 WO PCT/CN2021/089789 patent/WO2021218885A1/zh active Application Filing
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2002063852A2 (en) * | 2001-02-06 | 2002-08-15 | Hewlett-Packard Company | Method and apparatus for partial encryption of contents |
CN101751527A (zh) * | 2009-12-16 | 2010-06-23 | 梁文 | 多媒体文件在复制传播过程中的版权保护方法 |
CN102664928A (zh) * | 2012-04-01 | 2012-09-12 | 南京邮电大学 | 一种用于云存储的数据安全存取方法及用户端*** |
CN105356997A (zh) * | 2015-08-06 | 2016-02-24 | 华南农业大学 | 基于公共云的安全的分布数据管理方法 |
Cited By (22)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN113794560B (zh) * | 2021-11-05 | 2024-05-10 | 深邦智能科技集团(青岛)有限公司 | 一种治超仪表数据传输加密方法及其*** |
CN113794560A (zh) * | 2021-11-05 | 2021-12-14 | 深邦智能科技(青岛)有限公司 | 一种治超仪表数据传输加密方法及其*** |
CN114301634A (zh) * | 2021-12-09 | 2022-04-08 | 江苏网进科技股份有限公司 | 一种基于Oauth协议的门户***用户共享方法 |
CN114338222A (zh) * | 2022-01-11 | 2022-04-12 | 杭州弗兰科信息安全科技有限公司 | 一种密钥申请方法、***、装置及服务端 |
CN114338222B (zh) * | 2022-01-11 | 2024-02-06 | 杭州弗兰科信息安全科技有限公司 | 一种密钥申请方法、***、装置及服务端 |
CN114500035A (zh) * | 2022-01-24 | 2022-05-13 | 杭州天宽科技有限公司 | 一种基于服务数据共享云平台的数据加密*** |
CN114500035B (zh) * | 2022-01-24 | 2023-06-23 | 杭州天宽科技有限公司 | 一种基于服务数据共享云平台的数据加密*** |
CN115208615B (zh) * | 2022-05-20 | 2023-12-19 | 北京科技大学 | 一种数控***数据加密传输方法 |
CN115208615A (zh) * | 2022-05-20 | 2022-10-18 | 北京科技大学 | 一种数控***数据加密传输方法 |
CN115001720A (zh) * | 2022-08-05 | 2022-09-02 | 北京融数联智科技有限公司 | 联邦学习建模安全传输的优化方法、装置、介质和设备 |
CN115001720B (zh) * | 2022-08-05 | 2022-10-04 | 北京融数联智科技有限公司 | 联邦学习建模安全传输的优化方法、装置、介质和设备 |
CN117792613A (zh) * | 2022-10-13 | 2024-03-29 | 道和邦(广州)电子信息科技有限公司 | Cspki基于洛数超算预密钥跨域安全通讯算法 |
CN116155497B (zh) * | 2023-01-06 | 2023-09-29 | 南京通力峰达软件科技有限公司 | 一种车联网用户应用程序中的敏感数据加密和保存方法 |
CN116155497A (zh) * | 2023-01-06 | 2023-05-23 | 南京通力峰达软件科技有限公司 | 一种车联网用户应用程序中的敏感数据加密和保存方法 |
CN116821942B (zh) * | 2023-08-30 | 2023-12-22 | 北京紫光青藤微***有限公司 | 用于写入数据的方法及*** |
CN116821942A (zh) * | 2023-08-30 | 2023-09-29 | 北京紫光青藤微***有限公司 | 用于写入数据的方法及*** |
CN116884556B (zh) * | 2023-09-07 | 2024-01-12 | 苏州慧睿康智能科技有限公司 | 一种基于内联区块链的医学数据安全共享平台 |
CN116884556A (zh) * | 2023-09-07 | 2023-10-13 | 徐州医科大学 | 一种基于内联区块链的医学数据安全共享平台 |
CN117240625A (zh) * | 2023-11-14 | 2023-12-15 | 武汉海昌信息技术有限公司 | 一种涉及防篡改的数据处理方法、装置及电子设备 |
CN117240625B (zh) * | 2023-11-14 | 2024-01-12 | 武汉海昌信息技术有限公司 | 一种涉及防篡改的数据处理方法、装置及电子设备 |
CN117353919A (zh) * | 2023-12-01 | 2024-01-05 | 卓望数码技术(深圳)有限公司 | 基于秘钥分享算法的数据安全存储方法、*** |
CN117353919B (zh) * | 2023-12-01 | 2024-03-26 | 卓望数码技术(深圳)有限公司 | 基于秘钥分享算法的数据安全存储方法、*** |
Also Published As
Publication number | Publication date |
---|---|
CN113572614A (zh) | 2021-10-29 |
CN113572614B (zh) | 2023-07-14 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2021218885A1 (zh) | 用于数据传输的安全保密方法和*** | |
JP6941146B2 (ja) | データセキュリティサービス | |
US10090998B2 (en) | Multiple authority data security and access | |
US20190311148A1 (en) | System and method for secure storage of electronic material | |
WO2019199288A1 (en) | System and method for secure storage of electronic material | |
CN104662870A (zh) | 数据安全管理*** | |
CN109495251B (zh) | 基于密钥卡的抗量子计算智能家庭云存储方法和*** | |
JP2016510962A (ja) | 暗号化ネットワークストレージスペース | |
CN113067699B (zh) | 基于量子密钥的数据共享方法、装置和计算机设备 | |
US20090022319A1 (en) | Method and apparatus for securing data and communication | |
JP2016508699A (ja) | データセキュリティサービス | |
WO2020123926A1 (en) | Decentralized computing systems and methods for performing actions using stored private data | |
AU2018100503A4 (en) | Split data/split storage | |
JP2022542095A (ja) | 強化された安全な暗号化及び復号化システム | |
CN110996132A (zh) | 一种视频图像拆分加密传输方法、装置和*** | |
Zhang et al. | Cloud shredder: Removing the laptop on-road data disclosure threat in the cloud computing era | |
JP2002366523A (ja) | 可変認証情報を用いた資格認証方法 | |
CN116132037A (zh) | 一种安全隐蔽通信方法 | |
TWI844338B (zh) | 無密碼身分驗證方法與電腦程式產品 | |
US20230403145A1 (en) | Method for managing filesystem elements, method for setting up user access to a storage system, system and non-transitory computer readable storage medium | |
Latha et al. | BLOCK CHAIN BASED SECURED DATA SHARING SYSTEM FOR CLOUD ENVIRONMENT | |
KR20230024279A (ko) | 컴퓨터 네트워크에서 제어된 손상을 이용하여 키를 생성하는 방법 | |
JP2024043587A (ja) | ファイル共有システム及び方法 | |
Urs et al. | Comparitive study on existing and proposed system of access control with anonymous authentication of DA TA stored | |
Shalini et al. | Implementation of Multi-Party Key Authentication and Steganography for Secured Data Transaction in Cloud |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 21797546 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
32PN | Ep: public notification in the ep bulletin as address of the adressee cannot be established |
Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 20.02.2023) |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 21797546 Country of ref document: EP Kind code of ref document: A1 |