CN118260775A

CN118260775A - Method for controlling authority of encrypted file

Info

Publication number: CN118260775A
Application number: CN202211682081.9A
Authority: CN
Inventors: 朱明�; 杨黎明; 谢平平
Original assignee: Shandong Chinasoft Goldencis Software Co ltd
Current assignee: Shandong Chinasoft Goldencis Software Co ltd
Priority date: 2022-12-26
Filing date: 2022-12-26
Publication date: 2024-06-28

Abstract

The invention provides a method for controlling authority of an encrypted file, which comprises the following steps: defining a structure body for storing information required by encryption and decryption and authority; and II: the administrator distributes and distributes one or more pieces of random binary data for different department computers, and the random binary data are used as key fields and stored in the local computer; thirdly,: when encrypting the file, generating a real encryption key according to the key field, and writing the key field and the rest of the structural body into the encrypted file head; fourth, the method comprises the following steps: when a user needs to decrypt the file, judging whether the file is an encrypted file or not by checking the structural body, and if not, not executing decryption operation; if yes, the key is read and compared with the key stored in the computer, if the key has an intersection, the key is judged to have authority to decrypt, and if the key has no intersection, the key is judged to have no authority to decrypt. The invention realizes more flexible control of file authority, small occupied data volume, and easy expansion and difficult cracking of the authority and key generation algorithm.

Description

Method for controlling authority of encrypted file

Technical Field

The invention relates to a method for controlling authority of an encrypted file, belonging to the technical field of file encryption and decryption authority management.

Background

In the safe use process of the terminal computer, files are required to be encrypted, and files which flow to other departments are subjected to authority control through management mechanisms such as secret keys. For example, a certain file under the financial department can only be decrypted and opened under the financial department after being encrypted, and other departments cannot normally decrypt and open under the logistic department. And the financial department and the logistics department can decrypt and open a certain file after encrypting the file.

The relevant information such as encryption and authority control of the file is stored by opening a section of space at the head or the tail of the file. Most of the existing implementation methods directly write the information such as department ID, secret key and the like into the encrypted file as is. The written department IDs have limited numbers, the authorities are not easy to allocate and expand, and the occupied data is more. The secret key is stored in the encrypted file and is easy to crack and compromise.

Disclosure of Invention

In order to solve the problems, the invention provides a method for controlling the authority of an encrypted file, which has the following specific technical scheme,

A method of controlling rights to an encrypted file, comprising the steps of:

Step one: defining a structure body for storing information required by encryption and decryption and authority;

step two: the administrator distributes and distributes one or more pieces of random binary data for different department computers, and the random binary data are used as key fields and stored in the local computer;

Step three: when encrypting the file, generating a real encryption key through operation according to the key field, and writing the key field and the residual field of the structural body into the encrypted file head;

Step four: when a user needs to decrypt the file, judging whether the file is an encrypted file or not by checking the structural body, and if not, not executing decryption operation; if yes, the key is read and compared with the key stored in the computer, if the key has an intersection, the key is judged to have authority to decrypt, and if the key has no intersection, the key is judged to have no authority to decrypt.

Preferably, the structure includes a magic field, crcsum field, a key field, an encrypted_size, and an original_size field.

Further, the magic field is an int32_t type, four-byte size, fixed field, and is used for judging whether the file is an encrypted file.

Further, the crcsum field is of the int32_t type, four bytes in size, and crc check, which is used for checking the structure data and preventing tampering.

Further, the key is an int32_t array, the default array size is 16, and the information required by judging the authority and generating the decryption key is judged.

Further, the encrypted_size and the original_size are of the type int64_t, and are used for recording the sizes of plaintext and ciphertext files.

The invention realizes more flexible control of file authority, small occupied data volume, easy expansion of authority and key generation algorithm, difficult cracking, flexible control of encrypted file authority without storing real key, and no relation with platform, and supports all operating systems.

Drawings

FIG. 1 is a flow chart of the operation of the present invention for encrypting a file.

Fig. 2 is a flowchart of the present invention for decrypting a file.

Detailed Description

The following description of the embodiments of the present invention will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present invention, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.

The technical terms related to the invention are explained as follows:

encryption and decryption: through an algorithm, the plaintext and the ciphertext are converted with each other;

Secret key: a parameter, a parameter entered in an algorithm for interconversion between plaintext and ciphertext.

As shown in fig. 1 and 2, a method for controlling authority of an encrypted file is specifically implemented as follows:

Step one: defining a C/C++ language structure body for storing information required by encryption and decryption and authority; the structure includes a mac field, crcsum field, keys field, encrypted_size, and original_size field.

The magic field is of the type int32_t, four bytes in size, and is a fixed field, the invention is fixed to 0x67647362, and the abbreviation of the corresponding character string "gdsb", namely "goldsandbox", is used for judging whether the file is an encrypted file.

The crcsum field is of the type int32_t, four bytes in size and crc check, and is used for checking structural data and preventing tampering.

And the key is an int32_t array, the default array size is 16, and the information required by judging the authority and generating the decryption key is judged.

The encrypted_size and the original_size are of the type int64_t, and are used for recording the sizes of plaintext and ciphertext files.

Step two: an administrator distributes and distributes one or more random binary data to different department computers according to the authority strategy to serve as a key field;

Step three: when encrypting the file, generating a real encryption key through operation according to the key field, writing the key field and the rest field of the structure body into an encrypted file header, and writing the encrypted content into the back of the file header;

Taking the encrypted file of the department A, the department B has no authority, the department C can have the authority of the encrypted file of the department A and the department B at the same time as an example, the processing flow of the scheme is as follows:

The administrator issues random authority data, department A is 0xaaaaaaaa, department B is 0xbbbbbbbb, and department C is a collection of department A and department B, namely 0xaaaaaaaa and 0xbbbbbbbb;

The department a encrypts a file, such as a playltext, txt, and fills a corresponding structure field, wherein the key field is rights data 0xaaaaaaaa of the department a, generates an encryption key, such as [ 0xabcdef ], by using an algorithm (exclusive or algorithm) through the rights data, encrypts the playltext, txt, and stores the encrypted data as encrypted.

When the encrypt.txt file is to be decrypted, reading the file header structure content, wherein the acquired key is 0xaaaaaaaa, and if the current computer is department B, 0xaaaaaaaa is not intersected with the key of department B, namely 0xbbbbbbbb, and decryption cannot be performed; if the current computer is department C, 0xaaaaaaaa has a common intersection, namely 0xaaaaaaaa, if the key of department C, then decryption can be performed normally, and a decryption key is generated through 0xaaaaaaaa, namely [ 0xabcdef ].

Although the present invention has been described with reference to the foregoing embodiments, it will be apparent to those skilled in the art that modifications may be made to the embodiments described, or equivalents may be substituted for elements thereof, and any modifications, equivalents, improvements and changes may be made without departing from the spirit and principles of the present invention.

Claims

1. A method for controlling rights of an encrypted file, comprising the steps of:

2. The method of claim 1, wherein the structure body includes a mac field, crcsum field, keys field, encrypted_size and original_size fields.

3. The method of claim 2, wherein the magic field is an int32_t type, four-byte size, fixed field, and is used to determine whether the file is encrypted.

4. The method of claim 2, wherein the crcsum field is of the type int32_t, four bytes in size, and crc check, used for checking the structure data, and preventing tampering.

5. The method of claim 2, wherein the keys is an int32_t array, the default array size is 16, and the rights are determined and information required for generating the decryption key is generated.

6. The method of claim 2, wherein the encrypted_size and the original_size are of the type int64_t for recording the size of the plaintext and ciphertext files.