CN105740725B - A kind of document protection method and system - Google Patents

Abstract

The invention discloses a file protection method and system. The system administrator creates a security directory, and generates the system administrator ID and system administrator ticket according to the information of the system administrator; the administrator has the operation authority to the user authority description table; the user Authentication uses a custom user ticket to verify user identity; all user permission information is recorded in the user permission description table; continuously detects user operations in the security directory and responds in real time whether to protect files; protection specific By extracting the content of the file, encrypting it and repackaging it into a unified format file; using the three-layer key generation structure of the file to achieve the purpose of encrypting or decrypting the file. Based on the security directory, the invention provides real-time, safe and efficient protection for files in any format by managing users, monitoring files, generating file keys in layers and managing files.

Description

A file protection method and system

technical field

The present invention relates to file protection, in particular to a sensitive file protection method and system based on a safe directory which is independent of the format of the file to be protected.

Background technique

In recent years, with the vigorous development of network and digital technology, the digitization of files has made files the most direct and common carrier for people to store sensitive information. Due to the sensitivity and confidentiality of stored information, the protection of sensitive files has attracted more and more attention.

Existing file protection tools can be divided into two categories: file protection systems and encryption software. The most common and popular file protection system at present is the EFS (Encrypted File System) provided by Microsoft Corporation. EFS provides users with sensitive information protection by encrypting the files that need to be protected. However, for files that need to be protected specified by users, EFS only provides full disk encryption, that is, the effect of file encryption is achieved by encrypting an entire disk partition at a time. This is undoubtedly quite time-consuming, because the size of the disk partition is often several GB, which is far larger than the size of the file itself, and some information irrelevant to the file is also encrypted, which is unnecessary for the user. However, some widely used encryption software (such as Lockdir) does not actually encrypt the files, but transfers the files to a Windows-specific partition, and then hides these files so that ordinary users cannot see them. Location forge a fake folder to confuse illegal users. In fact, if attackers use some file sniffing tools (such as FolderSniffer), they can quickly discover these hidden files. And because the file itself is not encrypted, the sensitive information in the file will be exposed directly, so the so-called encryption software is in fact unsafe.

Therefore, the following problems exist in the existing methods and systems related to file protection, and it is impossible to protect files comprehensively and effectively:

(1) Unable to solve the problem of when to protect sensitive documents;

When a sensitive information is intercepted by an attacker, if the information is stored in a file in plain text, the attacker can easily obtain the sensitive information in the file. Therefore, an ideal file protection mechanism needs to minimize the time that the information in the file exists in plain text. Some file protection software only protect files when the user uses the software and selects the file to be protected. Since the file exists in plain text before being selected by the user, it is easy to be leaked and obtained illegally. Therefore, this protection method is Relatively unsafe.

(2) The security of the method of protecting sensitive documents is very low;

At present, there are mainly two ways to protect sensitive files: hiding files and encrypting files. The security of the protected files of the latter is obviously higher than that of the former. However, current file protection software (such as Lockdir) is based on the perspective of convenient implementation, and most of them use the method of hiding files, so that sensitive files still exist in the computer in plain text. Once an attacker uses a file detection tool to detect hidden files, It is easy to obtain sensitive information in the file, and the security is very low.

(3) The effectiveness of encryption key management methods is low;

At present, the most common method for generating file encryption keys based on encryption-based file protection tools is to directly use user passwords. Since passwords usually contain user information (such as birthday, phone number), such encryption keys cannot resist brute force attacks. Most file systems (such as EFS) use the above methods to generate file encryption keys. The encryption key is the same for each file. Once the key of a file is cracked, other protected files in the system become unsafe. Therefore, in order to provide more secure protection for sensitive files, more efficient key generation algorithms need to be designed.

(4) It is difficult to support applications in a multi-user sharing environment;

Traditional file protection software (such as folder encryption master) can only determine the legitimacy of users based on passwords. When a user needs to share a file, a password needs to be given to the shared user. The shared user who has obtained the password has the same file operation authority as the administrator, and does not distinguish the user's use authority and operation level. Such file protection software cannot be used in a multi-user sharing environment.

(5) Unable to balance safety and effectiveness;

For users, an ideal file protection tool should balance security and effectiveness. However, because the existing file system encrypts an entire disk partition at a time, it often takes a long time to protect a file, ignoring the user's waiting time, and the efficiency is not high. Existing methods are difficult to achieve a file protection mechanism that balances the security and effectiveness of file protection tools.

Contents of the invention

In order to overcome the deficiencies of the above-mentioned prior art, the present invention provides an efficient file protection method and system, which uses a secure directory as a carrier of sensitive files to provide real-time security protection for files of any format.

The technical scheme provided by the invention is:

A file protection method, the method is based on a safe directory, provides real-time security protection for files in any format by managing users, monitoring files, generating file keys in layers and file management methods, including the following steps:

1) The system administrator creates a security directory and stores the information of the system administrator;

Specifically: the system administrator selects the directory path, and the system creates a corresponding security directory after receiving the file path, and stores the administrator's information in the user management module; in the embodiment of the present invention, the security directory path selected by the administrator will be It is processed and stored in the system. At the same time, the user management module will generate its ID and ticket after receiving the administrator information, and form an administrator authority record with its authority information and automatically record it in the user authority description table UPDL. The administrator ticket is generated by Formula 1:

Ticket _u hash＝(password _u |rand_num _u |device_info) (Formula 1)

In Formula 1, Ticket _u hash is the hash value of Ticket _u , and Ticket _u is the ticket of user u; password _u is the password of the administrator; rand_num _u is the random number generated by the user management module for the administrator. Once the number is generated, it will be recorded in the administrator's record in UPDL; and device_info refers to the bound device information (such as the server device information of a small business), which will be dynamically extracted every time a ticket needs to be generated , no logging is required. The obtained ticket will be recorded in UPDL after calculating its hash value for user verification. Due to the irreversibility of the hash function, even if the ticket is obtained, it is difficult to obtain the user's password, so such a ticket is safe.

2) Ordinary users register by entering user information, and concatenate the dynamically extracted device information bound to the security directory to obtain the user ticket of the user, and record it in the user permission description table (UPDL); the specific operations are as follows :

The user management module receives user information (including user name and password) and generates a random number for the user, and combines the random number with the user password and dynamically extracted device information bound to the security directory (the default is the local computer that created the security directory /server) in series, and get the user ticket of the user after operation with the hash function. Each newly registered user will generate a seven-tuple {user ID, user code, user role, random number, start time, end time, user ticket} and record it in the user permission description table (UPDL);

3) When an ordinary user logs in with a user name and password, the user ticket of the user is compared with the ticket of the user recorded in UPDL to determine whether the login is successful; the specific operations are as follows:

After obtaining the user name and password, the user management module generates a temporary ticket for the user in the same way as when registering, decrypts and scans the UPDL, and compares it with the correct ticket of the user recorded in the UPDL. If they are identical, log in Success, otherwise deny user login;

4) When a common user creates a new file, perform the following operations:

By continuously monitoring the user behavior in the safe directory, when the user creates a new file in the safe directory, the file is a file that needs to be protected, and the present invention protects the file; specifically, it monitors through the file monitor, and the file monitor detects Notify the file management module immediately of the user's new behavior to protect the file;

To protect the file, do the following:

41) Generate a file encryption key for the newly created file, and the file encryption key is a three-layer key generation structure;

Specifically include: the file management module receives the file protection notification from the file monitor, and requests the file encryption key of the file from the layered key management module. The hierarchical key management module uses the generation method of the three-layer key structure, using the file summary, the random number corresponding to the file, the hash value of the device information, the hash value of the absolute path of the security directory, and a master key, Generate the encryption key of the newly created file through two-layer calculation and return it to the file management module;

The method for generating the three-layer key structure specifically includes the following steps:

First, use hardware fingerprints to generate a master key, and the generated key generated by the master key will be used as a key to encrypt UPDL and generate file encryption keys for each sensitive file. The generated key is generated by formula 2

geneKey _SD ＝Z ^MK|path_SD modP (Formula 2)

In Formula 2, MK is the master key at the top of the structure in Figure 5, and path _SD is the hash value of the security directory address specified when creating the security directory. P is a large prime number, and Z is a prime factor in the finite field of P. After the generated key is calculated by formula 2, the key management module finally generates the file encryption key of the file by formula 3:

Among them, geneKey _SD refers to the generation key generated in formula 2, and It is different file information for each file generated by Formula 4. G is a constructor used to enhance the security of the entire generator function (such as selecting an odd-numbered value to construct a file encryption key)

In Equation 4, is a different message authentication code for each file, and It is a different random number recorded in the uniform format file for each file, and dev _info refers to the hash value of the device information bound to the security directory that is dynamically extracted when the file information is generated;

42) Utilize the encryption key of the newly-created file to encrypt the content of the newly-created file and package it into a self-defined unified format file;

Specifically: the file management module receives the file key returned from the hierarchical key management module, encrypts the content of the newly created file and encapsulates it into a custom unified format file; the custom unified format file includes two parts: the file header and the file content, The content of the file is the encrypted ciphertext of the original file, and the file header is the original file name and its length, the total length of the encapsulated file and its header length, the device information hash value, and the plaintext of the message verification code. Such a file protection system which has nothing to do with the file format can meet the needs of users to the greatest extent, instead of only encrypting specific files, which increases the practicability of the invention.

In the embodiment of the present invention, the self-defined unified file format adopted specifically includes:

42a) The file header of a protected file first uses an 8Byte hexadecimal string to indicate the total length of the unified format file, and the next 8Bytes then represents the length of the unified format file header;

42b) The next 32Byte of the unified format file header is the hash value of the device information bound to the security directory, a 16Byte random number, and a 32Byte message authentication code for checking the integrity of the protected file;

42c) At the end of the unified format file header, the file name and the length of the initial file are also included, which are used to decrypt and restore the original file;

42d) After the unified format file header is the encrypted original file, as the file content of the unified format file, presented in the form of cipher text; since the size of the file content is unknown and may be quite large, a symmetric encryption algorithm is used to encrypt the file content encrypt;

5) When the user modifies the existing protected file, the present invention decrypts the file through the decryption key, and restores it to the original file format; after the user modifies and saves the original file, the present invention adopts step 4) again Re-protect the file using the above protection method;

Specifically, modifying the existing protected file is: the file monitor detects that the user tries to open a protected file, and notifies the file management module to recover the protected file. The file management module uses the decryption key generated by the layered key management module to decrypt the file and restore the original file format. The user modifies and saves the original file.

The re-protection is specifically: the file monitor detects the modification behavior of the user and notifies the file management module to re-protect the file; the file management module requests a new file encryption key from the hierarchical key management module, and the hierarchical key management module Generate a new encryption key according to the new file summary of the modified file, and return it to the file management module; the file management module receives the new file encryption key, re-encrypts the modified file, and encapsulates it into a unified format file for protection stand up.

The present invention simultaneously provides a file protection system based on a security directory, including the following modules:

M1) User Management Module

This module is mainly used to control the user's access to the security directory, and provides user authority distribution and user authentication functions. It is mainly divided into two parts: access control and authority management. The present invention uses a user-defined user ticket to verify user identity, and the user ticket is transparent to the user. A security directory has its creator, such users become the managers of the security directory, and the management of other users is to manage their rights by managing their roles. All user authority information is recorded in a locked user authority description table (UPDL). Only administrators have the authority to operate UPDL. Administrators can manage other users in a multi-user operating environment by modifying relevant information in UPDL. Access to the secure directory.

M2) File Monitor

After the user creates a new file or modifies a file, the file monitor of this system can detect the user's operation behavior on the file and notify the file management module to protect the file at the first time. As a background process that has been running all the time, Folder Monitor continuously detects user operations in the secure directory and responds in real time.

M3) file management module

The file management module is the core module of this system, which is responsible for providing security protection for files. In the process of providing the protection service, the present invention does not consider the original format of the file, but extracts the content of the file, encrypts it, and repackages it into a unified format file (see FIG. 4 ). The unified format file includes two parts: the file header and the file content. The file content is the encrypted ciphertext of the original file. The file header is the original file name and the length of the file name, the total length of the packaged file and the length of the file header, and the device information hash. Hash value, the plaintext of the message authentication code. Such a file protection system which has nothing to do with the file format can meet the needs of users to the greatest extent, instead of only encrypting specific files, which increases the practicability of the invention.

M4) Hierarchical key management module

In the encryption process of the present invention, the generation of key will adopt three-layer key generation structure, produces master key respectively, generates key and file encryption key, guarantees that the master key of the first layer can be used as little as possible and Modify, and generate different encryption keys for different files at the same time, to ensure that after a file key is leaked, other file keys are still safe and it is impossible to obtain any key from the leaked key that can crack other keys Information.

Compared with prior art, the beneficial effect of the present invention is:

The present invention provides a file protection method and system, which provide real-time security protection for files in any format by managing users, monitoring files, generating file keys in layers and a file management method based on a security directory. The technical solution provided by the invention has the following advantages:

First, users can operate files within the scope of permissions as needed. For a user with administrator rights, multiple security directories can be created as required. As far as the use of a single security directory is concerned, for any user entering the security directory, use the user ticket customized by the system instead of directly using the password entered by the user to verify the user, which can ensure the security of the user's password Properly authenticate the user's identity. At the same time, in order to enable multiple users to share files, the present invention also designs and maintains a User Permission Description Table (UPDL). For different users, we give them different roles, and define operations and use security directories for users by granting permissions to roles. A set of rules for an improved role-based access control;

Secondly, considering the user's ease of use and simultaneously realizing real-time and comprehensive protection of sensitive files, the present invention designs a file monitor. As a background daemon process, the monitor has been monitoring the file operation behavior of the safe directory. When the user creates a new file in the safe directory, or copies the directory from other folders to the safe directory, the file monitor can immediately detect and notify the file management component to encrypt the file Protect. When a user modifies a sensitive file, the file monitor can also monitor this behavior and notify the file management component to re-encrypt the modified file. The file monitor enables the user's behavior to be continuously and real-time detected, and the user does not need to specifically select certain files to be encrypted, which can effectively prevent the user from forgetting to encrypt due to negligence after creating a new sensitive file;

Again, the existing encryption software can only encrypt specific file formats, and cannot encrypt and protect some file formats such as .7Z (the format used by 7-zip software) and .iso. In order to solve the problem that the file protection depends on the file format, the present invention customizes a new file format, and encapsulates the original sensitive file in a unified format file, so that files of any format can be encrypted and protected under the system. Finally, in order to enhance the security of the protection system of the present invention, we also design a hierarchical key generation structure. Using the master key, generating key and file encryption key three-layer key, finally achieve the purpose of generating a unique and irrelevant encryption key for each protected file. It can not only ensure that the core-master key of file encryption is not leaked due to frequent use, but also ensure that the key of file encryption is replaced regularly to increase the difficulty of cracking.

Description of drawings

FIG. 1 is a system structure diagram of an embodiment of the present invention.

FIG. 2 is a flowchart of a file protection method provided by an embodiment of the present invention and a relationship diagram of system modules.

FIG. 3 is a flowchart of user access control in an embodiment of the present invention.

Fig. 4 is a unified file format defined in the embodiment of the present invention.

FIG. 5 is a structural diagram of hierarchical key management in an embodiment of the present invention.

Detailed ways

Below in conjunction with accompanying drawing, further describe the present invention through embodiment, but do not limit the scope of the present invention in any way.

The present invention provides a file protection method and system, which provide real-time security protection for files in any format by managing users, monitoring files, generating file keys in layers and a file management method based on a security directory.

The present invention will be described in detail below by taking a shared security directory created by a user on a server as an example. Fig. 1 shows the system structure of the present embodiment, and Fig. 2 is the file protection method process and the system module relationship diagram provided by the present embodiment, and the specific implementation of the present invention includes the following steps:

A1) The administrator creates a security directory

The administrator enters the account password to enter the file protection system, selects an installation path on the server, and applies to the file protection system to create a safe directory.

The security directory path selected by the administrator will be processed and stored in the system. At the same time, the user management module will generate its ID and ticket after receiving the administrator information, and form an administrator authority record with its authority information and automatically record it in UPDL . The administrator ticket is generated by Formula 1:

Ticket _u hash＝(password _u |rand_num _u |device_info) (Formula 1)

In Formula 1, Ticket _u hash is the hash value of Ticket _u , and Ticket _u is the ticket of user u; password _u is the password of the administrator; rand_num _u is the random number generated by the user management module for the administrator. Once the number is generated, it will be recorded in the administrator's record in UPDL; and device_info refers to the bound device information (such as the server device information of a small business), which will be dynamically extracted every time a ticket needs to be generated , no logging is required. The obtained ticket will be recorded in UPDL after calculating its hash value for user verification. Due to the irreversibility of the hash function, even if the ticket is obtained, it is difficult to obtain the user's password, so such a ticket is safe.

A2) Ordinary user registration

After ordinary users log in to the server, they need to register first before using the security directory created by the administrator. After a common user registers, the user management module will accept the user's username and password, and generate a seven-tuple record of {ID, role, user code, start time, end time, ticket, random number} for the user and save it automatically in UPDL. In fact, the ID is the ID assigned by UPDL to each user, the user code is the hash value of the user name, the start time and the end time refer to the life cycle of the user's access to the security directory, and the generation method of the ticket is as described in formula 1. The default role information is a common user.

A3) User login

FIG. 3 is a flowchart of user access control in an embodiment of the present invention. Users log into the secure directory to manipulate sensitive files. When the user enters the username and password to log in, the user management module will receive the login username and password input by the user, and use the verification mechanism in the module to determine whether the user is a legitimate user. When checking, the access control of the user management module generates a temporary ticket according to formula 1, and then decrypts the UPDL to find the user's record. After comparing the recorded ticket with the temporary ticket, if the two are exactly the same, the user has successfully logged in and entered the security directory, otherwise the system will determine that the user is illegal and refuse the user to enter the security directory.

A4) Legal users create new files

A legitimate user uses the present invention to create a new file in the safe directory. The file monitor designed by the present invention will call the internal function to monitor the user's behavior in the safe directory in real time. When detecting the user's "new file" operation, the file monitor will immediately notify the file management module to protect the file. The file management module receives a file protection request from the file monitor.

A5) Generate file encryption key

Fig. 5 is a hierarchical key management structure provided by an embodiment of the present invention. After receiving the file protection request sent by the file monitor, the file management module requests the encryption key of the file from the hierarchical key management module. The file encryption key is generated by the key structure shown in Figure 5. First, use hardware fingerprints to generate a master key, and the generated key generated by the master key will be used as a key to encrypt UPDL and generate file encryption keys for each sensitive file. The generated key is generated by formula 2

geneKey _SD ＝Z ^MK|path_SD modP (Formula 2)

In Formula 2, MK is the master key at the top of the structure in Figure 5, and path _SD is the hash value of the security directory address specified when creating the security directory. P is a large prime number, and Z is a prime factor in the finite field of P. After calculating the generated key through formula 2, the key management module finally generates the file encryption key of the file through formula 3:

Among them, geneKey _SD refers to the generation key generated in formula 2, and It is different file information for each file generated by Formula 4. G is a constructor used to enhance the security of the entire generator function (such as selecting an odd-numbered value to construct a file encryption key)

In Equation 4, is a different message authentication code for each file, and It is a different random number recorded in the uniform format file for each file, and dev _info refers to the hash value of the device information bound to the security directory that is dynamically extracted when the file information is generated.

A6) Return the file encryption key

The hierarchical key management module returns the generated encryption key of the file to the file management module.

A7) Generate a unified format file

After the file encryption module receives the file encryption key, it uses a symmetric encryption algorithm to encrypt the content information of the sensitive file, and uses the file encryption key, the original file name and other information as the file header, and encapsulates it into a unified protected file format, Fig. 4 is the unified file format defined in the embodiment of the present invention, wherein, the file header of a protected file at first indicates the total length of the unified format file with a hexadecimal character string of 8Byte, followed by 8Bytes then Indicates the length of the unified format file header. The next 32Byte is the hash value of the device information bound to the security directory, a 16Byte random number, and a 32Byte message authentication code used to verify the integrity of the protected file. The file name and length of the original file are also included at the end of the unified format file header, which are used for decrypting and restoring the original file. After the unified format file header is the encrypted original file, which is presented as the content of the unified format file in the form of ciphertext. Since the size of the file content is unknown and can be quite large, the file content is encrypted using a symmetric encryption algorithm.

A8) The user opens a protected file

The user opens a protected file for reading. The file monitor detects the user's opening operation, and notifies the file management module to decrypt the file for use by the user.

A9) The hierarchical key management module returns the decryption key

The hierarchical key management module generates the file decryption key of the file according to Formula 3, and returns it to the file management module.

This embodiment adopts a symmetric encryption key, where the encryption key and the decryption key are the same, so the decryption key is also generated by formula 3. In this embodiment, the key is not stored, and the key is dynamically generated by formula 3 each time.

A10) The file management module restores protected files

The file management module receives the file decryption key returned by the hierarchical key management module, uses the decryption key to decrypt the protected file, and restores it to the original file for use by the user.

A11) The user copies a file to the safe directory

The user copies a file to the safe directory, and a new unprotected file appears in the safe directory. The file monitor detects user behavior in the safe directory, captures that a new file is copied to the safe directory, and immediately notifies the file management module, which encrypts and encapsulates the newly copied file into a protected file according to the protection method of the newly created file.

A12) The user copies files from the secure directory

The user copies a protected file from the security directory to another folder, and the path of the folder where the file is located has changed. The generated key generated by the key generation module according to formula 2 has changed due to the change of path_SD, so the file decryption key at this time is different from the correct decryption key, and the file cannot be decrypted and restored, ensuring that sensitive files can only be decrypted. The ability to operate in a secure directory controls the spread of sensitive files.

A13) The user modifies the file

After a user modifies a sensitive file, the summary information of the file changes. The file monitor detects the user's modification behavior and notifies the file management module to re-encrypt and package the file. The file management module receives the new file encryption key transmitted from the key management module, re-encrypts the content of the original file and encapsulates it into a new unified format file and saves it in the safe directory. Since the file digest has changed, the old key will not be able to decrypt the modified file.

A14) Administrators modify ordinary user permissions

The administrator modifies the relevant permissions of ordinary users according to the company's personnel transfer. The user management module decrypts the UPDL with the key generated in Formula 2. The administrator modifies the user's permissions by modifying the user's role. After modification, the user management module will automatically save and encrypt the UPDL.

In the above embodiments, the technical solution of the present invention can achieve the following effects:

(1) Existing file protection systems (such as the typical Windows file protection system EFS) perform file protection in units of disk partitions, and one time of file protection is exactly one encryption of the disk. Since the size of the disk partition is often very large, the encryption time is quite long. Experiments show that for files of the same size, the protection time of EFS is dozens of times longer than that of the present invention. However, the present invention protects sensitive files in units of files, and the time to protect a file is far shorter than file systems such as EFS;

(2) The protection of files by popular file protection software is based on specific formats. For some non-software-specified formats, software cannot be used for protection. However, when real small enterprises manage sensitive files, the types of files are often very large and unpredictable. Under such circumstances, file protection software cannot provide comprehensive and reliable protection measures for enterprise sensitive files. The file protection system proposed by the present invention is a file format-independent system. No matter what the format of the original file is, it will be encrypted and packaged into a unified format, which overcomes the problem that the existing file encryption software can only encrypt files of a specific format. defect;

(3) Since the system is based on a secure directory and bound to a specific device, that is to say, if sensitive files are copied to other devices or other directories, the sensitive files cannot be decrypted and read correctly, ensuring that the sensitive files can only be Operating under the control of administrators, limiting the dissemination of sensitive files;

(4) All existing file protection tools do not have the function of user rights management. For all users, as long as they have a password, they can decrypt and view and modify the file content at will. Such a file protection method can only be based on the local machine, and in small enterprises, in order to facilitate information management, some private files must be shared on the server, which requires a flexible user management method for different levels of users. user. The improved role-based access control method proposed by the present invention defines different roles for different users, and achieves the purpose of managing users by assigning different permissions to the roles, so that the present invention can also be used in an environment shared by multiple users. works well.

It should be noted that the purpose of the disclosed embodiments is to help further understand the present invention, but those skilled in the art can understand that various replacements and modifications are possible without departing from the spirit and scope of the present invention and the appended claims of. Therefore, the present invention should not be limited to the content disclosed in the embodiments, and the protection scope of the present invention is subject to the scope defined in the claims.

Claims (10)

1. A kind of file protection method, this method is based on safe directory, by managing user, monitoring file, layered generation file key and file management, provides real-time security protection for the file of any format, comprises the steps: 1) The system administrator creates a security directory; generates the system administrator ID and the system administrator ticket according to the system administrator information; combines the system administrator ID and the system administrator ticket with the authority of the system administrator The information together forms a permission record of the system administrator, which is automatically recorded in the user permission description table; the ticket of the system administrator includes the password of the system administrator, the random number generated for the system administrator, and the security directory. Specified device information; the device information bound to the security directory is dynamically extracted each time a ticket needs to be generated; 2) Ordinary users register by inputting user information, which includes user name and password, and concatenate the user information with the dynamically extracted device information bound to the security directory to generate a user ticket for the user , and then generate a seven-tuple {user ID, user code, user role, random number, start time, end time, user ticket}, which is recorded in the user permission description table; 3) A common user logs in, and compares the user ticket of the user with the ticket of the user recorded in the user authority description table to determine whether the login is successful; 4) When a common user creates a new file, perform the following operations: By continuously monitoring user behavior in the safe directory, when a user creates a new file in the safe directory, the newly created file is a file that needs to be protected. First, a file encryption key is generated for the newly created file, and then the newly created file is used to An encryption key, which encrypts the content of the newly created file and encapsulates it into a custom unified format file, thereby protecting the newly created file; 5) When the user modifies the existing protected file, the file is decrypted by the decryption key and restored to the original file format; after the user modifies and saves the original file, the protection method described in step 4) is adopted Reprotect the file. 2. The file protection method according to claim 1, wherein the system manager ticket in step 1) is generated by formula 1: Ticket _u hash＝(password _u |rand_num _u |device_info) (Formula 1) In Formula 1, Ticket _u hash is the hash value of Ticket _u ; Ticket _u is the ticket of user u; password _u is the password of the administrator; rand_num _u is the random number generated by the user management module for the administrator. Once the number is generated, it will be recorded in the record of the system administrator in the user rights description table; device_info refers to the device information bound to the security directory. 3. the file protection method as claimed in claim 1, is characterized in that, step 2) specifically performs the following operations: 21) Generate a random number for the user according to the user's username and user password; 22) concatenate the random number, the user password and the dynamically extracted device information bound to the security directory, and perform operations with a hash function to obtain the user ticket of the user; 23) Generate a seven-tuple {user ID, user code, user role, random number, start time, end time, user ticket}, and record it in the user permission description table. 4. The file protection method according to claim 1, wherein the device information bound to the security directory is a local computer or server that creates the security directory. 5. The file protection method as claimed in claim 1, wherein step 3) determines whether the user logs in successfully, specifically by performing the following operations: Obtain username and user password, generate a temporary ticket for the user according to the method of generating the user ticket described in step 2), and decrypt and scan the user authority description table to obtain the user's ticket recorded in the user authority description table; Comparing the temporary ticket with the user's ticket recorded in the user authority description table, if they are identical, the login is successful; otherwise, the user login is rejected, and the user login fails. 6. the file protection method as claimed in claim 1, is characterized in that, step 4) file is protected, specifically perform the following operations: 41) Generate a file encryption key for the new file, and the file encryption key is a three-layer key structure; the specific method for generating the file encryption key is: generate a master key for the file, and then use the The abstract of the file, the random number corresponding to the file, the hash value of the device information and the hash value of the absolute path of the security directory, generate the encryption key of the file through two-layer calculation; 42) Using the encryption key to encrypt the content of the file, and package it into a self-defined unified format file, thereby completing the protection of the file. 7. The file protection method as claimed in claim 6, wherein said generating a master key specifically generates a master key through a hardware fingerprint; said two-layer calculation generates an encryption key, specifically: generating through formula 3 File encryption key: In formula 3, geneKey _SD refers to the generated key generated by formula 2; It is different file information for each file generated by formula 4; G is a constructor, which is used to enhance the security of the entire generation function; Described formula 2 is: geneKey _SD ＝Z ^MK|path_SD mod P (Formula 2) In Formula 2, MK is the master key; path_SD is the hash value of the security directory address specified when creating the security directory; P is a large prime number; Z is the prime factor in the finite field of P; Described formula 4 is: In formula 4, is a different message authentication code for each file; It is a different random number recorded in the uniform format file for each file; dev _info refers to the hash value of the device information bound to the security directory that is dynamically extracted when the file information is generated. 8. the file protection method as claimed in claim 1, is characterized in that, step 4) described self-defining unified file format specifically comprises file header and file content, specifically as follows: 42a) The file header includes a hexadecimal string of 8Bytes for indicating the total length of the unified format file and a hexadecimal string of 8Bytes representing the length of the unified format file header; 42b) The file header also includes the following 32Bytes hash value of the device information bound to the security directory, a 16Bytes random number and a 32Bytes message authentication code for verifying the integrity of the protected file; 42c) include the file name of the initial file and the length of the initial file at the end of the file header, for restoring the original file when decrypting; 42d) After the file header is the encrypted original file, which is presented in the form of ciphertext as the file content of the unified format file. 9. A file protection system for realizing the file protection method according to any one of claims 1 to 8, said file protection system comprising a user management module, a file monitor, a file management module and a layered key management module; The user management module is used to control the user's access to the security directory, and realizes user authority distribution and user authentication; the creation of the security directory is the manager of the security directory, and has the operation authority to the user authority description table; the user authentication uses the The defined user ticket is used to verify the identity of the user; all the permission information of the user is recorded in the user permission description table; The file monitor is used to continuously detect user operations in the security directory and respond in real time whether to protect the file; The file management module is used to provide security protection for the file, and the protection is repackaged into a unified format file after extracting the file content for encryption; The hierarchical key management module is used to generate the three-layer key generation structure of the file, and the three-layer key generation structure includes the master key, the generation key and the file encryption key, so as to achieve the purpose of encrypting or decrypting the file . 10. file protection system as claimed in claim 9, is characterized in that, the format of described unified format file comprises file header and file content, and described file content is the ciphertext after original file encryption; Described file header comprises original file Name, length of original file name, total length of encapsulated file, length of file header, hash value of device information and plain text of message authentication code.