CN1889426B - Method and system for realizing network safety storing and accessing - Google Patents

Abstract

This invention discloses a method for realizing safe storing and access of networks, which configures a cryptographic key device in advance containing the ID information of user identities, a server end generates related file packets based on the information and stores it including the following steps: a, when the device accesses a customer end, the customer end sends the ID information in the device to the server, which verifies the user identity ID, b, the customer end maps the file packets in the server related to said user to the local customer end, c, the customer end processes the information mapped to the local customer end and transmits the processed information to the file packet in the server. This invention also discloses a system for realizing safe storage and access.

Description

A method and system for realizing network security storage and access

technical field

The present invention relates to the technical field of computer security, and more specifically relates to a method and system for realizing network security storage and access.

Background technique

With the continuous development and progress of society, the competition in various industries is becoming increasingly fierce. How to reduce costs and improve work efficiency in the fierce competition environment has become one of the goals pursued by every enterprise.

For example, almost all companies now need to equip employees with computers, but in fact not every employee needs to use computers every day, especially for salespeople in the company, who only use computers when they come back to the company occasionally. In view of this situation, in order to improve the efficiency of computer use and reduce costs, companies often equip 4 to 5 employees with a computer. In this way, if there are 20 people in the company, it only needs to be equipped with 4 to 5 public computers to meet the general office requirements.

However, if one computer is configured for multiple employees, it may happen that two or more employees using the same computer need to use the computer in the company, but no one uses the other computer. In this case, if one of them wants to use an idle computer, he must copy his own data to the idle computer, or set his own data as a shared file. Obviously, the actual operation is very troublesome, and the safety of the data must also be There is no guarantee, for example, there may be leaks during data transmission.

For this reason, many companies have set up servers for storing employee data files, so that each employee can use any computer to obtain the data stored on the server. However, this solution also has security problems: for the general traditional data directory sharing method, the user data stored on the server is unencrypted, and the attacker can take away the original data by attacking the server, thereby bringing users and the company. serious loss. In addition, when the current method stores data on the server through the network, there may also be a problem of leaking during network transmission.

Contents of the invention

In view of this, the main problem to be solved by the present invention is to provide a method for implementing network security storage and access, so that users can access servers safely and conveniently through computers.

The invention also provides a system for realizing network security storage and access.

In order to solve the above problems, the present invention provides the following technical solutions:

A method for realizing network security storage and access according to the present invention includes pre-configuring a key device, in which identification information of a user identity is stored, and the server side generates a corresponding file package according to the identification information of the user identity, and Save the user identity information; the method further includes the following steps:

a. When the key device is connected to the client, the client sends the identification information of the user identity in the key device to the server, and the server verifies the received user identity;

b. After the client is authenticated by the server, map the file package related to the user in the server to the client; judge whether the user's access is aimed at the file package related to the user in the server, and if so, perform step c;

c. The client processes the information in the file package mapped to the client, and sends the processed information to the file package in the server.

The user identity information stored in the key device is a public key.

The step of generating a corresponding file package according to the identification information of the user identity at the server end and storing the user identity identification information includes: generating a corresponding file package according to the identification information of the user identity, assigning a symmetric key to the file package, and using The symmetric key encrypts the file package, and then uses the public key to encrypt the symmetric key, and saves the file package, the user's public key and the encrypted symmetric key;

In step b, the client mapping the file package related to the user to the client includes: the client obtains the encrypted symmetric key from the server, and obtains the pre-encrypted symmetric key through decryption processing, and then downloads the encrypted symmetric key from the server. User-related file packages, and use the obtained symmetric key to decrypt the file package, and then map the decrypted file package to the client;

In step c, the file package that the client sends the processed information to the server is: the client encrypts the processed information with the symmetric key obtained in step b, and sends the encrypted information to the server. in the file package.

In the step b, the client obtains the pre-encrypted symmetric key through decryption processing as follows:

The client obtains the public key from the key device, and uses the public key to decrypt the encrypted symmetric key;

Or send the encrypted symmetric key to the key device, and the key device uses the public key stored by itself to decrypt the encrypted symmetric key.

The private key is further stored in the key device;

In step b, the client obtains the pre-encrypted symmetric key through decryption processing as follows:

The client obtains the private key from the key device, and uses the private key to decrypt the encrypted symmetric key;

Or the client sends the encrypted symmetric key to the key device, and the key device uses the private key to decrypt the encrypted symmetric key to obtain the pre-encrypted symmetric key, and sends the symmetric key to to the client.

In the step a, the server verifying the received user identity includes: the client sends the public key to the server, and the server judges whether the public key exists in the user identity information saved by itself, and if there is , it is determined that the verification has passed, otherwise, it is determined that the verification has not passed.

The private key is further stored in the key device;

In step a, before the server determines that the verification is passed, it further includes:

a1. The server generates a long number, encrypts the long number with the public key, and transmits the encrypted long number to the client;

a2. The client decrypts the encrypted long number with the private key in the key device to obtain the corresponding long number, generates a signature of the long number with the private key, and then sends the signature to the server;

a3. The server uses the public key to verify whether the signature is correct, and if it is correct, it is determined that the verification is passed; otherwise, it is determined that the verification is not passed.

In the step b, the client maps the relevant file packages in the server to the client as follows: mapping the relevant file packages in the server to the virtual disk in the client;

In step c, the client processing the information in the file package mapped to the client includes: processing the information through a driver program of the virtual disk.

After the step c, it further includes: after the key device is separated from the client, informing the server to close the file package mapped to the client.

A system for implementing network security storage and access according to the present invention, the system includes a key device, a client and a server, wherein,

The identification information of the user identity is stored in the key device, which is used to send the user identification information stored by itself to the server;

The client is used to verify the user identity in the key device through the server when the key device is connected, and map the file package related to the user in the server to the client after the server verification is passed. terminal, and determine whether the user's access is aimed at the file package related to the user in the server, and if so, process the information in the file package;

The server is configured to store user identity information, distribute corresponding file packages to users, verify the user identity information in the key device, and send the information in the corresponding file package to the client after the verification is passed.

The client is further used to map the file package related to the user in the server to a virtual disk or a virtual directory in the client;

The client includes a user identity confirmation module, an access control module and a network virtual driver module, wherein,

A user identity confirmation module, configured to send the user identity in the key device to the server, receive the verification information returned by the server, and send the verification information to the access control module;

The access control module is configured to send the received access request for the virtual disk or virtual directory to the network virtual driver module after receiving the verification passing information;

The network virtual driver module is used to obtain the information in the corresponding file package of the server according to the access request, and perform corresponding processing on the information.

The file package stored in the server is an encrypted file package;

The network virtual drive module further includes: an encryption and decryption module, which is used to perform decryption operations on data read from the virtual disk, and perform encryption operations on data written into the virtual disk.

The server includes a user information storage module and a user identity verification module, wherein,

The user information storage module is used to store user identification information and assign corresponding file packages to users;

The user identity verification module is used to verify the user identity information in the key device, send the verification information to the client, and send the information in the corresponding file package to the client after the verification is passed.

The user information storage module is further used to generate a symmetric key, encrypt the file package with the symmetric key, and send the symmetric key to the client;

The client is further configured to use the symmetric key to decrypt the information read from the file package, and to encrypt the information written into the file package.

The solution of the present invention pre-configures a key device storing user identity information, and the server generates a corresponding file package according to the user identity information, and saves the user identity information, and then after the key device is inserted into the client, the client Verify the user identity information in the key device through the server, and map the corresponding file package to the client after the verification is passed, and the client will process the information in the file package according to the user's needs, and Send the processed information to the corresponding file package of the server, so that the user can read the information in the server through different terminals, and because the server needs to verify the user's key device before supporting the read operation, Therefore, the security is better.

And the solution of the present invention only needs the user to set the key device in the server once, and then any client connected to the server can read and write the corresponding file package in the server. And after the user's operation is over, just pull out the key device, the client will automatically close the encrypted file, even if other people log in on this PC, they can't see the user's file.

In addition, the solution of the present invention can also encrypt the file package in the server with a symmetric key, and encrypt and transmit the symmetric key through the user's identity information, further ensuring the security of data transmission and access.

The key operation adopted in the scheme of the present invention can be a symmetric key operation, an asymmetric key operation, or other key operations, and these key operations can be completed on the client side or in the key device In other words, the scheme of the present invention provides a variety of ways to realize the key operation.

Description of drawings

Fig. 1 is the realization flowchart of the scheme of the present invention;

Fig. 2 is a schematic diagram of logic implementation of a specific embodiment in the solution of the present invention;

Fig. 3 is a system structure diagram of the solution of the present invention.

Detailed ways

The scheme of the present invention is shown in Figure 1, corresponding to the following steps:

Step 101, pre-configure the key device.

User identification information for identification is stored in the key device. The identification information may be a public key.

Step 102, the server saves the user identity information in the key device, and generates a file package corresponding to the user identity information on the server. In order to ensure security, the user identification information and the corresponding file package need to be kept separately.

In order to realize the encrypted transmission of information in the file package, the server may assign a symmetric key to each file package, and use the symmetric key to encrypt the file package. In order to ensure that the client can obtain the symmetric key and that the symmetric key will not be obtained by other clients, the corresponding symmetric key can also be encrypted with the public key, and the encrypted symmetric key can be saved. Of course, the server can also delete the stored public key and corresponding information as needed.

In addition, the symmetric key can also be distributed by the key device, and the symmetric key can be sent to the server, and the server can encrypt the file package according to the symmetric key. Among them, in order to ensure the security of the symmetric key, the symmetric key can be encrypted by the key device with the public key, and the encrypted symmetric key is sent to the server, and the server decrypts the symmetric key according to the public key .

Step 103, when the key device is connected to the client, the client sends the identification information of the user identity in the key device to the server, and the server verifies the received user identity.

If the client just sends the user identity information such as the public key to the server, the server can judge whether there is the identity information sent by the client in the user identity information saved by itself, and if it exists, the verification is considered to be passed; otherwise , considers authentication failed.

Of course, if the user identity information in the key device is a public key, and the key device also stores a private key, the server can also generate a long number after determining that it has saved the user's identity information, Use the public key to encrypt the long number, and transmit the encrypted long number to the client; the client uses the private key in the key device to decrypt the encrypted long number to obtain the corresponding long number, and use The private key generates the signature of the long number, and then sends the signature to the server; the server uses the corresponding public key to verify whether the signature is correct, and if it is correct, it is determined that the verification is passed; otherwise, it is determined that the verification is not passed.

Step 104, after the client passes the authentication of the server, it maps the file package related to the user in the server to the client.

If the file package generated in step 102 is encrypted by a symmetric key, the client also needs to obtain the corresponding symmetric key when mapping the relevant file package in the server to the client, and then use the symmetric key to pair the file package The information in the file is decrypted, and then the decrypted file package is mapped to the client. Afterwards, the user can perform operations such as reading, modifying, and saving the data in the file package. The client computer re-encrypts the modified data with a symmetric key and sends it to the server.

For obtaining a symmetric key, if the server encrypts the symmetric key, the client also needs to decrypt the symmetric key. If a symmetric encryption algorithm is used, the client can obtain the public key directly from the key device, and use the public key to decrypt the symmetric key; or send the encrypted symmetric key to the key device, and the The key device decrypts the symmetric key by using the public key stored by itself. If an asymmetric encryption algorithm is used, the private key needs to be stored in the key device, and the client can directly obtain the private key from the key device and use the private key for decryption; or send the symmetric key to the key device , the symmetric key is decrypted by the key device using the private key stored by itself.

In this step, the file package is mapped to the client, either as a directory or as a disk. Regardless of whether it is mapped as a directory or a disk, it is virtual, that is, the directory or disk does not actually exist on the client. Therefore, it is necessary to obtain the information in the directory or disk through the corresponding virtual driver in the client. That is, the virtual driver interacts with the server to obtain the information in the corresponding file package in the server.

Taking mapping as a disk as an example, the solution of the present invention needs to set a filter on the upper or lower layer of the hard disk device object of the client, and constrain the original hard disk in the client through the filter, that is, judge the user's Whether the access is for the original hard disk or the virtual disk, if it is for the virtual disk, you need to start the corresponding virtual disk driver, and generate the corresponding access request through the virtual disk driver, and then the network service in the client The access request is mapped to an access to data at a specific location in a specific file package in the server.

Step 105, the client reads and writes the information in the file package mapped to the client, and sends the processed information to the file package in the server.

In this step, the client needs to read and write information from the server through a corresponding mapping driver to read and write corresponding information.

Through the above steps, the secure storage and access of the network can be realized.

Fig. 2 is a logical schematic diagram of realizing user file package setting and access based on public key and private key in the present invention.

In addition, if the key device is pulled out from the client, the client needs to notify the server to close its file package mapped to the client.

It can be seen from the above description that the system corresponding to the solution provided by the present invention includes a key device, a client and a server, as shown in FIG. 3 .

Wherein, the user identity information needs to be stored in the key device, and the user identity information may be a public key. The private key can also be further stored in the key device. As mentioned above, the private key is used to obtain a symmetric key through an asymmetric encryption operation, and is used for more stringent verification on the server side. The key device can also have calculation and key generation functions, etc. Therefore, the key device needs not only an independent storage space, but also a chip capable of calculation. The functions of the key device are as described above, and will not be repeated here. The key device may have a USB port, and interact with the PC through the USB port.

For the client, usually the file package on the server is locally mapped as a virtual disk or a virtual directory. In order to realize access to the virtual disk or virtual directory, the client usually needs to include a user identity identification confirmation module, an access control module and a network virtual driver module. Wherein, the user identity confirmation module is used to send the user identity in the key device to the server, and receive the verification information returned by the server, and send the verification information to the access control module; the access control module is used to receive the The access request of the virtual disk, and after receiving the verification information of the server side, the access request is sent to the network virtual driver module; the network virtual driver module is used to process the information in the corresponding file package of the server according to the access request show.

Because the user usually needs to read and write the information in the virtual disk or virtual directory, etc., the network virtual driver module can further set up a network read and write module, which reads and writes the data in the file package in the server. In addition, since the file packages saved in the server are usually encrypted file packages, an encryption and decryption module is also required in the network virtual drive module, and the encryption and decryption module decrypts the data read by the network read-write module, and The data written by the network read-write module is encrypted.

For the server, it at least needs to include a user information storage module and a user identity verification module, wherein the user information storage module is used to store user identity information and a file package allocated to the user; the user identity verification module uses The user identity information in the key device is verified, and the verification information is sent to the client, and after the verification is passed, the information in the corresponding file package is sent to the client. For the server, it can also have the function of generating a symmetric key, encrypting the file package according to the symmetric key and sending the symmetric key to the client, and using the public key to encrypt the symmetric key. It can be set in the user information storage module.

The above descriptions are only preferred embodiments of the solutions of the present invention, and are not intended to limit the protection scope of the present invention.

Claims (14)

1. A method for realizing network security storage and access, characterized in that a key device is pre-configured, and the identification information of the user identity is stored in the key device, and the server side generates a corresponding file according to the identification information of the user identity package, and save the user identification information; the method further includes the following steps: a. When the key device is connected to the client, the client sends the identification information of the user identity in the key device to the server, and the server verifies the received user identity; b. After the client is authenticated by the server, map the file package related to the user in the server to the client; judge whether the user's access is aimed at the file package related to the user in the server, and if so, perform step c; c. The client processes the information in the file package mapped to the client, and sends the processed information to the file package in the server. 2. The method according to claim 1, wherein the user identity information stored in the key device is a public key. 3. The method according to claim 2, wherein the step of generating a corresponding file package according to the identification information of the user identity at the server end and saving the identification information of the user identity comprises: generating a file package according to the identification information of the user identity For the corresponding file package, assign a symmetric key to the file package, and encrypt the file package with the symmetric key, then use the public key to encrypt the symmetric key, and save the file package, the user’s public key and the encrypted the symmetric key of In step b, the client mapping the file package related to the user to the client includes: the client obtains the encrypted symmetric key from the server, and obtains the pre-encrypted symmetric key through decryption processing, and then downloads the encrypted symmetric key from the server. User-related file packages, and use the obtained symmetric key to decrypt the file package, and then map the decrypted file package to the client; In step c, the file package that the client sends the processed information to the server is: the client encrypts the processed information with the symmetric key obtained in step b, and sends the encrypted information to the server. in the file package on the server mentioned above. 4. The method according to claim 3, characterized in that in the step b, the client obtains the symmetric key before encryption through decryption processing as: The client obtains the public key from the key device, and uses the public key to decrypt the encrypted symmetric key; Or send the encrypted symmetric key to the key device, and the key device uses the public key stored by itself to decrypt the encrypted symmetric key. 5. The method according to claim 3, wherein a private key is further stored in the key device; In step b, the client obtains the pre-encrypted symmetric key through decryption processing as follows: The client obtains the private key from the key device, and uses the private key to decrypt the encrypted symmetric key; Or the client sends the encrypted symmetric key to the key device, and the key device uses the private key to decrypt the encrypted symmetric key to obtain the pre-encrypted symmetric key, and sends the symmetric key to to the client. 6. The method according to claim 2, characterized in that in step a, the server verifying the received user identity includes: the client sends the public key to the server, and the server judges the public key stored by itself. Whether the public key exists in the user identity information, if yes, it is determined that the verification is passed, otherwise, it is determined that the verification is not passed. 7. The method according to claim 6, wherein a private key is further stored in the key device; In step a, before the server determines that the verification is passed, it further includes: a1. The server generates a long number, encrypts the long number with the public key, and transmits the encrypted long number to the client; a2. The client decrypts the encrypted long number with the private key in the key device to obtain the corresponding long number, generates a signature of the long number with the private key, and then sends the signature to the server; a3. The server uses the public key to verify whether the signature is correct, and if it is correct, it is determined that the verification is passed; otherwise, it is determined that the verification is not passed. 8. The method according to claim 1, characterized in that in the step b, the client maps the relevant file packages in the server to the client as: mapping the relevant file packages in the server to the client in the client virtual disk; In step c, the client processing the information in the file package mapped to the client includes: processing the information through a driver program of the virtual disk. 9. The method according to claim 1, further comprising: after the step c, notifying the server to close the file package mapped to the client after the key device is separated from the client. 10. A system for realizing network security storage and access, characterized in that the system includes a key device, a client and a server, wherein, The identification information of the user identity is stored in the key device, which is used to send the user identification information stored by itself to the server; The client is used to verify the user identity in the key device through the server when the key device is connected, and map the file package related to the user in the server to the client after the server verification is passed. terminal, and determine whether the user's access is aimed at the file package related to the user in the server, and if so, process the information in the file package in the client; The server is configured to store user identity information, distribute corresponding file packages to users, verify the user identity information in the key device, and send the information in the corresponding file package to the client after the verification is passed. 11. The system according to claim 10, wherein the client is further configured to map the file package related to the user in the server to a virtual disk or a virtual directory in the client; The client includes a user identity confirmation module, an access control module and a network virtual driver module, wherein, A user identity confirmation module, configured to send the user identity in the key device to the server, receive the verification information returned by the server, and send the verification information to the access control module; The access control module is configured to send the received access request for the virtual disk or virtual directory to the network virtual driver module after receiving the verification passing information; The network virtual driver module is used to obtain the information in the corresponding file package of the server according to the access request, and perform corresponding processing on the information. 12. The system according to claim 11, wherein the file package stored in the server is an encrypted file package; The network virtual drive module further includes: an encryption and decryption module, which is used to perform decryption operations on data read from the virtual disk, and perform encryption operations on data written into the virtual disk. 13. The system according to claim 10, wherein the server includes a user information storage module and a user identity verification module, wherein, The user information storage module is used to store user identification information and assign corresponding file packages to users; The user identity verification module is used to verify the user identity information in the key device, send the verification information to the client, and send the information in the corresponding file package to the client after the verification is passed. 14. The system according to claim 13, wherein the user information storage module is further used to generate a symmetric key, encrypt the file package with the symmetric key, and send the symmetric key to the client; The client is further configured to use the symmetric key to decrypt the information read from the file package, and to encrypt the information written into the file package.

Images