CN100518060C - Encryption protection method and client device for digital document - Google Patents

Abstract

The present invention discloses a ciphering protecting method of a digital file and a client device thereof in order to settle a problem that the file can not be protected when the client end generating the file is off network or the file is in the editing state. According to the invention a client system directly ciphers the file, binds the ciphering key with the hardware information or ciphers with the public key of the server system thereby protecting the file. When the file is in the editing state, a local client device protecting mode is adopted and the protection to the file is realized by a client machine singly. When the file is in the network circulating state, a network server protecting mode is adopted and a network identification of the server system is used for realizing the protection to the file. And when the file is authorized to be used by other client, the file being protected can be transferred again from other client device for circulating use.

Description

Encryption protection method and client device for digital document

technical field

The invention relates to the technical field of digital copyright protection, in particular to an encryption protection method for digital documents and a client device.

Background technique

With the development of the Internet, more and more digital content such as e-books, music, movies, and pictures are disseminated online. Since digital content is easy to copy and modify, there are a lot of piracy and infringement problems in digital content disseminated on the Internet. Therefore, copyright protection for digital content is becoming more and more important.

There are two main types of digital copyright protection methods, one is digital watermarking technology, and the other is DRM (Digital Rights Management, digital rights protection) technology with data encryption and copy protection as the core. Digital content protected by DRM technology includes eBooks (eBooks), videos, audios, pictures, and the like.

The main technology of DRM is to realize the data encryption of digital content with a certain calculation method. Only authorized users can obtain the decryption key, and the key is bound with the user's hardware information to form a license to prevent illegal copying. DRM technology prevents illegal copying of digital content, or makes copying difficult to a certain extent, and end users must be authorized to use digital content.

However, the current DRM technology with data encryption and anti-duplication as the core has the following problems:

1. The process of encrypting and protecting documents may require the participation of a digital copyright protection server system, and cannot be independently encrypted and protected by the client; or it can only be encrypted on the client, and cannot be circulated and disseminated. The former is found in systems where documents need to be circulated, and the latter is found in stand-alone encryption systems where documents cannot be circulated in an encrypted state. These two methods are independent of each other and cannot be used together.

2. The document being revised is not suitable for the mandatory requirement to be in the network state, and may not be able to communicate with the server system, but the document needs to be circulated after it is written.

3. Written documents that have entered the circulation link cannot be used after leaving the network, and the written documents may also be revised.

Contents of the invention

The embodiment of the invention discloses an encryption protection method of a digital document and a client device, so as to implement encryption protection on the document when the client generating the document leaves the network.

A method for a client device to encrypt a digital document according to an embodiment of the present invention:

When the client system independently protects the document being drafted or revised, switch to the local client device protection method to encrypt the digital document. The encryption methods include:

The client device generates a key K11, and encrypts a digital document using the key K11, to obtain an encrypted document of the digital document;

The client device generates a key K12 according to the specified feature information of the client device, and uses the key K12 to encrypt the key K11 to obtain encrypted information E11 of the key K11;

The client device associates the encrypted document with the encrypted information E11;

Switch to the network server protection mode when protecting the document in the state of circulation and reading, and use the server system network authentication to realize the protection of the document. The encryption method includes:

The client device generates a key K11, and encrypts the digital document with the key K11, to obtain an encrypted document of the digital document;

The client device obtains the public key K31 from the encryption server on the network side, and encrypts the key K11 with the public key K31, obtains the encrypted information E12 of the key K11, and sets the encrypted file to other clients except the local client. authorization information;

The client device encrypts the authorization information of the other client using the public key K31, and obtains the encrypted information A12 of the authorization information of the other client;

The client device generates a license certificate V12 containing encrypted information E12, A12 and client device identification information, and associates the license certificate V12 with the encrypted document.

According to an embodiment of the present invention, a client device decrypts an encrypted document. The encrypted document is obtained by the client device after encrypting the digital document according to the above method. When the protection mode is encrypted, the decryption method includes:

The client device generates the key K12 according to the specified characteristic information;

The client device obtains the encrypted information E11 associated with the encrypted document, and uses the key K12 to decrypt the encrypted information E11, and obtains the encrypted key K11 of the encrypted document;

The client device uses the key K11 to decrypt the encrypted document to obtain a decrypted digital document;

When the digital document that needs to be decrypted is encrypted using a network server protection method and decrypted in a different place, the decryption method includes:

The client device obtains the encrypted information E12 and A12 from the license certificate V12, and the E12 and A12 are encrypted information obtained by encrypting K11 and the authorization information of the encrypted document respectively using the public key K31 provided by the encryption server on the network side. K11 is the encryption key of the encrypted document;

The client device generates the key K22 according to the specified feature information, and encrypts the key K22 using the public key K31, and obtains the encrypted information E21 of the key K22;

The client device sends the encrypted information E12, A12, and E21 to the network-side encryption server, and receives the encrypted information E12, A12, and E21 decrypted by the network-side encryption server using the private key K32 corresponding to the public key K31. Afterwards, the encrypted information E31 and A31 returned, wherein: the encrypted information A31 is the encrypted information after using the key K22 to encrypt the authorization information of the client device set in the encrypted information A12, and the encrypted information E31 is encrypted using Encryption information encrypted by key K22 to key K11;

The client device uses the key K22 to decrypt the encrypted information E31 to obtain the key K11, and decrypts the encrypted information A31 to obtain authorization information for the client device;

The client device uses the key K11 to decrypt the encrypted file to obtain the corresponding digital file, and controls the use authority of the digital file of the client device according to the authorization information of the client device.

A client device according to an embodiment of the present invention includes:

An encrypted file generation unit, configured to generate a key K11, and use the key K11 to encrypt a digital file to obtain an encrypted file of the digital file;

A first encrypted information generation unit, configured to generate a key K12 according to specified feature information of the client device, and use the key K12 to encrypt the key K11 to obtain encrypted information E11 of the key K11;

A first associative storage unit, configured to associatively store the encrypted document and the encrypted information E11;

A public key acquisition unit, configured to acquire the public key K31 from the network-side encryption server;

A second encrypted information generating unit, configured to use the public key K31 to encrypt the key K11 to obtain encrypted information E12 of the key K11;

The second authorization information generation unit is used to generate the authorization information of the encrypted document for other client devices, and encrypt the authorization information with the public key K31, and obtain the encrypted information A12 of the authorization information;

A second license generating unit, configured to generate a license V12 containing encrypted information E12 and A12;

The second associative storage unit is used to associatively store the license certificate V12 and the encrypted document.

In the embodiment of the present invention, the client system independently protects the document being drafted or revised, and binds the protected document with the device hardware information of the client, so that when the client device cannot connect to the server through the network, it can also At the same time, the protected files can also be authorized for use by others, and when they are used by others, they need to be connected to the digital copyright protection server to obtain the authorized license. Furthermore, the protected files can be retransmitted from other people's machines for recycling.

Description of drawings

Fig. 1 is a flow chart of a method for encrypting a digital document by a client device in an embodiment of the present invention;

Fig. 2 is a flow chart of a method for decrypting an encrypted document in an embodiment of the present invention;

3 is a flow chart of another method for encrypting a digital document by a client device in an embodiment of the present invention;

FIG. 4 is a flow chart of another method for decrypting an encrypted document in an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a client device in an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of another client device in an embodiment of the present invention.

Detailed ways

Since the existing digital copyright protection technology requires that the execution device must be connected to the network to be able to encrypt and protect the document, the document cannot be encrypted and protected when running on a stand-alone computer, and it cannot prevent the document being edited from being illegally copied without a network. Therefore, In practical applications, a protection system that can freely switch between local client device protection and network server protection is needed. When a document is drafted or modified, it automatically switches to the local client device protection method, and the client The machine independently realizes the protection of documents, and automatically switches to the network server protection mode in the state of document circulation and reading, and uses the server system network authentication to realize the protection of documents.

In the embodiment of the present invention, the client system independently protects the document being drafted or revised, and binds the protected document with the specified feature information of the client, so that the client device can also be protected when the client device cannot connect to the server through the network. At the same time, the protected files can also be authorized for use by others, and when they are used by others, they need to be connected to the digital copyright protection server to obtain the authorized license. Furthermore, the protected files can be retransmitted from other people's machines for recycling.

Referring to Fig. 1, a method for encrypting a digital document by a client device according to an embodiment of the present invention has a specific workflow as follows:

S010. Generate a key K11, and use the key K11 to encrypt the digital document to obtain an encrypted document of the above digital document;

S020. Generate a key K12 according to the specified feature information of the client device, and use the key K12 to encrypt the key K11 to obtain encrypted information E11 of the key K11;

The above specified feature information of the client device may be hardware feature information of the client device;

S030. Generate the full authorization information of the above-mentioned encrypted document, and encrypt the above-mentioned full authorization information with the above-mentioned key K12, and obtain the encrypted information A11 of the above-mentioned full authorization information;

S040. Write the above-mentioned encrypted information E11 and A11 into an encrypted file to form an association; or generate a license certificate V11 including the above-mentioned encrypted information E11, A11 and client device identification information, and associate the above-mentioned encrypted file with the license certificate V11;

Referring to Figure 2, when the client device locally decrypts the above-mentioned encrypted document, it specifically includes the following steps:

s051. Obtain client device identification information and encrypted information A11 from the license certificate V11;

s052. After confirming that the identification information is the identification information of the client device, generate a key K12 according to the specified characteristic information of the client device;

s053. Use the key K12 to decrypt the encrypted information A11 to obtain authorization information, and confirm that the authorization information is full authorization information;

s054. Obtain the encrypted information E11 from the encrypted document or the license V11 associated with the encrypted document, and use the key K12 to decrypt the encrypted information E11 to obtain the encrypted key K11 of the encrypted document;

s055. Use the key K11 to decrypt the above-mentioned encrypted document to obtain a decrypted digital document.

Referring to Fig. 3, another client device encrypts a digital document according to an embodiment of the present invention. After the local client encrypts the digital document to form an encrypted document, when the encrypted document enters the network circulation for other client devices During use, the public key K31 provided by the encryption server on the network side and the private key K32 used to decrypt the data encrypted by the public key K31 are used to complete the protection of the encrypted document, wherein the public key K31 is issued to all clients. The private key K32 is stored in an encrypted server, and the specific working process of this method is as follows:

S110. Generate a file encryption key K11, and use the key K11 to encrypt the digital document to be protected to form an encrypted document;

S120. Generate the key K12 according to the specified feature information of the local client device, use the key K12 to encrypt the key K11, and generate the encrypted information E11 of the key K11, that is, E11=K12(K11), and the local client sets the encrypted file to this computer, generate authorization information, and encrypt the authorization information with the key K12 to obtain the encrypted information A11 of the authorization information;

Since the local client is the encryptor of the digital document that needs to be protected, its authorization information should stipulate that the local client has the maximum usage authority;

S130, the local client obtains the public key K31 from the encryption server, uses the public key K31 to encrypt the key K11 to obtain the encrypted information E12, that is, E12=K31(K11), and sets the authorization of the encrypted document to other clients except the local client information, and encrypt the authorization information with the public key K31 to obtain the encrypted information A12 of the authorization information;

S140. The local client generates a license certificate V12 including client device identification information, encrypted information A11, E11, A12, and E12, and the license certificate V12 is associated with the encrypted document;

In this step, the local client may also write the client device identification information, encrypted information A11, E11, A12, and E12 into the above encrypted file.

So far, the digital document has been encrypted and protected.

Referring to shown in Figure 4, the method for decrypting the above-mentioned encrypted document comprises the following steps:

s151. Before using the above-mentioned encrypted document, judge whether the current client matches the license V12 according to the client identification information in the license V12;

If the license certificate V12 matches the current client, you can directly use the license certificate V12 to enter the local license analysis;

The above local license parsing includes the following steps: generate a key K12 according to the specified feature information of the current client, and use the key K12 to decrypt the encrypted information E11 in the license certificate V12 to obtain the key K11, and use the key K12 to decrypt the encrypted information A11 to obtain the current The client's right to use the encrypted document, use the key K11 to decrypt the above encrypted document to obtain the final operable digital document, and perform corresponding operations on the digital document according to the current client's right to use the encrypted document;

If the license certificate V12 does not match the current client, proceed to the following steps to analyze the remote license;

s152. Generate a key K22 according to the specified feature information of the current client, obtain the public key K31 from the encryption server, and encrypt the key K22 with the public key K31, that is, K31(K22)=E21;

s153. Obtain the encrypted information E12 and A12 from the license certificate V12, and send the encrypted information E21, E12, and A12 to the encrypted server;

If the encrypted information A11, E11, A12 and E12 are written in the above-mentioned encrypted file, then the encrypted information E12 and A12 are obtained from the above-mentioned encrypted file;

s154. The encryption server decrypts the encrypted information A12 with the private key K32 corresponding to the public key K31, obtains the authorization information of the encrypted document, and judges whether the current client has legal authority to use the file according to the authorization information;

If you do not have the permission to use the file, return the information of denial of use to the current client, and the current client cannot use the encrypted file;

If the current client has some right to use the file, the encryption server uses the private key K32 to decrypt the key K11 from the encrypted information E12 and decrypts the key K22 from the encrypted information E21, and uses the key K22 to encrypt the key K11 to obtain Encrypted information E31, after encrypting the use authority information of current client with key K22 to obtain encrypted information A31, construct the new license certificate V31 of current client with encrypted information E31, A31 and E12, A12, namely V31=(E31, A31, E12, A12), returning the license certificate V31 to the current client, wherein V31 also includes the identification information of the current client;

s155. Generate the key K22 again, obtain the encrypted information E31 and A31 from the license certificate V31, and decrypt the encrypted information E31 with the key K22 to obtain the key K11, and decrypt the encrypted information A31 with the key K22 to obtain the authorization information of the current client;

s156. Decrypt the encrypted document with the key K11 to form a final usable digital document, and perform corresponding operations on the digital document according to the obtained authorization information.

According to the above steps and processes, a typical complete implementation process of file encryption on the client side, remote use authorization, dissemination, and use is completed.

After the client obtains the matching license certificate V31 through the remote license parsing process, the client can also save the license certificate V31 on the current client computer and re-associate the license certificate V31 with the encrypted document, then when accessing the encrypted document next time, Enter the local license parsing process directly according to the matching license certificate V31 to use the encrypted document offline, without needing to obtain the license certificate V31 through the encryption server again.

It can be seen that the encrypted documents used through the local license parsing process include two types: one is the encrypted document generated by the local client encryption; the other is the encrypted document received and used from other clients, and the encrypted document has been encrypted The license certificate obtained from the encryption server was reassociated.

Some other typical applications can also be produced according to different sequence combinations of the various steps in use. For example, if the documents that have been used in the receiving client are reissued by the receiving client for circulation, a similar but brand new application process can be generated. Once the document is received by another client, the roles of this client and the receiving client will respectively replace the receiving client and the local client in the above-mentioned reference embodiment. In particular, if the file is retrieved and used by the local client, the roles of the local client and the receiving client will be reversed.

As shown in Figure 5, the embodiment of the present invention also provides a client device, including:

An encrypted file generation unit 501, configured to generate a key K11, and use the key K11 to encrypt a digital file to obtain an encrypted file of the digital file;

The first encrypted information generating unit 502 is configured to generate a key K12 according to the specified characteristic information of the client device, and use the key K12 to encrypt the key K11 to obtain the encrypted information E11 of the key K11;

The first associative storage unit 503 is configured to associatively store the encrypted document and the encrypted information E11.

Wherein, the first association storage unit writes the encrypted information E11 into the associated encrypted file to form an association.

Further, it also includes:

The first license generating unit 504 is configured to generate a license V11 containing the encrypted information E11, and the first associated storage unit associates and stores the encrypted document and the license V11;

The first authorization information generating unit 505 is configured to generate the full authorization information of the encrypted document, and use the key K12 to encrypt the full authorization information to obtain the encrypted information A11 of the authorization information; the first license certificate The license certificate V11 generated by the generating unit also includes the encrypted information A11.

If encrypted files are used locally, the client device also includes:

The first decryption unit 506 is configured to obtain the associated stored encrypted document and encrypted information E11 from the first associated storage unit, use the key K12 to decrypt the encrypted information E11, and obtain the encrypted key K11 of the encrypted document, The encrypted document is decrypted by using the key K11 to obtain a decrypted digital document.

If encrypted documents need to be sent to the network for circulation, the client device also includes:

A public key obtaining unit 507, configured to obtain the public key K31 from the network side encryption server;

The second encrypted information generation unit 508 is configured to use the public key K31 to encrypt the key K11 to obtain encrypted information E12 of the key K11;

The second authorization information generating unit 509 is configured to generate authorization information for other client devices using the encrypted document, and encrypt the authorization information using the public key K31, to obtain encrypted information A12 of the authorization information;

A second license generating unit 510, configured to generate a license V12 containing encrypted information E12 and A12;

The second associative storage unit 511 is configured to associatively store the license certificate V12 and the encrypted document.

and, also includes:

A sending unit 512, configured to send the license certificate V12 and the encrypted document.

As shown in Figure 6, if the client device receives the decrypted document and license certificate from other network devices from the network, and needs to use the license certificate to decrypt the encrypted document to the local end, the client device includes:

A receiving unit 601, configured to receive the license V12 and the encrypted document, and obtain the encrypted information E12 and A12 from the license V12;

The second encrypted information generating unit 602 is configured to generate a key K22 according to the specified characteristic information of the client device, and encrypt the key K22 using the public key K31 to obtain encrypted information E21 of the key K22;

An authentication unit 603, configured to send the encrypted information E12, A12, and E21 to the encryption server, and receive the encrypted information E12, A12, and E21 decrypted by the encryption server using the private key K32 corresponding to the public key K31. Afterwards, the encrypted information E31 and A31 returned to the client, wherein: the encrypted information A31 is the encrypted information after using the key K22 to encrypt the authorization information of the client device included in the license certificate V12, and the encrypted information E31 is the encrypted information encrypted with the key K11 using the key K22;

The second decryption unit 604 is configured to use the key K22 to decrypt the encrypted information E31 to obtain the key K11, and decrypt the encrypted information A31 to obtain authorization information for the client device;

The authority control unit 605 is configured to use the key K11 to decrypt the encrypted document to obtain a corresponding digital document, and control the use authority of the digital document according to the authorization information of the client device.

It should be noted that the structures shown in Figure 5 and Figure 6 can be set on the same client device to form a comprehensive client system, then the first encrypted information generating unit 502 can be combined with the second encrypted information generating unit 602 , the first decryption unit 506 and the second decryption unit 604 may also be combined.

Referring to Figure 5 and Figure 6, the client device and the encryption server on the network side constitute an encryption system to realize the client's local encrypted digital text and authorize other client devices to use it.

In summary, the embodiment of the present invention independently protects the document being drafted or revised by the client system, and binds the protected document with the client device hardware information, so that the client device cannot be connected to the server through the network At the same time, the protected document can also be authorized for use by others, and when other people use it, it needs to be connected to the digital copyright protection server to obtain the authorized license. Furthermore, the protected files can be transferred from other people's machines for recycling.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention also intends to include these modifications and variations.

Claims (17)

1. A method for a client device to encrypt a digital document, characterized in that: When the client system independently protects the document being drafted or revised, switch to the local client device protection method to encrypt the digital document. The encryption methods include: The client device generates a key K11, and encrypts a digital document using the key K11, to obtain an encrypted document of the digital document; The client device generates a key K12 according to the specified feature information of the client device, and uses the key K12 to encrypt the key K11 to obtain encrypted information E11 of the key K11; The client device generates the full authorization information of the encrypted document, and uses the key K12 to encrypt the full authorization information, and obtains the encrypted information A11 of the full authorization information; The client device associates the encrypted document, encrypted information E11 and A11; Switch to the network server protection method when protecting the document in the state of circulation and reading, and use the server system network authentication to realize the protection of the document. The encryption method includes: The client device generates a key K11, and encrypts the digital document with the key K11, to obtain an encrypted document of the digital document; The client device obtains the public key K31 from the encryption server on the network side, and encrypts the key K11 with the public key K31, obtains the encrypted information E12 of the key K11, and sets the encrypted file to other clients except the local client. authorization information; The client device encrypts the authorization information of the other client using the public key K31, and obtains the encrypted information A12 of the authorization information of the other client; The client device generates a license certificate V12 containing encrypted information E12, A12 and client device identification information, and associates the license certificate V12 with the encrypted document. 2. The method according to claim 1, wherein when switching to the local client device protection mode to encrypt the digital document, the method for associating the encrypted document and encrypted information E11 and A11 comprises: The aforementioned encrypted information E11 and A11 are written into the encrypted file to form an association. 3. The method according to claim 1, wherein when switching to the local client device protection mode to encrypt the digital document, the method for associating the encrypted document, encrypted information E11 and A11 comprises: generating The encrypted information E11, A11 and the license certificate V11 of the client device identification information are associated with the encrypted document and the license certificate V11. 4. The method according to claim 1, wherein the specified feature information includes hardware feature information of the client device. 5. The method according to claim 1, wherein when switching to the network server protection mode, the encryption method further comprises: sending the license certificate V12 and the encrypted document to the receiver. 6. A method for decrypting an encrypted document, characterized in that the encrypted document is obtained by the client device after encrypting the digital document according to the method according to claim 1, when the digital document to be decrypted is obtained by a local client When encrypting in the protection mode of the end device, the decryption method includes: The client device generates the key K12 according to the specified characteristic information; The client device obtains the encrypted information A11 associated with the encrypted document, and uses the key K12 to decrypt A11 to obtain the authorization information, and confirms that the authorization information is full authorization information; The client device obtains the encrypted information E11 associated with the encrypted document, and uses the key K12 to decrypt the encrypted information E11, and obtains the encrypted key K11 of the encrypted document; The client device uses the key K11 to decrypt the encrypted document to obtain a decrypted digital document; When the digital document that needs to be decrypted is encrypted using a network server protection method and decrypted in a different place, the decryption method includes: The client device obtains the encrypted information E12 and A12 from the license certificate V12, and the E12 and A12 are encrypted information obtained by encrypting K11 and the authorization information of the encrypted document respectively using the public key K31 provided by the encryption server on the network side. K11 is the encryption key of the encrypted document; The client device generates the key K22 according to the specified feature information, and encrypts the key K22 using the public key K31, and obtains the encrypted information E21 of the key K22; The client device sends the encrypted information E12, A12, and E21 to the network-side encryption server, and receives the encrypted information E12, A12, and E21 decrypted by the network-side encryption server using the private key K32 corresponding to the public key K31. Afterwards, the encrypted information E31 and A31 returned, wherein: the encrypted information A31 is the encrypted information after using the key K22 to encrypt the authorization information of the client set in the encrypted information A12, and the encrypted information E31 is encrypted using the key K22. Key K22 encrypts the encrypted information of key K11; The client device uses the key K22 to decrypt the encrypted information E31 to obtain the key K11, and decrypts the encrypted information A31 to obtain authorization information for the client device; The client device uses the key K11 to decrypt the encrypted file to obtain the corresponding digital file, and controls the use authority of the digital file of the client device according to the authorization information of the client device. 7. The method according to claim 6, wherein when the digital document to be decrypted is encrypted using a local client device protection method, the encrypted information E11 and A11 are obtained from the encrypted document. 8. The method according to claim 6, wherein when the digital document to be decrypted is encrypted using a local client device protection method, the E11 and A11 are obtained from the license certificate V11 associated with the encrypted document . 9. The method according to claim 8, wherein the decryption method further comprises: The client device obtains the client device identification information from the license certificate V11; The client device generates the key K12 after confirming that the identification information is the identification information of the client device. 9. The method according to claim 6, wherein the specified feature information includes hardware feature information of the client device. 10. The method according to claim 6, wherein when the digital document to be decrypted is encrypted using a network server protection method and decrypted in a different place, the decryption method further comprises: The network-side encryption server returns the encryption information E31 and A31 included in the license certificate V31 to the client device. 11. The method according to claim 6, characterized in that when the digital document to be decrypted is encrypted using a network server protection method and decrypted in a different place, the license V12 also includes the identification information of the sender of the encrypted document, The client device first obtains the identification information from the license certificate V12, and after verifying that the identification information is not local client device identification information, continues to obtain the encrypted information E12 and A12 from the license certificate V12. 12. The method according to claim 11, wherein the encryption server on the network side returns to the client device after judging that it contains the authorization information set for the client device according to the decrypted authorization information. The encrypted information is described as E31 and A31, otherwise a rejection response is returned. 13. A client device, characterized by comprising: An encrypted file generation unit, configured to generate a key K11, and use the key K11 to encrypt a digital file to obtain an encrypted file of the digital file; A first encrypted information generation unit, configured to generate a key K12 according to specified feature information of the client device, and use the key K12 to encrypt the key K11 to obtain encrypted information E11 of the key K11; A first associative storage unit, configured to associatively store the encrypted document and the encrypted information E11; A first authorization information generating unit, configured to generate full authorization information of the encrypted document, and use the key K12 to encrypt the full authorization information to obtain encrypted information A11 of the authorization information; A public key acquisition unit, configured to acquire the public key K31 from the network-side encryption server; A second encrypted information generating unit, configured to use the public key K31 to encrypt the key K11 to obtain encrypted information E12 of the key K11; The second authorization information generation unit is used to generate the authorization information of the encrypted document for other client devices, and encrypt the authorization information with the public key K31, and obtain the encrypted information A12 of the authorization information; A second license generating unit, configured to generate a license V12 including client device identification information, encrypted information E12 and A12; The second associative storage unit is used to associatively store the license certificate V12 and the encrypted document. 14. The device according to claim 13, wherein the first association storage unit writes the encrypted information E11 and A12 into the associated encrypted file to form an association. 15. The apparatus of claim 13, further comprising: The first license generation unit is configured to generate a license V11 including the client device identification information, encrypted information E11 and A11, and the first associated storage unit stores the encrypted document and the license V11 in association. The first decryption unit is used to obtain the encrypted document and encrypted information E11 stored in association, use the key K12 to decrypt the encrypted information E11, obtain the encryption key K11 of the encrypted document, and use the key K11 to decrypt the encrypted Documents, access to decrypted digital documents. 16. The apparatus of claim 13, further comprising: A sending unit, configured to send the license certificate V12 and the encrypted document.

Images