CN102355350B - A kind of file encrypting method for mobile intelligent terminal and system - Google Patents

Abstract

The invention discloses a file encryption method and system applied in the field of mobile terminals. The method includes the following steps: a key generation step, generating an encryption key corresponding to the protection level; a file encryption step, according to the encryption key The encrypted file is obtained by encrypting the file to be encrypted with the key; the key encryption step is to encrypt the encryption key according to the user password; the writing step is to write the encrypted encryption key into the encrypted file. The specified location of the file. According to the method of the invention, the time for users to inquire about the key when reading the file can be saved, the security of the encryption key is well guaranteed, and the security of the file is improved.

Description

A file encryption method and system for mobile intelligent terminal

technical field

The invention relates to a file encryption technology, in particular to a hierarchical file encryption method and system for mobile smart terminals.

Background technique

File encryption is a technology that automatically encrypts data written to storage media at the operating system layer according to requirements, and encrypts files to prevent file information from being stolen. With the widespread application of mobile smart terminals, more and more hackers are targeting mobile smart terminal users, and more and more user file information is being stolen. Therefore, it is necessary to effectively encrypt user file information in mobile smart terminals becomes particularly important.

The Android (trademark) operating system is the name of an open source mobile smart terminal operating system based on the Linux platform released by Google on November 5, 2007. The platform consists of an operating system, middleware, user interface and application software. A truly open and complete mobile software for mobile terminals.

The encryption methods on the existing Android operating system all use the encryption interface provided by the application layer JAVA language, using the DES or AES algorithm. The DES algorithm is not only inefficient but also unable to resist differential attacks, and the key length is only 56 bits. AES Although the algorithm has a key length of 128 bits, the operation speed is very slow.

The main way of storing keys on the existing Android operating system is to directly store the keys in the database, but the database of Android itself does not have good protection measures, which makes once the database leaks, a large number of keys will be obtained by attackers, It caused a large amount of leakage of important user data.

The BLOWFISH encryption algorithm is a symmetric block cipher designed by Bruce Schneier. It has a strong ability to resist differential analysis attacks. It has the characteristics of high efficiency, security, and variable key length. It has optional keys from 32 to 448 bits. length. However, this algorithm also has a security risk, that is, in order to increase the encryption speed after the subkey is generated, the subkey is stored in the Cache, so that if the Cache content is stolen by an attacker, all encrypted subkeys will be destroyed. Give way.

The fifth edition of the message digest algorithm (MD5) was developed by Ronal L. Rivest and developed from MD2, MD3 and MD4. Its function is to generate message digest information for messages. If the message is modified during transmission, then When the terminal recalculates the digest value of the message and compares it with the original digest value, it can be seen that the digest value is different, and thus it can be concluded that the message has been modified.

Contents of the invention

The purpose of the present invention is to provide a file encryption method and file encryption system for mobile smart terminals, aiming to solve the problem of insecure mobile terminal files caused by ignoring security or ignoring efficiency in the prior art Storage or encryption efficiency is too slow.

In order to solve the above technical problems, the present invention provides a file encryption method for mobile intelligent terminals, which is characterized in that it includes: a key generation step, generating an encryption key corresponding to the protection level; a file encryption step, according to the The encryption key encrypts the file to be encrypted to obtain an encrypted file; the key encryption step encrypts the encryption key according to the user password; the writing step writes the encrypted encryption key into the Specify the location of the encrypted file described above.

Further, the method further includes: in the key generating step, selecting a protection level of the file to be encrypted, and according to the different protection levels, the length of the corresponding encryption key is different.

Further, the method further includes: in the key encryption step, processing the user password with digest message algorithm MD5 to obtain digest information of the user password, and using the digest information to encrypt the encryption key.

Further, the method also includes: before the file encryption step, performing an XOR operation on the file to be encrypted and a transformation matrix, and encrypting the XORed data to be encrypted in the file encryption step; The transformation matrix is encrypted according to the user password, and in the writing step, the encrypted transformation matrix and the encrypted encryption key are written into the specified position of the encrypted file.

Further, the method further includes: the transformation matrix is a matrix composed of random numbers, which is generated by system time and a random value.

Further, the method further includes: the transformation matrix is a matrix composed of 64-bit random numbers, and each 64-bit data read from the file to be encrypted is subjected to an XOR operation with the 64-bit random numbers respectively.

The present invention also provides a file encryption system, which is characterized in that it includes the following units: a key generation unit, which generates an encryption key corresponding to the protection level; a file encryption unit, which encrypts the Encrypting the file to be encrypted to obtain an encrypted file; a key encryption unit, which encrypts the encryption key according to the user password; a writing unit, which writes the encrypted encryption key into the encrypted file specify the location.

Further, the system also includes: the key generation unit selects the protection level of the file to be encrypted, and the length of the corresponding encryption key is different according to the protection level.

Further, the system also includes: an XOR operation unit, which generates a transformation matrix, and performs an XOR operation on the file to be encrypted and the transformation matrix. A transformation matrix encryption unit, which encrypts the transformation matrix according to the user password; the writing unit is configured to write the encrypted transformation matrix together with the encrypted encryption key into the encrypted file specify the location.

Further, the system also includes: using digest message algorithm MD5 to process the user password to obtain digest information of the user password, using the digest information to encrypt the encryption key in the key encryption unit, and converting The summary information is used in the matrix encryption unit to encrypt the transformation matrix.

Compared with the prior art, the present invention has the following advantages:

The file encryption method and the file encryption system of the present invention use MD5 to obtain the encrypted file encryption key after the abstract of the user password, and store the encrypted key in the designated position of the source file. In this way, when the user needs to read the key, he can directly read the fixed number of digits from the specified position of the file, which not only saves the time for the user to query the key when reading the file, but also ensures the security of the encryption key, that is, Stealing file encryption keys is very difficult if the user's password is not lost.

Furthermore, users can choose different protection levels according to their own definition of file security. For files with low security levels, low-level protection can be used, which is conducive to obtaining a fast encryption speed. For files with high security levels, high-level protection can be selected. Although the level of protection is relatively slow in time, the time sacrifice is acceptable for the importance of files. The method of hierarchical protection of files avoids the situation that all files are treated in a unified protection manner, and low-level protection is adopted for some files with low security, so that users will not spend and protect because they need to protect a file of general importance. The same time as files with higher importance will not prevent files with higher security from being protected with a high security level, thereby improving operating efficiency while ensuring the security level.

Further, the present invention also provides a file encryption method applicable to the BLOWFISH algorithm, that is, before encrypting the data, an XOR transformation is performed on the data, and then the matrix participating in the transformation is encrypted together with the file encryption key. In this method, even if the attacker steals all the encryption sub-keys, the content of the user file cannot be obtained if the attacker does not obtain the transformation matrix. This method can effectively improve the security of BLOWFISH.

Further, by using the system time and the random value as a seed to generate random numbers for XOR operation with the file to be encrypted, it can be ensured that the random numbers generated during fast operation are all different, further enhancing the security of the encryption method.

Additional features and advantages of the invention will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention may be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

Description of drawings

The accompanying drawings are used to provide a further understanding of the present invention, and constitute a part of the description, and are used together with the embodiments of the present invention to explain the present invention, and do not constitute a limitation to the present invention. In the attached picture:

Fig. 1 is a flowchart of a file encryption method according to Embodiment 1 of the present invention;

Fig. 2 is a flowchart of a file encryption method according to Embodiment 2 of the present invention;

3 is a structural diagram of a file encryption system according to Embodiment 3 of the present invention;

FIG. 4 is a structural diagram of a file encryption system according to Embodiment 4 of the present invention.

Detailed ways

The implementation of the present invention will be described in detail below in conjunction with the accompanying drawings and examples, so as to fully understand and implement the process of how to apply technical means to solve technical problems and achieve technical effects in the present invention. It should be noted that, as long as there is no conflict, each embodiment and each feature in each embodiment of the present invention can be combined with each other, and the formed technical solutions are all within the protection scope of the present invention.

In addition, the steps shown in the flow diagrams of the figures may be performed in a computer system, such as a set of computer-executable instructions, and, although a logical order is shown in the flow diagrams, in some cases, the sequence may be different. The steps shown or described are performed in the order herein.

Embodiment one

Fig. 1 is the flow chart of the file encryption method according to embodiment one of the present invention, each step of this method is described in detail below in conjunction with Fig. 1:

In step S110 (the word "step" is omitted below), an encryption key corresponding to the protection level is generated.

In this step, the file to be encrypted is first selected (called the file to be encrypted), and then the user selects the protection level for encryption according to the importance of the selected file.

Preferably, when prompting the user to select the file protection level, this step can select the protection level of the file to be encrypted according to the actual protection level required by the user, and generate file encryption keys of different lengths, because the security of the encryption system is very large Part of it is determined by the key length, but a long key will inevitably lead to slow file encryption during the encryption process. Therefore, this step provides the user with a qualitative protection interface for selecting the protection level, and the user can select the protection level according to his own requirements for the file.

S120. Encrypt the file to be encrypted according to the encryption key to obtain an encrypted file.

In this step, the file to be encrypted is encrypted with a preset encryption algorithm using the encryption key to obtain the encrypted file.

S130. Encrypt the encryption key according to the user password.

The purpose of this step is to enhance the security of the encryption key so that it is not easy to be stolen. Encrypting the encryption key through the user password can ensure that the encryption key is relatively safe under the condition that the user password is not lost or leaked.

Preferably, the MD5 hash function is used to process the user password to obtain summary information of the user password. The summary information is 128-bit summary information, and the 128-bit summary information is used as a new key encryption key for encryption.

S140. Write the encrypted encryption key into a designated location of the encrypted file.

Write the encrypted key obtained in S130 into a specified location of the file, and the specified location is preset. Since the number of bits of the encrypted encryption key to be written is fixed, it can be ensured that when the encryption key of the file needs to be read, the encrypted encryption key can be correctly positioned according to the preset specified position and the number of bits of the encryption key. The location of the key, resulting in the encryption key. Preferably, the specified position is at the end of the encrypted file or at a position with a specified number of digits away from the end.

Embodiment two

Fig. 2 is the flow chart of the file encryption method according to embodiment two of the present invention, embodiment two is on the basis of embodiment one, further improved encryption method, each step of this method is described in detail below in conjunction with Fig. 2:

S210. Generate an encryption key corresponding to the protection level.

This step is the same as S110 in the first embodiment. It will not be described in detail here.

S215. Generate a transformation matrix, and perform an XOR operation on the file to be encrypted and the transformation matrix.

Before encrypting the file to be encrypted, XOR operation is performed on it and a transformation matrix, so that the security of the file can still be guaranteed even if the encryption key is leaked. Preferably, the transformation matrix may be a matrix composed of random numbers generated by the system. The matrix is generated using the system time plus a random value as a seed, which can ensure that the generated seeds are not the same during fast operations. Preferably, the random number is a 64-bit random number, and an XOR operation is performed with the 64-bit data sequentially read from the file to be encrypted.

S220. Encrypt the file to be encrypted after the XOR operation according to the encryption key to obtain an encrypted file.

This step is the same as S120 in the first embodiment. It will not be described in detail here.

S230. Encrypt the transformation matrix and the encryption key according to the user password.

This step encrypts the transformation matrix according to the user password and is the same as step S130 in the first embodiment to encrypt the encryption key. Preferably, use the MD5 hash function to process the user password to obtain the summary information of the user password, and pass the summary information (128 bits) to encrypt the transformation matrix and encryption key.

S240. Write the encrypted change matrix together with the encrypted encryption key to a designated location of the encrypted file.

This step is similar to step S140 in the first embodiment, and the specified location is preset. Preferably, the specified position is at the end of the encrypted file or at a position with a specified number of digits away from the end.

The method of this embodiment can be used in the BLOWFISH algorithm to improve its security.

Embodiment three

FIG. 3 is a structural block diagram of a file encryption system according to Embodiment 3 of the present invention. The composition of the file encryption system will be described in detail below in conjunction with FIG. 3 .

The file encryption system corresponds to the file encryption method of Embodiment 1, and includes the following units:

A key generating unit, which generates an encryption key corresponding to the protection level.

In this unit, first select the file to be encrypted (called the file to be encrypted), and then the user selects the protection level of encryption according to the importance of the selected file.

Preferably, when prompting the user to select the file protection level, this unit can select the protection level of the file to be encrypted according to the actual protection level required by the user, and generate file encryption keys of different lengths, because the security of the encryption system is very large Part of it is determined by the key length, but a long key will inevitably lead to slow file encryption during the encryption process. Therefore, this unit provides a qualitative protection interface for users to choose the protection level, and users can choose the protection level according to their own requirements for files.

A file encryption unit, which encrypts the file to be encrypted according to the encryption key to obtain an encrypted file.

In this unit, the encryption key is used to encrypt the file to be encrypted by the preset encryption algorithm to obtain the encrypted file.

The key encryption unit encrypts the encryption key according to the user password.

The function of this unit is to enhance the security of the encryption key so that it is not easy to be stolen. Encrypting the encryption key through the user password can ensure that the encryption key is relatively safe under the condition that the user password is not lost or leaked.

Preferably, the MD5 hash function is used to process the user password to obtain summary information of the user password. The digest information is 128-bit digest information, and the encryption key is encrypted using the 128-bit digest information as a new key.

Write unit, which writes the encrypted encryption key into the specified location of the encrypted file.

Write the encrypted key obtained in the key encryption unit into a specified location of the file, and the specified location is preset. Since the number of bits of the encrypted encryption key to be written is fixed, it can be ensured that when the encryption key of the file needs to be read, the encrypted encryption key can be correctly positioned according to the preset specified position and the number of bits of the encryption key. The location of the key, resulting in the encryption key. Preferably, the specified position is at the end of the encrypted file or at a position with a specified number of digits away from the end.

Embodiment four

Fig. 4 is a flow chart of the file encryption method according to Embodiment 4 of the present invention. Embodiment 4 is a further improved encryption system on the basis of Embodiment 3, which corresponds to the file encryption method of Embodiment 3. Below in conjunction with Fig. 2 Each unit of the method is described in detail.

This file confidentiality system consists of the following units:

A key generating unit, which generates an encryption key corresponding to the protection level.

This unit is the same as the second embodiment. It will not be described in detail here.

An XOR operation unit, which generates a transformation matrix, and performs an XOR operation on the file to be encrypted and the transformation matrix.

Before encrypting the file to be encrypted, XOR operation is performed on it and a transformation matrix, so that the security of the file can still be guaranteed even if the encryption key is leaked. Preferably, the transformation matrix may be a matrix composed of random numbers generated by the system. The random numbers are generated by using the system time plus a random value as a seed, which can ensure that the generated seeds are not the same during fast operations. Preferably, the matrix is composed of 64-bit random numbers, and XOR operation is performed with the 64-bit data sequentially read from the file to be encrypted.

The file encryption unit encrypts the file to be encrypted after XOR operation according to the encryption key to obtain the encrypted file.

This unit is the same as the third embodiment. It will not be described in detail here.

The transformation matrix encryption unit encrypts the transformation matrix and the encryption key according to the user password.

This unit encrypts the transformation matrix according to the user password, which is the same as that unit S130 encrypts the encryption key in the first embodiment. Preferably, the MD5 hash function is used to process the user password to obtain the summary information of the user password. Through the summary information (128 bits) to encrypt the transformation matrix and encryption key.

A writing unit, which writes the encrypted change matrix and the encrypted encryption key into a specified position of the encrypted file.

This unit is similar to the writing unit in the third embodiment, and the designated position is preset. Preferably, the specified position is at the end of the encrypted file or at a position with a specified number of digits away from the end.

Preferably, what is written into the designated position together with the encrypted transformation matrix is the encrypted encryption key (realized by the key encryption unit, not shown in Fig. 4 ) encrypted by the user password, and its encryption method is the same as the transformation matrix .

The file encryption method and the file encryption system of the present invention have higher efficiency. With a 32bit microprocessor, the speed of encrypting 1Byte data can be achieved every 18 clock cycles, and the time is about one-tenth of DES and AES, which greatly improves the encryption efficiency.

The file encryption method and file encryption system provided by the present invention can be applied to computer devices and mobile smart terminals, can configure keys according to the security level selected by users, and improve encryption efficiency while ensuring security. Encrypt the encryption key of the file through the user password to further improve the reliability and security of file encryption. By performing an XOR operation on the file before encryption, further security is provided for the file, and losses caused by key leakage are avoided.

Those skilled in the art should understand that each module or each step of the present invention described above can be realized by a general-purpose computing device, and they can be concentrated on a single computing device, or distributed on a network formed by a plurality of computing devices, Optionally, they can be implemented with program codes executable by computing devices, thus, they can be stored in storage devices and executed by computing devices, or they can be made into individual integrated circuit modules, or multiple of them Each module or step is realized as a single integrated circuit module. As such, the present invention is not limited to any specific combination of hardware and software.

Although the embodiments disclosed in the present invention are as above, the described content is only an embodiment adopted for the convenience of understanding the present invention, and is not intended to limit the present invention. Anyone skilled in the technical field to which the present invention belongs can make any modifications and changes in the form and details of the implementation without departing from the spirit and scope disclosed by the present invention, but the patent protection scope of the present invention, The scope defined by the appended claims must still prevail.

Claims (6)

1. A file encryption method for a mobile intelligent terminal, characterized in that, comprising: A key generation step, generating an encryption key corresponding to the protection level; XOR operation step, performing XOR operation on the file to be encrypted and a transformation matrix; The file encryption step is to encrypt the file to be encrypted through XOR operation according to the encryption key to obtain the encrypted file; The key encryption step is to use the digest message algorithm MD5 to process the user password to obtain the summary information of the user password, and use the summary information to encrypt the encryption key and the transformation matrix; The writing step is to write the encrypted transformation matrix and the encrypted encryption key into the specified location of the encrypted file. 2. The encryption method according to claim 1, characterized in that, in the key generation step, the protection level of the file to be encrypted is selected, and according to the different protection levels, the lengths of the corresponding encryption keys are different . 3. The encryption method according to claim 1, wherein the transformation matrix is a matrix composed of random numbers, which is generated by system time and a random value. 4. The encryption method according to claim 3, wherein the transformation matrix is a matrix composed of 64-bit random numbers, and each 64-bit data read sequentially in the file to be encrypted is respectively related to the 64-bit random number. The number is XORed. 5. A file encryption system for a mobile intelligent terminal, characterized in that it comprises the following units: a key generation unit, which generates an encryption key corresponding to the protection level; An XOR operation unit, which generates a transformation matrix, and performs an XOR operation on the file to be encrypted and the transformation matrix; A file encryption unit, which encrypts the file to be encrypted after XOR operation according to the encryption key to obtain an encrypted file; A transformation matrix encryption unit, which uses the digest message algorithm MD5 to process the user password to obtain summary information of the user password, and uses the summary information to encrypt the transformation matrix; a key encryption unit that encrypts the encryption key using the digest information; A writing unit, which writes the encrypted transformation matrix and the encrypted encryption key into the specified location of the encrypted file. 6. The encryption system according to claim 5, wherein the key generating unit selects a protection level of the file to be encrypted, and the length of the corresponding encryption key is different according to the protection level.