Electronic file encrypting method and system based on fingerprint information

Method and system for encrypting electronic files based on fingerprint information

[0001] The present invention relates to a method and system for encrypting electronic files, and specifically refers to a method and system for encrypting electronic files based on fingerprint information.

Background technique

[0002] Computer cryptography is a science that studies the encryption, decryption and transformation of computer information. It is an interdisciplinary subject of mathematics and computer, and it is also an emerging subject. With the development of computer network security and computer communication technology, computer cryptography has received unprecedented attention and has been rapidly popularized and developed, and has been widely used in computer file encryption.

[0003] (1) Basic principles of data confidentiality and security

[0004] The security of the data information stored in the computer system and the data information transmitted in the network channel is mainly the confidentiality of the data information, that is, to prevent the data from being illegally learned; the second is the integrity of the data, that is, to prevent illegally. change the data.

[0005] The basis for solving the above problems is modern cryptography. The encryption method used in modern cryptography usually uses certain mathematical calculations to change the original information. Use a certain method to disguise the message and hide its content, called encryption (Encryption)_oThe message to be encrypted is called plaintext, and the set of all plaintexts is called the plaintext space; the encrypted message is called ciphertext, and the set of all ciphertexts is called the ciphertext space. The process of turning ciphertext into plaintext is called Decryption_oAmong them, encryption and decryption operations are composed of a class of algorithms. Different operations of these algorithms can be represented by different parameters. These parameters are called keys, and the key space is a collection of all keys. Therefore, a cryptographic system includes plaintext space, ciphertext space, key space, algorithms and their keys. The simple encryption and decryption process is shown in Figure 1.

[0006] As can be seen from the figure, the two basic units of a cryptographic system are algorithms and keys. Among them, the algorithm is relatively stable and is regarded as a constant; the key is not fixed and is regarded as a variable. Key security is the key to the security of a cryptographic system. For the security of the cryptographic system, frequent key replacement is necessary; special care should be taken when the key is distributed and stored. The sender uses an encryption key to encrypt the information and send it out through an encryption algorithm or device. After receiving the ciphertext, the receiver uses the decryption key to decrypt the ciphertext through a decryption algorithm and restores it to plaintext. If someone steals during transmission, he can only get the unintelligible ciphertext, thus keeping the information confidential.

[0007] (2) Data encryption technology

[0008] In a cryptographic system, an algorithm and a corresponding key form a cryptographic system. According to the characteristics of keys, cryptosystems are divided into symmetric key cryptosystems and public key cryptosystems. Among them, symmetric key cryptosystem is also called private key cryptosystem or single key cryptosystem. In a symmetric key cryptosystem, the encryption key and the decryption key are the same or it is easy to deduce one from the other. Public key cryptosystem is also called asymmetric key cryptosystem or dual-key cryptosystem. In the public key cryptosystem, the encryption key and the decryption key are different or it is difficult to deduce one from the other.

[0009] According to different encryption methods, symmetric key ciphers can be divided into block ciphers and stream ciphers. _oAmong them, the block cipher groups the plaintext according to a certain bit length, and the output is also a fixed-length ciphertext. The plaintext group is encrypted to obtain the ciphertext group. When decrypting, the ciphertext packet is restored to a plaintext packet after decryption operation. Minute

The advantage of group cipher is that the key can be fixed within a certain period of time without changing every time, which brings convenience to key distribution. The DES (Data Encryptionstandard) cipher is the first block cipher published by the National Bureau of Standards in 1977. At present, there are more than 100 kinds of block cipher algorithms open internationally, such as Lucifer, IDEA (International Data Encryption Algorithm), SAFER, etc., as well as the advanced data encryption standard AES (Advanced Encryption Standard) formulated and evaluated in February 2000. Readers who are interested in these algorithms can find their detailed discussion in Schneier's Applied Cryptography: Protocals, Algorithms, and Source Code in C book and conference proceedings Fast Software Encryption.

[0010] A stream cipher is also called a serial cipher, which uses a single character (generally a binary bit as a unit) to perform an encryption operation to generate a ciphertext for plaintext information. In stream ciphers, a bit sequence called a key stream is usually used as a key to apply an "exclusive OR" operation to the plaintext bit by bit. Some serial ciphers are based on a mechanism called Linear Feedback Shift Register (LFSR), which generates a sequence of binary bits. Commonly used stream cipher algorithms include RC4, A5, Software Optimized Encryption Algorithm (SEL), SN0W2. O.WAKE and PKZIP. Compared with block ciphers, sequence ciphers have a faster speed.

[0011] In a symmetric key cryptosystem, the decryption key is the same as the encryption key or can be easily derived from the encryption key. Exposure of the encryption key will make the system insecure. Therefore, the symmetric key cryptosystem is used to transmit any information. Before the ciphertext, the sender and receiver must use a secure channel to communicate the transmission key in advance, which is called secure key exchange, which is difficult to achieve in actual communication. The public key cryptosystem can well solve the security problem in the symmetric key cryptosystem. In public key cryptography, the decryption key is different from the encryption key. It is difficult to deduce the other. The decryption and encryption are separable, and the encryption key can be made public. The view of public key cryptosystem was first proposed by Diffie and Hellman in 1976, called the Diffie-Hellman algorithm, which revolutionized cryptography. In 1977, Rivest, Shamir and Adleman proposed the first relatively complete public key cryptographic algorithm, which is the famous RSA algorithm. Since then, people have proposed a large number of public-key cryptographic algorithms based on different calculation problems. Representative algorithms include DSA algorithm, Merke-Heliman knapsack algorithm and elliptic curve algorithm.

[0012] (3) Password-based file encryption technology

[0013] In cryptographic technology, symmetric encryption can be used in many fields, it is faster than asymmetric encryption, and is mainly suitable for large amounts of data conversion, such as file encryption. In symmetric encryption, the same key is used for both encryption and decryption, so the key of symmetric encryption should also be kept secret. In a password-based encryption strategy, the key is the password. Password-based encryption uses a password to encrypt the key. It is safer for users to master the key than using other physical media. The working process is shown in Figure 2. It can be seen from Figure 2 that password-based file encryption uses a combination of hash encryption and symmetric encryption. The password is hashed by the message digest algorithm, and the result of the hashing is the symmetric encryption algorithm to construct a key. Among them, the key derived module applies a hash function to derive the key, and the hash function can be MD2.MD5 or SHA-1.

[0014] In file decryption, the same key derivation function as the encryption operation is applied to the password to generate the derivation key. Then, under the action of the derived key, the ciphertext file is decrypted with the same basic block cipher algorithm as the encryption operation to recover the plaintext file, as shown in Figure 3.

[0015] However, the password encryption method is adopted, but this method has shortcomings that are easy to forget and stolen by others and are difficult to make up, and the security is unsatisfactory. Therefore, the conventional password-based authentication and encryption methods have many problems and cannot meet the special requirements of some sensitive occasions. With the development of biometric identification technology that has gradually matured in recent years, it is applied to information security, using the uniqueness and stability of biometrics to integrate with encryption algorithms.

Together, to provide protection for network information security. Combining fingerprint biometric technology and encryption mechanism organically can make use of the uniqueness and irreplaceability of fingerprint biometrics to ensure the long-term effectiveness of information security, and completely eliminate the phenomenon of forgotten, stolen and cracked passwords and keys.

[0016] In summary, the current confidentiality protection of electronic files is currently mainly handled by the following two methods: (1) password encryption method; (2) fingerprint authentication access control method (the principle is detailed in the Chinese Authorization Announcement No. 100520671 patent). However, the above two methods have problems: the first method, the use of traditional passwords for file encryption has obvious shortcomings. First, the password may be forgotten; second, the security of the password input is not good; secondly, the management is troublesome; finally, there is no uniqueness. ,A password can be used by anyone, there is no one-to-one relationship, and the user's behavior cannot be recorded. The second method is based on fingerprint authentication technology and fingerprint-key mechanism to encrypt and decrypt files. The disadvantage of this method is that fingerprint registration is required first, that is, the fingerprint information must be stored in the fingerprint database in advance. Therefore, the fingerprint information of this method is essentially only used for the identity verification of the operating user. Secondly, this method requires the establishment of a fingerprint-key information library, and an attacker can directly obtain the decryption key of the file by obtaining the information in the fingerprint-key library, and decrypt the file. In this way, it is possible to bypass the authentication when the file is decrypted. Therefore, both of the above two methods have safety problems.

Summary of the invention

[0017] The purpose of the present invention is to provide a method for encrypting files based on fingerprint technology for the confidentiality of static electronic file information in electronic storage media.

[0018] To achieve the above objective, the present invention adopts a technical solution: a method for encrypting electronic files based on fingerprint information, the encryption steps of which include:

[0019] S1 selects the plaintext electronic file that needs to be encrypted;

[0020] S2 selects an encryption algorithm;

[0021] S3 Input the user's fingerprint through the fingerprint sensor;

[0022] The S4 computer extracts fingerprint features through the input fingerprints;

[0023] The S5 computer generates a globally unique fingerprint information number according to fingerprint characteristics;

[0024] S6 transforms the globally unique fingerprint information number into a corresponding encryption key that complies with the encryption algorithm selected in step S2;

[0025] S7 uses a symmetric cryptographic operation on the plaintext electronic file according to the encryption key to generate a ciphertext electronic file.

[0026] At the same time, the present invention also adopts another technical solution: a fingerprint information-based electronic file encryption system, which includes: a fingerprint input module, an encryption module, a decryption module, and a central processing unit that controls the above modules, The encryption module includes an encryption algorithm unit, an encryption fingerprint identification unit, an encryption transformation unit, and an encryption key, while the decryption module includes a decryption algorithm unit, a decryption fingerprint identification unit, a decryption transformation unit, a decryption key, and a verification unit.

[0027] The advantages of the present invention are:

[0028] The method and system proposed by the present invention can realize the encryption protection of statically stored electronic files, and solve the confidentiality problem of statically stored plaintext electronic files. The present invention uses more mature fingerprint technology to design fingerprint encryption electronics. The file scheme uses fingerprint information as the key of the symmetric file encryption algorithm, and uses the uniqueness and irreplaceability of fingerprint characteristics to ensure the long-term validity of security information, and avoid the phenomenon of forgotten, stolen, and cracked passwords and keys. At the same time, the operation is simple and practical.

Description of the drawings

[0029] The present invention will be further described below in conjunction with the accompanying drawings and embodiments:

[0030] FIG. 1 is a functional block diagram of an existing electronic file encryption and decryption.

[0031] FIG. 2 is a functional block diagram of another existing electronic file encryption.

[0032] FIG. 3 is a functional block diagram of the decryption of FIG. 2.

[0033] FIG. 4 is a flowchart of the electronic file encryption method of the present invention.

[0034] FIG. 5 is a flowchart of the electronic file decryption method of the present invention.

[0035] FIG. 6 is a functional block diagram of the electronic file encryption system of the present invention.

[0036] FIG. 7 is a functional block diagram of the encryption and decryption module in the electronic file encryption system of the present invention.

Detailed ways

[0037] Embodiment: As shown in FIGS. 4-5, the present invention provides an embodiment of a method for encrypting an electronic file based on fingerprint information, wherein the method for encrypting and decrypting an electronic file includes an electronic file encryption process and an electronic file decryption process .

[0038] 1. Electronic file encryption process

[0039] As shown in FIG. 4, in this process, the electronic file is a plaintext file, and the encryption steps are as follows:

[0040] S1 selects the plaintext electronic file that needs to be encrypted;

[0041] S2 selects an encryption algorithm, where the encryption algorithm includes at least one of the following four: DES (Data Encryption Standard)> 3DES (Triple Data Encryption Standard), AES (Advanced Encryption Standard, Advanced Encryption Standard) ), IDEA (International Data Encryption Algorithm);

[0042] S3 inputs the user's fingerprint through the fingerprint sensor;

[0043] S4 The computer extracts fingerprint features through the input fingerprints;

[0044] The S5 computer generates a globally unique fingerprint information number GFID (Global Finger IDentifier) according to fingerprint characteristics;

[0045] S6 transforms the globally unique fingerprint information number into a corresponding encryption key in accordance with the encryption algorithm selected in step S2, for example, using a hash function MD5 (message digest algorithm 5, MessageDigest Algorithm 5) or SHA1 (secure Hash algorithm 1, Secure Hash Algorithm 1) to transform, but not limited to this;

[0046] S7 uses a symmetric cryptographic operation on the plaintext electronic file according to the encryption key to generate a ciphertext electronic file; where the encryption operation requires the use of the plaintext file information from step S1;

[0047] S8 The computer performs different processing on the plaintext file: deleting the plaintext electronic file or keeping the plaintext electronic file. If the user chooses to delete the plaintext electronic file, the computer will completely delete the data content of the plaintext electronic file in the storage body, for example, fill the storage unit where the plaintext electronic file data area is located with "00" data, but it is not limited to this. [0048] 2. Electronic file decryption process

[0049] As shown in FIG. 5, the electronic file in this process is a ciphertext file, and the decryption steps are as follows:

[0050] S9 the user selects a ciphertext electronic file;

[0051] S10 The user inputs a fingerprint through the fingerprint sensor;

[0052] S11 The computer extracts fingerprint features;

[0053] The S12 computer generates a globally unique fingerprint information number GFID according to fingerprint characteristics;

[0054] The S13 computer automatically transforms the globally unique fingerprint information number GFID into a decryption key required by the decryption algorithm in the decryption operation, for example, using a hash function MD5 or SHA1 for transformation, but not limited to this; need

Use the ciphertext electronic file information in step S9;

[0055] S14 The computer automatically selects a symmetric decryption algorithm according to the decryption key, and the decryption algorithm includes at least DES, 3DES,

One of the four algorithms of AES and IDEA; among them, it is necessary to use the ciphertext electronic file information in step S9 to determine when the correct decryption algorithm is automatically selected;

[0056] S15 determines whether the fingerprint input by the user is correct. If it is correct, the decrypted electronic file is a plaintext file; otherwise, the decrypted electronic file is a garbled file.

[0057] At the same time, as shown in Figures 6-7, the present invention provides a fingerprint information-based electronic file encryption system based on the above encryption method, which includes a fingerprint input module, an encryption module, a decryption module, and a central processing unit that controls the above modules. Unit (not shown). The fingerprint input module is used to input the user's fingerprint, and the central processing unit is the CPU or single-chip computer in the computer.

[0058] The encryption module is used to encrypt the plaintext electronic file, which includes an encryption algorithm unit, an encrypted fingerprint identification unit, an encryption conversion unit, and an encryption key. The encryption algorithm unit includes at least one of the four algorithms of DES, 3DES, AES, and IDEA. The encrypted fingerprint identification unit generates a globally unique fingerprint information number GFID through the extracted fingerprint characteristics. The encryption conversion unit uses a hash function, such as MD5 or SHA1, to convert the fingerprint information number and output an encryption key.

[0059] The decryption module is used to decrypt the ciphertext electronic file, which includes a decryption algorithm unit, a decryption fingerprint identification unit, a decryption transformation unit, a decryption key, and a verification unit. The decryption algorithm unit includes at least one of the four algorithms of DES, 3DES, AES, and IDEA. The decryption fingerprint identification unit generates a globally unique fingerprint information number through the extracted fingerprint characteristics. The GFIDo decryption transformation unit uses a hash function, such as MD5 or SHA1 for fingerprints. The information number is transformed to output a decryption key, and the verification unit is used to verify whether the encryption key and the decryption key are consistent.

[0060] In the present invention, the fingerprint-based encryption and decryption key value is determined by the fingerprint characteristic value and the hash algorithm, and in the electronic file encryption process, different encryption key values are generated according to the different encryption algorithms selected by the user, and at the same time In the decryption process of the electronic file, the appropriate decryption algorithm can be automatically selected according to the ciphertext file, and the corresponding decryption key value can be generated. In addition, the key required for encryption and decryption of electronic files is dynamically generated during the encryption and decryption operation, and there is no need to put the key in the key pool, and there is no need to store the key in any storage medium. This avoids problems such as key security or loss due to storage media. There is no need to generate and store the encryption and decryption keys in advance, thereby avoiding the security problem of the encryption and decryption keys themselves. Moreover, in the process of encrypting electronic files, users can also choose whether to completely delete the plaintext electronic files, so as to avoid the confidentiality problems caused by the plaintext electronic files remaining in the storage medium after the encrypted electronic files. The more important thing of the present invention is that before fingerprint encryption and decryption is performed on the electronic file, the fingerprint does not need to be registered in advance, which makes the operation simpler and more convenient.

[0061] The present invention organically combines fingerprint feature information and encryption mechanism to provide a safer and more convenient file encryption management system. The uniqueness and irreplaceability of fingerprint features ensure the long-term validity of security information. Avoid forgotten, stolen, and cracked passwords and keys, and the operation is simple and practical.

[0062] Of course, the above-mentioned embodiments are only to illustrate the technical ideas and features of the present invention, and their purpose is to enable people familiar with the technology to understand the content of the present invention and implement them accordingly, and cannot limit the scope of protection of the present invention. All equivalent changes or modifications made according to the spirit of the main technical solution of the present invention should be covered by the protection scope of the present invention.