File encryption method, device, system platform and file decryption method

Abstract

The application discloses a file encryption method, device, system platform and file decryption method. The method comprises the following steps: determining a first key, wherein the first key is a random generated preset length string; transforming the first key based on a preset transformation rule to obtain a second key; encrypting a target file according to the second key and a preset encryption algorithm, and writing the first key, the preset encryption algorithm and the preset transformation rule into a code segment for kernel compilation in a target platform, wherein the first key, the preset encryption algorithm and the preset transformation rule written in the code segment are used for decrypting the encrypted target file. The application solves the technical problem that the key is easily leaked due to the fact that the key for encryption and decryption is not processed in the prior art.

Description

Technical Field

[0001] This invention relates to the field of data security, and more specifically, to a file encryption method, apparatus, system platform, and file decryption method. Background Technology

[0002] In existing technologies, the encryption and decryption keys are not processed when encrypting files. If the same key is used continuously without processing, the key is easily leaked, and the root file system encryption loses its meaning.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This invention provides a file encryption method, apparatus, system platform, and file decryption method to at least solve the technical problem that the encryption and decryption keys are easily leaked because the prior art does not process the encryption and decryption keys.

[0005] According to one aspect of the present invention, a file encryption method is provided, comprising: determining a first key, wherein the first key is a randomly generated string of a preset length; transforming the first key based on a preset transformation rule to obtain a second key; encrypting a target file according to the second key and a preset encryption algorithm, and writing the first key, the preset encryption algorithm, and the preset transformation rule into a code segment for kernel compilation in a target platform, wherein the first key, the preset encryption algorithm, and the preset transformation rule written into the code segment are used to decrypt the encrypted target file.

[0006] Optionally, writing the first key into the code segment used for kernel compilation in the target platform includes: dividing the first key into a preset number of subkey fragments; embedding each subkey fragment in the preset number of subkey fragments into a specified location in the code segment, and deriving the memory address corresponding to the code segment, wherein the memory address is used to determine the specified location where each subkey fragment is embedded.

[0007] Optionally, embedding each of the preset number of subkey fragments into a specified position in the code segment includes: sorting the preset number of subkey fragments according to their positions in the first key and determining the sequence number corresponding to each subkey fragment; randomly assigning the preset number of subkey fragments to the specified positions and recording the sequence number corresponding to the subkey fragment embedded in each specified position, wherein each specified position embeds a subkey fragment.

[0008] Optionally, encrypting the target file according to the second key and the preset encryption algorithm includes: compressing the target file to obtain a target compressed package; encrypting the target compressed package according to the second key and the preset encryption algorithm; and writing the encrypted target compressed package into an image file.

[0009] Optionally, after encrypting the target file based on the second key and the preset encryption algorithm, and writing the first key, the preset encryption algorithm and the preset transformation rules into the code segment used for kernel compilation in the target platform, the file encryption method further includes adding kernel encryption and decryption configuration options to the kernel configuration file of the target platform.

[0010] According to another aspect of the present invention, a file decryption method is also provided, comprising: determining a preset transformation rule, a preset decryption algorithm and a first key corresponding to a target compressed file; transforming the first key according to the preset transformation rule and the first key to obtain a second key; determining a preset decryption algorithm corresponding to the target compressed file, and decrypting the target compressed file according to the second key and the preset decryption algorithm.

[0011] Optionally, determining the first key corresponding to the target compressed package includes: determining the memory address corresponding to the code segment used for kernel compilation in the target platform, wherein the memory address is used to determine the location of subkey fragments of multiple first keys embedded in the code segment; extracting multiple subkey fragments from the code segment based on the memory address; and concatenating the multiple subkey fragments to obtain the first key.

[0012] Optionally, concatenating multiple subkey segments to obtain a first key includes: determining the sequence number corresponding to each subkey segment in the multiple subkey segments, wherein the sequence number is the sequence number of the subkey segment in the key arrangement order, and the key arrangement order is the arrangement order of the multiple subkey segments determined according to the position of the subkey segments in the first key; concatenating the multiple subkey segments according to the sequence number corresponding to each subkey segment in the multiple subkey segments to obtain the first key.

[0013] According to another aspect of the present invention, a file encryption device is provided, comprising: a processing module for determining a first key, wherein the first key is a randomly generated string of a preset length; a transformation module for transforming the first key based on a preset transformation rule to obtain a second key; and an encryption module for encrypting a target file according to the second key and a preset encryption algorithm, and writing the first key, the preset encryption algorithm, and the preset transformation rule into a code segment for kernel compilation in a target platform, wherein the first key, the preset encryption algorithm, and the preset transformation rule are used to decrypt the encrypted target file.

[0014] According to another aspect of the present invention, a system platform is provided, including an encryption module and a decryption module. The encryption module is configured to: determine a first key, wherein the first key is a randomly generated string of a preset length; transform the first key based on a preset transformation rule to obtain a second key; encrypt a target file according to the second key and a preset encryption algorithm, and write the first key, the preset encryption algorithm, and the preset transformation rule into a code segment for kernel compilation in the target platform, wherein the first key, the preset encryption algorithm, and the preset transformation rule are used to decrypt the encrypted target file. The decryption module is configured to: determine a preset transformation rule, a preset decryption algorithm, and a first key corresponding to a target compressed package, wherein the target compressed package is obtained by compressing the target file; transform the first key according to the preset transformation rule and the first key to obtain a second key; determine a preset decryption algorithm corresponding to the target compressed package, and decrypt the target compressed package according to the second key and the preset decryption algorithm.

[0015] According to another aspect of the present invention, a non-volatile storage medium is provided, the non-volatile storage medium including a stored program, wherein, when the program is running, it controls the device where the non-volatile storage medium is located to execute a file encryption method.

[0016] According to another aspect of the present invention, a processor is provided for running a program, wherein the program executes a file encryption method during runtime.

[0017] In this embodiment of the invention, a first key is determined, wherein the first key is a randomly generated string of a preset length; a second key is obtained by transforming the first key based on a preset transformation rule; the target file is encrypted according to the second key and a preset encryption algorithm, and the first key, the preset encryption algorithm, and the preset transformation rule are written into the code segment used for kernel compilation in the target platform. The first key, the preset encryption algorithm, and the preset transformation rule written into the code segment are used to decrypt the encrypted target file. By transforming the first key to obtain the second key and using the second key to encrypt the target file, the purpose of preventing the target file from being decrypted after the first key is leaked is achieved, thereby realizing the technical effect of improving the security of the target file. This solves the technical problem of easy key leakage caused by the lack of processing of the encryption and decryption keys in the prior art. Attached Figure Description

[0018] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0019] Figure 1This is a flowchart illustrating a file encryption method according to an embodiment of the present invention;

[0020] Figure 2 This is a schematic diagram of a file encryption process in a target platform according to an embodiment of the present invention;

[0021] Figure 3 This is a flowchart illustrating a file decryption method according to an embodiment of the present invention;

[0022] Figure 4 This is a flowchart illustrating a file decryption process in a target platform according to an embodiment of the present invention;

[0023] Figure 5 This is a schematic diagram of a file encryption device according to an embodiment of the present invention;

[0024] Figure 6 This is a schematic diagram of the structure of a computer terminal device according to an embodiment of the present invention. Detailed Implementation

[0025] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0027] According to an embodiment of the present invention, a method embodiment of a file encryption method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0028] Figure 1 This is a file encryption method according to an embodiment of the present invention, such as... Figure 1 As shown, this method is applicable to embedded platform Linux systems and includes the following steps:

[0029] Step S102: Determine the first key, wherein the first key is a randomly generated string of a preset length;

[0030] In some embodiments of this application, any random character generation algorithm can be used to generate the aforementioned preset length string. For example, a string of 32 characters in length can be generated.

[0031] Step S104: Based on a preset transformation rule, the first key is transformed to obtain the second key;

[0032] In some embodiments of this application, the character length of the second key may be different from that of the first key.

[0033] Step S106: Based on the second key and the preset encryption algorithm, encrypt the target file, and write the first key, the preset encryption algorithm and the preset transformation rule into the code segment used for kernel compilation in the target platform. The first key, the preset encryption algorithm and the preset transformation rule written into the code segment are used to decrypt the encrypted target file.

[0034] In some embodiments of this application, the process of writing the first key into the code segment used for kernel compilation in the target platform is as follows: the first key is divided into a preset number of sub-key fragments; each sub-key fragment in the preset number of sub-key fragments is embedded in a specified position in the code segment, and the memory address corresponding to the code segment is derived, wherein the memory address is used to determine the specified position in which each sub-key fragment is embedded.

[0035] In some embodiments of this application, embedding each of the preset number of subkey segments into a designated position in the code segment includes: sorting the preset number of subkey segments according to their positions in the first key, and determining the sequence number corresponding to each subkey segment; randomly assigning the preset number of subkey segments to the designated positions, and recording the sequence number corresponding to the subkey segment embedded in each designated position, wherein each designated position embeds a subkey segment.

[0036] In some embodiments of this application, the target file is encrypted according to the second key and the preset encryption algorithm as follows: the target file is compressed to obtain a target compressed package; the target compressed package is encrypted according to the second key and the preset encryption algorithm; and the encrypted target compressed package is written into an image file.

[0037] In some embodiments of this application, after encrypting the target file based on the second key and the preset encryption algorithm, and writing the first key, the preset encryption algorithm and the preset transformation rule into the code segment for kernel compilation in the target platform, the file encryption method further includes: adding kernel encryption / decryption configuration options to the kernel configuration file of the target platform.

[0038] Specifically, a custom kernel encryption / decryption configuration option can be added to the kernel configuration file and enabled to enable the decryption process in the kernel.

[0039] In some embodiments of this application, when the target platform is a Linux system, a decryption process can be added before the root file system decompression process in the Linux kernel, and wrapped with a kernel configuration option macro definition to distinguish whether the decryption process is enabled. During decryption, the key fields are first obtained from the kernel code segment, then concatenated, and then the key is transformed using the same algorithm as during encryption to obtain the real key. Finally, the real key is used to decrypt the encrypted root file system, followed by decompression and mounting.

[0040] In some embodiments of this application, when the target platform is a Linux system and the target file is a system file corresponding to the root file system, the following is adopted: Figure 1 The file encryption method shown encrypts the root file as follows: Figure 2 As shown, it includes the following steps:

[0041] In step S202, a root file is generated; in step S204, the root file is compressed; in step S206, a first key is randomly generated and transformed to generate a second key; in step S208, the compressed root file is encrypted using the second key; in step S210, the first key is segmented and embedded into the kernel code segment of the Linux system; in step S212, the encrypted root file is compiled into the image file.

[0042] According to an embodiment of the present invention, a method embodiment of a file encryption method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0043] Figure 3 This is a file decryption method according to an embodiment of the present invention, such as... Figure 3 As shown, the method includes the following steps:

[0044] Step S302: Determine the preset transformation rule, preset decryption algorithm and first key corresponding to the target compressed package;

[0045] In some embodiments of this application, the process for determining the first key corresponding to the target compressed package is as follows: determining the memory address corresponding to the code segment used for kernel compilation in the target platform, wherein the memory address is used to determine the location of subkey fragments of multiple first keys embedded in the code segment; extracting multiple subkey fragments from the code segment based on the memory address; and concatenating the multiple subkey fragments to obtain the first key.

[0046] In some embodiments of this application, when concatenating multiple subkey segments to obtain the first key, it is also necessary to determine the arrangement order of each subkey segment in the first key. Specifically, it is necessary to determine the sequence number corresponding to each of the multiple subkey segments, wherein the sequence number is the sequence number of the subkey segment in the key arrangement order, and the key arrangement order is the arrangement order of the multiple subkey segments determined according to the position of the subkey segment in the first key; the multiple subkey segments are concatenated according to the sequence number corresponding to each of the multiple subkey segments to obtain the first key.

[0047] In some embodiments of this application, the target compressed package can be a compressed package of the root file system. Wherein, when the target compressed package is a compressed package of the root file system, the specific method for determining the first key is as follows: when the target device boots, the first key is obtained from the kernel code segment of the Linux system kernel running on the target device. It should be noted that the Linux system kernel is in kernel mode when obtaining the first key from the kernel code segment.

[0048] Step S304: According to the preset transformation rules and the first key, transform the first key to obtain the second key;

[0049] Step S306: Determine the preset decryption algorithm corresponding to the target compressed package, and decrypt the target compressed package according to the second key and the preset decryption algorithm.

[0050] When the target platform is a Linux system and the target file is a root file, the following is adopted: Figure 3 The specific process of decrypting the target file using the file decryption method shown is as follows: Figure 4As shown, the process includes the following steps: In step S402, the target device is started; in step S404, the Linux system kernel running on the target device is started; in step S406, the Linux system kernel in kernel mode reads the first key from the corresponding kernel code segment; in step S408, the first key is transformed to obtain the second key, and the second key is used to decrypt and decompress the compressed package of the root file system to obtain the system files of the root file system; in step S410, the root file system is mounted.

[0051] In some embodiments of this application, a complete encryption and decryption process for the root file in a Linux system is as follows: After the root file system is generated, it is compressed and encrypted. During encryption, a random number generator is used to randomly generate a 32-byte key, ensuring that the key used for encryption is different each time it is compiled. After the key is generated, it is divided into several key files and embedded into the kernel compilation code segment in segments, while the memory address is exported. A fixed algorithm transformation is performed on the key to generate a new key, ensuring that the key used for encryption is not directly exposed. The compressed file of the root file system is encrypted using the new key. The encryption algorithm is not limited, as long as it can encrypt the file. The encryption and decryption algorithm and the key transformation algorithm are compiled into the Linux kernel. At the same time, a custom kernel encryption and decryption configuration option is added to the kernel configuration file and enabled, enabling the decryption process in the kernel. A decryption process is added before the root file system decompression process in the Linux kernel, and wrapped with a kernel configuration option macro definition to distinguish whether the decryption process is enabled. During decryption, each key field is first obtained from the kernel code segment, then concatenated, and then the key is transformed according to the same algorithm used during encryption to obtain the real key. Finally, the encrypted root file system is decrypted using the real key, and then decompressed and mounted.

[0052] The above process protects the embedded root file system from direct exposure, thus safeguarding it. Furthermore, generating a key each time the image is packaged, and storing and re-encrypting the key in segments, effectively prevents key leakage.

[0053] According to an embodiment of the present invention, an embodiment of a file encryption device is provided. Figure 5 This is a file encryption device provided according to embodiments of the present invention, such as... Figure 5As shown, the file encryption device includes: a processing module 50, used to determine a first key, wherein the first key is a randomly generated string of a preset length; a transformation module 52, used to transform the first key based on a preset transformation rule to obtain a second key; and an encryption module 54, used to encrypt the target file according to the second key and a preset encryption algorithm, and to write the first key, the preset encryption algorithm and the preset transformation rule into the code segment for kernel compilation in the target platform, wherein the first key, the preset encryption algorithm and the preset transformation rule are used to decrypt the encrypted target file.

[0054] It should be noted that, Figure 5 The file encryption device shown can be used to perform Figure 1 The file encryption method shown here, therefore, for Figure 1 The explanations and descriptions of the file encryption methods shown also apply to Figure 5 The file encryption device shown is not described in detail here.

[0055] According to an embodiment of the present invention, a system platform embodiment is provided. The system platform includes an encryption module and a decryption module. The encryption module is used to determine a first key, wherein the first key is a randomly generated string of a preset length; transform the first key based on a preset transformation rule to obtain a second key; encrypt a target file according to the second key and a preset encryption algorithm, and write the first key, the preset encryption algorithm, and the preset transformation rule into a code segment for kernel compilation in the target platform, wherein the first key, the preset encryption algorithm, and the preset transformation rule are used to decrypt the encrypted target file. The decryption module is used to determine a preset transformation rule, a preset decryption algorithm, and a first key corresponding to a target compressed package, wherein the target compressed package is obtained by compressing the target file; transform the first key according to the preset transformation rule and the first key to obtain a second key; determine a preset decryption algorithm corresponding to the target compressed package, and decrypt the target compressed package according to the second key and the preset decryption algorithm.

[0056] According to an embodiment of the present invention, a non-volatile storage medium is provided. The non-volatile storage medium includes a stored program, wherein, during program execution, the device where the non-volatile storage medium is located executes the following file encryption method: determining a first key, wherein the first key is a randomly generated string of a preset length; transforming the first key based on a preset transformation rule to obtain a second key; encrypting a target file according to the second key and a preset encryption algorithm, and writing the first key, the preset encryption algorithm, and the preset transformation rule into a code segment for kernel compilation in the target platform, wherein the first key, the preset encryption algorithm, and the preset transformation rule written into the code segment are used to decrypt the encrypted target file.

[0057] According to an embodiment of the present invention, another embodiment of a non-volatile storage medium is provided. The non-volatile storage medium includes a stored program, wherein, during program execution, the device where the non-volatile storage medium is located executes the following file decryption method: determining a preset transformation rule, a preset decryption algorithm, and a first key corresponding to a target compressed package; transforming the first key according to the preset transformation rule and the first key to obtain a second key; determining a preset decryption algorithm corresponding to the target compressed package, and decrypting the target compressed package according to the second key and the preset decryption algorithm.

[0058] According to an embodiment of the present invention, a processor embodiment is provided. The processor is used to run a program, wherein the program executes the following file encryption method during runtime: determining a first key, wherein the first key is a randomly generated string of a preset length; transforming the first key based on a preset transformation rule to obtain a second key; encrypting a target file according to the second key and a preset encryption algorithm, and writing the first key, the preset encryption algorithm, and the preset transformation rule into a code segment for kernel compilation in a target platform, wherein the first key, the preset encryption algorithm, and the preset transformation rule written into the code segment are used to decrypt the encrypted target file.

[0059] According to an embodiment of the present invention, another embodiment of a processor is provided. The processor is used to run a program, wherein the program executes the following file decryption method during runtime: determining a preset transformation rule, a preset decryption algorithm, and a first key corresponding to a target compressed package; transforming the first key according to the preset transformation rule and the first key to obtain a second key; determining a preset decryption algorithm corresponding to the target compressed package, and decrypting the target compressed package according to the second key and the preset decryption algorithm.

[0060] According to an embodiment of the present invention, an embodiment of a computer device is provided. Figure 6 This is a schematic diagram of the structure of a computer device 600 according to an embodiment of the present invention.

[0061] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory 604 including instructions, which can be executed by a processor 602 of the device 600 to perform the following file encryption method: determining a first key, wherein the first key is a randomly generated string of a preset length; transforming the first key based on a preset transformation rule to obtain a second key; encrypting a target file according to the second key and a preset encryption algorithm, and writing the first key, the preset encryption algorithm, and the preset transformation rule into a code segment for kernel compilation in the target platform, wherein the first key, the preset encryption algorithm, and the preset transformation rule written into the code segment are used to decrypt the encrypted target file.

[0062] In some embodiments of this application, the above instructions may also be executed by the processor 602 of the device 600 to complete the following file encryption method: determining the preset transformation rule, preset decryption algorithm and first key corresponding to the target compressed package; transforming the first key according to the preset transformation rule and the first key to obtain a second key; determining the preset decryption algorithm corresponding to the target compressed package, and decrypting the target compressed package according to the second key and the preset decryption algorithm.

[0063] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0064] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0065] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0066] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0067] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0068] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0069] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A file encryption method characterized by, The method comprises the following steps: determining a first key, wherein the first key is a randomly generated preset length string; transforming the first key based on a preset transformation rule to obtain a second key; encrypting a target file according to the second key and a preset encryption algorithm, and writing the first key, the preset encryption algorithm and the preset transformation rule into a code segment for kernel compilation in a target platform, wherein the first key, the preset encryption algorithm and the preset transformation rule written into the code segment are used to decrypt the encrypted target file, the target platform obtains the first key in a kernel state, and a decryption process of the target platform is wrapped by a kernel configuration option macro definition; wherein writing the first key into the code segment for kernel compilation in the target platform comprises: dividing the first key into a preset number of sub-key segments; embedding each of the preset number of sub-key segments into a specified position in the code segment, and exporting a memory address corresponding to the code segment, wherein the memory address is used to determine the specified position where each of the sub-key segments is embedded, and the preset number of sub-key segments are randomly allocated to the specified positions.

2. The file encryption method of claim 1, wherein, embedding each of the preset number of sub-key segments into a specified position in the code segment comprises: sorting the preset number of sub-key segments according to their positions in the first key, and determining a serial number corresponding to each of the sub-key segments; randomly allocating the preset number of sub-key segments to the specified positions, and recording the serial number corresponding to the sub-key segment embedded in each of the specified positions, wherein each of the specified positions embeds a segment of the sub-key segment.

3. The file encryption method of claim 1, wherein, encrypting a target file according to the second key and a preset encryption algorithm comprises: compressing the target file to obtain a target compressed package; encrypting the target compressed package according to the second key and the preset encryption algorithm; writing the encrypted target compressed package into an image file.

4. The file encryption method of claim 1, wherein, After encrypting a target file according to the second key and a preset encryption algorithm, and writing the first key, the preset encryption algorithm and the preset transformation rule into a code segment for kernel compilation in a target platform, the file encryption method further comprises: adding a kernel encryption and decryption configuration option in a kernel configuration file of the target platform.

5. A file decryption method characterized by, The method comprises the following steps: determining a target compressed package corresponding to a preset transformation rule, a preset decryption algorithm and a first key; transforming the first key according to the preset transformation rule and the first key to obtain a second key; determining a preset decryption algorithm corresponding to the target compressed package, and decrypting the target compressed package according to the second key and the preset decryption algorithm; The first key corresponding to the target compressed package is determined by determining a memory address corresponding to a code segment for kernel compilation in the target platform, wherein a decryption process of the target platform is wrapped by a kernel configuration option macro definition, the memory address is used to determine positions of a plurality of sub-key segments of the first key embedded in the code segment, the sub-key segments are randomly arranged in the positions, and the plurality of sub-key segments are extracted from the code segment according to the memory address.

6. The file decryption method according to claim 5, characterized by, The first key is obtained by splicing the plurality of sub-key segments. Each of the plurality of sub-key segments is determined to correspond to a serial number, wherein the serial number is a serial number of the sub-key segment in a key arrangement order, and the key arrangement order is an arrangement order of the plurality of sub-key segments determined according to positions of the sub-key segments in the first key. The first key is obtained by splicing the plurality of sub-key segments according to the serial number corresponding to each of the plurality of sub-key segments.

7. The file decryption method according to claim 5, characterized by, The target compressed package is a compressed package of a root file system, and in the case that the target compressed package is the compressed package of the root file system, the first key is determined by: obtaining the first key from a kernel code segment of a linux system kernel running on the target device when the target device starts.

8. A file encryption apparatus characterized by comprising: The first key is determined by: a processing module, wherein the first key is a randomly generated preset length string; a transformation module, configured to transform the first key based on a preset transformation rule to obtain a second key; an encryption module, configured to encrypt a target file according to the second key and a preset encryption algorithm, and write the first key, the preset encryption algorithm and the preset transformation rule into a code segment for kernel compilation in a target platform, wherein the first key, the preset encryption algorithm and the preset transformation rule are used to decrypt the encrypted target file, the target platform obtains the first key in a kernel state, and a decryption process of the target platform is wrapped by a kernel configuration option macro definition. The first key is written into the code segment for kernel compilation in the target platform by: dividing the first key into a preset number of sub-key segments; embedding each of the preset number of sub-key segments into a specified position in the code segment, and exporting a memory address corresponding to the code segment, wherein the memory address is used to determine the specified position in which the each of the preset number of sub-key segments is embedded.

9. A system platform, characterized by The encryption module and the decryption module are included. The encryption module is configured to determine a first key, wherein the first key is a randomly generated preset length string; transform the first key based on a preset transformation rule to obtain a second key; encrypt a target file based on the second key and a preset encryption algorithm, and write the first key, the preset encryption algorithm, and the preset transformation rule into a code segment for kernel compilation in a target platform, wherein the first key, the preset encryption algorithm, and the preset transformation rule are used to decrypt the encrypted target file. The decryption module is configured to determine a preset transformation rule, a preset decryption algorithm, and a first key corresponding to a target compressed package, wherein the target compressed package is obtained by compressing the target file; transform the first key based on the preset transformation rule and the first key to obtain a second key; determine the preset decryption algorithm corresponding to the target compressed package, and decrypt the target compressed package based on the second key and the preset decryption algorithm, wherein the target platform is in a kernel state when the first key is obtained, and a decryption process of the target platform is wrapped by a kernel configuration option macro. The first key is written into a code segment for kernel compilation in a target platform, including: The first key is divided into a preset number of sub-key segments; Each sub-key segment of the preset number of sub-key segments is embedded in a specified position in the code segment, and a memory address corresponding to the code segment is exported, wherein the memory address is used to determine the specified position in which each sub-key segment is embedded, and the preset number of sub-key segments are randomly allocated to the specified positions.

10. A non-volatile storage medium, comprising: The non-volatile storage medium includes a stored program, wherein the program controls a device in which the non-volatile storage medium is located to perform the file encryption method of any one of claims 1 to 4 when the program is running.

11. A processor, comprising: The processor is configured to run a program, wherein the program performs the file encryption method of any one of claims 1 to 4 when the program is running.

Images