Method and device for protecting image files

Abstract

The present invention discloses a method and device for protecting image files. The method includes: configuring encrypted data segment information in an original image file; determining the number of data segments to be encrypted in the data segment information based on multiple dimensions, such as self-assessment and reference to multiple indicators, as well as the nature of the original image file itself, whether the applicant is a key user, or the system operation status; after encrypting the data segments to be encrypted in the original image file, storing the encrypted information in a preset data structure, and adding the preset data structure to the original image file to obtain an encrypted image file. The present invention achieves unified protection of the confidentiality and integrity of image files, ensuring the security of image files both inside and outside the cloud. Image files are always stored in an encrypted manner within the platform and cannot be decrypted without an encryption key.

Description

Technical Field

[0001] The present invention belongs to the field of cloud computing security technology, and more specifically, relates to a method and device for protecting image files. Background Art

[0002] As cloud technology matures, cloud platforms are increasingly being used in a variety of fields, with numerous business systems being migrated to cloud platforms for service provision. Cloud computing is constantly changing how organizations use, store, and share data, applications, and workloads. However, it also introduces a host of new security threats and challenges. As more and more data moves into the cloud, more sensitive content inevitably becomes exposed to potential risks.

[0003] Among them, images, as content carriers, are the most critical data resources for virtual machines / containers and require special protection. If the images themselves are insecure or illegally modified, they will directly impact the security of subsequent applications. In recent years, security breaches caused by image vulnerabilities have been on the rise, exposing numerous potential risks to cloud computing application security in terms of image security protection. Recently published national standards such as the "Basic Requirements for Information Security Technology Network Security Level Protection" (also known as "Level Protection 2.0") and the "Basic Requirements for Information Security Technology Information System Cryptography Application" both address image security requirements.

[0004] Nowadays, most cloud platforms / container platforms, whether public, private, or proprietary, offer some form of image protection. However, a careful analysis reveals the following issues: First, image confidentiality protection is lacking: Due to implementation complexity, vendors often substitute integrity protection for confidentiality. This results in images being stored in plaintext on the cloud / container platform backend, potentially allowing for unauthorized access during transmission and storage. Furthermore, full encryption is not suitable for image encryption scenarios. Batch encryption and decryption significantly degrades system performance, impacting service deployment time. Traditional image signing only ensures the authenticity of the image source but fails to protect confidentiality. Second, image confidentiality protection is insufficient: To maximize processing speed, some vendors often use the MD5 algorithm for integrity verification. However, MD5 is not secure and can potentially allow images to be illegally replaced through collision attacks. Third, there is a lack of algorithm binding: These features are often implemented based on fixed international algorithms and lack support for China's commercial cryptographic algorithms, also known as national cryptographic algorithms.

[0005] In view of this, overcoming the defects of the prior art is an urgent problem to be solved in this technical field. Summary of the Invention

[0006] In response to the above-mentioned defects or improvement needs of the prior art, the present invention provides a method and device for protecting image files, which aims to improve the confidentiality and integrity of image files, thereby solving the technical problem that traditional encryption algorithms in public cloud / private cloud / proprietary cloud modes cannot simultaneously achieve the confidentiality and integrity of image files.

[0007] To achieve the above object, according to one aspect of the present invention, a method for protecting an image file is provided, which configures encrypted data segment information in the original image file;

[0008] In the data segment information, the number of data segments to be encrypted in the original image file is determined according to the indicator to be evaluated and the preset threshold value set corresponding to the indicator;

[0009] After the data segment to be encrypted in the original image file is encrypted, the encryption information is stored in a preset data structure, and the preset data structure is added to the original image file to obtain an encrypted image file.

[0010] As a further improvement and supplement to the above solution, the present invention also includes the following additional technical features.

[0011] Preferably, the encrypted data segment information in the configuration original image file is specifically configured as follows:

[0012] The interval bytes between encrypted data segments, the number range of random encrypted data segments, and / or the start and end positions of fixed encrypted data segment bytes.

[0013] Preferably, in the data segment information, the number of data segments to be encrypted in the original image file is determined according to an indicator to be evaluated and a preset threshold value set corresponding to the indicator, and the method includes:

[0014] Checking whether the indicator to be evaluated meets the preset threshold set corresponding to the indicator according to the preset threshold set corresponding to the indicator;

[0015] If the indicator to be evaluated does not meet the corresponding preset threshold, the maximum number of encrypted data segments at the random position in the original image file is correspondingly reduced, increased, or unchanged.

[0016] Preferably, after the data segment to be encrypted in the original image file is encrypted, the encrypted information is stored in a preset data structure, wherein the encrypted information includes image basic information and encryption type information.

[0017] Preferably, the preset data structure is added to the original image file to obtain an encrypted image file, and the specific method includes:

[0018] A new file is created, where the length of the new file is the length of the preset data structure and the encrypted original image file, and the preset data structure is located at the head of the encrypted image file, and the encrypted original image file is located at the tail of the encrypted image file.

[0019] Preferably, after obtaining the encrypted image file, the method further comprises:

[0020] Decrypting the header of the encrypted image file to obtain the encryption information recorded in the preset data structure;

[0021] The encrypted data segment position in the image file is obtained from the encryption information, and the original data segment corresponding to the encrypted data segment in the image file is decrypted and obtained.

[0022] Preferably, after obtaining the encrypted image file, the method further comprises:

[0023] Obtaining the recorded encryption information from the preset data structure of the encrypted image file, and performing an integrity check on the restored file with reference to the encryption information;

[0024] If the verification is correct, the recovered file is in its normal form before encryption and the original image is delivered;

[0025] If the verification is incorrect, then there is an abnormality in the restored file and the process is interrupted.

[0026] Preferably, the method for configuring the encrypted data segment information in the original image file also includes: configuring the symmetric encryption algorithm and / or hash algorithm used by the platform, the symmetric encryption algorithm is used to encrypt and decrypt the encrypted image file, and the hash algorithm is used to verify whether the restored file is consistent with the encryption information of the original image file.

[0027] Preferably, the encryption information includes summary information and / or a hash authentication code of the original image file.

[0028] According to another aspect of the present invention, a device for protecting an image file is provided, the device comprising:

[0029] At least one processor; and a memory in communication with the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are configured by the processor to execute the method for protecting the image file according to the first aspect.

[0030] In a third aspect, the present invention further provides a non-volatile computer storage medium, wherein the computer storage medium stores computer executable instructions, which are executed by one or more processors to complete the method for protecting image files described in the first aspect.

[0031] In general, the above technical solutions conceived by the present invention have the following beneficial effects compared with the prior art:

[0032] The present invention provides a method and device for protecting image files. On the one hand, the method and device automatically calculate the coverage rate of the encrypted data segment of the image file through independent evaluation and reference to multiple indicators, as well as multi-dimensional data such as the nature of the original image file itself, whether the applicant is a key user, or the system operation status. For example, it focuses on security when the load is low and ensures availability when the load is high. It supports custom extensions, avoids the inflexibility of traditional fixed coverage methods, reduces the impact of batch concurrent operations on platform performance, and does not affect the user's original image upload experience. All image encryption and decryption processing is completed on the platform backend, and users do not need to prepare encrypted images in advance according to proprietary methods. There is no need to use specific storage types or introduce additional components such as object storage, and it can support related functions in the fields of snapshots and backups.

[0033] On the other hand, the present invention realizes the unified protection of confidentiality and integrity of image files. The image files can be ensured to be safe both inside and outside the cloud. The image files are always stored in an encrypted manner in the platform. Without the encryption key, they cannot be decrypted. During the pre-use / periodic inspection of the image, illegal tampering can be discovered in time, and the application creation can be terminated to avoid introducing security risks. Even if the image is illegally obtained during transmission, the original content of the image cannot be viewed because the encryption key cannot be obtained. In addition, the method of the present invention supports multiple international and national encryption algorithms, is not limited to a specific cloud platform / container platform, and is not restricted to a certain fixed algorithm. Other algorithms can also be expanded in the present invention, and encryption equipment from different manufacturers can also be flexibly connected. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0035] Figure 1 This is a flow chart of a method for protecting an image file provided in the first embodiment;

[0036] Figure 2 This is a flow chart for determining the number of randomly encrypted data segments according to the first embodiment;

[0037] Figure 3 This is the encryption process for uploading image files in the first embodiment;

[0038] Figure 4This is a schematic diagram of the structural changes during the image file encryption process in the first embodiment of the present invention;

[0039] Figure 5 This is the process flow for downloading the encrypted image file in the first embodiment;

[0040] Figure 6 This is a schematic diagram of a device for protecting image files provided in the second embodiment. DETAILED DESCRIPTION

[0041] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely for the purpose of explaining the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below may be combined with each other as long as they do not conflict with each other.

[0042] Example 1:

[0043] This embodiment provides a method for protecting an image file. Figure 1 As shown, the method includes the following steps:

[0044] S101: Configure the encrypted data segment information in the original image file.

[0045] The configuration includes: the encrypted data segments in the original image file include fixed encrypted data segments and random encrypted data segments. In the first embodiment, both fixed and random encrypted data segments are included, but it is also possible to include only fixed encrypted data segments or only random encrypted data segments. The administrator can directly configure the start and end byte positions of the fixed encrypted data segments, the interval bytes between encrypted data segments, and the number range of random encrypted data segments. The final number of random encrypted data segments in the original image file is then determined by evaluation indicators. The evaluation indicators can be selected based on multiple dimensions such as the nature of the original image file itself, whether the applicant is a key user, or the system operation status.

[0046] The segments to be encrypted are divided into two categories: fixed and randomly generated.

[0047] Fixed encrypted data segment m: Marks the specific location of the fixed encryption segment in the original image file. If configured, each image needs to cover this part when it is encrypted. The specified format is {m1 start :m1 end ,m2 start :m2 end ,…} encrypted segment; m start and m end They represent the starting and ending positions of the fixed encrypted data segment bytes respectively.

[0048] The number of random encrypted data segments n: The evaluation model dynamically determines the number n based on the evaluation indicators, and then randomly generates encrypted data segments; the encryption position of each original image file may be different. The number n must be specified in the random encrypted data segment. min , n max , n int The three parameters represent the minimum number of random encrypted data segments, the maximum number of random encrypted data segments (the number is an integer greater than 1, and n min ≤n max ), and the interval bytes between random encrypted data segments. The interval bytes between random encrypted data segments are consistent, and the interval bytes between fixed encrypted data segments can be inconsistent or consistent. For the sake of convenience, this application only provides an embodiment in which the interval bytes between random encrypted data segments are consistent. It should be understood that the above general description and the detailed description below are only exemplary and explanatory and cannot limit this article. The case of inconsistent interval bytes can also be adopted. It is only necessary to store the position information of multiple encryption segments (such as the starting interval, the ending interval; or the starting interval, the interval length, etc.) in a preset data structure, which will not be repeated here.

[0049] Initial value setting: The administrator specifies the number of fixed encrypted data segments m, the start and end positions of fixed encrypted data segments, and the minimum number of random encrypted data segments n through configuration. min , maximum number n max The interval byte n between the random encrypted data segment int .

[0050] S102: In the data segment information, determine the number of random data segments to be encrypted in the original image file according to the indicator to be evaluated and a preset threshold value set corresponding to the indicator.

[0051] Evaluation metrics support custom extensions. Administrators can configure the number, content, and preset thresholds of metrics based on actual business needs, such as system load, number of encryption tasks, image file size, and specific tags. The number of evaluation metrics must be at least one. Each metric is evaluated sequentially or in parallel, and the final evaluation result is obtained after all metrics are evaluated.

[0052] The evaluation index is used to analyze the number of random encrypted data segments. The evaluation index consists of two subcomponents: the first subcomponent includes the name of each indicator and the implementation plug-in, which is used to provide a way to obtain the indicator; the second subcomponent includes: the threshold of each indicator and the corresponding execution action: used to implement conditional branches, which stipulate the actions to be executed when the indicator is met. Multiple evaluation indicators can be configured, and each evaluation indicator can be independent of each other or affect each other. When calculating the number of random encrypted data segments n, the initial value is n max .

[0053] The logic for selecting the final number of randomly encrypted data segments is: if the number of randomly encrypted data segments n min is 1, n max After reading each evaluation indicator, we determine whether each evaluation indicator meets the preset threshold value set accordingly, and perform corresponding actions according to the comparison results. After all indicators are analyzed and processed, the final value of n is obtained. int Randomly select n data segments for the interval bytes, and n is the number of subsequent random encrypted data segments. If conflicts with fixed encrypted data segments need to be avoided during the selection process, the position of the random segment can be considered to start after the last fixed encrypted data segment, or skip it when encountering a fixed encrypted data segment. If there is no fixed encrypted data segment, the random encrypted data segment can be considered to start from the image header, or start from the header plus an offset, etc. In terms of the expected effect of the selection point, if the system load is high, fewer random encrypted data segments will be selected; otherwise, the number of random encrypted data segments will be increased to enhance security. If the indicator does not meet a certain condition, the number of random encrypted data segments will increase. The administrator configures the fixed encrypted data segment byte span to 1024 bytes, for example "{1024:2048,4096:8192}", which means that two data segments with bytes 1024 to 2048 and 4096 to 8192 are specified as the positions of the fixed encrypted data segments. The number of random encrypted data segments ranges from 1 to 10, where: n min =1,n max =10,n int =1024.

[0054] S103: After the data segment to be encrypted in the original image file is encrypted, the encryption information is stored in a preset data structure, and the preset data structure is added to the original image file to obtain an encrypted image file.

[0055] The default data structure is used to store proprietary data segments for image protection information. The default length is 1024 bytes, and the byte length can be adjusted based on encryption or payload requirements. The default data structure needs to record two types of data: basic image information, such as original size and operating system type; and encryption information, including encryption keys, encryption locations, and summary information / hash authentication codes.

[0056] Adding a pre-set data structure to the image file header compromises the readability of the original image file while also recording the necessary information for image confidentiality and integrity. The encrypted information exists as a single entity with the original image file, eliminating the need for storage in a database and mitigating security risks associated with database leaks.

[0057] In the first embodiment, in order to adjust the relationship between the encrypted data segments according to the configuration, there is also a preferred implementation scheme in combination with the embodiment of the present invention. Specifically, the encrypted data segment information in the configuration image file is specifically configured as follows:

[0058] The interval bytes between encrypted data segments, the number range of random encrypted data segments, and / or the start and end positions of fixed encrypted data segment bytes.

[0059] In the first embodiment, both fixed encrypted data segments and random encrypted data segments are included, or only fixed encrypted data segments or only random encrypted data segments can be included. For example, the fixed encrypted data segment is "{1024:2048,4096:8192}", which represents the positions of two fixed encrypted data segments of 1024 to 2048 and 4096 to 8192 bytes. The number of random encrypted data segments ranges from 1 to 10, where: n min =1,n max =10,n int = 1024. When calculating the number of random encrypted data segments n, the initial value n0 is n max .

[0060] In the first embodiment, in order to determine the number of data segments to be encrypted in the original image file, in combination with the embodiment of the present invention, there is also a preferred implementation scheme. Specifically, in the data segment information, the number of data segments to be encrypted in the original image file is determined based on the indicator to be evaluated and a preset threshold value set corresponding to the indicator. The method includes:

[0061] Checking whether the indicator to be evaluated meets the preset threshold set corresponding to the indicator according to the preset threshold set corresponding to the indicator;

[0062] If the indicator to be evaluated does not meet the corresponding preset threshold, the maximum number of encrypted data segments at the random position in the original image file is correspondingly reduced, increased, or unchanged.

[0063] For example, if the evaluation indicator is to determine whether it has a "high security" label, if the original image file has a "high security" label, the number of randomly encrypted data segments needs to be increased to the maximum number n max .

[0064] For example: the administrator configures the starting and ending positions of the fixed encrypted data segment bytes to be "{1024:2048,4096:8192}", which represents the positions of two fixed encrypted data segments with bytes between 1024 and 2048 and 4096 and 8192. The number of random encrypted data segments is not determined, only the range is determined to be between 1 and 10. Therefore, the number of random encrypted data segments is determined by the indicator to be evaluated and the preset threshold set corresponding to the indicator based on empirical values. In the example of the first embodiment, "original image file size", "system load" and "current number of encryption tasks" are selected as three evaluation indicators, and three thresholds and processing actions are set accordingly. The evaluation process can be judged sequentially or in parallel. The process of selecting the sequential inspection is as follows:

[0065] If the system load exceeds the preset threshold of the corresponding setting, for example, the preset threshold of the system load setting is 50%, after the system load of the original image file is greater than 50%, it is necessary to reduce the coverage of the encrypted data segment in the original image file; then n1=max(n min , n max / 2), round down when divisible. n1=5.

[0066] If the current number of encryption tasks exceeds the corresponding preset threshold, for example, the preset threshold of the current number of encryption tasks is 20, and the current number of encryption tasks of the original image file is greater than 20, it is necessary to reduce the coverage of the encrypted data segment in the original image file; then n2=max(n min , n1 / 2), round down when divisible. n2=2.

[0067] If the size of the original image file exceeds the preset threshold of the corresponding setting, for example, the preset threshold of the original image file size setting is 20G, the original image file size is 10G, and the file size is lower than the threshold of 20G, it is necessary to increase the coverage of the encrypted data segment in the original image file; then n=n2+1.

[0068] Based on the above settings, if the current system load is high and the number of encryption tasks is large, a random number analysis of a 10GB image yields n1 = 5, n2 = 2, and n = 3. The final number of fixed encrypted data segments in the original image file is determined to be 2, and the locations of the fixed encrypted data segments are "{1024:2048,4096:8192}." The final number of random encrypted data segments in the original image file is determined to be 3. After excluding the fixed encrypted data segments from the original image file, three interval bytes of 1024 are randomly selected as random encrypted data segments. Since the start and end positions of the entire data segment are {0:image file size × 1024 × 1024 × 1024}, where the image file size is in GB, the locations of the random encrypted data segments are selected from {0:1023}, {2049:4095}, and {8193:image file size × 1024 × 1024 × 1024}.

[0069] In the first embodiment, in order to record the necessary information for image confidentiality and integrity, in combination with the embodiment of the present invention, there is also a preferred implementation scheme. Specifically, after the data segment to be encrypted in the image file is encrypted, the encrypted information is stored in a preset data structure, wherein the encrypted information includes the image basic information and encryption class information.

[0070] A preset data structure stores a proprietary data segment for image protection information. The default size is 1024 bytes, but it can be configured as needed. The preset data structure records two types of data: basic image information, such as the original image file size and operating system type; and encryption information, including encryption keys, encryption locations, and digest information / hash authentication codes. The encryption location includes the locations of fixed and random encrypted data segments. The fixed encrypted data segment is located as "{1024:2048,4096:8192}." The random encrypted data segment is located by excluding the fixed encrypted data segment from the original image file and then randomly selecting three 1024-byte regions from {0:1023}, {2049:4095}, and {8193:image file size × 1024 × 1024 × 1024}, where the image file size is expressed in GB. The first encryption algorithm is used to encrypt the location to be encrypted within the original image file. For example, a specified symmetric encryption algorithm is used to encrypt the location to be encrypted in the original image file. After the encrypted data segment is encrypted, the encrypted information is stored in a preset data structure. The first encryption is performed on the fixed data segment and / or random data segment, and the encryption information is the secret key of the first encryption algorithm.

[0071] In the first embodiment, in order to destroy the readability of the original image file, in combination with the embodiment of the present invention, there is also a preferred implementation scheme. Specifically, the preset data structure is added to the header of the image file to obtain an encrypted image file. The specific method includes:

[0072] A new file is created, where the length of the new file is the length of the combination of the preset data structure and the encrypted image file, and the header of the new file is the preset data structure, and the tail of the new file is the encrypted image file.

[0073] Adding a pre-set data structure to the image file header compromises the readability of the original image file while also recording the necessary information for image confidentiality and integrity. The encrypted information exists as a single entity with the original image file, eliminating the need for storage in a database and mitigating security risks associated with database leaks.

[0074] In the first embodiment, in order to facilitate subsequent use of the encrypted image file by the platform after downloading, there is also a preferred implementation scheme in combination with the embodiment of the present invention. Specifically, after obtaining the encrypted image file, the method further includes:

[0075] Decrypting the header of the encrypted image file to obtain the encryption information recorded in the preset data structure;

[0076] The encrypted data segment position in the image file is obtained from the encryption information, and the original data segment corresponding to the encrypted data segment in the image file is decrypted and obtained.

[0077] Decrypting an encrypted image file is the reverse process of encrypting an image file: that is, before using the image, the device will first decrypt the original image from the new image using the radical information, and then re-verify the integrity before making it available to the platform.

[0078] In the first embodiment, in order to verify that the image file downloaded from the platform is in a normal form before encryption, in combination with the embodiment of the present invention, there is also a preferred implementation scheme. Specifically, after obtaining the encrypted image file, the method further includes:

[0079] Obtaining the recorded encryption information from the preset data structure of the encrypted image file, and performing an integrity check on the restored file with reference to the encryption information;

[0080] The encrypted information includes basic image information and encryption information, such as verifying the restored new image using a specified hash algorithm according to the summary information / hash authentication code of the original image recorded in a preset data structure.

[0081] If the verification is correct, the recovered file is in its normal form before encryption and the original image is delivered.

[0082] If the verification is incorrect, then there is an abnormality in the restored file and the process is interrupted.

[0083] Example 2:

[0084] This embodiment 2 provides a method for protecting an image file, wherein the evaluation logic and decision process for selecting the number of random encrypted data segments include the following steps: Figure 2 As shown:

[0085] S201: Receive an evaluation request.

[0086] The intelligent evaluation component receives a request from the platform to evaluate an encrypted location.

[0087] S202: Read the default configuration.

[0088] The platform reads the default configuration and determines the starting position of the fixed encrypted data segment configured by the administrator, the number range of the random encrypted data segment, and the byte span of the random encrypted data segment.

[0089] S203: Read the indicator to be evaluated.

[0090] Determine the current values of various indicators for subsequent evaluation, such as image file size, node load, and number of concurrent tasks.

[0091] S204: Calculate the number n of randomly encrypted data segments.

[0092] According to the preset thresholds corresponding to the indicators to be evaluated, the evaluation is performed step by step or in parallel to determine whether each indicator to be evaluated does not meet the preset thresholds set accordingly. If so, the corresponding processing action is performed; if not, the next indicator analysis is performed to determine the number n of randomly encrypted data segments. For example, Figure 2 middle:

[0093] Item 1 is set as the node load. The preset threshold corresponding to the node load is 50%. If the current node load is greater than 50%, the maximum number of random encrypted data segments in the range of random encrypted data segments configured by the administrator is directly halved and rounded down to obtain n1.

[0094] Item2 is set to the number of concurrent tasks. The preset threshold corresponding to the number of concurrent tasks is 20. If the current number of concurrent tasks is greater than 20, n1 is directly halved and rounded down to obtain n2.

[0095] Item3 is set to the image file size. The preset threshold corresponding to the image file size is 20G. If the current image file size is larger than 20G, n2 is directly halved and rounded down to obtain the number n of random encrypted data segments; if the current image file size is smaller than 20G, a random encrypted data segment is added by n2.

[0096] Item4 is set to read the tag contained in the original image file.

[0097] If the label of the original image file is accelerated processing, then n = n-2, that is, the number of random encryptions - 2, and the lower limit is n min ;

[0098] If the label of the original image file is normal processing, no processing is done and n does not increase or decrease;

[0099] If the label of the original image file is security processing, then n = n + 2, that is, the number of randomly encrypted data segments + 2, and the upper limit is n max ;

[0100] If the label of the original image file is the highest security processing, then n=n max ;

[0101] If the label of the original image file is not read, the default processing is normal, and n does not increase or decrease.

[0102] Item 5 is set to analyze whether the user is a key user or a VIP user.

[0103] If it is a key user or VIP user, then n=n+3, that is, the number of random encryptions + 3, the upper limit n max ;

[0104] If the user is not a key user or VIP user, the default process will be normal, and n will not increase or decrease.

[0105] Item1-N can be performed in parallel, and the final calculation result is the maximum / minimum value of all items, or it can be performed in series, and the final calculation result is the result of itemN. Figure 2 The following is an example of performing calculations serially.

[0106] Items can be set to multi-dimensional evaluation indicators such as the nature of the original image file itself, whether the applicant is a key user, or the system operation status.

[0107] S205: Determine the location of the randomly encrypted data segment.

[0108] After all items are analyzed, the final number of random encrypted data segments n can be obtained. Read the encryption interval n configured by the administrator int , generate the positions of n random encrypted data segments, and complete the determination of the random encryption positions.

[0109] S206: Return the locations of all data segments to be encrypted, including the locations of fixed encrypted data segments and random encrypted data segments, for subsequent encryption by the platform.

[0110] The encryption process for image file upload includes the following steps. For details, see reference Figure 3 The specific process is described as follows:

[0111] S301: Preparation stage.

[0112] The administrator completes the environment deployment and algorithm configuration, selects the international algorithm family or the national secret algorithm family, and specifies the default symmetric encryption algorithm and hash algorithm.

[0113] S302: Interface authentication judgment.

[0114] The platform performs interface authentication according to the original process. After the verification is passed, the device begins to process the original image file.

[0115] S3021: Determine the basic information of the original image file.

[0116] Such as the original image file size and operating system type.

[0117] S3022: Calculate the summary information / hash authentication code of the original image file.

[0118] Use the specified hash algorithm to calculate the summary information / hash authentication code of the original image file. For the entire image, use the specified digest algorithm and record the summary information / hash authentication code result.

[0119] S3023: Determine the location to be encrypted in the original image file through the intelligent evaluation model.

[0120] S3024: Perform a first encryption on the location to be encrypted in the original image file using a first encryption algorithm.

[0121] Using a specified symmetric encryption algorithm, the original image file is encrypted at the location to be encrypted. After the encrypted data segment is encrypted, the encrypted information is stored in a pre-set data structure. The first encryption is performed on fixed data segments and / or random data segments, and the encryption information is the secret key B of the first encryption algorithm.

[0122] The structural changes during the image file encryption process are as follows: Figure 4 As shown, use S3021-S3022 to record the original image file size and operating system type in the original image file, and calculate the summary information / hash authentication code A of the original image file. Then, through S3023-S3024, the position to be encrypted in the original image file is encrypted for the first time using the first encryption algorithm, and the encryption key B of the encrypted data segment is recorded.

[0123] S303: Construct a preset data structure.

[0124] Collect the encrypted information in the preset data structure and write it into the original image file. The encrypted information includes the encryption information of steps S3021 to S3024, such as the basic information of the original image file, summary information / hash authentication code A, the specific location of the encrypted data segment, and encryption key B.

[0125] S304: Encrypt the preset data structure.

[0126] Generate an encrypted data segment according to the administrator's configuration, and encrypt the entire preset data structure using the second encryption algorithm key C.

[0127] The second encryption algorithm uses a specific symmetric encryption algorithm.

[0128] The structural changes during the image file encryption process are as follows: Figure 4 As shown, the entire preset data structure is encrypted using the second encryption algorithm key C using S303-S304.

[0129] S305: Create a new file.

[0130] The new file includes a preset data structure and an original image file. The length of the new file is the sum of the lengths of the encrypted image preset data structure and the encrypted original image file.

[0131] S306: Fill in new file.

[0132] The preset data structure and the encrypted original image file are written in segments, with the header being the encrypted image preset data structure and the tail being the encrypted original image file.

[0133] S307: The platform uploads the new file normally.

[0134] The process flow diagram for downloading encrypted image files is as follows: Figure 3 The reverse process of the encrypted image file download process is as follows Figure 5 The specific process is described as follows:

[0135] S401: Interface authentication judgment.

[0136] The platform performs interface authentication according to the original image download process. After the verification is passed, the platform begins normal new file download.

[0137] S402: Decrypt the new file for the first time using the second encryption algorithm key.

[0138] Using the specified symmetric encryption algorithm, the first decryption is for the preset data structure of the new file, decrypted with the symmetric encryption key C.

[0139] S403: Read the encryption information of the preset data structure in the new file.

[0140] Obtain summary information / hash authentication code A, the specific location of the encrypted data segment, and secret key B.

[0141] S404: Determine the location of the encrypted data segment.

[0142] From the specific position information of the encrypted data segment, the specific positions and interval byte sizes of several fixed encrypted data segments and random encrypted data segments are known.

[0143] S405: Decrypt the image file for the second time.

[0144] The encrypted data segment in S404 is decrypted for the second time using secret key B to obtain the original image without the encrypted data segment.

[0145] S406: Verify the image file.

[0146] The summary information / hash authentication code of the image file obtained by the second decryption is checked and compared with the summary information / hash authentication code of the image file contained in the preset data structure to confirm whether they are consistent.

[0147] Use the specified hash algorithm to compare the digest information / hash authentication code of the original image file and the decrypted file at least twice. The comparison results determine whether the downloaded image file can be delivered as the original image file or whether an abnormality alarm is generated and the download is interrupted.

[0148] If the summary information / hash authentication code is consistent, the original image file can be delivered. The platform will deliver it for normal process / business use according to the default image file usage method;

[0149] If the summary information / hash authentication code is inconsistent, it means that the original image file is abnormal. An alarm must be triggered to indicate that the image integrity is compromised and the image download process must be terminated.

[0150] Example 3:

[0151] The third embodiment provides a device for protecting an image file, the device comprising:

[0152] At least one processor; and a memory in communication with the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being programmed to execute any one of the methods for protecting an image file described in Example 1.

[0153] like Figure 6 FIG. 1 is a schematic diagram of a device for protecting image files according to an embodiment of the present invention. The device for protecting image files according to this embodiment includes one or more processors 21 and a memory 22. Figure 6 A processor 21 is taken as an example.

[0154] The processor 21 and the memory 22 may be connected via a bus or other means. Figure 6 The bus connection is taken as an example.

[0155] The memory 22 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs and non-volatile computer executable programs, such as the method for protecting image files in Example 1. The processor 21 executes the method for protecting image files by running the non-volatile software programs and instructions stored in the memory 22.

[0156] The memory 22 may include high-speed random access memory and non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state memory device. In some embodiments, the memory 22 may optionally include a memory remotely located relative to the processor 21, and such remote memory may be connected to the processor 21 via a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0157] The program instructions / modules are stored in the memory 22, and when executed by the one or more processors 21, the method for protecting the image file in the first embodiment is executed, for example, the method described above is executed. Figure 1 The steps shown.

[0158] It is worth noting that the information interaction, execution process, etc. between the modules and units within the above-mentioned devices and systems are based on the same concept as the processing method embodiment of the present invention. The specific content can be found in the description of the method embodiment of the present invention and will not be repeated here.

[0159] Those skilled in the art will understand that all or part of the steps in the various methods of the embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, which may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0160] It will be easily understood by those skilled in the art that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for protecting an image file, characterized in that: include: Configure the encrypted data segment information in the original image file; In the data segment information, the number of data segments to be encrypted in the original image file is determined according to the indicator to be evaluated and the preset threshold value set corresponding to the indicator; After the data segment to be encrypted in the original image file is encrypted, the encryption information is stored in a preset data structure, and the preset data structure is added to the original image file to obtain an encrypted image file.

2. The method for protecting an image file according to claim 1, wherein: The encrypted data segment information in the configuration original image file is specifically configured as follows: The interval bytes between encrypted data segments, the number range of random encrypted data segments, and / or the start and end positions of fixed encrypted data segment bytes.

3. The method for protecting an image file according to claim 2, wherein: In the data segment information, the number of data segments to be encrypted in the original image file is determined according to an indicator to be evaluated and a preset threshold value set corresponding to the indicator, and the method includes: Checking whether the indicator to be evaluated meets the preset threshold set corresponding to the indicator according to the preset threshold set corresponding to the indicator; If the indicator to be evaluated does not meet the corresponding preset threshold, the maximum number of encrypted data segments at the random position in the original image file is correspondingly reduced, increased, or unchanged.

4. The method for protecting an image file according to claim 3, wherein: After the encryption of the data segment to be encrypted in the original image file is completed, the encryption information is stored in a preset data structure, wherein the encryption information includes image basic information and encryption type information.

5. The method for protecting an image file according to claim 4, wherein: The preset data structure is added to the original image file to obtain an encrypted image file, and the specific method includes: A new file is created, where the length of the new file is the length of the preset data structure and the encrypted original image file, and the preset data structure is located at the head of the encrypted image file, and the encrypted original image file is located at the tail of the encrypted image file.

6. The method for protecting an image file according to claim 1, wherein: After obtaining the encrypted image file, the method further includes: Decrypting the header of the encrypted image file to obtain the encryption information recorded in the preset data structure; The encrypted data segment position in the image file is obtained from the encryption information, and the original data segment corresponding to the encrypted data segment in the image file is decrypted and obtained.

7. The method for protecting an image file according to claim 6, wherein: After obtaining the encrypted image file, the method further includes: Obtaining the recorded encryption information from the preset data structure of the encrypted image file, and performing an integrity check on the restored file with reference to the encryption information; If the verification is correct, the recovered file is in its normal form before encryption and the original image is delivered; If the verification is incorrect, then there is an abnormality in the restored file and the process is interrupted.

8. The method for protecting an image file according to claim 7, wherein: The encryption information includes image basic information and encryption class information, and the configuration includes encrypted data segment information in the original image file. The method also includes: configuring a symmetric encryption algorithm and / or a hash algorithm used by the platform, the symmetric encryption algorithm is used to encrypt and decrypt the encrypted image file, and the hash algorithm is used to verify whether the restored file is consistent with the encryption class information of the original image file.

9. The method for protecting an image file according to claim 8, wherein: The encryption information includes summary information and / or hash authentication code of the original image file.

10. A device for protecting an image file, characterized in that: The device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are configured by the processor to execute the method for protecting an image file according to any one of claims 1 to 9.

Images